Function at 0x10066610
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xcc], edx
xor edx, edx
mov eax, dword [esi]
push edi
mov dword [ebp - 0xc8], esi
mov dword [eax + 8], 0
mov dword [esi + 0x46cc], 0
mov dword [esi + 0x46d0], 0
mov dword [esi + 0x4714], 0
mov dword [esi + 0x4718], 0
mov dword [esi + 0x475c], 0
mov dword [esi + 0x4760], 0
mov dword [esi + 0x47a4], 0
mov dword [esi + 0x47a8], 0
mov dword [esi + 0x4804], 0
call fcn.100659e0
test eax, eax
je 0x100668de
mov ecx, esi
call fcn.100636f0
movzx ecx, al
cmp ecx, 0xd9
je 0x1006679a
nop
cmp ecx, 0xda
jne 0x10066723
mov ecx, esi
call fcn.10064c80
test eax, eax
je 0x100668de
mov ecx, esi
call fcn.10063820
test eax, eax
je 0x100668de
cmp byte [esi + 0x47c4], 0xff
jne 0x1006670c
mov ecx, esi
call fcn.10065b10
mov byte [esi + 0x47c4], al
mov ecx, esi
call fcn.100636f0
movzx ecx, al
lea eax, [ecx - 0xd0]
cmp eax, 7
ja 0x1006678e
jmp 0x10066784
cmp ecx, 0xdc
jne 0x10066777
mov ecx, dword [esi]
call fcn.10061060
mov ecx, dword [esi]
mov edi, eax
call fcn.10061060
cmp edi, 4
jne 0x100668c5
mov ecx, dword [esi]
cmp eax, dword [ecx + 4]
je 0x10066784
mov ecx, dword [0x10099d0c]
mov eax, dword fs:[0x2c]
mov edx, dword [esi]
push 0
mov eax, dword [eax + ecx*4]
mov ecx, esi
mov edx, dword [edx + 8]
mov dword [eax + 0xc], str.bad_DNL_height
call fcn.10065180
jmp 0x10067057
mov edx, ecx
mov ecx, esi
call fcn.100641e0
test eax, eax
je 0x100667aa
mov ecx, esi
call fcn.100636f0
movzx ecx, al
cmp ecx, 0xd9
jne 0x100666d0
cmp dword [esi + 0x47cc], 0
je 0x100667aa
mov ecx, esi
call fcn.10064060
mov eax, dword [esi]
xor ebx, ebx
mov ecx, dword [eax + 8]
cmp ecx, 3
mov dword [ebp - 0xc0], ecx
setge bl
lea ebx, [ebx*2 + 1]
mov dword [ebp - 0x94], ebx
jne 0x100668f1
cmp dword [esi + 0x47ec], 3
je 0x100667f3
cmp dword [esi + 0x47e8], 0
jne 0x100668f1
cmp dword [esi + 0x47e4], 0
jne 0x100668f1
mov dword [ebp - 0xc4], 1
mov ecx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea edi, [ebp - 0x7c]
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
lea edx, [esi + 0x46a0]
mov dword [ebp - 0x9c], edi
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xa0], ecx
mov eax, dword [esi]
mov eax, dword [eax]
add eax, 3
push eax
call ecx
mov ecx, dword [ebp - 0xa8]
add esp, 4
mov dword [ecx + 0x34], eax
test eax, eax
je 0x10067030
mov eax, dword [esi + 0x4684]
cdq
idiv dword [ecx]
mov dword [edi - 4], eax
mov dword [ebp - 0x90], eax
mov eax, dword [esi + 0x4688]
cdq
idiv dword [ecx + 4]
mov edx, dword [ebp - 0x9c]
mov edi, eax
mov eax, dword [ebp - 0x90]
mov ecx, edi
dec eax
sar ecx, 1
mov dword [edx + 8], ecx
mov ecx, dword [esi]
mov dword [edx], edi
xor edx, edx
add eax, dword [ecx]
div dword [ebp - 0x90]
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa8]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x28]
mov dword [ecx - 8], eax
mov dword [ecx - 0xc], eax
mov eax, dword [ebp - 0x90]
mov dword [ecx + 0xc], 0
cmp eax, 1
jne 0x10066921
cmp edi, eax
jne 0x10066915
mov eax, 0x10065cb0
jmp 0x10066944
mov ecx, dword [0x10099d0c]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0xc], str.bad_DNL_len
mov edx, dword [esi]
mov ecx, esi
push 0
mov edx, dword [edx + 8]
call fcn.10065180
jmp 0x10067057
