Function at 0x4225d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x234
mov eax, dword [0x47c600]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x238]
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
push edi
push 0x2c
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], 0
call fcn.004096f2
mov esi, dword [esp + 0x258]
add esp, 4
mov edi, dword [esp + 0x250]
xor ebx, ebx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esp + 0x1c], eax
nop
push str.dsdsww
push 0x47e2c8
call fcn.00401660
push eax
call fcn.00402010
push str.size_of_vector
push 0x47e2c8
mov byte [esp + ebx + 0x54], bl
call fcn.00401660
push eax
call fcn.00402010
mov eax, ebx
add esp, 0x18
cdq
idiv esi
mov al, byte [edx + edi]
mov byte [esp + ebx + 0x140], al
inc ebx
cmp ebx, 0x100
jl 0x422630
xor esi, esi
xor edi, edi
nop dword [eax]
mov bl, byte [esp + esi + 0x40]
movzx eax, byte [esp + esi + 0x140]
add edi, eax
movzx ecx, bl
add edi, ecx
and edi, 0x800000ff
jns 0x4226a3
dec edi
or edi, 0xffffff00
inc edi
push str.regwgrrwr
push 0x47e2c8
call fcn.00401660
push eax
call fcn.00402010
mov al, byte [esp + edi + 0x4c]
add esp, 0xc
mov byte [esp + esi + 0x40], al
inc esi
mov byte [esp + edi + 0x40], bl
cmp esi, 0x100
jl 0x422680
xor edi, edi
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x14], edi
test ebp, ebp
jle 0x422852
inc eax
and eax, 0x800000ff
jns 0x4226f1
dec eax
or eax, 0xffffff00
inc eax
mov bl, byte [esp + eax + 0x40]
movzx esi, bl
add ecx, esi
mov dword [esp + 0x10], eax
and ecx, 0x800000ff
jns 0x42270e
dec ecx
or ecx, 0xffffff00
inc ecx
push 0
push 0
push 0
mov dword [esp + 0x24], ecx
call dword [sym.imp.USER32.dll_OffsetRect]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push 0
push 0
movzx eax, byte [esp + edx + 0x48]
mov byte [esp + ecx + 0x48], al
push 0
mov byte [esp + edx + 0x4c], bl
call dword [sym.imp.GDI32.dll_Polyline]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
movzx eax, byte [esp + eax + 0x40]
add eax, esi
movzx eax, al
add eax, ecx
lea ecx, [esp + 0x30]
push eax
push 0
call fcn.004019f0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0
push eax
push 0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call fcn.00401ba0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x30]
add ecx, dword [edx]
movzx eax, byte [esi]
xor byte [ecx], al
mov eax, edx
mov ecx, dword [esp + 0x2c]
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4227d9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42288c
push ecx
push edx
call fcn.00409722
mov eax, dword [esp + 0x40]
add esp, 8
sub eax, esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov ecx, esi
mov dword [esp + 0x2c], 0
cmp eax, 0x1000
jb 0x42281a
mov esi, dword [ecx - 4]
add eax, 0x23
sub ecx, esi
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x42288c
push eax
push esi
call fcn.00409722
inc edi
mov dword [esp + 0x38], 0
add esp, 8
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x14], edi
cmp edi, ebp
jge 0x422852
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
jmp 0x4226e2
mov eax, dword [esp + 0x1c]
push dword [eax + 4]
lea eax, [esp + 0x20]
push eax
mov ecx, eax
call fcn.00401ed0
push 0x2c
push dword [esp + 0x20]
call fcn.00409722
mov ecx, dword [esp + 0x248]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409a3b
add esp, 0x234
ret
call fcn.0040e04f
int3