Function at 0x425640
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xcc
mov eax, dword [0x572b90]
xor eax, esp
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xd8]
push ebx
mov ebx, dword [esp + 0xd4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x38], eax
mov eax, dword [ebx]
mov dword [esp + 0x2c], ebx
mov dword [eax + 8], 0
mov eax, dword [esp + 0xe4]
mov dword [esp + 0xc], eax
cmp eax, 4
ja 0x425eb0
push esi
push ebx
call fcn.004291f0
mov esi, dword [ebx]
add esp, 4
test eax, eax
jne 0x4256d4
push eax
push dword [esi + 8]
push ebx
call fcn.00429670
add esp, 0xc
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.004c0767
add esp, 0xcc
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esi + 8]
mov dword [esp + 0x20], edx
test eax, eax
jne 0x4256f4
cmp edx, 3
setge al
lea eax, [eax*2 + 1]
mov dword [esp + 0x10], eax
mov ecx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [esp + 0x18], ecx
push ebp
push edi
cmp edx, 3
jne 0x42572b
cmp dword [ebx + 0x47ec], 3
je 0x425720
cmp dword [ebx + 0x47e8], 0
jne 0x42572b
cmp dword [ebx + 0x47e4], 0
jne 0x42572b
mov ebp, 1
mov dword [esp + 0x30], ebp
jmp 0x425736
xor ebp, ebp
mov dword [esp + 0x30], ebp
cmp edx, 3
jne 0x425749
cmp eax, 3
jge 0x425749
test ebp, ebp
jne 0x425749
mov dword [esp + 0x28], 1
jmp 0x425757
mov ecx, esi
test edx, edx
jle 0x425842
mov ecx, dword [esp + 0x20]
lea edi, [ebx + 0x46a0]
mov dword [esp + 0x10], 0
lea ebp, [esp + 0x64]
mov dword [esp + 0x1c], edi
nop dword [eax]
mov eax, dword [ebx]
mov eax, dword [eax]
add eax, 3
push eax
call ecx
add esp, 4
mov dword [edi + 0x34], eax
test eax, eax
je 0x4258a9
mov eax, dword [ebx + 0x4684]
cdq
idiv dword [edi]
mov dword [ebp + 0x10], 0
mov esi, eax
mov eax, dword [ebx + 0x4688]
cdq
idiv dword [edi + 4]
xor edx, edx
mov dword [ebp], esi
mov edi, eax
mov ecx, eax
mov dword [ebp + 4], edi
sar ecx, 1
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebx]
mov eax, dword [ecx]
dec eax
add eax, esi
div esi
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x28]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp esi, 1
jne 0x4257ef
cmp edi, esi
jne 0x4257de
mov eax, 0x425ee0
jmp 0x425816
mov esi, 1
cmp edi, 2
jne 0x425800
mov eax, 0x431ce0
jmp 0x425816
cmp esi, 2
jne 0x425811
cmp edi, 1
jne 0x425800
mov eax, 0x4319b0
jmp 0x425816
cmp esi, 2
jne 0x425811
cmp edi, esi
jne 0x425811
mov eax, dword [ebx + 0x4814]
jmp 0x425816
mov eax, 0x431960
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
inc esi
mov ecx, dword [esp + 0x20]
add edi, 0x48
mov dword [ebp - 0xc], eax
add ebp, 0x20
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], edi
cmp esi, dword [esp + 0x28]
jl 0x425770
mov esi, dword [ebx]
mov ecx, esi
mov ebp, dword [esp + 0x18]
mov eax, ecx
mov edi, dword [esi + 4]
mov esi, dword [esi]
test ebp, ebp
js 0x4258b6
test esi, esi
js 0x4258b6
je 0x425863
mov eax, 0x7fffffff
cdq
idiv esi
cmp ebp, eax
jg 0x4258b8
mov eax, esi
mov edx, ecx
imul eax, ebp
mov dword [esp + 0x2c], eax
test eax, eax
js 0x4258b2
test edi, edi
js 0x4258b2
je 0x425886
mov eax, 0x7fffffff
cdq
idiv edi
cmp dword [esp + 0x2c], eax
jg 0x4258b8
imul esi, edi
imul esi, ebp
cmp esi, 0x7ffffffe
jg 0x4258b8
lea eax, [esi + 1]
push eax
call dword [esp + 0x24]
mov ecx, dword [ebx]
add esp, 4
mov edi, eax
mov dword [esp + 0x20], eax
jmp 0x4258be
mov eax, dword [ebx]
push 0
push dword [eax + 8]
jmp 0x4258c6
mov ecx, edx
jmp 0x4258b8
mov ecx, eax
xor edi, edi
mov dword [esp + 0x20], edi
test edi, edi
jne 0x4258f4
push edi
push dword [ecx + 8]
push ebx
call fcn.00429670
add esp, 0xc
mov dword [0x575ec0], 0x4ca240
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.004c0767
add esp, 0xcc
ret
xor eax, eax
mov dword [esp + 0x2c], eax
cmp dword [ecx + 4], eax
jbe 0x425e6a
mov ebp, dword [esp + 0x48]
mov esi, dword [ecx]
mov edx, dword [esp + 0x18]
imul esi, eax
mov dword [esp + 0x10], 0
imul esi, edx
add esi, edi
cmp dword [esp + 0x28], 0
jle 0x4259b0
lea ebp, [ebx + 0x46bc]
mov ebx, dword [esp + 0x28]
lea edi, [esp + 0x70]
mov eax, dword [edi - 8]
sar eax, 1
cmp dword [edi], eax
jl 0x425944
mov edx, dword [edi - 0x14]
jmp 0x425947
mov edx, dword [edi - 0x10]
jl 0x42594e
mov eax, dword [edi - 0x10]
jmp 0x425951
mov eax, dword [edi - 0x14]
push dword [edi - 0xc]
push dword [edi - 4]
push edx
push eax
push dword [ebp + 0x18]
call dword [edi - 0x18]
mov edx, dword [esp + 0x24]
add esp, 0x14
mov dword [esp + edx*4 + 0x48], eax
mov eax, dword [edi]
inc eax
mov dword [edi], eax
cmp eax, dword [edi - 8]
jl 0x425993
inc dword [edi + 4]
mov eax, dword [edi + 4]
mov ecx, dword [edi - 0x10]
mov dword [edi], 0
mov dword [edi - 0x14], ecx
cmp eax, dword [ebp]
jge 0x425993
mov eax, dword [ebp + 4]
add eax, ecx
mov dword [edi - 0x10], eax
inc edx
add edi, 0x20
add ebp, 0x48
mov dword [esp + 0x10], edx
cmp edx, ebx
jl 0x425936
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x48]
mov edx, dword [esp + 0x18]
mov ecx, dword [ebx]
cmp edx, 3
jl 0x425bf4
mov eax, dword [ecx + 8]
cmp eax, 3
jne 0x425a43
cmp dword [esp + 0x30], 0
je 0x425a24
xor edi, edi
cmp dword [ecx], edi
jbe 0x425bed
mov ecx, dword [esp + 0x4c]
add esi, 2
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], ebp
sub ebp, ecx
sub eax, ecx
mov dword [esp + 0x10], eax
nop dword [eax]
movzx eax, byte [ecx + ebp]
lea ecx, [ecx + 1]
mov byte [esi - 2], al
inc edi
movzx eax, byte [ecx - 1]
mov byte [esi - 1], al
mov eax, dword [esp + 0x10]
movzx eax, byte [eax + ecx - 1]
mov byte [esi], al
mov byte [esi + 1], 0xff
add esi, edx
mov eax, dword [ebx]
cmp edi, dword [eax]
jb 0x4259f0
mov ebp, dword [esp + 0x48]
mov ecx, eax
jmp 0x425e54
mov eax, dword [ebx + 0x4810]
push edx
push dword [ecx]
push dword [esp + 0x58]
push dword [esp + 0x58]
push ebp
push esi
call eax
mov ecx, dword [ebx]
add esp, 0x18
jmp 0x425e54
cmp eax, 4
jne 0x425bca
mov eax, dword [ebx + 0x47e8]
test eax, eax
jne 0x425b09
mov dword [esp + 0x10], eax
cmp dword [ecx], eax
jbe 0x425bed
mov edx, dword [esp + 0x54]
mov eax, ebp
mov ecx, dword [esp + 0x4c]
sub eax, edx
mov edi, dword [esp + 0x18]
sub ecx, edx
mov dword [esp + 0x34], ecx
add esi, 2
mov ecx, dword [esp + 0x50]
