Function at 0x4131fc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc8
mov edi, edx
mov ebx, eax
push 0xc
push ebx
call sub.user32.dll_GetWindowLongA
mov byte [esp + 0x2c], al
cmp byte [esp + 0x2c], 1
jne 0x413221
mov byte [esp + 0x2d], 0
jmp 0x413226
mov byte [esp + 0x2d], 0xb
mov eax, dword [0x499170]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov dword [esp + 0x24], eax
mov edx, 0x49919c
lea eax, [esp + 0xb]
mov ecx, 3
call fcn.00405a94
mov dword [esp + 0x28], 3
lea ebx, [esp + 0xb]
lea ebp, [esp + 0xe]
xor eax, eax
mov al, byte [ebx]
mov edx, pe_nt_image_headers32
sub edx, eax
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fdivr dword [0x41374c]
call fcn.004028a0
mov word [ebp], ax
add ebp, 2
inc ebx
dec dword [esp + 0x28]
jne 0x413259
mov word [esp + 0x20], 1
mov dword [esp + 0x28], 3
lea ebx, [esp + 0xb]
lea esi, [esp + 0xe]
lea ebp, [esp + 8]
movsx eax, word [esp + 0x20]
movsx edx, word [esi]
mov ecx, edx
cdq
idiv ecx
mov edx, eax
xor eax, eax
mov al, byte [ebx]
add edx, eax
mov eax, 0xff
call fcn.0040bb7c
mov byte [ebp], al
inc ebp
add esi, 2
inc ebx
dec dword [esp + 0x28]
jne 0x4132a0
mov cl, byte [esp + 0xa]
mov dl, byte [esp + 9]
mov al, byte [esp + 8]
call fcn.00405aa4
push eax
push 0
push 0
call sub.gdi32.dll_CreatePen
mov ebx, eax
push ebx
push edi
call sub.gdi32.dll_SelectObject
cmp word [esp + 0x20], 0x12
jl 0x413334
xor eax, eax
mov al, byte [esp + 0x2d]
mov dx, 0x2b
sub dx, ax
mov cx, word [esp + 0x20]
dec ecx
mov eax, edi
call fcn.0040ec74
movsx eax, word [esp + 0x20]
dec eax
push eax
cmp word [esp + 0x24], 0x12
setge al
and eax, 0x7f
imul eax, eax, 0x1f4
dec eax
push eax
push edi
call sub.gdi32.dll_LineTo
movsx esi, word [esp + 0x20]
mov eax, 0x12d
sub eax, esi
cmp eax, 0x12
setl al
and eax, 0x7f
imul dx, ax, 0x1f4
xor eax, eax
mov al, byte [esp + 0x2d]
mov cx, 0x2b
sub cx, ax
add dx, cx
mov cx, 0x12c
sub cx, word [esp + 0x20]
mov eax, edi
call fcn.0040ec74
mov eax, 0x12c
sub eax, esi
push eax
push 0xffffffffffffffff
push edi
call sub.gdi32.dll_LineTo
mov eax, dword [esp + 0x24]
push eax
push edi
call sub.gdi32.dll_SelectObject
push ebx
call sub.gdi32.dll_DeleteObject
inc word [esp + 0x20]
cmp word [esp + 0x20], 0x12e
jne 0x41328c
mov cl, 0xff
xor edx, edx
xor eax, eax
call fcn.00405aa4
push eax
push edi
call sub.gdi32.dll_SetTextColor
push 0xffffff
push edi
call sub.gdi32.dll_SetBkColor
push 1
push edi
call sub.gdi32.dll_SetBkMode
mov eax, dword [0x48da64]
push eax
push 0x31
push 2
push 0
push 0
push 0
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0xf
call sub.gdi32.dll_CreateFontA
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov dword [esp], eax
xor ebx, ebx
cmp byte [esp + 0x2c], 1
jne 0x413486
cmp bx, 7
jbe 0x41341b
mov dword [0x4948d8], 0xa
jmp 0x413422
xor eax, eax
mov dword [0x4948d8], eax
cmp bx, 9
jbe 0x413430
dec dword [0x4948d8]
jmp 0x413437
add dword [0x4948d8], 7
movzx eax, bx
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004123c0
mov edx, eax
lea eax, [esp + 0x14]
call fcn.00405c48
lea eax, [esp + 0x14]
call fcn.00405bdc
push eax
lea eax, [esp + 0x18]
push eax
push 2
movzx eax, bx
shl eax, 3
lea eax, [eax + eax*2]
add eax, 0x34
inc eax
add eax, dword [0x4948d8]
push eax
push edi
call sub.gdi32.dll_TextOutA
jmp 0x4134dd
movzx eax, bx
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 1
xor eax, eax
call fcn.0040fe88
mov edx, eax
lea eax, [esp + 0x14]
call fcn.00405c48
lea eax, [esp + 0x14]
call fcn.00405bdc
push eax
lea eax, [esp + 0x18]