mov eax, ecx
mov dword [ebp - 0xc4], 0
test eax, eax
jg 0x100667fd
mov edx, ecx
mov ecx, esi
push 0
call fcn.10065180
jmp 0x10067057
cmp edi, 2
jne 0x10066921
mov eax, 0x10065cc0
jmp 0x10066944
cmp eax, 2
jne 0x1006693f
cmp edi, 1
jne 0x10066932
mov eax, 0x10065ee0
jmp 0x10066944
cmp edi, 2
jne 0x1006693f
mov eax, dword [esi + 0x4814]
jmp 0x10066944
mov eax, 0x10066200
mov dword [ecx - 0x10], eax
add edx, 0x48
mov eax, dword [ebp - 0xac]
add ecx, 0x20
inc eax
mov dword [ebp - 0x9c], ecx
mov edi, ecx
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], edx
cmp eax, dword [ebp - 0xc0]
jl 0x10066832
mov eax, dword [esi]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
test ecx, ecx
js 0x10067029
je 0x1006699b
mov eax, 0x7fffffff
cdq
idiv ecx
cmp ebx, eax
jg 0x10067029
mov eax, ecx
imul eax, ebx
mov dword [ebp - 0x98], eax
test eax, eax
js 0x10067029
test edi, edi
js 0x10067029
je 0x100669cc
mov eax, 0x7fffffff
cdq
idiv edi
cmp dword [ebp - 0x98], eax
jg 0x10067029
mov eax, ecx
imul eax, edi
imul eax, ebx
cmp eax, 0x7ffffffe
jg 0x10067029
imul ecx, edi
imul ecx, ebx
inc ecx
push ecx
call dword [ebp - 0xa0]
mov edi, eax
add esp, 4
mov eax, dword [esi]
test edi, edi
je 0x1006702b
xor ecx, ecx
mov dword [ebp - 0x90], ecx
cmp dword [eax + 4], ecx
jbe 0x10066bf8
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x9c], edi
nop dword [eax]
mov ebx, dword [eax]
imul ebx, ecx
mov dword [ebp - 0x98], 0
imul ebx, edx
add ebx, edi
cmp dword [ebp - 0xc0], 0
mov dword [ebp - 0xa4], ebx
je 0x10066b2a
mov ebx, dword [ebp - 0x9c]
lea eax, [esi + 0x46bc]
mov dword [ebp - 0xa0], eax
lea edi, [ebp - 0x74]
mov esi, eax
nop
mov eax, dword [edi - 8]
lea ecx, [edi - 0x10]
sar eax, 1
lea edx, [edi - 0x14]
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xac], edx
cmp dword [edi], eax
jl 0x10066a87
mov eax, dword [edx]
mov edx, ecx
mov dword [ebp - 0xa0], ecx
jmp 0x10066a9d
mov eax, ecx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ecx]
push dword [edi - 0xc]
push dword [edi - 4]
push eax
push dword [edx]
push dword [esi + 0x18]
call dword [edi - 0x18]
mov ecx, dword [ebp - 0x98]
add esp, 0x14
mov dword [ebp + ecx*4 - 0xbc], eax
mov eax, dword [edi]
inc eax
mov dword [edi], eax
cmp eax, dword [edi - 8]
jl 0x10066af3
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xac]
inc dword [edi + 4]
mov dword [edi], 0
mov edx, dword [edx]
mov dword [eax], edx
mov eax, dword [edi + 4]
cmp eax, dword [esi]
jge 0x10066af3
mov eax, dword [esi + 4]
add eax, edx
mov edx, dword [ebp - 0xa8]
mov dword [edx], eax
inc ecx
add edi, 0x20
add esi, 0x48
mov dword [ebp - 0x98], ecx
cmp ecx, dword [ebp - 0xc0]
jl 0x10066a60
mov esi, dword [ebp - 0xc8]
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x9c], ebx
mov ebx, dword [ebp - 0xa4]
cmp dword [ebp - 0xc0], 3
mov eax, dword [esi]
jl 0x10066e13
mov ecx, dword [eax + 8]
cmp ecx, 3
jne 0x10066c51
cmp dword [ebp - 0xc4], 0
je 0x10066bb3
xor edx, edx
cmp dword [eax], edx
jbe 0x10066bd4
mov ecx, dword [ebp - 0xb8]
add ebx, 2
mov eax, dword [ebp - 0xbc]
mov edi, dword [ebp - 0xb4]
sub eax, ecx
sub edi, ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa4], edi
mov edi, dword [ebp - 0x94]
mov al, byte [ecx + eax]
lea ecx, [ecx + 1]
