Function at 0x40861c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x175]
mov esi, 0x42df6b
push ebx
sub esp, 0x18c
mov eax, dword [0x42961c]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x155]
mov esi, 0x42df7b
mov ecx, 0x3d
rep movsb byte es:[edi], byte [esi]
and eax, 0xe9430bab
imul eax, eax, 0xeb78e0f6
or eax, 0xa7026471
xor eax, 0xb3f33862
mov dword [0x42961c], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
sub eax, 0x48a8fe20
mov dword [0x42961c], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x40867d
xor esi, esi
xor ecx, ecx
mov edi, 0x3c
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x155]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x408695
xor edi, edi
xor esi, esi
xor ebx, ebx
inc ebx
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Exception_in_WerpCurrentPeb
movzx ebx, bl
mov dword [esp], 0x42a2f4
mov al, byte [ebp + ebx - 0x118]
mov byte [ebp - 0x179], al
add eax, esi
movzx esi, al
mov eax, dword [0x42961c]
xor eax, 0x60673cfe
add eax, 0x1dd97b2a
imul eax, eax, 0x776dcf62
and eax, 0xd1802110
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [0x42961c], eax
call fcn.0040e9f0
mov edx, 0x42a2f4
mov al, byte [edx]
test al, al
je 0x40874f
sub eax, 0x30
cmp al, 9
jbe 0x40874c
imul eax, dword [0x42961c], 0xabe28731
mov dword [0x42961c], eax
jmp 0x40874f
inc edx
jmp 0x40872e
or dword [0x42961c], 0xc6c01c16
call fcn.004150c4
mov cl, byte [ebp - 0x179]
imul eax, dword [0x42961c], 0xdc5293c7
xor eax, 0x1fb3b70e
lea edx, [eax - 0x552cc265]
mov dword [0x42961c], edx
mov dl, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], dl
mov byte [ebp + esi - 0x118], cl
mov ecx, 0x42a2f4
mov dl, byte [ecx]
test dl, dl
je 0x4087b6
sub edx, 0x30
cmp dl, 9
jbe 0x4087b3
sub eax, 0x5b809789
mov dword [0x42961c], eax
jmp 0x4087b6
inc ecx
jmp 0x408799
imul eax, dword [0x42961c], 0xd8c12d6e
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_Exception_in_WerpCurrentPeb
mov dword [0x42961c], eax
call fcn.004148d8
mov edx, 0x42a2f4
mov al, byte [edx]
test al, al
je 0x4087f2
sub eax, 0x30
cmp al, 9
jbe 0x4087ef
sub dword [0x42961c], 0x27803729
jmp 0x4087f2
inc edx
jmp 0x4087d6
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Exception_in_WerpCurrentPeb
mov dword [esp], str.u_ltktP5
or dword [0x42961c], 0x9566a09c
call fcn.004127ec
mov al, byte [ebp - 0x179]
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + edi - 0x175]
