Function at 0x4876d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov esi, dword [0x4a39d0]
xor eax, eax
push ebp
push 0x488128
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
movzx eax, word [0x4b8d20]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x488140
call fcn.00409894
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.0044f668
mov al, byte [ebp - 5]
mov byte [esi], al
movzx eax, bx
mov edx, eax
and edx, 0xff
mov byte [esi + 1], dl
mov edx, eax
shr edx, 8
mov byte [esi + 2], dl
mov bl, byte [esi + 1]
or bl, 0x5a
xor bl, dl
test bl, bl
jne 0x487761
mov bl, 0x57
mov eax, dword [0x4a3958]
mov al, byte [eax]
mov byte [esi + 3], al
mov eax, dword [0x4a353c]
mov al, byte [eax]
mov byte [esi + 4], al
mov eax, dword [0x4a37ac]
mov al, byte [eax]
mov byte [esi + 5], al
mov byte [esi + 6], 0
mov byte [esi + 7], 2
mov byte [esi + 8], 0x78
mov byte [esi + 9], 0x4e
mov byte [esi + 0xa], 0x5f
mov byte [esi + 0xb], 0x32
mov byte [esi + 0xc], 0x50
mov byte [esi + 0xd], 0x57
mov byte [esi + 0xe], 0xff
mov byte [esi + 0xf], 0xff
mov byte [esi + 0x10], 0
mov eax, dword [0x4a3798]
mov al, byte [eax]
mov byte [esi + 0x11], al
mov byte [esi + 0x12], 0
mov eax, dword [0x4a3958]
mov al, byte [eax]
mov byte [esi + 0x13], al
mov eax, dword [0x4a353c]
mov al, byte [eax]
mov byte [esi + 0x14], al
mov eax, dword [0x4a37ac]
mov al, byte [eax]
mov byte [esi + 0x15], al
mov eax, dword [0x4a3a98]
mov al, byte [eax]
mov byte [esi + 0x16], al
mov eax, dword [0x4a38a8]
mov al, byte [eax]
mov byte [esi + 0x17], al
mov eax, dword [0x4a398c]
mov al, byte [eax]
mov byte [esi + 0x18], al
mov eax, dword [0x4a387c]
mov al, byte [eax]
mov byte [esi + 0x19], al
mov eax, pe_nt_image_headers32
call fcn.00402f9c
mov byte [esi + 0x1a], al
mov eax, pe_nt_image_headers32
call fcn.00402f9c
mov byte [esi + 0x1b], al
mov eax, dword [0x4a39c0]
movzx eax, word [eax]
shl eax, 0xa
mov edi, eax
and edi, 0xffff
shr eax, 0x10
movzx edx, di
and edx, 0xff
mov byte [esi + 0x1c], dl
movzx edx, di
shr edx, 8
mov byte [esi + 0x1d], dl
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x1e], cl
shr edx, 8
mov byte [esi + 0x1f], dl
mov eax, dword [0x4a39c0]
movzx eax, word [eax]
and eax, 0xff
mov byte [esi + 0x20], al
mov eax, dword [0x4a39c0]
movzx eax, word [eax]
shr eax, 8
mov byte [esi + 0x21], al
mov eax, dword [0x4a3aa4]
movzx eax, word [eax]
and eax, 0xff
mov byte [esi + 0x22], al
mov eax, dword [0x4a3aa4]
movzx eax, word [eax]
shr eax, 8
mov byte [esi + 0x23], al
mov eax, dword [0x4a3aa0]
cmp byte [eax], 0
je 0x4878b4
mov eax, dword [0x4a3a28]
mov al, byte [eax]
mov byte [esi + 0x24], al
mov eax, dword [0x4a3a68]
mov al, byte [eax]
mov byte [esi + 0x25], al
jmp 0x4878d2
mov eax, dword [0x4a39bc]
movzx eax, word [eax]
and eax, 0xff
mov byte [esi + 0x24], al
mov eax, dword [0x4a39bc]
movzx eax, word [eax]
shr eax, 8