push eax
push 2
cmp byte [esp + 0x38], 3
sete al
and eax, 0x7f
lea eax, [eax + eax*8]
add eax, 0x14
movzx edx, bx
imul edx
add eax, 0x2a
push eax
push edi
call sub.gdi32.dll_TextOutA
inc ebx
cmp bx, 0x10
jne 0x413402
push 2
push edi
call sub.gdi32.dll_SetTextAlign
xor esi, esi
cmp byte [esp + 0x2c], 1
jne 0x41353d
movzx eax, si
mov ebx, eax
shl ebx, 4
mov dword [esp + 0x34], ebx
fild dword [esp + 0x34]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004123c0
mov edx, eax
lea eax, [esp + 0x19]
call fcn.00405c48
lea eax, [esp + 0x19]
call fcn.00405bdc
push eax
lea eax, [esp + 0x1d]
push eax
add ebx, 0x16
push ebx
push 0x21
push edi
call sub.gdi32.dll_TextOutA
jmp 0x413583
movzx eax, si
mov ebx, eax
shl ebx, 4
mov dword [esp + 0x34], ebx
fild dword [esp + 0x34]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.0040fe88
mov edx, eax
lea eax, [esp + 0x19]
call fcn.00405c48
lea eax, [esp + 0x19]
call fcn.00405bdc
push eax
lea eax, [esp + 0x1d]
push eax
add ebx, 0x16
push ebx
push 0x17
push edi
call sub.gdi32.dll_TextOutA
inc esi
cmp si, 0x10
jne 0x4134f2
push 0
push edi
call sub.gdi32.dll_SetTextAlign
cmp byte [esp + 0x2c], 2
jne 0x4135a9
mov eax, dword [0x49914c]
push eax
push edi
call sub.gdi32.dll_SelectObject
push 0
push edi
call sub.gdi32.dll_SetTextColor
push 0xffffff
push edi
call sub.gdi32.dll_SetBkColor
mov byte [esp + 0x1f], 0x3a
mov si, 1
mov ebp, 0x48bce0
mov bx, 1
mov dword [esp + 0x30], 0x48bce0
cmp byte [esp + 0x2c], 1
jne 0x41362a
mov al, byte [ebp]
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x30]
mov al, byte [eax]
mov byte [esp + 0x1e], al
push 2
lea eax, [esp + 0x21]
push eax
movzx eax, si
dec eax
shl eax, 4
add eax, 0x16
push eax
cmp bx, 8
seta al
and eax, 0x7f
add eax, eax
lea eax, [eax + eax*4]
movzx edx, bx
dec edx
shl edx, 3
lea edx, [edx + edx*2]
add edx, 0x34
add eax, edx
push eax
push edi
call sub.gdi32.dll_TextOutA
jmp 0x413715
mov eax, esi
dec eax
shl eax, 4
add al, bl
dec eax
mov byte [esp + 0x2e], al
cmp byte [esp + 0x2c], 3
jne 0x4136af
cmp byte [esp + 0x2e], 0x20
jae 0x4136af
xor eax, eax
mov al, byte [esp + 0x2e]
mov edx, dword [0x48db08]
lea eax, [edx + eax*4]
call fcn.00405bdc
xor edx, edx
mov dl, al
push edx
xor edx, edx
mov dl, byte [esp + 0x32]
mov ecx, dword [0x48db08]
lea edx, [ecx + edx*4]
push edx
movzx edx, si
dec edx
shl edx, 4
add edx, 0x16
add edx, 3
xor ecx, ecx
mov cl, byte [esp + 0x34]
sub edx, ecx
push edx
movzx edx, bx
dec edx
imul edx, edx, 0x1d
add edx, 0x2d
xor ecx, ecx
mov cl, byte [esp + 0x38]
sub edx, ecx
sub edx, 4
cmp al, 3
sete al
and eax, 0x7f
shl eax, 2
sub edx, eax
push edx
push edi
call sub.gdi32.dll_TextOutA
jmp 0x413715
mov al, byte [esp + 0x2e]
mov byte [esp + 0x1d], al
cmp byte [esp + 0x2c], 4
jne 0x4136d4
and eax, 0xff
mov edx, dword [0x4996d8]
mov al, byte [edx + eax + 0x100]
mov byte [esp + 0x1d], al
push 1
lea edx, [esp + 0x21]
push edx
movzx edx, si
dec edx
shl edx, 4
add edx, 0x16
add edx, 3
xor eax, eax
mov al, byte [esp + 0x34]
sub edx, eax
push edx
cmp byte [esp + 0x38], 3
sete dl
and edx, 0x7f
lea edx, [edx + edx*8]
add edx, 0x14
movzx ecx, bx
dec ecx
imul edx, ecx
add edx, 0x2d
sub edx, eax
push edx
push edi
call sub.gdi32.dll_TextOutA
inc ebx
inc dword [esp + 0x30]
cmp bx, 0x11
jne 0x4135d6
inc esi
inc ebp
cmp si, 0x11
jne 0x4135ca
mov eax, dword [esp]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov eax, dword [esp + 4]
push eax
call sub.gdi32.dll_DeleteObject
add esp, 0x38
pop ebp
pop edi
pop esi
pop ebx
ret