mov byte [ebx - 2], al
inc edx
mov al, byte [ecx - 1]
mov byte [ebx - 1], al
mov eax, dword [ebp - 0xa4]
mov al, byte [ecx + eax - 1]
mov byte [ebx], al
mov byte [ebx + 1], 0xff
add ebx, edi
mov eax, dword [esi]
cmp edx, dword [eax]
mov eax, dword [ebp - 0x98]
jb 0x10066b83
jmp 0x10066bd4
push edx
push dword [eax]
mov eax, dword [esi + 0x4810]
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
push dword [ebp - 0xbc]
push ebx
call eax
add esp, 0x18
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
mov eax, dword [esi]
inc ecx
mov edi, dword [ebp - 0x9c]
mov dword [ebp - 0x90], ecx
cmp ecx, dword [eax + 4]
jb 0x10066a20
mov edx, dword [eax + 8]
mov ecx, esi
push 0
call fcn.10065180
mov eax, dword [esi]
add esp, 4
mov ecx, dword [ebp - 0xcc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0xd0]
mov eax, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ebp - 0xd4]
test eax, eax
je 0x10066c3e
mov ecx, dword [esi]
xor edx, edx
cmp dword [ecx + 8], 3
setge dl
lea edx, [edx*2 + 1]
mov dword [eax], edx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10074ff7
mov esp, ebp
pop ebp
ret
cmp ecx, 4
jne 0x10066de4
mov ecx, dword [esi + 0x47e8]
test ecx, ecx
jne 0x10066d33
mov dword [ebp - 0x98], ecx
cmp dword [eax], ecx
jbe 0x10066bda
mov edi, dword [ebp - 0xb0]
add ebx, 2
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xbc]
sub ecx, edi
mov dword [ebp - 0xa4], ecx
sub eax, edi
mov ecx, dword [ebp - 0xb4]
sub ecx, edi
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa0], ecx
nop dword [eax]
movzx ecx, byte [edi + eax]
lea edi, [edi + 1]
movzx edx, byte [edi - 1]
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [ebx - 2], al
mov eax, dword [ebp - 0xa4]
movzx ecx, byte [edi + eax - 1]
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [ebx - 1], al
mov eax, dword [ebp - 0xa0]
movzx ecx, byte [edi + eax - 1]
imul ecx, edx
mov edx, dword [ebp - 0x94]
mov byte [ebx + 1], 0xff
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 0x98]
shr eax, 8
inc ecx
mov byte [ebx], al
add ebx, edx
mov eax, dword [esi]
mov dword [ebp - 0x98], ecx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0xac]
jb 0x10066cb0
jmp 0x10066bda
mov eax, dword [eax]
mov edi, dword [esi + 0x4810]
push edx
push eax
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
push dword [ebp - 0xbc]
push ebx
cmp ecx, 2
jne 0x10066ddd
call edi
mov eax, dword [esi]
xor edi, edi
add esp, 0x18
cmp dword [eax], edi
jbe 0x10066bd4
add ebx, 2
nop dword [eax]
mov eax, dword [ebp - 0xb0]
movzx edx, byte [edi + eax]
inc edi
mov al, byte [ebx - 2]
not al
movzx ecx, al
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [ebx - 2], al
mov al, byte [ebx - 1]
not al
movzx ecx, al
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [ebx - 1], al
mov al, byte [ebx]
not al
movzx ecx, al
imul ecx, edx
mov edx, dword [ebp - 0x94]
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [ebx], al
add ebx, edx
mov eax, dword [esi]
cmp edi, dword [eax]
jb 0x10066d70
jmp 0x10066bda
call edi
jmp 0x10066bd1
xor ecx, ecx
cmp dword [eax], ecx
jbe 0x10066bda
inc ebx
nop
mov eax, dword [ebp - 0xbc]
mov al, byte [ecx + eax]
inc ecx
mov byte [ebx + 1], al
mov byte [ebx], al
mov byte [ebx - 1], al
