Function at 0x40a580
Capabilities:
Create thread
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
fldz
push ebx
xor ebx, ebx
mov dword [esp + 0x10], ebx
xor eax, eax
mov word [esp + 8], ax
xor ecx, ecx
mov word [esp + 0xc], cx
fstp dword [esp + 0x1c]
fldz
push ebp
push esi
xor edx, edx
xor esi, esi
mov word [esp + 0xc], dx
fstp qword [esp + 0x1c]
push edi
mov dword [0x4277ac], ebx
cmp dword [0x425000], ebx
je 0x40a61a
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
movzx eax, word [esp + 0x10]
push ebx
push ebx
push esi
push 0x402490
push ebx
sub eax, 0x1d68f3e9
mov word [esp + 0x24], ax
push ebx
mov dword [esi*4 + 0x4272e8], ebx
call edi
mov cx, word [0x424260]
movsx edx, cx
mov dword [esp + 0x20], edx
inc esi
fild dword [esp + 0x20]
fld dword [0x425df8]
fadd qword [0x41f988]
fsubp st(1)
call fcn.0040af20
mov word [0x424260], ax
cmp esi, dword [0x425000]
jne 0x40a5c4
fld dword [esp + 0x28]
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x18]
movsx ecx, ax
mov dword [esp + 0x28], ecx
movsx eax, dx
fild dword [esp + 0x28]
mov dword [esp + 0x28], eax
faddp st(1)
fild dword [esp + 0x28]
faddp st(1)
call fcn.0040af20
mov word [esp + 0x18], ax
fld dword [0x4234b8]
fsub qword [0x41f980]
fadd dword [0x4230fc]
movzx ecx, word [esp + 0x14]
movsx edx, cx
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fmulp st(1)
call fcn.0040af20
mov word [esp + 0x14], ax
fld dword [0x4230fc]
fld1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
fsub st(1), st(0)
push 0xa
fxch st(1)
fstp dword [0x4230fc]
fadd dword [0x4234b8]
fstp dword [0x4234b8]
movzx eax, word [0x4241bc]
movzx ecx, word [0x425208]
cwde
sub ecx, eax
mov word [0x425208], cx
movzx edx, word [esp + 0x14]
sub edx, 0x786af50e
mov word [esp + 0x14], dx
call edi
inc dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0x24858b7b
sub ecx, eax
add ecx, dword [0x425268]
mov esi, 0x425004
test dword [ebx + ebp], esp
enter 0xd03, 0x68
push edx
inc edx
add byte [esi + 0x425004], bh
mov dword [0x425268], ecx
add byte [edi], cl
mov bh, 0x16
movzx edx, word [esi]
mov eax, dword [edx*4 + 0x4272e8]
push eax
call ebp
movzx ecx, word [esi]
cmp dword [ecx*4 + 0x4272e8], ebx
je 0x40a720
lea esp, [esp]
push 0xa
call edi
movzx edx, word [esi]
cmp dword [edx*4 + 0x4272e8], ebx
jne 0x40a710
movzx eax, word [0x425dfc]
imul eax, eax, 0xb9f2c0a6
add esi, 2
mov word [0x425dfc], ax
cmp esi, 0x42500c
jne 0x40a6f0
call dword [0x4277ac]
pop esi
mov eax, 0x77c8a1ff
nop
ja 0x40a6db
mov ecx, 0xecfe9477
add edx, dword [ecx - 0x267dd159]
mov ecx, dword [edi + 0x26]
mov ebp, 0xe1dcff1d
push esi
cmpsd dword [esi], dword es:[edi]
adc al, 0x4e
jae 0x40a6ef
jecxz 0x40a707
popal
popfd
lcall 0xec3d, 0xa21668c1
rcr dword [eax], cl
jg 0x40a7a1
mov cl, 0x6f
stosd dword es:[edi], eax
dec edi
or byte [ebx], 0xc
call [eax]
clc
mov esp, dword [edi - 0x742e9aac]
add al, 0xa
popfd
and ecx, esi
xchg dword [esi], edx
enter 0x2bfb, 0xffffffffffffffd3
cmp al, 0xd7
add dh, byte [ecx - 0x7f8360ba]
jnp 0x40a7ad
in eax, dx
sbb byte [ebp + 0x52], ah
nop
push esp
ljmp 0x8162
int1
repne lodsd eax, dword [esi]
bound eax, qword [ecx + 0x11ea8e21]
enter 0x2a9f, 0x6d
insd dword es:[edi], dx
cmp al, 0x97
test al, 0xcb
inc esi
xchg ebx, eax
cmc
pop ecx
jnp 0x40a749
fadd dword [esi]
adc byte gs:[ebx + 0x19d0ea7f], al
nop
lodsd eax, dword [esi]
xor byte [eax - 0x5bf71ac], bl
neg byte [edi - 0x68877208]
movsb byte es:[edi], byte [esi]
adc byte [edx + 0x76f8f3eb], 0xfe
mov dl, byte [ecx + 0x20]
mul esp
lcall 0xa86e, 0xd213d780
insd dword es:[edi], dx
inc esp
outsd dx, dword [esi]
xchg ebp, eax
pop ecx
push 0xa23cd
add byte [eax], al
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0x10