Function at 0x41ada0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x435d88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [0x4457b0]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x7c]
xor ebp, ebp
cmp eax, 0xffffffff
mov dword [esp + 0x6c], ebp
jne 0x41ade6
mov dword [esp + 0x18], 3
xor ebx, ebx
jmp 0x41ae2d
lea eax, [eax + eax*4]
mov dword [esp + 0x18], 1
lea ecx, [eax + eax*8]
mov eax, 0x10624dd3
shl ecx, 5
imul ecx
mov eax, dword [esp + 0x80]
sar edx, 6
mov ecx, edx
lea eax, [eax + eax*4]
shr ecx, 0x1f
add edx, ecx
lea ecx, [eax + eax*8]
shl ecx, 5
mov eax, 0x10624dd3
mov ebp, edx
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ebx, edx
mov edx, dword [esp + 0x74]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x8b8]
not ecx
dec ecx
test eax, eax
mov cl, byte [ecx + edx - 1]
mov byte [esp + 0x7c], cl
je 0x41ae5e
mov ecx, esi
call fcn.0041ab60
mov cl, byte [esp + 0x7c]
mov edx, dword [esp + 0x74]
cmp cl, 0x50
je 0x41b2ad
cmp cl, 0x70
je 0x41b2ad
push edx
mov ecx, esi
call fcn.00412490
mov esi, eax
test esi, esi
je 0x41b47f
mov ecx, dword [esi]
lea edx, [esp + 0x24]
push edx
push esi
call dword [ecx + 0x18]
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [eax + 0x1c]
fild dword [esp + 0x24]
fmul qword [0x437e00]
call fcn.00420414
fild dword [esp + 0x20]
mov edi, eax
fmul qword [0x437e00]
call fcn.00420414
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x80], eax
lea eax, [edi + edi*4]
xor edx, edx
lea eax, [eax + eax*8]
shl eax, 5
div ecx
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x80]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
div ecx
mov dword [esp + 0x84], eax
mov al, byte [esp + 0x7c]
cmp al, 0x47
je 0x41b185
cmp al, 0x67
je 0x41b185
lea ecx, [esp + 0x54]
call fcn.0043161e
push 0
mov byte [esp + 0x70], 5
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x58]
call fcn.004316d5
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0x4376c8
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x80]
push edx
push edi
mov ecx, dword [eax + 4]
mov byte [esp + 0x74], 6
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x30]
call fcn.00431c92
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x58]
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
and eax, ecx
push eax
push edx
call fcn.00431816
mov eax, dword [esp + 0x20]
push 0
mov edx, eax
mov ecx, dword [esi]
neg edx
push edx
mov edx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x90]
push 0
push eax
push edi
push 0
push 0
push edx
push esi
call dword [ecx + 0x20]
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea ecx, [esp + 0x3c]
call fcn.004344b0
push 0
mov byte [esp + 0x70], 7
call dword [sym.imp.GDI32.dll_CreateMetaFileA]
push eax
lea ecx, [esp + 0x40]
call fcn.004316d5
test eax, eax
je 0x41b13c
push 8
lea ecx, [esp + 0x40]
call fcn.0043193b
push 0
lea ecx, [esp + 0x38]
push 0
push ecx
lea ecx, [esp + 0x48]
call fcn.00431aa5
mov esi, dword [esp + 0x80]
lea edx, [esp + 0x34]
push esi
push edi
push edx
lea ecx, [esp + 0x48]
call fcn.00431af1
mov edx, dword [esp + 0x58]
lea eax, [esp + 0x54]
neg eax
sbb eax, eax
push 0xcc0020
and eax, edx
push 0
push 0
push eax
mov eax, dword [esp + 0x50]
push esi
push edi
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
lea ecx, [esp + 0x3c]
call fcn.0043170c
push eax
call dword [sym.imp.GDI32.dll_CloseMetaFile]
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x1c]
add edx, ebx
push ecx
add eax, ebp
push edx
push eax
push ebx
push ebp
lea ecx, [esp + 0x24]
push str._shp_shpinst_shpleft_d_shptop_d_shpright_d_shpbottom_d_shpfhdr0_shpbxcolumn_shpbxignore_shpbypara_shpwr3_sp_sn_shapeType_sv_75_sp_sn_posrelh_sv__d_sp_sn_pib_sv
push ecx
call fcn.0042ab8b
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x2c]
add esp, 0x1c
mov ecx, dword [eax - 8]
lea esi, [edx + 0x8d0]
push ecx
push eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push 6
lea edx, [esp + 0x1c]
push str.dn_dpictpicw_dpich_dwmetafile8
push edx
call fcn.0042ab8b
mov eax, dword [esp + 0x24]
mov edx, dword [esi]
add esp, 0x14
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
push 0
push 0
push edi
mov ebp, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
call ebp
mov ebx, eax
push ebx
call fcn.0042b785
add esp, 4
mov dword [esp + 0x74], eax
push eax
push ebx
push edi
call ebp
xor ebp, ebp
test ebx, ebx
jbe 0x41b10a
mov ecx, dword [esp + 0x74]
xor eax, eax
lea edx, [esp + 0x10]
mov al, byte [ecx + ebp]
push eax
push str._02x
push edx
call fcn.0042ab8b
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
inc ebp
cmp ebp, ebx
jb 0x41b0d9
push str._sp_sn_fLine_sv_0_sp_sn_fBehindDocument_sv_1_shprsltpict
lea ecx, [esp + 0x14]
