Function at 0x1001641a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10022358
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x1002d018]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x1002d018]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
xor edi, edi
mov ecx, 0x29
xor eax, eax
mov dl, byte [eax + 0x100286d8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x30], dl
jns 0x1001610d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x14
jl 0x100160f0
mov byte [esp + 0x44], 0
mov dword [esp + 0x70], edi
mov ecx, 0x1f
xor eax, eax
mov dl, byte [eax + str.Vfira_nuINF_OY]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x48], dl
jns 0x10016140
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x17
jl 0x10016123
mov byte [esp + 0x5f], 0
mov byte [esp + 0x70], 1
mov ecx, dword [0x10032c4c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
lea edx, [esp + 0x30]
push edx
call eax
mov esi, eax
push 4
push esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x100161c0
lea ecx, [esp + 0x24]
push ecx
push 0x40
push 4
push esi
call edi
push eax
call ebx
lea edx, [esp + 0x2c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x24]
push ecx
push edx
push 4
push esi
call edi
push eax
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [0x10032c4c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x40]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x48]
push eax
call edx
mov esi, eax
add esi, dword [esp + 0x10]
xor eax, eax
push 4
push esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10016232
lea eax, [esp + 0x20]
push eax
push 0x40
push 4
push esi
call edi
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
push 4
push esi
call edi
push eax
call ebx
mov eax, dword [esp + 0x10]
xor edi, edi
mov dword [0x100323a4], eax
mov dword [esp + 0x70], 0xffffffff
cmp eax, edi
je 0x100164aa
call fcn.100081d0
push eax
call fcn.100080b0
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fstp dword [0x10032704]
call fcn.100081d0
push eax
call fcn.10008140
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fstp dword [0x10030660]
cmp dword [0x100324d4], edi
je 0x100162d3
call fcn.1000df10
call fcn.1000f1f0
cmp dword [0x10032144], edi
jne 0x100162cc
mov edx, dword [0x10033284]
mov eax, dword [0x100323a4]
push 0x10032144
add edx, 5
push eax
mov dword [0x1002fc34], edx
mov dword [0x100310e8], 0x1000b2c0
call fcn.1000b2c0
call fcn.1000df80
jmp 0x10016317
call fcn.1000de40
mov esi, dword [0x100323a4]
cmp dword [0x10032f10], edi
jne 0x10016317
cmp dword [0x10032f18], edi
jne 0x100162f3
call fcn.1000dcc0
fild dword [0x1002d244]
push esi
sub esp, 8
fstp dword [esp + 4]
fild dword [0x1002d248]
fstp dword [esp]
call fcn.1000a800
add esp, 0xc
call fcn.1000ad60
call fcn.1000b250
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCR100.dll__time64]
lea edx, [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.MSVCR100.dll__localtime64]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push edx
push eax
push str._02i:_02i:_02i
push 0x10032710
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
cmp dword [0x10032eb0], edi
je 0x10016363
call fcn.10015f10
call fcn.100150b0
call fcn.10015890
call fcn.10015b10
call fcn.10015200
call fcn.10009cb0
test al, al
je 0x100163aa
call fcn.10010e20
call fcn.10011d10
call fcn.10011f50
call fcn.10012260
call fcn.10012580
call fcn.10013c40
call fcn.10012aa0
call fcn.10014d00
jmp 0x100163e0
mov dword [0x10032d28], edi
mov dword [0x10032c78], edi
mov dword [0x10032c8c], edi
mov dword [0x10032dac], edi
mov dword [0x10032db0], edi
mov dword [0x10032de8], edi
mov dword [0x10032d40], edi
mov dword [0x10032dec], edi
mov dword [0x10032d20], edi
mov eax, dword [0x10032dc4]
cmp eax, edi
je 0x10016435
dec eax
cmp eax, 4
ja case.default.0x100163ef
jmp dword [eax*4 + 0x100164c8]
mov dword [0x100325f0], 0x3e8
jmp case.default.0x100163ef
mov dword [0x100325f0], 0x7d0
jmp case.default.0x100163ef
mov dword [0x100325f0], 0xbb8
jmp case.default.0x100163ef
mov dword [0x100325f0], 0xfa0
jmp case.default.0x100163ef
mov dword [0x100325f0], 0x1388
call fcn.10013640
cmp dword [0x10032dd0], edi
je 0x100164aa
mov esi, 0xc
lea ebx, [esi - 0xa]
jmp 0x10016450
mov ecx, 0x29
xor eax, eax
mov dl, byte [eax + str.zOGINZlXP_QY]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x30], dl
jns 0x10016474
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x12
jl 0x10016457
mov byte [esp + 0x42], 0
mov dword [esp + 0x70], ebx
mov ecx, dword [0x10032c4c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
lea edx, [esp + 0x30]
push edx
call eax
mov ecx, dword [eax]
mov dword [esi + ecx], edi
add esi, 4
mov dword [esp + 0x70], 0xffffffff
cmp esi, 0x34
jl 0x10016450
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.1001fd05
mov esp, ebp
pop ebp
ret