Function at 0x427660
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp + 0xc]
push str._CS18_2
mov dword [ebp - 0x35c], eax
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
mov cx, word [0x43c034]
cmp ch, 3
jne 0x4276ab
movsx eax, byte [0x43c036]
mov dword [eax], 3
jmp 0x4276bf
mov al, cl
xor al, 0x36
cmp al, ch
je 0x4276c6
movsx eax, byte [0x43c036]
movsx ecx, ch
mov dword [eax], ecx
mov cx, word [0x43c034]
mov ax, word [0x43c038]
push ebx
push esi
push edi
cmp ah, 5
jne 0x4276e2
movsx eax, byte [0x43c036]
movsx ecx, cl
mov dword [eax], ecx
jmp 0x427702
movsx edx, al
movsx esi, ah
xor esi, edx
add edx, 0x20
cmp esi, edx
je 0x42770f
movsx esi, byte [0x43c036]
movsx edx, cl
movsx eax, ch
xor edx, eax
mov dword [edx], esi
mov ax, word [0x43c038]
mov cx, word [0x43c034]
mov dx, word [0x445c68]
test dl, dl
je 0x42771e
test dh, dh
jne 0x42772a
movsx ecx, al
mov byte [ecx], ah
mov cx, word [0x43c034]
mov dl, byte [0x445668]
mov bl, byte [0x44566a]
mov bh, byte [0x44566b]
movzx edi, bl
movzx eax, dl
movzx esi, bh
add eax, edi
mov byte [ebp - 0x34d], dl
cmp esi, eax
je 0x427778
and esi, edi
movzx eax, dl
mov word [esi], ax
mov dl, byte [0x445668]
mov bh, byte [0x44566b]
mov bl, byte [0x44566a]
mov cx, word [0x43c034]
mov byte [ebp - 0x34d], dl
movzx eax, dl
mov dword [ebp - 0x34c], eax
movzx esi, bh
movzx edi, bl
mov eax, esi
sub eax, edi
cdq
idiv dword [ebp - 0x34c]
mov dl, byte [0x445669]
mov byte [ebp - 0x34e], dl
add eax, esi
movzx edx, dl
cmp edx, eax
je 0x4277d3
and edi, dword [ebp - 0x34c]
mov al, byte [ebp - 0x34e]
mov byte [edi], al
mov al, byte [0x445668]
mov bh, byte [0x44566b]
mov bl, byte [0x44566a]
mov cx, word [0x43c034]
mov byte [ebp - 0x34d], al
movsx eax, ch
movzx esi, bh
cdq
idiv esi
movsx edx, byte [0x43c03d]
cmp eax, edx
je 0x427807
mov cl, byte [ebp - 0x34d]
movzx eax, bl
and eax, esi
mov byte [eax], cl
mov bh, byte [0x44566b]
mov bl, byte [0x44566a]
mov cx, word [0x43c034]
movsx eax, ch
cdq
movzx esi, bh
idiv esi
movzx edi, byte [0x44566c]
imul eax, edi
mov edx, edi
mov ecx, edi
shl edx, cl
cmp edx, eax
jne 0x427835
mov al, byte [0x44566c]
cmp al, 8
je 0x427835
cmp al, 1
je 0x427835
test al, al
jne 0x427856
mov edx, edi
imul edx, edi
mov al, dl
inc al
shl al, cl
mov ecx, edx
imul ecx, edi
shl edx, cl
mov byte [edx + 0x43c040], al
movsx eax, al
mov byte [eax + 0x445668], bl
xor eax, eax
mov dword [ebp - 0x360], eax
nop
cmp byte [eax + 0x440eb8], 0
jne 0x427ae0
mov eax, dword [0x43c044]
inc byte [eax + 6]
mov esi, dword [0x43c044]
mov dword [ebp - 0x34c], esi
movsx ebx, byte [esi + 6]
movsx eax, byte [esi + 2]
movsx edx, byte [esi + 9]
movsx ecx, byte [esi + 8]
mov dword [ebp - 0x358], eax