call fcn.0042bb81
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [esp + 0x74]
push eax
call fcn.0042b7ae
add esp, 4
push edi
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
lea ecx, [esp + 0x54]
call fcn.0043173d
lea ecx, [esp + 0x2c]
call fcn.00431ce9
lea ecx, [esp + 0x3c]
mov byte [esp + 0x6c], 6
call fcn.00434507
mov dword [esp + 0x2c], vtable.CGdiObject.0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x6c], 8
call fcn.00431ce9
lea ecx, [esp + 0x54]
mov byte [esp + 0x6c], 0
call fcn.00431753
jmp 0x41b47f
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add eax, ebx
push edx
add ecx, ebp
push eax
push ecx
push ebx
push ebp
lea edx, [esp + 0x24]
push str._shp_shpinst_shpleft_d_shptop_d_shpright_d_shpbottom_d_shpfhdr0_shpbxcolumn_shpbxignore_shpbypara_shpwr3_sp_sn_shapeType_sv_75_sp_sn_posrelh_sv__d_sp_sn_pib_sv
push edx
call fcn.0042ab8b
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x2c]
add esp, 0x1c
mov ecx, dword [eax - 8]
lea esi, [edx + 0x8d0]
push ecx
push eax
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x10]
push eax
push edi
push str.pictpicw_dpich_djpegblip
push ecx
call fcn.0042ab8b
mov eax, dword [esp + 0x20]
mov edx, dword [esi]
add esp, 0x10
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea ecx, [esp + 0x54]
call fcn.0042fff2
mov eax, dword [esp + 0x74]
push 0
push 0
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x78], 4
call fcn.00430104
test eax, eax
je 0x41b27c
lea ecx, [esp + 0x14]
push 1
push ecx
lea ecx, [esp + 0x5c]
call fcn.00430221
test eax, eax
je 0x41b273
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
and edx, 0xff
push edx
push str._02x
push eax
call fcn.0042ab8b
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea eax, [esp + 0x14]
push 1
push eax
lea ecx, [esp + 0x5c]
call fcn.00430221
test eax, eax
jne 0x41b232
lea ecx, [esp + 0x54]
call fcn.0043031f
push str._sp_sn_fLine_sv_0_sp_sn_fBehindDocument_sv_1_shprsltpict
lea ecx, [esp + 0x14]
call fcn.0042bb81
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea ecx, [esp + 0x54]
mov byte [esp + 0x6c], 0
call fcn.00430047
jmp 0x41b47f
push 0x2050
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov edi, eax
test edi, edi
je 0x41b47f
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0x4376c8
push edi
lea ecx, [esp + 0x30]
mov byte [esp + 0x70], 1
call fcn.00431c92
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x3c]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x84]
push edx
lea eax, [eax + eax*4]
xor edx, edx
lea eax, [eax + eax*8]
shl eax, 5
div ecx
xor edx, edx
add eax, ebx
push eax
mov eax, dword [esp + 0x48]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 5
div ecx
add eax, ebp
push eax
push ebx
push ebp
lea eax, [esp + 0x24]
push str._shp_shpinst_shpleft_d_shptop_d_shpright_d_shpbottom_d_shpfhdr0_shpbxcolumn_shpbxignore_shpbypara_shpwr3_sp_sn_shapeType_sv_75_sp_sn_posrelh_sv__d_sp_sn_pib_sv
push eax
call fcn.0042ab8b
mov eax, dword [esp + 0x2c]
mov edx, dword [esi + 0x8d0]
add esp, 0x1c
add esi, 0x8d0
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x4e]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
lea ecx, [esp + 0x20]
push str.pictdibitmap0picw_dpich_dwbmbitspixel_dwbmplanes1wbmwidthbytes_d
push ecx
call fcn.0042ab8b
mov eax, dword [esp + 0x28]
mov edx, dword [esi]
add esp, 0x18
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea ecx, [esp + 0x2c]
call fcn.00431cbf
test eax, eax
je 0x41b3ae
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [esp + 0x54]
call fcn.0042fff2
mov eax, dword [esp + 0x74]
push 0
push 0
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x78], 2
call fcn.00430104
test eax, eax
je 0x41b43d
push 0
push 0xe
lea ecx, [esp + 0x5c]
call fcn.004302a6
lea ecx, [esp + 0x14]
push 1
push ecx
lea ecx, [esp + 0x5c]
call fcn.00430221
test eax, eax
je 0x41b434
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
and edx, 0xff
push edx
push str._02x
push eax
call fcn.0042ab8b
mov eax, dword [esp + 0x1c]
mov edx, dword [esi]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea eax, [esp + 0x14]
push 1
push eax
lea ecx, [esp + 0x5c]
call fcn.00430221
test eax, eax
jne 0x41b3f3
lea ecx, [esp + 0x54]
call fcn.0043031f
push str._sp_sn_fLine_sv_0_sp_sn_fBehindDocument_sv_1_shprsltpict
lea ecx, [esp + 0x14]
call fcn.0042bb81
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
lea ecx, [esp + 0x54]
mov byte [esp + 0x6c], 1
call fcn.00430047
mov dword [esp + 0x2c], vtable.CGdiObject.0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x6c], 3
call fcn.00431ce9
lea ecx, [esp + 0x10]
mov dword [esp + 0x6c], 0xffffffff
call fcn.0042ba44
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14