Function at 0x40f690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1f0
mov dword [esp + 0x18], ecx
mov ebx, edx
mov ecx, dword [0x4af0c8]
test ecx, ecx
je 0x40fb31
and ecx, 0x8000
xor edx, edx
xor eax, eax
or ecx, eax
or edx, edx
mov al, 2
or ecx, edx
jne 0x40f6e6
mov eax, dword [0x4af0c8]
test eax, eax
je 0x40fb4e
and eax, 0x400
xor ecx, ecx
xor edx, edx
or ecx, ecx
or eax, edx
or eax, ecx
setne al
lea ecx, [ebx - 1]
cmp ecx, 0x40
jae 0x40fb6b
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
movaps xmm1, xmmword [0x457100]
movaps xmm3, xmmword [0x457110]
movaps xmm2, xmmword [0x457120]
mov edx, ebx
xorps xmm0, xmm0
mov dword [esp + 0x14], ebx
or edx, 0x1010000
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x90], xmm0
mov dword [esp + 0xa4], 0x6a09e667
movaps xmmword [esp + 0x1d0], xmm0
movaps xmmword [esp + 0x1c0], xmm0
movaps xmmword [esp + 0x1b0], xmm0
movaps xmmword [esp + 0x1a0], xmm0
movaps xmmword [esp + 0x190], xmm0
movaps xmmword [esp + 0x180], xmm0
movaps xmmword [esp + 0x170], xmm0
movaps xmmword [esp + 0x160], xmm0
xor edx, 0xf3bcc908
mov dword [esp + 0xa0], edx
movups xmmword [esp + 0xa8], xmm1
movups xmmword [esp + 0xb8], xmm3
movups xmmword [esp + 0xc8], xmm2
lea ecx, [edi + ecx*8]
mov dword [esp + 0xd8], 0x137e2179
mov dword [esp + 0xdc], 0x5be0cd19
movaps xmmword [esp + 0xe0], xmm0
mov byte [esp + 0xf0], 0
mov byte [esp + 0xf1], bl
xor ebx, ebx
mov byte [esp + 0xf2], al
mov word [esp + 0xf3], 1
mov dword [esp + 0x1c], ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
mov edx, dword [edi]
mov esi, dword [edi + 4]
test bl, bl
je 0x40f900
mov dword [esp + 0x10], edi
movzx eax, bl
mov edi, pe_nt_image_headers32
sub edi, eax
cmp edi, esi
mov ebx, edi
jb 0x40f833
mov ebx, esi
mov ecx, ebx
add ecx, eax
jb 0x40fb6b
cmp ecx, 0x80
ja 0x40fb6b
lea eax, [esp + eax + 0x20]
push ebx
push edx
push eax
mov dword [esp + 0x18], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esp + 0x18]
add esp, 0xc
movzx eax, byte [esp + 0xf0]
mov ecx, esi
add edx, ebx
sub ecx, ebx
add al, bl
cmp edi, esi
mov byte [esp + 0xf0], al
jae 0x40f910
movzx eax, byte [esp + 0xf3]
mov edi, ecx
movzx ecx, byte [esp + 0xf2]
mov esi, edx
lea edx, [esp + 0x20]
push 1
push eax
push dword [esp + 0xf4]
push dword [esp + 0xf4]
push dword [esp + 0xf4]
push dword [esp + 0xf4]
lea eax, [esp + 0xb8]
push eax
push pe_nt_image_headers32
call fcn.00410c70
mov edx, esi
add esp, 0x20
add dword [esp + 0xe0], 0x80
mov esi, edi
adc dword [esp + 0xe4], 0
adc dword [esp + 0xe8], 0
adc dword [esp + 0xec], 0
xor eax, eax
mov byte [esp + 0xf0], 0
jmp 0x40f912
xor eax, eax
mov ecx, esi
xor ebx, ebx
sub ecx, 1
jae 0x40f91f
jmp 0x40f921
mov esi, ecx
mov edi, dword [esp + 0x10]
mov ecx, esi
xor ebx, ebx
sub ecx, 1
jb 0x40f921
mov ebx, ecx
and ebx, 0xffffff80
je 0x40f9a3
sub esi, ebx
jb 0x40fb6b
mov dword [esp + 0xc], edx
movzx eax, byte [esp + 0xf3]
movzx ecx, byte [esp + 0xf2]
mov edx, dword [esp + 0xc]
push 1
push eax
push dword [esp + 0xf4]
push dword [esp + 0xf4]
push dword [esp + 0xf4]
push dword [esp + 0xf4]
lea eax, [esp + 0xb8]
push eax
push ebx
call fcn.00410c70
mov edx, dword [esp + 0x2c]
add esp, 0x20
add dword [esp + 0xe0], ebx
adc dword [esp + 0xe4], 0
adc dword [esp + 0xe8], 0
adc dword [esp + 0xec], 0
add edx, ebx
movzx eax, byte [esp + 0xf0]
movzx eax, al
mov ebx, pe_nt_image_headers32
sub ebx, eax
cmp ebx, esi
cmovae ebx, esi
mov ecx, ebx
add ecx, eax
jb 0x40fb6b
cmp ecx, 0x80
ja 0x40fb6b
lea eax, [esp + eax + 0x20]
push ebx
push edx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
add edi, 8
add bl, byte [esp + 0xf0]
cmp edi, dword [esp + 0x1c]
mov byte [esp + 0xf0], bl
jne 0x40f810
lea eax, [esp + 0xa0]
cmp bl, 0x81
movsd xmm1, qword [eax + 0x30]
movsd xmm2, qword [eax + 0x28]
movsd xmm0, qword [eax + 0x38]
movsd qword [esp + 0x130], xmm1
movsd xmm1, qword [eax + 0x20]
movsd qword [esp + 0x128], xmm2
movsd xmm2, qword [eax + 0x18]
movsd qword [esp + 0x138], xmm0
movsd qword [esp + 0x120], xmm1
movsd xmm1, qword [eax + 0x10]
movsd qword [esp + 0x118], xmm2
movsd xmm2, qword [eax]
movsd qword [esp + 0x110], xmm1
movsd xmm1, qword [eax + 8]
movsd qword [esp + 0x100], xmm2
movsd qword [esp + 0x108], xmm1
jae 0x40fb6b
movzx esi, byte [esp + 0xf3]
movzx ecx, byte [esp + 0xf2]
movzx eax, bl
lea edi, [esp + 0x100]
lea edx, [esp + 0x20]
push 0
push esi
push dword [esp + 0xf4]
push dword [esp + 0xf4]
push dword [esp + 0xf4]
push dword [esp + 0xf4]
push edi
push eax
call fcn.00410c70
add esp, 0x20
movups xmm0, xmmword [esp + 0x100]
movups xmm1, xmmword [esp + 0x110]
movzx eax, byte [esp + 0xf1]
movups xmm2, xmmword [esp + 0x120]
movups xmmword [esp + 0x160], xmm0
movups xmmword [esp + 0x170], xmm1
movups xmm1, xmmword [esp + 0x130]
cmp eax, 0x41
movups xmmword [esp + 0x180], xmm2
movups xmmword [esp + 0x190], xmm1
mov byte [esp + 0x1a0], al
jae 0x40fb6b
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jne 0x40fb6b
lea eax, [esp + 0x160]
push ecx
push eax
push dword [esp + 0x20]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x150]
call fcn.0042c4e0
mov ecx, 0x8000
and ecx, dword [esp + 0x150]
jmp 0x40f6b9
lea ecx, [esp + 0x140]
call fcn.0042c4e0
mov eax, 0x400
and eax, dword [esp + 0x140]
jmp 0x40f6d9
ud2