mov byte [esi + 0x25], al
mov eax, dword [0x4a3ae4]
movzx eax, word [eax]
and eax, 0xff
mov byte [esi + 0x26], al
mov eax, dword [0x4a3ae4]
movzx eax, word [eax]
shr eax, 8
mov byte [esi + 0x27], al
mov eax, dword [0x4a3900]
movzx eax, word [eax]
and eax, 0xff
mov byte [esi + 0x28], al
mov eax, dword [0x4a3900]
movzx eax, word [eax]
shr eax, 8
mov byte [esi + 0x29], al
mov eax, dword [0x4a3638]
mov al, byte [eax]
mov byte [esi + 0x2a], al
mov eax, dword [0x4a3950]
mov al, byte [eax]
mov byte [esi + 0x2b], al
mov eax, dword [0x4a35f8]
mov al, byte [eax]
mov byte [esi + 0x2c], al
mov eax, dword [0x4a36b4]
mov al, byte [eax]
mov byte [esi + 0x2d], al
mov eax, dword [0x4a3820]
mov al, byte [eax]
mov byte [esi + 0x2e], al
mov eax, dword [0x4a38ec]
cmp byte [eax], 1
jne 0x487956
mov eax, dword [0x4a3798]
mov al, byte [eax]
mov byte [esi + 0x2f], al
jmp 0x48798d
mov eax, dword [0x4a38ec]
cmp byte [eax], 2
jne 0x487983
mov eax, dword [0x4a353c]
mov al, byte [eax]
and al, 0xf0
cmp al, 0x70
jne 0x487983
mov eax, dword [0x4a3798]
mov al, byte [eax]
mov byte [esi + 0x2e], al
mov eax, dword [0x4a387c]
mov al, byte [eax]
mov byte [esi + 0x2f], al
jmp 0x48798d
mov eax, dword [0x4a387c]
mov al, byte [eax]
mov byte [esi + 0x2f], al
mov eax, dword [0x4a397c]
movzx eax, word [eax]
mov edx, eax
and edx, 0xff
mov byte [esi + 0x30], dl
mov edx, dword [0x4a397c]
shr eax, 8
mov byte [esi + 0x31], al
mov eax, dword [0x4a3744]
movzx eax, word [eax]
mov edx, eax
and edx, 0xff
mov byte [esi + 0x32], dl
mov edx, dword [0x4a3744]
shr eax, 8
mov byte [esi + 0x33], al
mov eax, dword [0x4a3a4c]
movzx eax, word [eax]
mov edx, eax
and edx, 0xff
mov byte [esi + 0x34], dl
mov edx, dword [0x4a3a4c]
shr eax, 8
mov byte [esi + 0x35], al
mov eax, dword [0x4a37f0]
movzx eax, word [eax]
mov edx, eax
and edx, 0xff
mov byte [esi + 0x36], dl
mov edx, dword [0x4a37f0]
shr eax, 8
mov byte [esi + 0x37], al
mov eax, dword [0x4a3ab4]
mov eax, dword [eax]
and eax, 0xff
mov byte [esi + 0x38], al
mov eax, dword [0x4a3ab4]
mov eax, dword [eax]
shr eax, 8
mov byte [esi + 0x39], al
mov eax, dword [0x4a3644]
mov eax, dword [eax]
and eax, 0xff
mov byte [esi + 0x3a], al
mov eax, dword [0x4a3644]
mov eax, dword [eax]
shr eax, 8
mov byte [esi + 0x3b], al
mov eax, dword [0x4a39e4]
mov al, byte [eax]
mov byte [esi + 0x3c], al
mov eax, dword [0x4a37dc]
mov al, byte [eax]
mov byte [esi + 0x3d], al
mov eax, dword [0x4a3768]
movzx eax, word [eax]
and eax, 0xff
mov byte [esi + 0x3e], al
mov eax, dword [0x4a3768]
movzx eax, word [eax]
shr eax, 8
mov byte [esi + 0x3f], al
xor edi, edi
mov eax, dword [0x4a3998]
movzx edx, di
add edx, 0x40
mov cl, byte [eax]
mov byte [esi + edx], cl
inc edi
inc eax
cmp di, 8
jne 0x487a7a
mov eax, dword [0x4a38ec]
cmp byte [eax], 2
jne 0x487afe
mov eax, dword [0x4a353c]
mov al, byte [eax]
and al, 0xf0
cmp al, 0x70
jne 0x487afe
mov eax, dword [0x4a3998]
mov al, byte [eax + 8]
mov byte [esi + 0x2b], al
mov eax, dword [0x4a3998]
mov al, byte [eax + 9]
mov byte [esi + 0x2c], al
mov eax, dword [0x4a3998]
mov al, byte [eax + 0xa]
mov byte [esi + 0x2d], al
mov eax, dword [0x4a3998]
mov al, byte [eax + 0xb]
mov byte [esi + 0x2e], al
mov eax, dword [0x4a3998]
mov al, byte [eax + 0xc]
mov byte [esi + 0x3e], al
mov eax, dword [0x4a3998]
mov al, byte [eax + 0xd]
mov byte [esi + 0x3f], al
mov eax, dword [0x4a3998]
mov al, byte [eax + 0xe]
mov byte [esi + 0x48], al
mov eax, dword [0x4a3998]
mov al, byte [eax + 0xf]
mov byte [esi + 0x49], al
jmp 0x487b1c
mov eax, dword [0x4a39a4]
movzx eax, word [eax]
and eax, 0xff
mov byte [esi + 0x48], al
mov eax, dword [0x4a39a4]
movzx eax, word [eax]
shr eax, 8
mov byte [esi + 0x49], al
mov eax, dword [0x4a3750]
movzx eax, word [eax]
mov edx, eax
and edx, 0xff
mov byte [esi + 0x4a], dl
mov edx, dword [0x4a3750]
shr eax, 8
mov byte [esi + 0x4b], al
mov edi, dword [0x4a3740]
mov edi, dword [edi]
shr edi, 8
and di, 0xffff
movzx eax, di
mov edx, eax
and edx, 0xff
mov byte [esi + 0x4c], dl
shr eax, 8
mov byte [esi + 0x4d], al
mov edi, dword [0x4a39ec]
mov edi, dword [edi]
shr edi, 8
and di, 0xffff
movzx eax, di
mov edx, eax
and edx, 0xff
mov byte [esi + 0x4e], dl
shr eax, 8
mov byte [esi + 0x4f], al
mov eax, dword [0x4a35e8]
mov al, byte [eax]
mov byte [esi + 0x50], al
mov eax, dword [0x4a36f0]
mov al, byte [eax]
mov byte [esi + 0x51], al
mov eax, dword [0x4a3a24]
mov al, byte [eax]
mov byte [esi + 0x52], al
mov byte [esi + 0x53], 0
mov byte [esi + 0x54], 0
mov eax, dword [0x4a38c4]
mov eax, dword [eax]
and eax, 0xffff
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x55], cl
shr edx, 8
mov byte [esi + 0x56], dl
mov eax, dword [0x4a38c4]
mov eax, dword [eax]
shr eax, 0x10
movzx eax, ax
and eax, 0xff
mov byte [esi + 0x57], al
mov eax, dword [0x4a3840]
mov eax, dword [eax]
and eax, 0xffff
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x58], cl
shr edx, 8
mov byte [esi + 0x59], dl
mov eax, dword [0x4a3840]
mov eax, dword [eax]
shr eax, 0x10
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x5a], cl
shr edx, 8
mov byte [esi + 0x5b], dl
mov eax, dword [0x4a39d4]
mov eax, dword [eax]
and eax, 0xffff
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x5c], cl
shr edx, 8
mov byte [esi + 0x5d], dl
mov eax, dword [0x4a39d4]
mov eax, dword [eax]
shr eax, 0x10
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x5e], cl
shr edx, 8
mov byte [esi + 0x5f], dl
mov eax, dword [0x4a39ac]
mov al, byte [eax]
mov byte [esi + 0x60], al
mov byte [esi + 0x61], 0
mov eax, dword [0x4a3ac0]
mov eax, dword [eax]
and eax, 0xffff
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x62], cl
shr edx, 8
mov byte [esi + 0x63], dl
mov eax, dword [0x4a3ac0]
mov eax, dword [eax]
shr eax, 0x10
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x64], cl
shr edx, 8
mov byte [esi + 0x65], dl
xor edi, edi
movzx eax, di
add eax, 0x66
mov byte [esi + eax], 0xff
inc edi
cmp di, 0x20
jne 0x487ca8
push 0x83
push 8
push esi
call sub.WizProRHB.dll_GetNecCheckSum
movzx edx, ax
mov ecx, edx
and ecx, 0xff
mov byte [esi + 0x84], cl
shr edx, 8
mov byte [esi + 0x85], dl
push 0x85
push 8
push esi
call sub.WizProRHB.dll_GetBinaryCheckSum
movzx edx, ax
and edx, 0xff
mov byte [esi + 0x86], dl
movzx eax, ax
shr eax, 8
mov byte [esi + 0x87], al
mov di, 0x88
push 0x10
lea edx, [ebp - 0x24]
mov eax, dword [0x4a378c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3d8]
call fcn.0044f638
mov edx, dword [ebp - 0x24]
mov ecx, edi
mov eax, dword [ebp - 4]
call fcn.00488248
mov di, 0x98
push 0x20
lea edx, [ebp - 0x28]
mov eax, dword [0x4a378c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c8]
call fcn.0044f638
mov edx, dword [ebp - 0x28]
mov ecx, edi
mov eax, dword [ebp - 4]
call fcn.00488248
mov di, 0xb8
push 8
lea edx, [ebp - 0x2c]
mov eax, dword [0x4a378c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
call fcn.0044f638
mov edx, dword [ebp - 0x2c]
mov ecx, edi
mov eax, dword [ebp - 4]
call fcn.00488248
mov di, 0xc0
push 0x20
lea edx, [ebp - 0x30]
mov eax, dword [0x4a378c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c0]
call fcn.0044f638
mov edx, dword [ebp - 0x30]
mov ecx, edi
mov eax, dword [ebp - 4]
call fcn.00488248
mov byte [esi + 0xe0], 0xff
mov byte [esi + 0xe1], 0xff
mov eax, dword [0x4a378c]
mov eax, dword [eax]
mov eax, dword [eax + 0x560]
call fcn.0047e06c
mov ecx, 5
cdq
idiv ecx
mov edi, eax
movzx eax, di
and eax, 0xff
mov byte [esi + 0xe2], al
movzx eax, di
shr eax, 8
mov byte [esi + 0xe3], al
mov eax, dword [0x4a378c]
mov eax, dword [eax]
mov eax, dword [eax + 0x564]
call fcn.0047e06c
mov ecx, 5
cdq
idiv ecx
mov edi, eax
movzx eax, di
and eax, 0xff
mov byte [esi + 0xe4], al
movzx eax, di
shr eax, 8
mov byte [esi + 0xe5], al
xor edi, edi
movzx eax, di
add eax, 0xe6
mov byte [esi + eax], 0xff
inc edi
cmp di, 0x22
jne 0x487e24
xor edi, edi
lea eax, [esi + 0x108]
movzx edx, di
add edx, 8
mov dl, byte [esi + edx]
mov byte [eax], dl
inc edi
inc eax
cmp di, 0x100
jne 0x487e3f
mov di, 0x200
lea eax, [esi + 8]
xor byte [eax], bl
inc eax
dec di
jne 0x487e5a
mov eax, dword [0x4a3958]
cmp byte [eax], 7
jne 0x487ea2
mov eax, esi
mov dx, 0x208
call fcn.00484d44
movzx edx, ax
and edx, 0xff
mov byte [esi + 0x208], dl
movzx eax, ax
shr eax, 8
mov byte [esi + 0x209], al
mov eax, esi
mov dx, 0x20a
call fcn.0048467c
jmp 0x488105
mov eax, dword [0x4a353c]
cmp byte [eax], 0xf0
jne 0x487fd8
mov eax, dword [0x4a35b4]
cmp byte [eax], 0
jne 0x487f16
mov byte [esi + 6], 0xe6
mov byte [esi + 7], 0x11
xor edi, edi
mov eax, dword [0x4a38a4]
movzx edx, di
add edx, 0x208
mov cl, byte [eax]
mov byte [esi + edx], cl
