Function at 0x4aef6c
Capabilities:
Check for time delay via gettickcount
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
xor ebx, ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4af2cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0xe7c
call fcn.00402b58
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add edx, 0x15
mov cl, 0xe
call fcn.00402a34
mov edx, dword [ebp - 0xc]
add edx, 0x10
mov eax, dword [ebp - 8]
call fcn.004b3580
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x5c0]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc6c], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x274], 0
je 0x4af085
mov eax, dword [ebp - 0xc]
add eax, 0xc70
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x274]
add edx, 0x15
mov cl, 0xe
call fcn.00402a34
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x274]
mov eax, dword [eax + 0x278]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4af085
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x11c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x274]
mov eax, dword [eax + 0x278]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
mov ecx, 0xff
call fcn.00403ea8
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl eax, 4
sub eax, ecx
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax + 0xc7f]
mov cl, 0xe
call fcn.00402a34
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4af029
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x27d]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0xd06], al
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x27c]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0xd07], al
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x27e]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0xd08], al
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x349]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0xd09], al
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x34a]
mov edx, dword [ebp - 0xc]
mov byte [edx + 0xd0a], al
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x280]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4af159
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 9
jg 0x4af151
lea ecx, [ebp - 0x120]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x280]
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x118]
mov ecx, 0xff
call fcn.00403ea8
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl eax, 4
sub eax, ecx
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax + 0xd0b]
mov cl, 0xe
call fcn.00402a34
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4af0fd
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x29c]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4af26a
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x29c]
mov edx, dword [ebp - 0x10]
call fcn.00411704
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 4
jg 0x4af25e
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*8]
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 0xda4]
mov edx, dword [ebp - 0x14]
add edx, 0x15
mov cl, 0xe
call fcn.00402a34
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x294]
mov dword [edx + eax*4 + 0xdb4], ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov cl, byte [ecx + 0x298]
mov byte [edx + eax*4 + 0xdb8], cl
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov cl, byte [ecx + 0x299]
mov byte [edx + eax*4 + 0xdb9], cl
call sub.kernel32.dll_GetTickCount
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x28c]
pop edx
sub eax, edx
mov ecx, 0x3e8
xor edx, edx
div ecx
mov edx, dword [ebp - 0x10]
lea edx, [edx + edx*8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + edx*4 + 0xdbc], eax
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
movzx ecx, word [ecx + 0x1a4]
mov dword [edx + eax*4 + 0xdc0], ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax*8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
movzx ecx, word [ecx + 0x1a6]
mov dword [edx + eax*4 + 0xdc4], ecx
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4af179
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx + 0x218]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx + 0xe5c], al
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
sub eax, dword [edx + ecx*4 + 0x220]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [edx + ecx*4 + 0xe64], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jne 0x4af26f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af2d6
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00403c70
ret