Function at 0x4b25e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc8
mov edi, edx
mov ebx, eax
push 0xc
push ebx
call sub.user32.dll_GetWindowLongA
mov byte [esp + 0x2c], al
cmp byte [esp + 0x2c], 1
jne 0x4b2605
mov byte [esp + 0x2d], 0
jmp 0x4b260a
mov byte [esp + 0x2d], 0xb
mov eax, dword [0x4cecdc]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov dword [esp + 0x24], eax
mov edx, 0x4ced08
lea eax, [esp + 0xb]
mov ecx, 3
call fcn.004066dc
mov dword [esp + 0x28], 3
lea ebx, [esp + 0xb]
lea ebp, [esp + 0xe]
xor eax, eax
mov al, byte [ebx]
mov edx, pe_nt_image_headers32
sub edx, eax
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fdivr dword [0x4b2b34]
call fcn.004028e8
mov word [ebp], ax
add ebp, 2
inc ebx
dec dword [esp + 0x28]
jne 0x4b263d
mov word [esp + 0x20], 1
mov dword [esp + 0x28], 3
lea ebx, [esp + 0xb]
lea esi, [esp + 0xe]
lea ebp, [esp + 8]
movsx eax, word [esp + 0x20]
movsx edx, word [esi]
mov ecx, edx
cdq
idiv ecx
mov edx, eax
xor eax, eax
mov al, byte [ebx]
add edx, eax
mov eax, 0xff
call fcn.004aa570
mov byte [ebp], al
inc ebp
add esi, 2
inc ebx
dec dword [esp + 0x28]
jne 0x4b2684
mov cl, byte [esp + 0xa]
mov dl, byte [esp + 9]
mov al, byte [esp + 8]
call fcn.00406710
push eax
push 0
push 0
call sub.gdi32.dll_CreatePen
mov ebx, eax
push ebx
push edi
call sub.gdi32.dll_SelectObject
cmp word [esp + 0x20], 0x12
jl 0x4b2718
xor eax, eax
mov al, byte [esp + 0x2d]
mov dx, 0x2b
sub dx, ax
mov cx, word [esp + 0x20]
dec ecx
mov eax, edi
call fcn.004addb4
movsx eax, word [esp + 0x20]
dec eax
push eax
cmp word [esp + 0x24], 0x12
setge al
and eax, 0x7f
imul eax, eax, 0x1f4
dec eax
push eax
push edi
call sub.gdi32.dll_LineTo
movsx esi, word [esp + 0x20]
mov eax, 0x12d
sub eax, esi
cmp eax, 0x12
setl al
and eax, 0x7f
imul dx, ax, 0x1f4
xor eax, eax
mov al, byte [esp + 0x2d]
mov cx, 0x2b
sub cx, ax
add dx, cx
mov cx, 0x12c
sub cx, word [esp + 0x20]
mov eax, edi
call fcn.004addb4
mov eax, 0x12c
sub eax, esi
push eax
push 0xffffffffffffffff
push edi
call sub.gdi32.dll_LineTo
mov eax, dword [esp + 0x24]
push eax
push edi
call sub.gdi32.dll_SelectObject
push ebx
call sub.gdi32.dll_DeleteObject
inc word [esp + 0x20]
cmp word [esp + 0x20], 0x12e
jne 0x4b2670
mov cl, 0xff
xor edx, edx
xor eax, eax
call fcn.00406710
push eax
push edi
call sub.gdi32.dll_SetTextColor
push 0xffffff
push edi
call sub.gdi32.dll_SetBkColor
push 1
push edi
call sub.gdi32.dll_SetBkMode
mov eax, dword [0x4c4524]
push eax
push 0x31
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0xf
call sub.gdi32.dll_CreateFontA
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov dword [esp], eax
xor ebx, ebx
cmp byte [esp + 0x2c], 1
jne 0x4b286a
cmp bx, 7
jbe 0x4b27ff
mov dword [0x4c8230], 0xa
jmp 0x4b2806
xor eax, eax
mov dword [0x4c8230], eax
cmp bx, 9
jbe 0x4b2814
dec dword [0x4c8230]
jmp 0x4b281b
add dword [0x4c8230], 7
movzx eax, bx
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b849c
mov edx, eax
lea eax, [esp + 0x14]
call fcn.004b81b0
lea eax, [esp + 0x14]
call fcn.004b8144
push eax
lea eax, [esp + 0x18]
push eax
push 2
movzx eax, bx
shl eax, 3
lea eax, [eax + eax*2]
add eax, 0x34
inc eax
add eax, dword [0x4c8230]
push eax
push edi
call sub.gdi32.dll_TextOutA
jmp 0x4b28c1
movzx eax, bx
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 1
xor eax, eax
call fcn.004af0b0
mov edx, eax
lea eax, [esp + 0x14]
call fcn.004b81b0
lea eax, [esp + 0x14]
call fcn.004b8144
push eax
lea eax, [esp + 0x18]
push eax
push 2
