Function at 0x406e21
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop es
js 0x406e27
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.00404c49
inc esp
jnp 0x406e7a
sbb byte [ecx - 0x75], cl
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x406e36
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x406e36
call fcn.00404c49
dec ebp
stosd dword es:[edi], eax
into
mov edx, 0x3245a8b
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00404c49
mov ah, byte [edi + 0xf]
sub eax, 0xff0875ff
jne 0x406e7f
add al, 0xff
jne 0x406e7e
push dword [ebp]
call fcn.00405449
in al, 9
add byte [eax], al
movzx eax, al
push 0x2d
cdq
pop ecx
idiv ecx
push 9
pop ecx
mov esi, eax
movzx eax, dl
cdq
idiv ecx
mov ecx, esi
movzx edi, dl
xor edx, edx
mov dword [ebp - 0x3c], edi
inc edx
shl edx, cl
mov ecx, eax
dec edx
mov dword [ebp - 0x1c], edx
xor edx, edx
inc edx
shl edx, cl
lea ecx, [edi + esi]
mov esi, 0x300
shl esi, cl
dec edx
mov dword [ebp - 0x18], edx
add esi, 0x736
lea edi, [esi + esi]
cmp edi, dword [ebp - 0x78]
je 0x406ef5
invalid
cmp dword [ebp - 4], 0
je 0x406ede
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 4], eax
je 0x40786b
mov dword [ebp - 0x78], edi
test esi, esi
je 0x406f05
mov eax, dword [ebp - 4]
dec esi
mov word [eax + esi*2], 0x400
jne 0x406ef9
and dword [ebp - 0x48], 0
and dword [ebp - 0x40], 0
jmp 0x406f35
cmp dword [ebp - 0x6c], 0
je 0x4077bf
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x6c]
mov ecx, eax
mov eax, dword [ebp - 0x70]
shl ecx, 3
movzx eax, byte [eax]
shl eax, cl
or dword [ebp - 0x40], eax
inc dword [ebp - 0x70]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 4
jl 0x406f0f
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x74]
je 0x406f6b
cmp dword [ebp - 8], 0
mov dword [ebp - 0x74], eax
je 0x406f55
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x40]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 8], eax
je 0x40786b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x48], 5
and byte [eax + ecx - 1], 0
jmp 0x406fa0
cmp dword [ebp - 0x6c], 0
je 0x4077ce
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0x6c]
movzx ecx, byte [ecx]
shl eax, 8
or eax, ecx
inc dword [ebp - 0x70]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x48]
test eax, eax
jne 0x406f7f
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x38]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x84], 6
shl ecx, 4
mov dword [ebp - 0x4c], eax
add ecx, eax
mov eax, dword [ebp - 4]
lea esi, [eax + ecx*2]
jmp 0x40763c
mov dword [ebp - 0x54], esi
mov ax, word [esi]
mov ecx, dword [ebp - 0x10]
movzx edx, ax
shr ecx, 0xb
imul ecx, edx
cmp dword [ebp - 0xc], ecx
jae 0x40766b
mov dword [ebp - 0x10], ecx
mov ecx, 0x800
sub ecx, edx
sar ecx, 5
add ecx, eax
and dword [ebp - 0x40], 0
mov word [esi], cx
jmp 0x407684
sub dword [ebp - 0x10], ecx
sub dword [ebp - 0xc], ecx
mov cx, ax
mov dword [ebp - 0x40], 1
shr cx, 5
sub eax, ecx
mov word [esi], ax
cmp dword [ebp - 0x10], 0x1000000
jae 0x4076b2
cmp dword [ebp - 0x6c], 0
je 0x407840
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0xc]
shl dword [ebp - 0x10], 8
movzx ecx, byte [ecx]
dec dword [ebp - 0x6c]
shl eax, 8
or eax, ecx
inc dword [ebp - 0x70]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
jmp 0x406e54
mov dword [ebp - 0x88], 1
jmp 0x407856
mov dword [ebp - 0x88], 3
jmp 0x407856
mov dword [ebp - 0x88], 5
jmp 0x407856
mov edi, dword [ebp - 0x90]
push 0x22
pop ecx
lea esi, [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x40786e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret