Function at 0x6c355194
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8fc
mov dword [ebp - 0x8d0], eax
mov dword [ebp - 0x8b8], edx
mov dword [ebp - 0x8c0], ecx
test edx, edx
jne 0x6c3551cc
mov eax, dword [ebp + 8]
imul eax, ecx
imul eax, dword [ebp + 0xc]
cmp eax, dword [0x6c39003c]
jl 0x6c35556a
mov edx, dword [ebp - 0x8d0]
mov eax, dword [edx]
mov dword [esp], eax
call sym.libgdk_win32_2.0_0.dll_gdk_visual_get_screen
mov esi, eax
mov ecx, dword [ebp - 0x8d0]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x8b4], ecx
test ecx, ecx
je 0x6c35578c
xor eax, eax
lea edx, [ebp - 0x894]
lea ebx, [ebp - 0x494]
nop
mov dword [edx + eax*4], 0xc0
mov dword [ebx + eax*4], 0x100
inc eax
cmp eax, 0x100
jne 0x6c355204
mov dword [esp], esi
call sym.libgdk_win32_2.0_0.dll_gdk_screen_get_system_colormap
mov dword [ebp - 0x8ac], eax
mov edx, dword [ebp - 0x8b4]
cmp eax, edx
je 0x6c355577
mov ecx, dword [ebp - 0x8c0]
dec ecx
mov dword [ebp - 0x8a0], ecx
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp - 0x8a4], eax
mov edx, dword [ebp + 0xc]
dec edx
mov dword [ebp - 0x8a8], edx
mov ecx, dword [ebp - 0x8c0]
test ecx, ecx
jle 0x6c355397
mov dword [ebp - 0x8ac], 0
mov dword [ebp - 0x8bc], 0
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
jle 0x6c355375
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0x8b0], 0
nop
mov edx, dword [ebp + 0xc]
test edx, edx
jle 0x6c355356
mov esi, ecx
xor edi, edi
jmp 0x6c3552c4
inc esi
add edi, 0xffff
mov eax, esi
sub eax, ecx
cmp dword [ebp + 0xc], eax
jle 0x6c355354
cmp dword [ebx + esi*4], 0x100
jne 0x6c3552b0
mov eax, dword [ebp - 0x8ac]
cdq
idiv dword [ebp - 0x8a0]
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x89c]
cdq
idiv dword [ebp - 0x8a4]
mov word [ebp - 0x1e], ax
mov eax, edi
cdq
idiv dword [ebp - 0x8a8]
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x8b8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea edx, [ebp - 0x24]
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x8b4]
mov dword [esp], eax
mov dword [ebp - 0x8d4], ecx
call sym.libgdk_win32_2.0_0.dll_gdk_colormap_alloc_color
test eax, eax
mov ecx, dword [ebp - 0x8d4]
je 0x6c35551c
mov eax, dword [ebp - 0x24]
mov dword [ebx + esi*4], eax
inc esi
add edi, 0xffff
mov eax, esi
sub eax, ecx
cmp dword [ebp + 0xc], eax
jg 0x6c3552c4
lea esi, [esi]
mov ecx, esi
inc dword [ebp - 0x8b0]
add dword [ebp - 0x89c], 0xffff
mov edx, dword [ebp - 0x8b0]
cmp dword [ebp + 8], edx
jg 0x6c35529c
inc dword [ebp - 0x8bc]
add dword [ebp - 0x8ac], 0xffff
mov eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0x8c0], eax
jg 0x6c35527b
mov ecx, dword [ebp - 0x8c0]
mov edx, dword [ebp - 0x8d0]
mov dword [edx + 8], ecx
mov eax, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x10], ecx
mov dword [esp], 0x1000
call sym._g_malloc
mov edx, dword [ebp - 0x8d0]
mov dword [edx + 0x64], eax
mov cl, byte [ebp + 0xc]
mov byte [ebp - 0x89c], cl
mov al, cl
mul byte [ebp + 8]
mov byte [ebp - 0x8b8], al
imul edx, dword [ebp - 0x8a0], 0x11
mov dword [ebp - 0x8b4], edx
imul ecx, dword [ebp - 0x8a4], 0x11
mov dword [ebp - 0x8ac], ecx
imul eax, dword [ebp - 0x8a8], 0x11
mov dword [ebp - 0x8b0], eax
mov ebx, pe_nt_image_headers32
mov esi, pe_nt_image_headers32
mov edi, pe_nt_image_headers32
xor edx, edx
mov ecx, edi
sar ecx, 8
mov al, byte [ebp - 0x8b8]
mul cl
mov byte [ebp + edx - 0x34], al
mov ecx, esi
sar ecx, 8
mov al, byte [ebp - 0x89c]
mul cl
mov byte [ebp + edx - 0x44], al
mov eax, ebx
sar eax, 8
mov byte [ebp + edx - 0x94], al
inc edx
add edi, dword [ebp - 0x8b4]
add esi, dword [ebp - 0x8ac]
add ebx, dword [ebp - 0x8b0]
cmp edx, 0x10
jne 0x6c355413
xor eax, eax
mov edi, dword [ebp - 0x8d0]
lea esi, [esi]
mov ecx, dword [edi + 0x64]
mov edx, eax
and edx, 0xf
movzx esi, byte [ebp + edx - 0x94]
mov edx, eax
sar edx, 8
movzx ebx, byte [ebp + edx - 0x34]
mov edx, eax
sar edx, 4
and edx, 0xf
movzx edx, byte [ebp + edx - 0x44]
lea ebx, [esi + ebx]
add ebx, edx
mov edx, dword [ebp + ebx*4 - 0x494]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x1000
jne 0x6c355464
mov dword [esp], 0x200
call sym._g_malloc
mov edx, dword [ebp - 0x8d0]
mov dword [edx + 0x68], eax
xor eax, eax
mov edi, edx
nop
mov ebx, eax
sar ebx, 6
cmp ebx, dword [ebp - 0x8a0]
jle 0x6c3554cf
mov ebx, dword [ebp - 0x8a0]
mov edx, eax
sar edx, 3
and edx, 7
cmp dword [ebp + 8], edx
jg 0x6c3554e2
mov edx, dword [ebp - 0x8a4]
mov ecx, eax
and ecx, 7
cmp dword [ebp + 0xc], ecx
jg 0x6c3554f2
mov ecx, dword [ebp - 0x8a8]
mov esi, dword [edi + 0x68]
imul ebx, dword [ebp + 8]
lea ebx, [edx + ebx]
imul ebx, dword [ebp + 0xc]
lea ebx, [ecx + ebx]
mov edx, dword [ebp + ebx*4 - 0x494]
mov byte [esi + eax], dl
inc eax
cmp eax, 0x200
jne 0x6c3554bc
mov ax, 1
jmp 0x6c35555f
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x14], edx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x10], ecx
mov eax, dword [ebp - 0x8c0]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._d__d__d_colormap_failed_n
mov dword [esp + 4], 0x50
lea eax, [ebp - 0x94]
mov dword [esp], eax
call sym._g_snprintf
mov edx, ebx
mov eax, dword [ebp - 0x8b4]
call sym._gdk_rgb_cmap_fail
add esp, 0x8fc
pop ebx
pop esi
pop edi
leave
ret
xor eax, eax
add esp, 0x8fc
pop ebx
pop esi
pop edi
leave
ret
mov ecx, dword [ebp - 0x8b4]
mov esi, dword [ecx + 0xc]
test esi, esi
jle 0x6c3557b1
mov eax, dword [ebp - 0x8c0]
dec eax
mov dword [ebp - 0x8a0], eax
mov edx, dword [ebp + 8]
dec edx
mov dword [ebp - 0x8a4], edx
mov ecx, dword [ebp + 0xc]
dec ecx
mov dword [ebp - 0x8a8], ecx
mov dword [ebp - 0x8bc], 0