mov byte [ebp + edi - 0x165], al
inc edi
cmp edi, 0x10
jne 0x4086d8
mov eax, dword [0x42961c]
mov byte [ebp - 0x155], 0
xor ecx, ecx
add eax, 0x360397a9
mov dword [0x42961c], eax
cmp byte [ecx + 0x42a2f4], 0
je 0x408874
inc ecx
cmp ecx, 0x23c7
jne 0x408857
imul eax, eax, 0xcaff8fe8
mov dword [0x42961c], eax
mov eax, dword [0x42961c]
mov dword [esp + 4], str.WER_CrashAPI:_u:_ERROR_Exception_in_WerpCurrentPeb
mov dword [esp], 0x42a2f4
and eax, 0xdbc5032f
imul eax, eax, 0xe58cee5a
mov dword [0x42961c], eax
call fcn.004127ec
lea edx, [ebp - 0x165]
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], 0x19e8
mov dword [esp], str.DQk_Xpb2k3VtbUNxCB7dIkhQYjA3H4JpAnB2LnDrPdp9FO29kurnhOkD9GbNAUEqbKhxvLxJ2Xzq6vwVf0m07rXm5sd_rcxM6pghJndXCjmex038m0wgYMH1nwOqnm_PP8Ws9XboyFEETe615e0XLPAH8IabuXctSvWJqUqWa2Ao5TrqAX8EqYaxuROMQUcxZV8MWclNcs_NscU9u4KqR7hD2mId8_w8dUK8oSviAjRAS5FD6vptvX6XiZd04poJ4brwpDAY_DLWku0lTSPDCE2bXQ11Gam9MDYLxR3eHhAu2fKQ_M04bkukW0GBoH4uSerjvOTbWbU8g_fQ4_rv4q3t0zQkG8N77bFOXnqxBSpIhiDpKSqpDSch2YRjnrf1WvXcY8LQ1X839eBtno4cIQm67wsu89XWNhs9WjAdP6TLQOh9cyOhksScmRM3yVUlX3kFzuO3f9RuZWo5ad15bg5gaeQnOLxqe9UsPPu22a4PZR5qAhKvPiFuTNUg9XRF85BjsU_CpzL6glMNCOlZLOIQx2eMYwS8PApQdqGBoqXNkKXTQx7cW2HJiAwMmVLy1M2roqalUuTd9gfUmUQ_QaXgiWnoYtF8Vn1AdOGaiRmNC42df_upOGFtIchHU3zcdkMAckE0dDDJB8fHxGIn6xmwib_OWRDW2YIn2nDZO1kpmRFhtz2dMF0xDLQqzjTUV4yr8XeUAPEbB0uLf2NBrVWufEbChbjafr9DTtbBxU_fNHdGNeb8MNeQN8mzY4CMZtuDxNVzLX6vgrwrcjLP4uB1aNqTIBn6oiypy4byUmFTwtt_uQMmPr9TOXINlLWmyypbbiq8DeGuYxz3zXH5k94oRovj4y3ve8hGYysMVUTY8WgfRCtcSMXA2UvLqsafUktovigjD96d9s7w1GhTtmNhhQc7AHJ2uXqVUuQpOKsMwa23nD1jiPCdqLwAWqVWmjVZmOGxuu0QSKNnKHfWJYNIylBMPvYZZm8Y1_o4eMaHhGJJ1fn9I8miLjloqdmsGJJiGKMr6Mc_SWcnXQUBxNPt4_papryJ8R2RsVnK3iVH2e6MnAxRFwTaVwka1mqc3OkbOT3bfDndX5kZ8QRrYxaXNdPO5y4_QMZNnRezTP3VlrZH7_7IKn5Fha9v7udoLSgjZTGvORelXzETYwP91edLXuxfTtFQK0ameCdxTMV3i7R02tCMpDSf6hTlVvrNrn8bFPLD2zOiAnvdkXvL3Os3LKSZhAMEk1UUGJtlJO8GZ6T5yUSNxN5tjzSKY38plvcxdDcrgxqG54W27nkK2WfSVmcpLwdFVHLRB_7CmdV2cMqScXVq3xBLnh2NQTOgYVpmmQuH_gaA0xMrVP4io3fWpnygbob6HwsBe6v0x_oyNwueyCLz8ZO3Wvhfknm5vOy8RewReiVM6T7UDnHQeJ2nkNhGt5y7q2XR196GQxXlkQlG9RBciD2LtFabzFTRgzXcdWGarazBHLmXhgVHidADmfaNeMogvwaH1baDm4EVWfBXvvQ7ODSVK1urjxzkN3r9gVLDrBvSToPUD3PpDqRxL4CxmoWUCqPXL2kaAhulWSQRqf_mbdio5pCGPBxWKvtIuCpu2VELK4uxpAv7xZ3LimspYeVaTk5oz_FZ32eU8IjHOlgxnIXvDstWLE5jLfdqJWKngJBpOmqOZ3XGIX13BhRKaXYRgaEZVsYvxDkqwDVLnP0mzXEH3BmvxUmkbU1WRUkpRz2b2J1GUPtf0ImJvI86L3HzdL7z_f8jhB2rUtb0RFqp30T4olCGdyxp1HxFz3zfH6ihxNsH3XiMeJ8sxjYpTzsaHCWgwyDRFLxEccgpsxzfaUzN1aGzKTFhM88cmZHgjjhx9RirVIFq5UgR5pOVCACmhsZz2R5S6xCuNtOPrhLyth43g33DrmVBQRnPInhhRWNw_ZvZUADFH5cNejEJ5OJ9Xq8NYDQRH_m8MSaebezVvju48QiYyjBIgvAycY5QO5jhAwKAwpZzVXLbzmgV_3IySAnIEXyzrFECkBNs5_6Th0kkjXTTsksfzx97C3ABcq6GW4vSrQn2v6McK276blxAEZ44lfzFpJXfxP66SUaw3oU1DNR6Rfctr5NGyfcKTSV1Z6JIqarTEHU8VtmdU3kEBFHNiDQZdQEFOYMDBXfnQIuXRAZYobCaf4K0vaLwfsxWYw9cW5tgMaqlLDBxA9azDzNEFr_zr2hYrK40XSpD1A4qlTA_pwpUsSi1FARQPxRl6AYVGdi09hdEOdlTC2qTxX6cinjFHIBczo99D2LxYIoPfTos8qvQqSrE0afqHkZ1ynB6ZPE3BZNPtfYgZZ3AgL37qhKX2383vdmbGLGm8ySLCwmIAnYxpbHjpEeAo4tkI7PMaEYTJMiN3WOYArgywKpWzTHEGSH9NuM3HtLuOzQKaxXKent4vBbIzkOVSpog1n2R9dHQLx9PNz4zZn45jL3eI7dR3mMXSTfjVSg6y6Fjxnzttfta2O0ZbGZatF04ddj89D_OPwSm8gJfStBOGDjTMz5mvU3iPiK5ST889XlsqLTK2e8uWpmQ6vIjYEttOFRFPtuUTnrHe7_GsFNPSCgYLnh_Tcy5od6a2kRHeB3AyipTILCBb_9FK0w7TAlB2AP8FttNgNXKa4nItp1gth83hbbWVwXytJlBWsKGnXiN6hHBZGGKiTY9TpeHqfo6jTFByDilIp85KoGw0f2ftUruagCp6JRThaGC7UYbnJ87tFZ3EADBEjk0v4hIdZS80Mjy87HwfqSNJ7dQuENu_2lneDX8ajnkndcxuxWXqjZa0cttzghL6YjnMRvVuySAwmsmygCQX_nVpXM8TOIuhA4qCM70I5MyujpqyYR9aV3zKuajCQ39RLhOz6BVfelSN4BTbcSRpkvWz0kHF0jEmTfqJ__IrXRJ60DMrA6ANW8Pry0A7twWLeRhsHWpIsA_3RBqcP3nWmmEhAIfzaOpvQTRTDRAA7Nmtsu2tkcxZOyauaw9Cb466ltk5_18L1Ql5CbtHWXzXGvZdUlDZRrAsZPyssF8rJjOhBUOhFMyRgdgoIy2upX9Vk1ejJM79GMWv9W_eTA9a5h4ZlPHHNCPv25JKXq_HLpqnWilKXQse2__WqfVrVgvivdbqh1rfSsrtlwLwPBpCyovyW1xjAMrQ6RDqfW2TvRHynmQalAVCUrio7SxkA_SLqoCtV5r0Qq2GjAoaRXjZwDkRET0fH8DUND8Z7l40OdjbPH6VxcUEQMzktDRuZ6bEVQthFPuRRmqXCu7GQVlCK9t2QlYEIVaPZ73U8G_xkOO8oZeq1TBZF54BuEeYysvi_bvgxIlmaUlvI5YQs5REyuPVcge6NnH9hsVZT41cbGFlVcEGLifYOpF00NhI_tkcKdE6pjbONuMnceIb8Bj6goaqqsddlyqVw6lx7tyqg4jHOv2IlGgKiXLNfIdeT20u5g5DWRaEIwKQBmXkiJ8_2x6yySrO_PVQ5jp_iCIUhCfq2gFGZIe7EK8JlGC6gRGgpDpybo2JcPxqD0hved1o8S2_0MLFC8XfnyxYNrEStgZHZI_8_b3X9VfQsPOxeMjsDWKaqI5D6Vj5sXITdnLUV8X8YWkeH16_sxus7woWQR5e3_ws4CJjRy7qP3t3RnzCAhauBX21cIW0nQ1Tl9VOP3gC9lLp0wFau6B1e4VNaY0Q7lLRBfQQTmHR0GSSPshOrDwBQtR3H9HGlSNuR785wEEecST1PCxlg58O_0lw9GYjUbmNGf0gHVvLaLKi3mJLadIMOv6eMCGCnf39qAFtnFZaKRoPyztefLbSzdrMwtfsiyieUP56BEafRhS3p3ySTD_ZIon34y0uRx5pqdNQ6KbZAxu81pXrztydcypk4zHuGGLQrxjtAxY0v20A1Edvo7f2KBhZbe7WEeXdYP50SZNSzMXFBzBdbQ0lqiw7RmmzLkkmdFiEG2uBSsuzpaTMBrstsZ3XI13a1ljRtziCFWbx2lUtPWMqwBUAPsmiyTG0A5M53AJDgSLuM2v8oyTloI
call fcn.0040be04
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret