Function at 0x491eab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edx, [eax + 3]
shr edx, 3
cmp eax, 0xa2c
push ebx
mov ah, byte [eax + 0xb05d]
ja 0x49210b
test cl, cl
movzx eax, byte [edx + 0x64b994]
lea ebx, [eax*8 + 0xa35080]
jne 0x491ed5
mov edx, dword [ebx + 8]
mov eax, dword [edx + 0x10]
mov ecx, 0xfffffff8
cmp edx, ebx
je 0x491efb
add dword [edx + 0x14], 1
and ecx, dword [eax - 4]
mov esp, 0x5000104a
cld
je 0x491f1b
mov byte [ebx], 0
pop ebx
ret
mov edx, dword [ebx + 0x18]
movzx ecx, word [ebx + 2]
add ecx, eax
cmp eax, dword [ebx + 0x55]
ja 0x491f7f
add byte [edx + 0x14], al
add dword [ecx + 0x3c6104b], ecx
add byte [ecx - 0x3ca403b0], cl
nop
nop
nop
mov ecx, dword [edx + 8]
mov dword [ecx + 0xc], ebx
mov ebx, ecx
or dh, al
add byte [eax], al
pop ebx
ret
add byte [edi - 0x80], dl
cmp eax, 0x64b05d
add byte [ecx + edi - 0x48], dh
add byte [ecx], al
add byte [eax], al
mov eax, pe_nt_image_headers32
lock cmpxchg byte [0x64baec], ah
je 0x491fc3
pause
and byte [ebx + 0xb98d], 0
jne 0x491f8a
push 0
call fcn.0049180f
mov eax, pe_nt_image_headers32
lock cmpxchg byte [0x64baec], ah
je 0x491fc3
push 0xa
call 0x149187e
jmp 0x491f8a
movsx esi, byte [ebx + 1]
and esi, dword [0x64baf8]
je 0x49203f
bsf eax, esi
lea esi, [eax*8]
mov ecx, dword [eax*4 - 0x5f9b4504]
bsf eax, dword [eax]
lea ecx, [ecx + esi*4]
lea edi, [ecx*8 + 0x64bb7c]
mov esi, dword [edi + 4]
mov edx, dword [esi + 4]
mov dword [edi + 4], edx
mov dword [edx], edi
cmp edi, edx
jne 0x492013
mov edx, 0xfffffffe
sar ebx, cl
and dword [eax + eax], edx
cld
mov edx, 0x7750064
btr dword [0x64baf8], eax
mov edi, 0xfffffff0
and edi, dword [esi - 4]
cmp edi, 0x10a60
jb 0x49208f
mov edx, edi
invalid
movzx ecx, word [ebx + 4]
mov edi, dword [0x64baf4]
cmp edi, ecx
and dword [esi], 0xbaf0008b
add byte fs:[edi], cl
mov bh, 0x4b
push es
lea edx, [ecx + 0xb30]
cmp edi, edx
jb 0x492063
mov edi, ecx
sub esi, edi
sub dword [0x64baf4], edi
mov dword [0x64baf0], esi
mul byte [ecx]
sldt word [ebx + 6]
mov edi, eax
call fcn.00491b8f
mov esi, eax
test eax, eax
jne 0x492094
mov byte [0x64baec], al
mov byte [ebx], al
pop edi
pop esi
pop ebx
ret
and byte [edi + esi - 4], 0xf7
lea ecx, [edi + 6]
mov dword [edx], edx
cld
xor dword [eax], eax
mov byte [0x64baec], al
mov dword [esi], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 1
mov dword [ebx + 0x18], esi
lea eax, [esi + 0x20]
movzx ecx, word [ebx + 2]
lea edx, [ecx + eax]
mov dword [ebx + 0x10], edx
add edi, esi
sub dword [edx - 0x77], esp
jnp 0x4920c4
mov byte [ebx], 0
mov dword [eax - 4], esi
pop edi
pop esi
pop ebx
ret
mov eax, pe_nt_image_headers32
lock cmpxchg byte [0x64baec], ah
je 0x492129
pause
cmp byte [0x64b98d], 0
jne 0x4920cf
lodsd eax, dword [esi]
add al, ch
add bh, dh
invalid
cmp eax, 0x40a2c
ja 0x495523
add byte [eax + 0xd3], bl
and ebx, 0xffffff00
add ebx, 0x30
test cl, cl
jne 0x4920cf
lea edx, [ebx - 0xb30]
mov ecx, edx
shr edx, 0xd
shr ecx, 8
mov eax, 0xffffffff
shl eax, cl
bound eax, qword [edx*4 + 0x64ba00]
je 0x492153
and ecx, 0xffffffe0
bsf eax, eax
or ecx, eax
jmp 0x4921af
mov eax, 0xfffffffe
mov ecx, edx
shl eax, cl
and eax, dword [0x64baf8]
je 0x49217b
bsf edx, eax
mov eax, dword [edx*4 + 0x64ba7c]
bsf ecx, eax
mov eax, edx
shl eax, 5
or ecx, eax
jmp 0x4921af
mov ecx, dword [0x64baf4]
sub ecx, ebx
jb 0x49219f
mov eax, dword [0x64baf0]
sub eax, ebx
mov dword [0x64baf0], eax
mov dword [0x64baf4], ecx
ror bl, cl
add al, byte [eax]
pop eax
cld
jmp 0x4921a6
mov eax, ebx
call fcn.00491b8f
mov byte [0x64baec], 0
pop ebx
ret
push esi
push edi
lea edi, [ecx*8 + 0x64bb7c]
mov esi, dword [edi + 4]
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov dword [eax], edi
cmp edi, eax
cmp edx, dword [edi]
mov eax, 0xffffff00
rol eax, cl
and dword [edx*4 + 0x64bafc], eax
jne 0x4921de
btr dword [0x64baf8], edx
mov edi, 0xfffffff0
and edi, dword [esi - 4]
mov edx, edi
sub edx, ebx
je 0x49220b
lea eax, [ebx + esi]
lea ecx, [edx + 3]
mov dword [eax - 0x56], ecx
mov dword [eax + eax - 8], edx
cmp edx, 0xb30
jb 0x492210
call fcn.00491ac3
jmp 0x492210
and byte [edi + esi - 4], 0xf7
lea ecx, [ebx + 2]
mov dword [esi - 4], ecx
mov byte [0x64baec], 0
mov eax, esi
pop edi
pop esi
pop ebx
ret
ret
jl 0x495521
invalid