Function at 0x401880
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x988
xor ecx, ecx
mov eax, 0x100
push ebx
push esi
push edi
mov esi, dword [esp + 0x99c]
push ebp
mov edx, esi
mov edi, dword [edx]
cmp ecx, edi
jge 0x4018a2
mov ecx, edi
add edx, 4
dec eax
jne 0x40189a
test ecx, ecx
jne 0x4018ff
mov ebx, dword [esp + 0x99c]
push 0x3f4
push ebx
call dword [sym.imp.USER32.dll_Ordinal_254]
mov esi, eax
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_Ordinal_237]
push esi
mov ebp, dword [sym.imp.USER32.dll_Ordinal_249]
call ebp
mov edi, eax
lea ecx, [esp + 0x20]
mov eax, dword [0x40a06c]
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_Ordinal_212]
push edi
mov ebp, dword [sym.imp.USER32.dll_Ordinal_498]
push esi
call ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x988
ret
mov edi, 0xa
cmp ecx, edi
jle 0x40191a
lea eax, [ecx - 1]
sub edx, edx
div edi
lea eax, [eax + eax*4 + 5]
lea edi, [eax*2]
cmp edi, 0xf4240
jle 0x40197a
cmp ecx, 0x3b9aca00
jle 0x401932
add ecx, 0x1dcd6500
jmp 0x401958
cmp ecx, 0x5f5e100
jle 0x401942
add ecx, 0x2faf080
jmp 0x401958
cmp ecx, 0x989680
jle 0x401952
add ecx, 0x4c4b40
jmp 0x401958
add ecx, 0xf4240
mov edi, 0xf4240
mov eax, ecx
cdq
idiv edi
mov edi, eax
shl edi, 6
add edi, eax
lea ecx, [edi + edi*2]
lea edx, [eax + ecx*4]
lea edi, [eax + edx*4]
lea edi, [edi + edi*4]
shl edi, 6
jmp 0x4019c2
cmp edi, 0x3e8
jle 0x4019c2
cmp ecx, 0x186a0
jle 0x401992
add ecx, 0xc350
jmp 0x4019a8
cmp ecx, 0x2710
jle 0x4019a2
add ecx, 0x1388
jmp 0x4019a8
add ecx, 0x3e8
mov edi, 0x3e8
mov eax, ecx
cdq
idiv edi
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea edx, [ecx + ecx*4]
lea edi, [edx*8]
mov ebx, dword [esp + 0x99c]
push edi
push 0x3f3
push ebx
call fcn.00401690
add esp, 0xc
push 0x3f4
push ebx
call dword [sym.imp.USER32.dll_Ordinal_254]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_Ordinal_237]
mov eax, dword [esp + 0x28]
lea ebp, [esp + 0x198]
sub eax, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], edi
fild dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
fstp dword [esp + 0x30]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fstp dword [esp + 0x34]
fld dword [esp + 0x30]
fild dword [esi]
mov eax, ebx
mov edi, dword [esp + 0x14]
add esi, 4
add ebp, 8
fdiv st(1)
cdq
and edx, 0xff
add eax, edx
sar eax, 8
mov dword [ebp - 8], eax
fmul dword [esp + 0x34]
call fcn.00404328
sub edi, eax
add ebx, dword [esp + 0x18]
dec edi
lea eax, [esp + 0x998]
mov dword [ebp - 4], edi
cmp ebp, eax
jb 0x401a31
fstp st(0)
lea ebx, [esp + 0x44]
xor ecx, ecx
mov esi, dword [esp + 0x18]
xor edi, edi
dec esi
mov dword [ebx - 0xc], edi
mov ebp, 0xa
mov dword [ebx - 4], esi
mov eax, ecx
add ebx, 0x10
add ecx, dword [esp + 0x14]
cdq
idiv ebp
mov dword [ebx - 0x10], eax
mov dword [ebx - 0x18], eax
lea eax, [esp + 0xe4]
cmp ebx, eax
jb 0x401a7d
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0xf0]
dec edi
xor ebx, ebx
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], edi
mov dword [esp + 0xd8], 0
mov dword [esp + 0xdc], edi
mov ebp, 0xa
mov eax, ebx
add ecx, 0x10
add ebx, dword [esp + 0x18]
cdq
idiv ebp
mov dword [ecx - 0x10], eax
mov dword [ecx - 0x18], eax
lea eax, [esp + 0x190]
mov dword [ecx - 0x14], 0
mov dword [ecx - 0xc], edi
cmp ecx, eax
jb 0x401ad3
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x190], esi
mov dword [esp + 0x188], esi
push eax
xor esi, esi
mov dword [esp + 0x198], edi
mov dword [esp + 0x190], esi
call dword [sym.imp.USER32.dll_Ordinal_249]
mov edi, eax
lea ecx, [esp + 0x20]
mov eax, dword [0x40a068]
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_Ordinal_212]
mov ecx, dword [0x40a064]
push ecx
push edi
call dword [sym.imp.GDI32.dll_Ordinal_371]
mov ebp, eax
mov ebx, dword [sym.imp.GDI32.dll_Ordinal_351]
lea eax, [esp + esi + 0x38]
push 2
push eax
add esi, 0x10
push edi
call ebx
lea eax, [esp + esi + 0xd8]
push 2
push eax
push edi
call ebx
cmp esi, 0xb0
jl 0x401b52
mov eax, dword [0x40a060]
push eax
push edi
call dword [sym.imp.GDI32.dll_Ordinal_371]
lea eax, [esp + 0x198]
push 0x100
push eax
push edi
call ebx
push ebp
push edi
call dword [sym.imp.GDI32.dll_Ordinal_371]
mov eax, dword [esp + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_Ordinal_498]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x988
ret