Function at 0x40f637
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd2c
cmp dword [ebp + 0x1c], 4
jl 0x40f657
push str.________main_sort_initialise_..._n
push 0x426950
call fcn.0041351c
pop ecx
pop ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov ecx, 0x10001
lea eax, [esi + 0x40000]
and dword [eax], 0
sub eax, 4
dec ecx
jne 0x40f668
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
dec eax
mov ch, byte [ebx]
cmp eax, 3
jl 0x40f6dd
mov edx, dword [ebp + 0x10]
lea edi, [edx + eax*2 - 4]
and word [edi + 4], 0
xor edx, edx
mov dh, byte [ebx + eax]
sub eax, 4
sar ecx, 8
or ecx, edx
xor edx, edx
inc dword [esi + ecx*4]
and word [edi + 2], 0
mov dh, byte [ebx + eax + 3]
sar ecx, 8
or ecx, edx
xor edx, edx
inc dword [esi + ecx*4]
and word [edi], 0
mov dh, byte [ebx + eax + 2]
sub edi, 8
sar ecx, 8
or ecx, edx
xor edx, edx
inc dword [esi + ecx*4]
and word [edi + 6], 0
mov dh, byte [ebx + eax + 1]
sar ecx, 8
or ecx, edx
inc dword [esi + ecx*4]
cmp eax, 3
jge 0x40f688
test eax, eax
jl 0x40f6ff
mov edx, dword [ebp + 0x10]
lea edi, [edx + eax*2]
and word [edi], 0
xor edx, edx
mov dh, byte [eax + ebx]
sar ecx, 8
or ecx, edx
inc dword [esi + ecx*4]
dec eax
dec edi
dec edi
test eax, eax
jge 0x40f6e7
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
xor eax, eax
lea edi, [edx + ecx*2]
add ecx, ebx
mov dl, byte [eax + ebx]
mov byte [ecx + eax], dl
and word [edi], 0
inc eax
inc edi
inc edi
cmp eax, 0x22
jl 0x40f70c
cmp dword [ebp + 0x1c], 4
jl 0x40f735
push str.________bucket_sorting_..._n
push 0x426950
call fcn.0041351c
pop ecx
pop ecx
lea eax, [esi + 4]
mov ecx, 0x10000
mov edx, dword [eax - 4]
add dword [eax], edx
add eax, 4
dec ecx
jne 0x40f73d
xor eax, eax
mov ah, byte [ebx]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x18]
dec eax
cmp eax, 3
jl 0x40f7d0
xor edx, edx
mov dh, byte [ebx + eax]
mov dl, byte [ebp + 0x15]
movzx ecx, dx
lea edi, [esi + ecx*4]
mov ecx, dword [esi + ecx*4]
dec ecx
mov dword [edi], ecx
mov edi, dword [ebp + 8]
mov dword [edi + ecx*4], eax
xor ecx, ecx
mov ch, byte [ebx + eax - 1]
mov cl, dh
mov dword [ebp + 0x14], ecx
movzx ecx, cx
lea edx, [esi + ecx*4]
mov ecx, dword [esi + ecx*4]
dec ecx
mov dword [edx], ecx
lea edx, [eax - 1]
mov dword [edi + ecx*4], edx
xor ecx, ecx
mov ch, byte [ebx + eax - 2]
mov cl, byte [ebp + 0x15]
mov dword [ebp + 0x14], ecx
movzx ecx, cx
lea edx, [esi + ecx*4]
mov ecx, dword [esi + ecx*4]
dec ecx
mov dword [edx], ecx
lea edx, [eax - 2]
mov dword [edi + ecx*4], edx
xor ecx, ecx
mov ch, byte [ebx + eax - 3]
mov cl, byte [ebp + 0x15]
mov dword [ebp + 0x14], ecx
movzx ecx, cx
lea edx, [esi + ecx*4]
mov ecx, dword [esi + ecx*4]
dec ecx
mov dword [edx], ecx
lea edx, [eax - 3]
mov dword [edi + ecx*4], edx
sub eax, 4
jmp 0x40f753
test eax, eax
jl 0x40f7f4
xor ecx, ecx
mov ch, byte [eax + ebx]
mov cl, byte [ebp + 0x15]
mov dword [ebp + 0x14], ecx
movzx ecx, cx
lea edx, [esi + ecx*4]
mov ecx, dword [esi + ecx*4]
dec ecx
mov dword [edx], ecx
mov edx, dword [ebp + 8]
mov dword [edx + ecx*4], eax
dec eax
jns 0x40f7d4
and dword [ebp + 0xc], 0
push pe_nt_image_headers32
pop ecx
xor eax, eax
lea edi, [ebp - 0x12c]
lea edx, [ebp - 0x52c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
inc dword [ebp + 0xc]
mov dword [edx], eax
add edx, 4
cmp dword [ebp + 0xc], 0xff
jle 0x40f80b
push 1
pop ecx
lea ecx, [ecx + ecx*2 + 1]
cmp ecx, 0x100
jle 0x40f822
mov eax, ecx
push 3
cdq
pop ecx
idiv ecx
