Function at 0x4069f7
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
xor edi, edi
mov ebx, eax
cmp dword [esi + 0x1c], edi
pop ecx
mov dword [ebp - 0x20], ebx
jle 0x406a31
mov eax, dword [esi + 0x20]
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
mov dword [ebx + edi*4], eax
inc edi
cmp edi, dword [esi + 0x1c]
pop ecx
jl 0x406a1b
and dword [ebp - 4], 0
cmp dword [esi + 0x20], 0
jle 0x406a70
mov eax, dword [esi + 0x1c]
xor edi, edi
test eax, eax
jle 0x406a65
push dword [ebp - 4]
mov eax, dword [esi + 0x18]
push edi
push dword [eax + 4]
call dword [sym.imp.GDI32.dll_GetPixel]
mov ecx, dword [ebx + edi*4]
mov edx, dword [ebp - 4]
inc edi
mov dword [ecx + edx*4], eax
mov eax, dword [esi + 0x1c]
cmp edi, eax
jl 0x406a44
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [esi + 0x20]
jl 0x406a3e
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
jge 0x406a7c
mov eax, ecx
cdq
mov ecx, pe_nt_image_headers32
idiv ecx
push ecx
push ecx
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fstp qword [esp]
call sub.MSVCRT.dll_sqrt
fsubr qword [0x40a610]
pop ecx
pop ecx
call sub.MSVCRT.dll__ftol
and dword [ebp - 4], 0
cmp dword [esi + 0x20], 0
mov dword [esi + 0xc], eax
jle 0x406aff
mov eax, dword [esi + 0x1c]
xor ebx, ebx
test eax, eax
jle 0x406af4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor edx, edx
push 0x64
mov eax, dword [eax + ebx*4]
lea edi, [eax + ecx*4]
mov ecx, dword [edi]
mov al, byte [edi + 2]
and eax, 0xff
mov dl, ch
imul eax, eax, 0x1e
imul edx, edx, 0x3b
and ecx, 0xff
add eax, edx
imul ecx, ecx, 0xb
add eax, ecx
pop ecx
cdq
idiv ecx
inc ebx
mov dword [edi], eax
mov eax, dword [esi + 0x1c]
cmp ebx, eax
jl 0x406ab7
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [esi + 0x20]
jl 0x406ab1
mov eax, dword [esi + 0x1c]
push 4
pop ebx
cdq
mov ecx, ebx
push 0x10
idiv ecx
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x20]
cdq
idiv ecx
mov dword [ebp - 8], eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x1c], eax
mov edi, eax
mov dword [ebp - 0x18], ebx
push 0x10
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [edi], eax
xor ebx, ebx
push 8
call sub.MFC42.DLL_operatornew
pop ecx
mov ecx, dword [edi]
mov dword [ebx + ecx], eax
add ebx, 4
cmp ebx, 0x10
jl 0x406b32
add edi, 4
dec dword [ebp - 0x18]
jne 0x406b26
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 4
mov eax, dword [edi]
mov ecx, dword [ebp - 8]
and dword [ebp - 4], 0
mov eax, dword [ebx + eax]
test ecx, ecx
mov dword [eax], 0xff
jle 0x406bc9
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jle 0x406bbe
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
add eax, edx
mov edx, dword [ebp - 0x10]
shl eax, 2
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x14]
mov edx, dword [edi]
mov ecx, dword [ecx]
mov edx, dword [ebx + edx]
mov ecx, dword [eax + ecx]
cmp ecx, dword [edx]
jge 0x406ba8
mov dword [edx], ecx
mov edx, dword [edi]
mov edx, dword [ebx + edx]
cmp ecx, dword [edx + 4]
jle 0x406bb5
mov dword [edx + 4], ecx
add dword [ebp - 0x14], 4
dec dword [ebp - 0x24]
jne 0x406b95
inc dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], ecx
jl 0x406b7a
mov eax, dword [ebp - 0xc]
add edi, 4
shl eax, 2
add dword [ebp - 0x10], eax
dec dword [ebp - 0x28]
jne 0x406b64
add dword [ebp - 0x18], ecx
add ebx, 4
cmp ebx, 0x10
jl 0x406b54
push 0x10
call sub.MFC42.DLL_operatornew
mov ebx, eax
pop ecx
mov dword [ebp - 0x2c], ebx
xor edi, edi
push 0x10
call sub.MFC42.DLL_operatornew
mov dword [ebx + edi*4], eax
inc edi
cmp edi, 4
pop ecx
jl 0x406bf8
sub ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
xor ebx, ebx
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x28], 4
mov eax, dword [edi]
mov ecx, dword [ebx + eax]
mov eax, dword [ecx + 4]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + edi]
add edi, 4
cdq
sub eax, edx
sar eax, 1
dec dword [ebp - 0x28]
mov dword [ebx + ecx], eax
jne 0x406c1b
add ebx, 4
cmp ebx, 0x10
jl 0x406c11
mov eax, dword [esi + 0x1c]
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
xor ebx, ebx
xor edi, edi
cmp dword [esi + 0x1c], ebx
pop ecx
mov dword [esi + 4], eax
jle 0x406c71
push dword [esi + 0x20]
call sub.MFC42.DLL_operatornew
pop ecx
mov ecx, dword [esi + 4]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [esi + 0x1c]
jl 0x406c5c
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 4
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
cmp ecx, ebx
jle 0x406ce4
mov edx, dword [ebp - 0xc]
cmp edx, ebx
jle 0x406cd9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
add eax, ecx
mov ecx, dword [ebp - 0x18]
shl eax, 2
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ecx + edx]
mov edi, dword [edi]
mov edx, dword [eax + edx]
cmp edx, dword [ebx + edi]
mov edi, dword [esi + 4]
mov ebx, dword [ebp - 4]
mov edi, dword [edi + ecx]
setl dl
add edi, dword [ebp - 0x10]
add ecx, 4
dec dword [ebp - 0x28]
mov byte [edi + ebx], dl
jne 0x406ca9
xor ebx, ebx
inc dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], ecx
jl 0x406c91
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x1c], 4
shl eax, 2
add dword [ebp - 0x18], eax
dec dword [ebp - 0x24]
jne 0x406c87
add dword [ebp - 0x14], 4
add dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], 0x10
jl 0x406c77
pop edi
pop esi
pop ebx
leave
ret