mov dword [ebp - 0x8cc], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x8dc], eax
jmp 0x6c355656
mov edi, dword [ebp - 0x8dc]
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea ecx, [ebp - 0x24]
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x8ac]
mov dword [esp], eax
mov dword [ebp - 0x8d4], edx
call sym.libgdk_win32_2.0_0.dll_gdk_colormap_alloc_color
test eax, eax
mov edx, dword [ebp - 0x8d4]
je 0x6c35579f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x8b0]
mov dword [ebp + ecx*4 - 0x494], eax
mov dword [ebp + ecx*4 - 0x894], edx
inc dword [ebp - 0x8cc]
add dword [ebp - 0x8bc], 0xc
mov edx, dword [ebp - 0x8ac]
mov eax, dword [edx + 0xc]
cmp eax, 0x100
jle 0x6c35564a
mov eax, 0x100
cmp eax, dword [ebp - 0x8cc]
jle 0x6c355257
mov esi, dword [ebp - 0x8bc]
mov edx, dword [ebp - 0x8ac]
add esi, dword [edx + 0x10]
movzx ecx, byte [esi + 5]
mov dword [ebp - 0x89c], ecx
movzx eax, byte [esi + 7]
mov dword [ebp - 0x8c4], eax
movzx edx, byte [esi + 9]
mov dword [ebp - 0x8c8], edx
mov edx, dword [ebp - 0x8a0]
imul edx, ecx
sub edx, 0xffffff80
sar edx, 8
mov ecx, dword [ebp - 0x8a4]
imul ecx, eax
sub ecx, 0xffffff80
sar ecx, 8
mov edi, dword [ebp - 0x8a8]
imul edi, dword [ebp - 0x8c8]
sub edi, 0xffffff80
sar edi, 8
mov eax, dword [ebp - 0x8c0]
imul eax, edx
add eax, ecx
imul eax, dword [ebp + 0xc]
add eax, edi
mov dword [ebp - 0x8b0], eax
mov eax, edx
shl eax, 8
sub eax, edx
cdq
idiv dword [ebp - 0x8a0]
mov edx, dword [ebp - 0x89c]
sub edx, eax
mov dword [ebp - 0x89c], edx
mov eax, ecx
shl eax, 8
sub eax, ecx
cdq
idiv dword [ebp - 0x8a4]
mov ecx, dword [ebp - 0x8c4]
sub ecx, eax
mov eax, edi
shl eax, 8
sub eax, edi
cdq
idiv dword [ebp - 0x8a8]
mov edx, dword [ebp - 0x8c8]
sub edx, eax
imul ecx, ecx
mov eax, dword [ebp - 0x89c]
imul eax, eax
add ecx, eax
imul edx, edx
lea edx, [ecx + edx]
mov ecx, dword [ebp - 0x8b0]
cmp edx, dword [ebp + ecx*4 - 0x894]
jge 0x6c355628
mov eax, dword [ebp + ecx*4 - 0x494]
cmp eax, 0xff
ja 0x6c3555cb
mov dword [ebp - 0x24], eax
mov dword [esp + 8], 1
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x8ac]
mov dword [esp], ecx
mov dword [ebp - 0x8d4], edx
call sym.libgdk_win32_2.0_0.dll_gdk_colormap_free_colors
mov esi, dword [ebp - 0x8bc]
mov eax, dword [ebp - 0x8ac]
add esi, dword [eax + 0x10]
mov edx, dword [ebp - 0x8d4]
jmp 0x6c3555cb
mov dword [esp], eax
call sym.libgdk_win32_2.0_0.dll_gdk_screen_get_system_colormap
mov dword [ebp - 0x8b4], eax
jmp 0x6c3551f5
mov edx, ebx
mov eax, dword [ebp - 0x8ac]
call sym._gdk_rgb_cmap_fail
jmp 0x6c35555f
mov eax, dword [ebp - 0x8c0]
dec eax
mov dword [ebp - 0x8a0], eax
mov edx, dword [ebp + 8]
dec edx
mov dword [ebp - 0x8a4], edx
mov ecx, dword [ebp + 0xc]
dec ecx
mov dword [ebp - 0x8a8], ecx
jmp 0x6c355257