mov ecx, eax
cmp ecx, 0xff
mov dword [ebp - 0xc], ecx
mov dword [ebp + 0xc], ecx
jg 0x40f92f
shl eax, 2
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov dword [ebp + 0x14], edx
mov edx, edi
mov eax, dword [ebp + edi - 0x52c]
mov dword [ebp - 0x14], edx
mov edx, ecx
mov ecx, edi
shl edx, 2
sub ecx, edx
mov dword [ebp - 0x18], ecx
mov ecx, edi
sub ecx, edx
lea edx, [eax + 1]
shl edx, 0xa
mov edi, eax
mov edx, dword [edx + esi]
shl edi, 0xa
sub edx, dword [edi + esi]
mov edi, dword [ebp + ecx - 0x52c]
mov ecx, dword [ebp + ecx - 0x52c]
inc edi
shl edi, 0xa
shl ecx, 0xa
mov edi, dword [edi + esi]
sub edi, dword [ecx + esi]
cmp edi, edx
jbe 0x40f90e
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
shl edi, 2
sub ecx, edi
mov edi, dword [ebp - 8]
mov ecx, dword [ebp + ecx - 0x52c]
mov dword [ebp + edi - 0x52c], ecx
mov ecx, dword [ebp - 0xc]
sub dword [ebp + 0x14], ecx
shl ecx, 2
sub dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
dec ecx
cmp dword [ebp + 0x14], ecx
jle 0x40f90e
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
shl edi, 2
sub ecx, edi
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
sub ecx, edi
mov edi, dword [ebp + ecx - 0x52c]
mov ecx, dword [ebp + ecx - 0x52c]
inc edi
shl edi, 0xa
shl ecx, 0xa
mov edi, dword [edi + esi]
sub edi, dword [ecx + esi]
cmp edi, edx
ja 0x40f8ab
mov ecx, dword [ebp + 0x14]
add dword [ebp - 4], 4
inc dword [ebp + 0xc]
cmp dword [ebp - 4], 0x3fc
mov dword [ebp + ecx*4 - 0x52c], eax
mov ecx, dword [ebp - 0xc]
jle 0x40f850
cmp ecx, 1
jne 0x40f82e
and dword [ebp - 0xc], 0
and dword [ebp + 0xc], 0
lea eax, [ebp - 0x52c]
mov dword [ebp - 8], eax
and dword [ebp + 0x14], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp + 0x14], eax
je 0x40f9ee
shl eax, 8
add eax, dword [ebp + 0x14]
mov ecx, dword [esi + eax*4]
lea edx, [esi + eax*4]
test ecx, 0x200000
mov dword [ebp - 0x14], edx
jne 0x40f9ea
mov edi, dword [esi + eax*4 + 4]
and ecx, 0xffdfffff
and edi, 0xffdfffff
mov dword [ebp - 4], ecx
dec edi
cmp edi, ecx
jle 0x40f9ea
cmp dword [ebp + 0x1c], 4
jl 0x40f9b3
mov eax, edi
sub eax, ecx
inc eax
push eax
mov eax, dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [eax]
push str.________qsort__0x_x__0x_x____done__d___this__d_n
push 0x426950
call fcn.0041351c
add esp, 0x18
push dword [ebp + 0x20]
push 2
push edi
push dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0040fc73
sub edi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add esp, 0x20
lea eax, [eax + edi + 1]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
cmp dword [eax], 0
jl 0x40fc6e
mov edx, dword [ebp - 0x14]
or byte [edx + 2], 0x20
inc dword [ebp + 0x14]
cmp dword [ebp + 0x14], 0xff
jle 0x40f94d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp byte [ebp + eax - 0x12c], 0
lea eax, [ebp + eax - 0x12c]
mov dword [ebp - 0x2c], eax
je 0x40fa22
push 0x3ee
call fcn.0040c8f7
pop ecx
mov eax, dword [ebp - 8]
mov edi, 0xffdfffff
mov eax, dword [eax]
mov ecx, eax
shl ecx, 2
mov dword [ebp - 0x20], ecx
lea eax, [ecx + esi]
mov dword [ebp - 0x24], eax
mov dword [ebp + 0x14], eax
xor eax, eax
mov edx, dword [ebp + 0x14]
add eax, 4
mov edx, dword [edx]
and edx, edi
mov dword [ebp + eax - 0x930], edx
mov edx, dword [ebp + 0x14]
add dword [ebp + 0x14], 0x400
mov edx, dword [edx + 4]
and edx, edi
dec edx
cmp eax, 0x3fc
mov dword [ebp + eax - 0xd30], edx
jle 0x40fa3f
mov eax, dword [ebp - 8]
lea edx, [ebp + ecx - 0x92c]
