Function at 0x41ad90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
pushfd
pushal
xor eax, eax
cmp dword [esp + 0x48], eax
je 0x41adb2
mov eax, dword [0x436980]
cmp eax, 0xffffffff
jne 0x41adae
call fcn.0041b390
mov eax, dword [0x436980]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
lea eax, [eax + eax*2]
mov dword [0x43697c], edx
mov dword [0x436978], eax
cmp dword [esp + 0x30], 0x100
jae 0x41b050
cmp dword [esp + 0x48], 1
je 0x41aef0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mul ecx
mov ebx, eax
mov ebp, edx
add ecx, dword [esp + 0x34]
xor edi, edi
mov eax, dword [esp + 0x34]
mul edi
add eax, ebx
adc edx, ebp
div ecx
mov esi, eax
shl eax, 8
mov dword [edi*4 + 0x434970], esi
shl esi, 0x10
mov dword [edi*4 + 0x434d70], eax
shl eax, 0x10
mov dword [edi*4 + 0x435170], esi
mov dword [edi*4 + 0x435570], eax
inc edi
cmp edi, 0x100
jne 0x41adf5
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
sub edi, esi
xor ecx, ecx
mov ebp, dword [0x436978]
sub ecx, edi
push esi
sub ecx, esi
and ecx, 3
je 0x41ae62
xor edx, edx
mov dl, byte [esi]
inc esi
mov al, byte [edx*4 + 0x434970]
dec ebp
mov byte [esi + edi - 1], al
je 0x41aed1
loop 0x41ae4f
mov ecx, ebp
shr ebp, 2
je 0x41aeba
push ecx
mov eax, dword [esi]
add esi, 4
mov ebx, eax
mov ecx, eax
shr ebx, 0x10
mov edx, eax
shr eax, 0x18
and ebx, 0xff
shr ecx, 8
and edx, 0xff
mov eax, dword [eax*4 + 0x435570]
and ecx, 0xff
mov ebx, dword [ebx*4 + 0x435170]
mov edx, dword [edx*4 + 0x434970]
mov ecx, dword [ecx*4 + 0x434d70]
or eax, ebx
or ecx, edx
or eax, ecx
dec ebp
mov dword [esi + edi - 4], eax
jne 0x41ae6a
pop ecx
and ecx, 3
je 0x41aed1
xor edx, edx
mov dl, byte [esi]
inc esi
mov al, byte [edx*4 + 0x434970]
mov byte [esi + edi - 1], al
loop 0x41aec1
pop esi
mov edx, dword [0x43697c]
mov eax, dword [esp + 0x40]
add esi, edx
dec eax
mov dword [esp + 0x40], eax
jne 0x41ae3b
popal
popfd
ret
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mul ecx
mov ebx, eax
mov ebp, edx
add ecx, dword [esp + 0x34]
xor edi, edi
mov eax, dword [esp + 0x34]
mul edi
add eax, ebx
adc edx, ebp
div ecx
mov dword [edi*4 + 0x434970], eax
inc edi
cmp edi, 0x100
jne 0x41af04
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
add ebx, eax
mov ecx, pe_nt_image_headers32
mul ecx
div ebx
movd mm4, eax
punpcklwd mm4, mm4
punpckldq mm4, mm4
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
add ebx, eax
mul dword [esp + 0x30]
div ebx
movd mm5, eax
punpcklwd mm5, mm5
punpckldq mm5, mm5
pxor mm6, mm6
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
sub edi, esi
xor ecx, ecx
mov ebp, dword [0x436978]
sub ecx, edi
push esi
sub ecx, esi
and ecx, 7
je 0x41afc2
mov eax, ecx
and ecx, 3
je 0x41af94
xor edx, edx
mov dl, byte [esi]
inc esi
mov dl, byte [edx*4 + 0x434970]
dec ebp
mov byte [esi + edi - 1], dl
je 0x41b032
loop 0x41af7d
cmp ebp, 4
jb 0x41b01f
test eax, 4
je 0x41afc2
movd mm0, dword [esi]
punpcklbw mm0, mm6
pmullw mm0, mm4
add esi, 4
sub ebp, 4
psrlw mm0, 8
paddw mm0, mm5
packuswb mm0, mm6
movd dword [esi + edi - 4], mm0
mov ecx, ebp
shr ecx, 3
je 0x41aff6
movq mm0, qword [esi]
movq mm2, mm0
punpckhbw mm0, mm6
pmullw mm0, mm4
punpcklbw mm2, mm6
pmullw mm2, mm4
add esi, 8
psrlw mm0, 8
psrlw mm2, 8
paddw mm0, mm5
paddw mm2, mm5
packuswb mm2, mm0
movq qword [esi + edi - 8], mm2
loop 0x41afc9
and ebp, 7
je 0x41b032
sub ebp, 4
jb 0x41b01c
movd mm0, dword [esi]
punpcklbw mm0, mm6
pmullw mm0, mm4
psrlw mm0, 8
paddw mm0, mm5
packuswb mm0, mm6
movd dword [esi + edi], mm0
je 0x41b032
add esi, 4
and ebp, 3
xor edx, edx
mov dl, byte [esi]
inc esi
mov al, byte [edx*4 + 0x434970]
dec ebp
mov byte [esi + edi - 1], al
jne 0x41b021
pop esi
mov edx, dword [0x43697c]
mov eax, dword [esp + 0x40]
add esi, edx
dec eax
mov dword [esp + 0x40], eax
jne 0x41af62
emms
popal
popfd
ret
cmp dword [esp + 0x48], 1
je 0x41b1e0
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
add ebx, edx
je 0x41b1da
mov edi, 0x434970
call fcn.0041a634
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
add ebx, edx
mov edi, 0x435970
