Function at 0x40183c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push eax
push ebx
push ecx
push edx
push edi
push esi
push 0x400
lea eax, [ebp - 0x400]
push eax
call fcn.00401c29
push 4
lea eax, [ebp - 0x404]
push eax
call fcn.00401c29
jl 0x40186f
jge 0x40186f
test eax, 0x8b10758b
jge 0x40187d
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
jmp 0x4018a9
jo 0x401881
add esi, dword [ecx + 1]
jno 0x401881
inc esi
mov al, byte [ebx + edi]
xor byte [esi], al
jp 0x40188c
jnp 0x40188c
popal
adc al, 0x46
inc esi
inc ebx
dec ecx
cmp ebx, dword [ebp + 0xc]
jne 0x4018a2
jge 0x40189a
jl 0x40189a
add al, 0x33
invalid
xor ebx, ebx
jb 0x4018a2
jae 0x4018a2
lcall 0x6c03, 0x79057816
js 0x4018a9
jns 0x4018a9
insb byte es:[edi], dx
das
lodsb al, byte [esi]
cmp ecx, 0
jg 0x40187c
mov eax, 0xfffefdfc
mov ecx, 0x40
mov dword [ebp + ecx*4 - 0x404], eax
sub eax, 0x4040404
dec ecx
jne 0x4018b8
xor eax, eax
jb 0x4018d0
jae 0x4018d0
mul dword [esi - 2]
mov edi, dword [ebp + 8]
je 0x4018d9
jne 0x4018d9
iretd
xor ebx, ebx
jbe 0x4018e0
ja 0x4018e0
invalid
mov esi, dword [ebp + 0xc]
jl 0x4018e9
jge 0x4018e9
test al, 0x74
jmp 0x4018fe
inc bl
je 0x4018fb
jne 0x4018fb
xor dh, byte [ecx + ebp + 0x71db744e]
add al, 0x70
add al, byte [edx + 8]
dec esi
je 0x4018d9
jno 0x401904
jo 0x401904
inc edx
or byte [esi], dh
mov dl, byte [ecx + ebp - 0x400]
mov dl, byte ss:[ecx + ebp - 0x400]
jnp 0x401911
jp 0x401911
jbe 0x401914
add al, byte [ebx + edi]
add al, 0x3b
add al, dl
jnp 0x40191b
jp 0x40191b
and esi, dword [esi]
mov dh, byte [eax + ebp - 0x400]
mov dh, byte ss:[eax + ebp - 0x400]
jp 0x40192a
jnp 0x40192a
fisttp qword [ebx + 0x1e]
mov byte ss:[ecx + ebp - 0x400], dh
jl 0x401939
jge 0x401939
retf 0xfbd
mov byte ss:[eax + ebp - 0x400], dl
inc cl
jne 0x4018f2
sub byte [eax], al
cld
invalid
jns 0x40194b
js 0x40194b
out dx, eax
pushfd
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
test edi, edi
js 0x401959
jns 0x401959
mov eax, dword [0x757f7426]
add esi, dword [ecx + eax + 0x7f]
je 0x4019da
jne 0x401960
je 0x401960
jg 0x401994
xor eax, eax
xor edx, edx
sal byte [ebx], 0xd2
xor ecx, ecx
jle 0x40196c
jg 0x40196c
push es
arpl word [ebx], si
fstp xword [edx + 3]
xor ebx, ebx
jp 0x401973
jnp 0x401973
mov al, byte [0x8a36c3fe]
xchg esp, eax
sub eax, dword [eax]
cld
invalid
inc bl
mov dl, byte ss:[ebx + ebp - 0x400]
jne 0x401982
je 0x401982
xchg byte [edx], al
ret 0x477
add al, dl
ja 0x40198a
jbe 0x40198a
jbe 0x40193c
mov cl, byte ss:[eax + ebp - 0x400]
mov byte ss:[ebx + ebp - 0x400], cl
js 0x4019a1
mov word [ebx], gs
add ah, bh
invalid
jns 0x4019a1
cwde
pop es
mov byte ss:[eax + ebp - 0x400], dl
add cl, dl
jl 0x4019b2
jge 0x4019b2
test cl, dh
jns 0x4019e9
mov cl, byte ss:[ecx + ebp - 0x400]
mov cl, byte [ecx + ebp - 0x400]
xor byte [esi], cl
inc esi
dec edi
jne 0x40196e
xor eax, eax
jp 0x4019c7
jnp 0x4019c7
popfd
lea edi, [ebp - 0x400]
jb 0x4019d2
jae 0x4019d2
mov bh, byte [ecx + 0x40]
mov ecx, 0x40
cld
rep stosd dword es:[edi], eax
jno 0x4019df
jo 0x4019df
sbb eax, 0x8b10758b
jge 0x4019ed
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
jns 0x4019ef
add eax, 0xaf8a0378
js 0x4019ef
mov ch, byte [edi - 0x1424ccd5]
scasd eax, dword es:[edi]
sub esi, dword [ebx]
fucomi st(3)
xor ebx, ebx
jmp 0x401a22
das
mov al, byte [ebx + edi]
jge 0x4019fc
jl 0x4019fc
sar dword [ebx + 0x30], 6
xor byte [esi], al
jae 0x401a05
jb 0x401a05
ror byte [ebp + ebp*8 + 0x7a057b46], 1
add edi, dword [ebx - 0x34]
inc esi
jnp 0x401a0d
jp 0x401a0d
jnp 0x4019d8
pushal
inc ebx
dec ecx
jge 0x401a15
jl 0x401a15
inc eax
ja 0x401a51
cmp ebx, dword [ebp + 0xc]
jne 0x401a22
pop ebp
or al, 0x75
or byte [edx + 4], bh
jp 0x401a20
jnp 0x401a20
fild dword [edx - 0x67c24cd]
add byte [edi - 0x34], bh
xor ebx, ebx
cmp ecx, 0
jg 0x4019f3
jbe 0x401a2d
ja 0x401a2d
test bh, bl
ja 0x401a32
jbe 0x401a32
ja 0x401a91
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0x10
or ch, byte [edx - 1]
push dword [ebp + 0x14]
call sub.kernel32.dll_WaitForSingleObject
mov esi, dword [ebp + 0xc]
jmp 0x401aa5
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call fcn.00401bef
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x401aab
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.wsock32.dll_send
or al, ch
xchg ebx, eax
push cs
add byte [eax], al
test eax, eax
jle 0x401aab
sub dword [ebp + 0x10], eax
add esi, eax
dec dword [ebp - 4]
je 0x401aab
cmp dword [ebp + 0x10], 0
jne 0x401a61
cmp dword [ebp + 0x14], 0
je 0x401ab9
push dword [ebp + 0x14]
call sub.kernel32.dll_SetEvent
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
leave
ret 0x10