Function at 0x4a99fc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov esi, ecx
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4aa2c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x2c
call fcn.004030e0
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x454]
mov dword [0x51246c], eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
neg eax
mov dword [0x512470], eax
mov esi, 0x512468
lea edi, [ebp - 0x94]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a9ab3
lea edx, [ebp - 0x98]
mov eax, dword [0x513910]
call fcn.00406a80
mov ecx, dword [ebp - 0x98]
mov edx, dword [0x4a4aa0]
mov eax, dword [ebp - 4]
call fcn.004a98f0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_CreateDIBSection
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4a9adc
cmp dword [ebp - 0x10], 0
jne 0x4a9b18
cmp dword [ebp - 0x18], 0
je 0x4a9aeb
mov eax, dword [ebp - 0x18]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
lea edx, [ebp - 0x9c]
mov eax, dword [0x513910]
call fcn.00406a80
mov ecx, dword [ebp - 0x9c]
mov edx, dword [0x4a4aa0]
mov eax, dword [ebp - 4]
call fcn.004a98f0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
push 0xcc0020
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
push eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x454]
push eax
mov eax, dword [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
push eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x454]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_StretchBlt
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x454]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
movzx edx, word [ebp - 0x86]
imul edx
add eax, 0x1f
and eax, 0xffffffe0
test eax, eax
jns 0x4a9bb1
add eax, 7
sar eax, 3
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004a9960
movzx ebx, word [eax + 0x2b]
mov eax, dword [ebp - 4]
call fcn.004a9960
imul ebx, dword [eax + 0x454]
add ebx, 0x1f
and ebx, 0xffffffe0
shr ebx, 3
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x450]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov ebx, dword [eax + 0x448]
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
dec eax
imul ebx, eax
mov eax, dword [ebp - 4]
call fcn.004a9960
add ebx, dword [eax + 0x44c]
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 4]
call fcn.004a9960
mov ax, word [eax + 0x2b]
dec ax
je 0x4a9f2b
sub ax, 3
je 0x4a9f2b
sub ax, 4
je 0x4a9f2b
sub ax, 0x10
jne 0x4aa22b
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
test eax, eax
jle 0x4aa22b
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x454]
dec eax
test eax, eax
jl 0x4a9f08
inc eax
mov dword [ebp - 0x54], eax
xor esi, esi
mov eax, dword [ebp - 0x44]
lea edi, [eax + esi*4]
cmp dword [ebp + 0x14], 0
jle 0x4a9cba
mov eax, dword [ebp - 0x40]
xor ebx, ebx
mov bl, byte [eax + esi]
mov eax, 0xff
sub eax, dword [ebp + 0x14]
imul ebx, eax
shr ebx, 8
jmp 0x4a9cc0
mov eax, dword [ebp - 0x40]
mov bl, byte [eax + esi]
cmp byte [ebp + 0x10], 0
je 0x4a9d80
lea eax, [esi + esi*2]
add eax, 2
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
lea edx, [esi + esi*2]
inc edx
mov ecx, dword [ebp - 0x3c]
movzx edx, byte [ecx + edx]
add eax, edx
lea edx, [esi + esi*2]
mov ecx, dword [ebp - 0x3c]
movzx edx, byte [ecx + edx]
add eax, edx
mov ecx, 3
xor edx, edx
div ecx
mov byte [ebp - 0x49], al
xor eax, eax
mov al, byte [ebp - 0x49]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 2]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 2], al
xor eax, eax
mov al, byte [ebp - 0x49]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 1]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 1], al
xor eax, eax
mov al, byte [ebp - 0x49]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi], al
jmp 0x4a9efe
cmp dword [ebp + 8], 0
jg 0x4a9d90
cmp dword [ebp + 0xc], 0
jle 0x4a9e6c
lea eax, [esi + esi*2]
add eax, 2
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
add eax, dword [ebp + 8]
mov edx, 0xff
call fcn.0042ab58
sub eax, dword [ebp + 0xc]
xor edx, edx
call fcn.0042aba0
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 2]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 2], al
lea eax, [esi + esi*2]
inc eax
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
add eax, dword [ebp + 8]
mov edx, 0xff
call fcn.0042ab58
sub eax, dword [ebp + 0xc]
xor edx, edx
call fcn.0042aba0
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 1]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 1], al
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
add eax, dword [ebp + 8]
mov edx, 0xff
call fcn.0042ab58
sub eax, dword [ebp + 0xc]
xor edx, edx
call fcn.0042aba0
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi], al
jmp 0x4a9efe
lea eax, [esi + esi*2]
add eax, 2