mov dword [ebp - 0x14], edx
mov eax, dword [eax]
shl eax, 0xa
add eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [eax]
and eax, edi
cmp eax, dword [edx]
mov dword [ebp + 0x14], eax
jge 0x40fae8
mov edx, dword [ebp + 8]
lea edx, [edx + eax*4]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
dec edx
mov dword [ebp - 4], edx
jns 0x40faaa
add edx, dword [ebp + 0x18]
mov dword [ebp - 4], edx
movzx edx, byte [edx + ebx]
cmp byte [ebp + edx - 0x12c], 0
jne 0x40fad9
mov ecx, dword [ebp - 4]
lea eax, [ebp + edx*4 - 0x92c]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
mov dword [edx + eax*4], ecx
mov ecx, dword [ebp - 0x1c]
inc eax
mov dword [ecx], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
add dword [ebp - 0x10], 4
inc eax
cmp eax, dword [edx]
mov dword [ebp + 0x14], eax
jl 0x40fa99
mov eax, dword [ebp - 8]
lea ecx, [ebp + ecx - 0xd2c]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax]
inc eax
shl eax, 0xa
add eax, esi
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
and eax, edi
dec eax
cmp eax, dword [ecx]
mov dword [ebp + 0x14], eax
jle 0x40fb64
mov edx, dword [ebp + 8]
lea edx, [edx + eax*4]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
dec edx
mov dword [ebp - 4], edx
jns 0x40fb26
add edx, dword [ebp + 0x18]
mov dword [ebp - 4], edx
movzx edx, byte [edx + ebx]
cmp byte [ebp + edx - 0x12c], 0
jne 0x40fb55
mov ecx, dword [ebp - 4]
lea eax, [ebp + edx*4 - 0xd2c]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
mov dword [edx + eax*4], ecx
mov ecx, dword [ebp - 0x20]
dec eax
mov dword [ecx], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x14]
sub dword [ebp - 0x10], 4
dec eax
cmp eax, dword [ecx]
mov dword [ebp + 0x14], eax
jg 0x40fb15
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
mov ecx, dword [ecx]
lea eax, [edx - 1]
cmp eax, ecx
je 0x40fb86
test edx, edx
jne 0x40fb7b
mov eax, dword [ebp + 0x18]
dec eax
cmp ecx, eax
je 0x40fb86
push 0x3ef
call fcn.0040c8f7
pop ecx
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
or byte [eax + 2], 0x20
add eax, 0x400
dec ecx
jne 0x40fb8e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + 0xc], 0xff
mov byte [eax], 1
jge 0x40fc35
mov eax, dword [ebp - 0x28]
and dword [ebp - 4], 0
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
and edx, edi
mov eax, dword [eax]
and eax, edi
sub eax, edx
cmp eax, 0xfffe
jle 0x40fbda
inc dword [ebp - 4]
mov edi, eax
mov ecx, dword [ebp - 4]
sar edi, cl
cmp edi, 0xfffe
jg 0x40fbc8
dec eax
test eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x14], eax
jl 0x40fc1e
add edx, eax
mov eax, dword [ebp + 8]
lea eax, [eax + edx*4]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov edi, dword [eax]
sar edx, cl
mov ecx, dword [ebp + 0x10]
cmp edi, 0x22
mov word [ecx + edi*2], dx
jge 0x40fc0f
mov ecx, dword [ebp + 0x18]
add edi, ecx
mov ecx, dword [ebp + 0x10]
mov word [ecx + edi*2], dx
dec dword [ebp + 0x14]
sub eax, 4
cmp dword [ebp + 0x14], 0
jge 0x40fbed
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
sar eax, cl
cmp eax, 0xffff
jle 0x40fc35
push 0x3ea
call fcn.0040c8f7
pop ecx
inc dword [ebp + 0xc]
add dword [ebp - 8], 4
cmp dword [ebp + 0xc], 0xff
jle 0x40f949
cmp dword [ebp + 0x1c], 4
jl 0x40fc6e
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x18]
push str._________d_pointers___d_sorted___d_scanned_n
push 0x426950
call fcn.0041351c
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret