Function at 0x402ba0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov byte [ebp - 0x2a], 0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], 0x6b6e753c
mov dword [ebp - 0x24], 0x6e776f6e
mov dword [ebp - 0x20], 0x3e
mov word [ebp - 0x1c], 0
mov byte [ebp - 0x1a], 0
mov dword [ebp - 0x38], 0x6b6e753c
mov dword [ebp - 0x34], 0x6e776f6e
mov dword [ebp - 0x30], 0x3e
mov word [ebp - 0x2c], 0
mov eax, dword [edi]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 1
test eax, eax
je 0x402c70
mov edx, dword [edi + 4]
test edx, edx
je 0x402c70
movzx eax, byte [eax + 0x3a]
xor esi, esi
cmp esi, eax
jge 0x402c70
nop
lea eax, [esi + esi*8]
add eax, eax
movzx ebx, word [edx + eax + 0x10]
movzx ecx, byte [edx + eax + 0xf]
shr ebx, 7
xor ebx, 1
mov byte [ebp - 0x39], cl
and ebx, 1
test cl, cl
jne 0x402c3e
test ebx, ebx
je 0x402c3e
mov ecx, dword [ebp - 0x44]
test ecx, ecx
jne 0x402e14
cmp byte [ebp - 0x39], 0x20
je 0x402e00
cmp byte [ebp - 0x39], 3
je 0x402dc0
mov eax, dword [edi]
inc esi
movzx eax, byte [eax + 0x3a]
cmp esi, eax
jge 0x402c70
mov edx, dword [edi + 4]
jmp 0x402c10
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402d50
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
call sub.cygwin1.dll_inet_ntoa
lea ecx, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], 0x4027d5
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
call sub.cygwin1.dll_printf
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x402d30
mov dword [esp], 0x402b73
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_printf
mov edx, dword [edi + 8]
test edx, edx
je 0x402d20
mov dword [esp], 0x4027f0
movzx eax, byte [edx]
mov dword [esp + 4], eax
movzx eax, byte [edx + 1]
mov dword [esp + 8], eax
movzx eax, byte [edx + 2]
mov dword [esp + 0xc], eax
movzx eax, byte [edx + 3]
mov dword [esp + 0x10], eax
movzx eax, byte [edx + 4]
mov dword [esp + 0x14], eax
movzx eax, byte [edx + 5]
mov dword [esp + 0x18], eax
call sub.cygwin1.dll_printf
add esp, 0x5c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xa
call sub.cygwin1.dll_putchar
jmp 0x402d13
mov dword [esp], 0x402b7a
call sub.cygwin1.dll_printf
jmp 0x402cb3
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_inet_ntoa
lea ecx, [ebp - 0x28]
mov dword [esp], 0x402b83
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call sub.cygwin1.dll_printf
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x402da5
mov dword [esp], 0x402b8e
mov dword [esp + 4], 0x402b7a
call sub.cygwin1.dll_printf
lea eax, [ebp - 0x38]
mov dword [esp], 0x40284e
mov dword [esp + 4], eax
call sub.cygwin1.dll_printf
jmp 0x402cd1
mov dword [esp], 0x402b8e
mov dword [esp + 4], 0x402b94
jmp 0x402d88
test ebx, ebx
je 0x402c52
lea eax, [ebp - 0x38]
mov dword [esp], eax
lea eax, [esi + esi*8]
mov edx, dword [edi + 4]
mov dword [esp + 8], 0xf
lea eax, [edx + eax*2]
mov dword [esp + 4], eax
call sub.cygwin1.dll_strncpy
mov byte [ebp - 0x29], 0
jmp 0x402c52
test ebx, ebx
je 0x402c48
mov dword [ebp - 0x40], 1
jmp 0x402c48
mov dword [esp + 8], 0xf
lea ecx, [ebp - 0x28]
lea eax, [eax + edx]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.cygwin1.dll_strncpy
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x44], 0
jmp 0x402c3e