call fcn.0041a634
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
sub edi, esi
sub ebx, esi
mov dword [0x436974], edi
mov dword [0x436970], ebx
xor ecx, ecx
mov ebp, dword [0x436978]
sub ecx, esi
mov edi, dword [0x436974]
mov ebx, dword [0x436970]
push esi
sub ecx, edi
and ecx, 3
je 0x41b0ea
xor eax, eax
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + ebx]
inc esi
mov eax, dword [eax*4 + 0x434970]
mov edx, dword [edx*4 + 0x435970]
add eax, edx
dec ebp
mov byte [esi + edi - 1], al
je 0x41b1c2
loop 0x41b0c7
mov ecx, ebp
shr ebp, 2
je 0x41b19d
push ecx
mov eax, dword [esi + ebx]
add esi, 4
mov ebx, eax
and eax, 0xff
mov edx, ebx
and ebx, 0xff00
shr ebx, 8
mov ecx, dword [eax*4 + 0x435970]
mov eax, edx
and edx, 0xff0000
shr eax, 0x18
mov ebx, dword [ebx*4 + 0x435d70]
shr edx, 0x10
mov edi, dword [esi - 4]
add ecx, ebx
mov eax, dword [eax*4 + 0x436570]
add ecx, eax
mov ebx, dword [edx*4 + 0x436170]
mov edx, edi
and edi, 0xff
mov eax, edx
and edx, 0xff00
shr edx, 8
mov edi, dword [edi*4 + 0x434970]
add ecx, ebx
mov ebx, eax
shr ebx, 0x18
mov edx, dword [edx*4 + 0x434d70]
add ecx, edi
and eax, 0xff0000
shr eax, 0x10
mov ebx, dword [ebx*4 + 0x435570]
mov edi, dword [0x436974]
add ecx, edx
mov eax, dword [eax*4 + 0x435170]
add ecx, ebx
mov ebx, dword [0x436970]
add ecx, eax
mov dword [esi + edi - 4], ecx
dec ebp
jne 0x41b0f6
pop ecx
and ecx, 3
je 0x41b1c2
xor eax, eax
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + ebx]
inc esi
mov eax, dword [eax*4 + 0x434970]
mov edx, dword [edx*4 + 0x435970]
add eax, edx
mov byte [esi + edi - 1], al
loop 0x41b1a6
pop esi
mov edx, dword [0x43697c]
mov eax, dword [esp + 0x40]
add esi, edx
dec eax
mov dword [esp + 0x40], eax
jne 0x41b0a5
popal
popfd
ret
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
add ebx, edx
je 0x41b38d
mov edi, 0x434970
call fcn.0041a694
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
add ebx, edx
mov edi, 0x435970
call fcn.0041a694
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
add ebx, eax
mov ecx, pe_nt_image_headers32
mul ecx
div ebx
sub ecx, eax
movd mm4, eax
movd mm5, ecx
punpcklwd mm4, mm4
punpcklwd mm5, mm5
punpckldq mm4, mm4
punpckldq mm5, mm5
pxor mm6, mm6
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
sub edi, esi
sub ebx, esi
mov dword [0x436974], edi
mov dword [0x436970], ebx
xor ecx, ecx
mov ebp, dword [0x436978]
sub ecx, esi
mov edi, dword [0x436974]
push esi
sub ecx, edi
mov ebx, dword [0x436970]
and ecx, 7
je 0x41b2d8
mov eax, ecx
and ecx, 3
je 0x41b2a0
xor eax, eax
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + ebx]
inc esi
mov eax, dword [eax*4 + 0x434970]
mov edx, dword [edx*4 + 0x435970]
add eax, edx
dec ebp
mov byte [esi + edi - 1], al
je 0x41b373
loop 0x41b27d
cmp ebp, 4
jb 0x41b352
test eax, 4
je 0x41b2d8
movd mm0, dword [esi]
movd mm1, dword [esi + ebx]
punpcklbw mm0, mm6
pmullw mm0, mm4
punpcklbw mm1, mm6
pmullw mm1, mm5
add esi, 4
sub ebp, 4
paddw mm0, mm1
psrlw mm0, 8
packuswb mm0, mm6
movd dword [esi + edi - 4], mm0
mov ecx, ebp
shr ecx, 3
je 0x41b31f
movq mm0, qword [esi]
movq mm1, qword [esi + ebx]
movq mm2, mm0
punpckhbw mm0, mm6
movq mm3, mm1
pmullw mm0, mm4
punpckhbw mm1, mm6
pmullw mm1, mm5
punpcklbw mm2, mm6
pmullw mm2, mm4
punpcklbw mm3, mm6
pmullw mm3, mm5
add esi, 8
paddw mm0, mm1
psrlw mm0, 8
paddw mm2, mm3
psrlw mm2, 8
packuswb mm2, mm0
movq qword [esi + edi - 8], mm2
loop 0x41b2df
and ebp, 7
je 0x41b373
sub ebp, 4
jb 0x41b34f
movd mm0, dword [esi]
movd mm1, dword [esi + ebx]
punpcklbw mm0, mm6
pmullw mm0, mm4
punpcklbw mm1, mm6
pmullw mm1, mm5
paddw mm0, mm1
psrlw mm0, 8
packuswb mm0, mm6
movd dword [esi + edi], mm0
je 0x41b373
add esi, 4
and ebp, 3
xor eax, eax
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + ebx]
inc esi
mov eax, dword [eax*4 + 0x434970]
mov edx, dword [edx*4 + 0x435970]
add eax, edx
dec ebp
mov byte [esi + edi - 1], al
jne 0x41b356
pop esi
mov edx, dword [0x43697c]
mov eax, dword [esp + 0x40]
add esi, edx
dec eax
mov dword [esp + 0x40], eax
jne 0x41b254
emms
popal
popfd
ret