mov byte [ebx + 2], 0xff
add ebx, edx
mov eax, dword [esi]
cmp ecx, dword [eax]
jb 0x10066df0
jmp 0x10066bda
cmp dword [ebp - 0xc4], 0
je 0x10066e8f
xor edi, edi
cmp dword [eax], edi
jbe 0x10066be0
mov edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb8]
sub eax, edx
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xb4]
sub eax, edx
sub ebx, edx
mov dword [ebp - 0x98], eax
nop word [eax + eax]
movzx eax, byte [eax + edx]
lea edx, [edx + 1]
imul ecx, eax, 0x1d
inc edi
mov eax, dword [ebp - 0xa4]
movzx eax, byte [edx + eax - 1]
imul eax, eax, 0x96
add ecx, eax
movzx eax, byte [edx - 1]
imul eax, eax, 0x4d
add ecx, eax
shr ecx, 8
mov byte [ebx + edx - 1], cl
mov eax, dword [esi]
cmp edi, dword [eax]
mov eax, dword [ebp - 0x98]
jb 0x10066e50
jmp 0x10066bd4
cmp dword [eax + 8], 4
jne 0x10067000
mov ecx, dword [esi + 0x47e8]
test ecx, ecx
jne 0x10066fa0
mov dword [ebp - 0x98], ecx
cmp dword [eax], ecx
jbe 0x10066bda
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb8]
mov edi, dword [ebp - 0xbc]
sub eax, ecx
mov dword [ebp - 0xa4], eax
sub edi, ecx
mov eax, dword [ebp - 0xb4]
sub eax, ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa0], eax
nop dword [eax + eax]
movzx edi, byte [ecx + edi]
movzx eax, byte [ecx]
mov edx, dword [ebp - 0xa4]
mov esi, dword [ebp - 0xa0]
imul edi, eax
movzx ecx, byte [edx + ecx]
mov edx, dword [ebp - 0xa8]
imul ecx, eax
sub edi, 0xffffff80
movzx edx, byte [esi + edx]
imul edx, eax
sub ecx, 0xffffff80
mov esi, dword [ebp - 0xc8]
mov eax, ecx
mov byte [ebx + 1], 0xff
shr eax, 8
add eax, ecx
shr eax, 8
sub edx, 0xffffff80
movzx eax, al
imul ecx, eax, 0x96
mov eax, edx
shr eax, 8
add eax, edx
mov edx, dword [ebp - 0x94]
shr eax, 8
movzx eax, al
imul eax, eax, 0x1d
add ecx, eax
mov eax, edi
shr eax, 8
add eax, edi
mov edi, dword [ebp - 0x98]
shr eax, 8
inc edi
movzx eax, al
imul eax, eax, 0x4d
mov dword [ebp - 0x98], edi
add ecx, eax
shr ecx, 8
mov byte [ebx], cl
add ebx, edx
mov eax, dword [esi]
mov ecx, dword [ebp - 0xa8]
inc ecx
mov dword [ebp - 0xa8], ecx
cmp edi, dword [eax]
mov edi, dword [ebp - 0xac]
jb 0x10066ef0
jmp 0x10066bda
cmp ecx, 2
jne 0x10067000
xor edi, edi
cmp dword [eax], edi
jbe 0x10066bda
mov eax, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xb0]
sub eax, edx
mov dword [ebp - 0xa4], eax
mov al, byte [eax + edx]
lea edx, [edx + 1]
not al
inc edi
movzx ecx, al
movzx eax, byte [edx - 1]
imul ecx, eax
mov byte [ebx + 1], 0xff
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [ebx], al
mov eax, dword [esi]
add ebx, dword [ebp - 0x94]
cmp edi, dword [eax]
mov eax, dword [ebp - 0xa4]
jb 0x10066fc3
jmp 0x10066bd4
mov eax, dword [eax]
xor ecx, ecx
test eax, eax
je 0x10066bda
mov edi, dword [ebp - 0xbc]
sub edi, ebx
mov al, byte [edi + ebx]
lea ebx, [ebx + 1]
mov byte [ebx - 1], al
inc ecx
mov eax, dword [esi]
cmp ecx, dword [eax]
jb 0x10067014
jmp 0x10066bda
mov eax, dword [esi]
mov edx, dword [eax + 8]
jmp 0x10067035
mov edx, dword [esi]
mov edx, dword [edx + 8]
push 0
mov ecx, esi
call fcn.10065180
mov ecx, dword [0x10099d0c]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0xc], str.outofmem
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.10074ff7
mov esp, ebp
pop ebp
ret