mov ebp, edx
sub ecx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ecx
nop
movzx ecx, byte [eax + ebp]
lea ebp, [ebp + 1]
movzx edx, byte [ebp - 1]
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + ebp - 1]
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi - 1], al
mov eax, dword [esp + 0x24]
movzx ecx, byte [eax + ebp - 1]
imul ecx, edx
mov byte [esi + 1], 0xff
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
mov ecx, dword [esp + 0x10]
shr eax, 8
inc ecx
mov byte [esi], al
add esi, edi
mov eax, dword [ebx]
mov dword [esp + 0x10], ecx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x14]
jb 0x425a90
mov ebp, dword [esp + 0x48]
mov ecx, dword [ebx]
jmp 0x425e54
mov ecx, dword [ecx]
mov edi, dword [ebx + 0x4810]
push edx
push ecx
push dword [esp + 0x58]
push dword [esp + 0x58]
push ebp
push esi
cmp eax, 2
jne 0x425bbe
call edi
mov eax, dword [ebx]
add esp, 0x18
mov dword [esp + 0x14], 0
cmp dword [eax], 0
jbe 0x425bed
mov edi, dword [esp + 0x18]
add esi, 2
mov ebp, dword [esp + 0x14]
nop dword [eax]
mov eax, dword [esp + 0x54]
movzx edx, byte [eax + ebp]
inc ebp
movzx eax, byte [esi - 2]
not al
movzx ecx, al
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi - 2], al
movzx eax, byte [esi - 1]
not al
movzx ecx, al
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi - 1], al
movzx eax, byte [esi]
not al
movzx ecx, al
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi], al
add esi, edi
mov eax, dword [ebx]
cmp ebp, dword [eax]
jb 0x425b50
mov ebp, dword [esp + 0x48]
mov ecx, eax
jmp 0x425e54
call edi
mov ecx, dword [ebx]
add esp, 0x18
jmp 0x425e54
xor edx, edx
cmp dword [ecx], edx
jbe 0x425bed
mov edi, dword [esp + 0x18]
inc esi
mov al, byte [edx + ebp]
inc edx
mov byte [esi + 1], al
mov byte [esi], al
mov byte [esi - 1], al
mov byte [esi + 2], 0xff
add esi, edi
mov eax, dword [ebx]
cmp edx, dword [eax]
jb 0x425bd5
mov ecx, dword [ebx]
jmp 0x425e54
cmp dword [esp + 0x30], 0
je 0x425cd1
mov eax, dword [ecx]
xor edi, edi
cmp edx, 1
jne 0x425c6b
test eax, eax
je 0x425e54
mov eax, dword [esp + 0x4c]
mov edx, ebp
sub eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
sub eax, ebp
sub esi, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], eax
nop dword [eax]
movzx eax, byte [eax + edx]
lea edx, [edx + 1]
imul ecx, eax, 0x1d
inc edi
movzx eax, byte [edx + ebp - 1]
imul eax, eax, 0x96
add ecx, eax
movzx eax, byte [edx - 1]
imul eax, eax, 0x4d
add ecx, eax
mov eax, dword [esp + 0x24]
shr ecx, 8
mov byte [esi + edx - 1], cl
mov ecx, dword [ebx]
cmp edi, dword [ecx]
jb 0x425c30
mov ebp, dword [esp + 0x48]
jmp 0x425e54
test eax, eax
je 0x425e54
mov eax, dword [esp + 0x4c]
mov edx, ebp
sub eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
sub eax, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], eax
nop dword [eax]
movzx eax, byte [edx + eax]
lea edx, [edx + 1]
imul ecx, eax, 0x1d
lea esi, [esi + 2]
movzx eax, byte [edx + ebp - 1]
inc edi
imul eax, eax, 0x96
add ecx, eax
movzx eax, byte [edx - 1]
imul eax, eax, 0x4d
mov byte [esi - 1], 0xff