cmp byte [esp + 0x38], 3
sete al
and eax, 0x7f
lea eax, [eax + eax*8]
add eax, 0x14
movzx edx, bx
imul edx
add eax, 0x2a
push eax
push edi
call sub.gdi32.dll_TextOutA
inc ebx
cmp bx, 0x10
jne 0x4b27e6
push 2
push edi
call sub.gdi32.dll_SetTextAlign
xor esi, esi
cmp byte [esp + 0x2c], 1
jne 0x4b2921
movzx eax, si
mov ebx, eax
shl ebx, 4
mov dword [esp + 0x34], ebx
fild dword [esp + 0x34]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b849c
mov edx, eax
lea eax, [esp + 0x19]
call fcn.004b81b0
lea eax, [esp + 0x19]
call fcn.004b8144
push eax
lea eax, [esp + 0x1d]
push eax
add ebx, 0x16
push ebx
push 0x21
push edi
call sub.gdi32.dll_TextOutA
jmp 0x4b2967
movzx eax, si
mov ebx, eax
shl ebx, 4
mov dword [esp + 0x34], ebx
fild dword [esp + 0x34]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.004af0b0
mov edx, eax
lea eax, [esp + 0x19]
call fcn.004b81b0
lea eax, [esp + 0x19]
call fcn.004b8144
push eax
lea eax, [esp + 0x1d]
push eax
add ebx, 0x16
push ebx
push 0x17
push edi
call sub.gdi32.dll_TextOutA
inc esi
cmp si, 0x10
jne 0x4b28d6
push 0
push edi
call sub.gdi32.dll_SetTextAlign
cmp byte [esp + 0x2c], 2
jne 0x4b298d
mov eax, dword [0x4cecb4]
push eax
push edi
call sub.gdi32.dll_SelectObject
push 0
push edi
call sub.gdi32.dll_SetTextColor
push 0xffffff
push edi
call sub.gdi32.dll_SetBkColor
mov byte [esp + 0x1f], 0x3a
mov si, 1
mov ebp, dword [0x4be898]
mov bx, 1
mov eax, dword [0x4be898]
mov dword [esp + 0x30], eax
cmp byte [esp + 0x2c], 1
jne 0x4b2a10
mov al, byte [ebp]
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x30]
mov al, byte [eax]
mov byte [esp + 0x1e], al
push 2
lea eax, [esp + 0x21]
push eax
movzx eax, si
dec eax
shl eax, 4
add eax, 0x16
push eax
cmp bx, 8
seta al
and eax, 0x7f
add eax, eax
lea eax, [eax + eax*4]
movzx edx, bx
dec edx
shl edx, 3
lea edx, [edx + edx*2]
add edx, 0x34
add eax, edx
push eax
push edi
call sub.gdi32.dll_TextOutA
jmp 0x4b2afb
mov eax, esi
dec eax
shl eax, 4
add al, bl
dec eax
mov byte [esp + 0x2e], al
cmp byte [esp + 0x2c], 3
jne 0x4b2a95
cmp byte [esp + 0x2e], 0x20
jae 0x4b2a95
xor eax, eax
mov al, byte [esp + 0x2e]
mov edx, dword [0x4beea0]
lea eax, [edx + eax*4]
call fcn.004b8144
xor edx, edx
mov dl, al
push edx
xor edx, edx
mov dl, byte [esp + 0x32]
mov ecx, dword [0x4beea0]
lea edx, [ecx + edx*4]
push edx
movzx edx, si
dec edx
shl edx, 4
add edx, 0x16
add edx, 3
xor ecx, ecx
mov cl, byte [esp + 0x34]
sub edx, ecx
push edx
movzx edx, bx
dec edx
imul edx, edx, 0x1d
add edx, 0x2d
xor ecx, ecx
mov cl, byte [esp + 0x38]
sub edx, ecx
sub edx, 4
cmp al, 3
sete al
and eax, 0x7f
shl eax, 2
sub edx, eax
push edx
push edi
call sub.gdi32.dll_TextOutA
jmp 0x4b2afb
mov al, byte [esp + 0x2e]
mov byte [esp + 0x1d], al
cmp byte [esp + 0x2c], 4
jne 0x4b2aba
and eax, 0xff
mov edx, dword [0x4cf244]
mov al, byte [edx + eax + 0x100]
mov byte [esp + 0x1d], al
push 1
lea edx, [esp + 0x21]
push edx
movzx edx, si
dec edx
shl edx, 4
add edx, 0x16
add edx, 3
xor eax, eax
mov al, byte [esp + 0x34]
sub edx, eax
push edx
cmp byte [esp + 0x38], 3
sete dl
and edx, 0x7f
lea edx, [edx + edx*8]
add edx, 0x14
movzx ecx, bx
dec ecx
imul edx, ecx
add edx, 0x2d
sub edx, eax
push edx
push edi
call sub.gdi32.dll_TextOutA
inc ebx
inc dword [esp + 0x30]
cmp bx, 0x11
jne 0x4b29bc
inc esi
inc ebp
cmp si, 0x11
jne 0x4b29af
mov eax, dword [esp]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov eax, dword [esp + 4]
push eax
call sub.gdi32.dll_DeleteObject
add esp, 0x38
pop ebp
pop edi
pop esi
pop ebx
ret