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 2]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 2], al
lea eax, [esi + esi*2]
inc eax
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 1]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 1], al
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi], al
inc esi
dec dword [ebp - 0x54]
jne 0x4a9c96
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x40], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x50]
jne 0x4a9c79
jmp 0x4aa22b
mov eax, dword [ebp - 4]
call fcn.004a9960
cmp byte [eax + 0x45d], 4
jne 0x4aa05e
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
test eax, eax
jle 0x4aa22b
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x454]
dec eax
test eax, eax
jl 0x4aa03b
inc eax
mov dword [ebp - 0x54], eax
xor esi, esi
mov eax, dword [ebp - 0x44]
lea ebx, [eax + esi*4]
mov eax, dword [ebp - 4]
call fcn.004a9960
add eax, 0x1d
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x3c]
movzx edx, byte [edx + esi]
mov eax, dword [ebp - 0x40]
mov al, byte [eax + esi]
xor ecx, ecx
mov cl, al
imul edx, ecx
add edx, 0xff
and eax, 0xff
mov ecx, 0xff
sub ecx, eax
xor eax, eax
mov al, byte [ebx + 2]
imul ecx, eax
add edx, ecx
shr edx, 8
mov byte [ebx + 2], dl
mov edx, dword [ebp - 0x3c]
movzx edx, byte [edx + esi]
mov eax, dword [ebp - 0x40]
mov al, byte [eax + esi]
xor ecx, ecx
mov cl, al
imul edx, ecx
add edx, 0xff
and eax, 0xff
mov ecx, 0xff
sub ecx, eax
xor eax, eax
mov al, byte [ebx + 1]
imul ecx, eax
add edx, ecx
shr edx, 8
mov byte [ebx + 1], dl
mov edx, dword [ebp - 0x3c]
movzx edx, byte [edx + esi]
mov eax, dword [ebp - 0x40]
mov al, byte [eax + esi]
xor ecx, ecx
mov cl, al
imul edx, ecx
add edx, 0xff
and eax, 0xff
mov ecx, 0xff
sub ecx, eax
xor eax, eax
mov al, byte [ebx]
imul ecx, eax
add edx, ecx
shr edx, 8
mov byte [ebx], dl
inc esi
dec dword [ebp - 0x54]
jne 0x4a9f7d
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x40], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x50]
jne 0x4a9f60
jmp 0x4aa22b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x238]
mov edx, dword [0x4a545c]
call fcn.004a6040
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x238]
mov edx, dword [0x4a53f0]
call fcn.004a6040
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
test eax, eax
jle 0x4aa22b
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 1
xor esi, esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov al, byte [eax + 0x45c]
dec al
je 0x4aa0d5
dec al
je 0x4aa0f9
sub al, 2
je 0x4aa0f9
jmp 0x4aa122
mov eax, esi
and eax, 0x80000007
jns 0x4aa0e3
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, 7
sub ecx, eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
shr eax, cl
and al, 1
mov byte [ebp - 0x21], al
jmp 0x4aa12a
mov eax, esi
and eax, 0x80000001
jns 0x4aa107
dec eax
or eax, 0xfffffffe
inc eax
mov edx, 1
sub edx, eax
mov ecx, edx
shl ecx, 2
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
shr eax, cl
and al, 0xf
mov byte [ebp - 0x21], al
jmp 0x4aa12a
mov eax, dword [ebp - 0x2c]
mov al, byte [eax]
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x44]
lea edi, [eax + esi*4]
xor eax, eax
mov al, byte [ebp - 0x21]
mov edx, dword [ebp - 0x1c]
mov bl, byte [edx + eax + 0x15]
mov dl, byte [ebp - 0x21]
mov eax, dword [ebp - 0x20]
call fcn.004a90d8
shr eax, 0x10
and eax, 0xff
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 2]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 2], al
mov dl, byte [ebp - 0x21]
mov eax, dword [ebp - 0x20]
call fcn.004a90d8
shr eax, 8
and eax, 0xff
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 1]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov dl, byte [ebp - 0x21]
mov eax, dword [ebp - 0x20]
call fcn.004a90d8
and eax, 0xff
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi], al
inc esi
mov eax, dword [ebp - 4]
call fcn.004a9960
movzx eax, word [eax + 0x2b]
add dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 8
jl 0x4aa0b9
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004a9960
cmp esi, dword [eax + 0x454]
jl 0x4aa0b4
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x3c], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x50]
jne 0x4aa0ac
push 0xcc0020
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
push eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x454]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x458]
push eax
mov eax, dword [ebp - 4]
call fcn.004a9960
mov eax, dword [eax + 0x454]
push eax
mov eax, dword [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_StretchBlt
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0x18]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa2c9
lea eax, [ebp - 0x9c]
mov edx, 2
call fcn.00404740
ret