inc edi
inc eax
cmp di, 0xfe6
jne 0x487ec9
mov eax, esi
mov dx, 0x11ee
call fcn.00484d44
movzx edx, ax
and edx, 0xff
mov byte [esi + 0x11ee], dl
movzx eax, ax
shr eax, 8
mov byte [esi + 0x11ef], al
mov eax, esi
mov dx, 0x11f0
call fcn.0048467c
jmp 0x488105
mov eax, dword [0x4a35b4]
cmp byte [eax], 1
jne 0x487f7c
mov byte [esi + 6], 0xe6
mov byte [esi + 7], 0x11
xor edi, edi
mov eax, dword [0x4a36b8]
movzx edx, di
add edx, 0x208
mov cl, byte [eax]
mov byte [esi + edx], cl
inc edi
inc eax
cmp di, 0xfe6
jne 0x487f2f
mov eax, esi
mov dx, 0x11ee
call fcn.00484d44
movzx edx, ax
and edx, 0xff
mov byte [esi + 0x11ee], dl
movzx eax, ax
shr eax, 8
mov byte [esi + 0x11ef], al
mov eax, esi
mov dx, 0x11f0
call fcn.0048467c
jmp 0x488105
mov byte [esi + 6], 0x2e
mov byte [esi + 7], 0x15
xor edi, edi
mov eax, dword [0x4a3730]
movzx edx, di
add edx, 0x208
mov cl, byte [eax]
mov byte [esi + edx], cl
inc edi
inc eax
cmp di, 0x132e
jne 0x487f8b
mov eax, esi
mov dx, 0x1536
call fcn.00484d44
movzx edx, ax
and edx, 0xff
mov byte [esi + 0x1536], dl
movzx eax, ax
shr eax, 8
mov byte [esi + 0x1537], al
mov eax, esi
mov dx, 0x1538
call fcn.0048467c
jmp 0x488105
mov eax, dword [0x4a353c]
cmp byte [eax], 0x60
jae 0x4880d4
xor edi, edi
movzx eax, di
add eax, 8
mov al, byte [esi + eax]
movzx edx, di
add edx, 0x208
mov byte [esi + edx], al
inc edi
cmp di, 0x200
jne 0x487fe8
mov eax, dword [0x4a3ab4]
mov ax, word [eax]
shl eax, 4
mov word [ebp - 0xe], ax
mov eax, dword [0x4a3644]
mov ax, word [eax]
shl eax, 4
add ax, 0x10
mov word [ebp - 0x10], ax
mov di, word [ebp - 0xe]
mov ax, word [ebp - 0x10]
sub ax, di
jb 0x48807f
inc eax
mov word [ebp - 0x14], ax
movzx eax, di
add eax, eax
mov edx, dword [0x4a3a60]
lea eax, [edx + eax*8]
mov byte [ebp - 0x11], 0
mov edx, eax
movzx ecx, di
movzx ebx, word [ebp - 0xe]
sub ecx, ebx
shl ecx, 4
add ecx, 0x408
xor ebx, ebx
mov bl, byte [ebp - 0x11]
add ecx, ebx
mov bl, byte [edx]
mov byte [esi + ecx], bl
inc byte [ebp - 0x11]
inc edx
cmp byte [ebp - 0x11], 0x10
jne 0x48804d
inc edi
add eax, 0x10
dec word [ebp - 0x14]
jne 0x488047
mov edi, dword [0x4a3ae4]
mov di, word [edi]
add di, 0x400
movzx eax, di
and eax, 0xff
mov byte [esi + 6], al
movzx eax, di
shr eax, 8
mov byte [esi + 7], al
lea edx, [edi + 8]
mov eax, esi
call fcn.00484d44
movzx edx, di
movzx ecx, ax
and ecx, 0xff
mov byte [esi + edx + 8], cl
movzx edx, di
movzx eax, ax
shr eax, 8
mov byte [esi + edx + 9], al
lea edx, [edi + 0xa]
mov eax, esi
call fcn.0048467c
jmp 0x488105
mov eax, esi
mov dx, 0x208
call fcn.00484d44
movzx edx, ax
and edx, 0xff
mov byte [esi + 0x208], dl
movzx eax, ax
shr eax, 8
mov byte [esi + 0x209], al
mov eax, esi
mov dx, 0x20a
call fcn.0048467c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48812f
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404624
lea eax, [ebp - 0x18]
call fcn.00404600
ret