add ecx, eax
mov eax, dword [esp + 0x24]
shr ecx, 8
mov byte [esi - 2], cl
mov ecx, dword [ebx]
cmp edi, dword [ecx]
jb 0x425c90
mov ebp, dword [esp + 0x48]
jmp 0x425e54
cmp dword [ecx + 8], 4
jne 0x425e0d
mov eax, dword [ebx + 0x47e8]
test eax, eax
jne 0x425db6
mov dword [esp + 0x10], eax
cmp dword [ecx], eax
jbe 0x425e54
mov ecx, dword [esp + 0x54]
mov edi, ebp
mov eax, dword [esp + 0x4c]
sub edi, ecx
sub eax, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov edx, ecx
mov eax, dword [esp + 0x50]
sub eax, ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], eax
nop dword [eax + eax]
movzx eax, byte [edx]
mov ecx, dword [esp + 0x14]
movzx edi, byte [edx + edi]
mov ebp, dword [esp + 0x24]
imul edi, eax
movzx ecx, byte [edx + ecx]
imul ecx, eax
movzx edx, byte [edx + ebp]
imul edx, eax
sub edi, 0xffffff80
mov byte [esi + 1], 0xff
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
sub edx, 0xffffff80
add eax, ecx
shr eax, 8
movzx eax, al
imul ecx, eax, 0x96
mov eax, edx
shr eax, 8
add eax, edx
mov edx, dword [esp + 0x1c]
shr eax, 8
inc edx
movzx eax, al
imul eax, eax, 0x1d
mov dword [esp + 0x1c], edx
add ecx, eax
mov eax, edi
shr eax, 8
add eax, edi
mov edi, dword [esp + 0x34]
shr eax, 8
movzx eax, al
imul eax, eax, 0x4d
add ecx, eax
mov eax, dword [esp + 0x10]
shr ecx, 8
inc eax
mov byte [esi], cl
mov ecx, dword [ebx]
add esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
cmp eax, dword [ecx]
jb 0x425d20
mov ebp, dword [esp + 0x48]
jmp 0x425e54
cmp eax, 2
jne 0x425e0d
xor edi, edi
cmp dword [ecx], edi
jbe 0x425e54
mov edx, dword [esp + 0x54]
mov eax, ebp
mov ebp, dword [esp + 0x18]
sub eax, edx
mov dword [esp + 0x14], eax
mov al, byte [edx + eax]
lea edx, [edx + 1]
not al
inc edi
movzx ecx, al
movzx eax, byte [edx - 1]
imul ecx, eax
mov byte [esi + 1], 0xff
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi], al
add esi, ebp
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
cmp edi, dword [ecx]
jb 0x425dd5
mov ebp, dword [esp + 0x48]
jmp 0x425e54
mov eax, dword [ecx]
cmp edx, 1
jne 0x425e32
xor edx, edx
test eax, eax
je 0x425e54
mov edi, ebp
sub edi, esi
nop
mov al, byte [edi + esi]
lea esi, [esi + 1]
mov byte [esi - 1], al
inc edx
mov ecx, dword [ebx]
cmp edx, dword [ecx]
jb 0x425e20
jmp 0x425e54
xor edx, edx
test eax, eax
je 0x425e54
nop dword [eax + eax]
mov al, byte [edx + ebp]
lea esi, [esi + 2]
mov byte [esi - 2], al
inc edx
mov byte [esi - 1], 0xff
mov ecx, dword [ebx]
cmp edx, dword [ecx]
jb 0x425e40
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [ecx + 4]
jb 0x425907
push 0
push dword [ecx + 8]
push ebx
call fcn.00429670
mov eax, dword [ebx]
add esp, 0xc
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, dword [esp + 0x40]
mov eax, dword [eax + 4]
mov dword [ecx], eax
test edx, edx
je 0x425ea9
mov eax, dword [ebx]
xor ecx, ecx
cmp dword [eax + 8], 3
setge cl
lea ecx, [ecx*2 + 1]
mov dword [edx], ecx
mov eax, edi
jmp 0x4258db
mov ecx, dword [esp + 0xcc]
xor eax, eax
pop ebx
xor ecx, esp
mov dword [0x575ec0], 0x4ca2f8
call fcn.004c0767
add esp, 0xcc
ret