add eax, ebx
imul eax, edx
movsx edi, byte [esi + 1]
movsx esi, byte [esi + 3]
mov dword [ebp - 0x338], ecx
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x354], ebx
movsx ecx, byte [eax + ecx]
mov eax, edi
imul eax, edx
mov edx, dword [ebp - 0x34c]
mov bl, byte [ecx + edx]
movsx eax, byte [eax + edx]
add bl, byte [eax + edx]
mov eax, esi
imul eax, dword [ebp - 0x338]
movsx ecx, byte [eax + edx]
mov eax, dword [ebp - 0x354]
add eax, esi
imul ecx, eax
movsx eax, byte [edx + 7]
imul ecx, edi
mov edi, dword [ebp - 0x34c]
movsx ecx, byte [ecx + edx]
movsx esi, byte [ecx + edx]
cdq
idiv dword [ebp - 0x358]
movsx ecx, byte [eax + edi]
mov eax, dword [ebp - 0x354]
cdq
idiv dword [ebp - 0x338]
imul esi, ecx
mov ecx, eax
mov eax, esi
cdq
idiv ecx
mov byte [eax + edi], bl
mov edx, dword [0x43c044]
movsx eax, byte [edx + 2]
movsx ecx, byte [edx + 6]
add ecx, eax
movsx eax, byte [edx + 9]
imul ecx, eax
movsx eax, byte [ecx + edx]
inc byte [eax + edx]
mov esi, dword [0x43c044]
movsx eax, byte [esi + 5]
movsx edx, byte [esi + 7]
movsx ecx, byte [esi + 6]
imul edx, eax
mov al, byte [esi + 1]
imul edx, ecx
imul edx, ecx
mov byte [edx + esi], al
mov eax, dword [0x43c044]
inc byte [eax + 1]
mov ecx, dword [0x43c044]
mov dword [ebp - 0x34c], ecx
movsx edi, byte [ecx + 3]
movsx esi, byte [ecx + 4]
mov eax, edi
cdq
idiv esi
mov bl, byte [ecx + 1]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x34c]
movsx ecx, bl
mov dword [ebp - 0x358], ecx
movsx eax, byte [eax]
imul eax, ecx
cdq
idiv dword [ebp - 0x338]
mov edx, dword [ebp - 0x34c]
movsx ecx, byte [eax + edx]
mov eax, esi
mov esi, dword [ebp - 0x34c]
mov bh, byte [ecx + edx]
movsx ecx, byte [edx + 9]
add bh, bl
cdq
idiv ecx
mov ecx, eax
movsx eax, byte [esi + 2]
imul eax, edi
cdq
idiv ecx
movsx eax, byte [eax + esi]
movsx eax, byte [eax + esi]
imul eax, dword [ebp - 0x358]
cdq
idiv dword [ebp - 0x338]
mov byte [eax + esi], bh
mov edi, dword [0x43c044]
movsx eax, byte [edi + 3]
movsx ecx, byte [edi + 4]
cdq
idiv ecx
movsx ecx, byte [edi]
mov esi, eax
movsx eax, byte [edi + 1]
imul eax, ecx
cdq
idiv esi
movsx eax, byte [eax + edi]
inc byte [eax + edi]
mov esi, dword [0x43c044]
mov dword [ebp - 0x34c], esi
movsx ebx, byte [esi + 6]
movsx eax, byte [esi + 2]
movsx edx, byte [esi + 9]
movsx ecx, byte [esi + 8]
movsx edi, byte [esi + 1]
mov dword [ebp - 0x358], eax
add eax, ebx
imul eax, edx
movsx esi, byte [esi + 3]
mov dword [ebp - 0x354], ecx
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x338], ebx
movsx ecx, byte [eax + ecx]
mov eax, edi
imul eax, edx
mov edx, dword [ebp - 0x34c]
mov bl, byte [ecx + edx]
movsx eax, byte [eax + edx]
add bl, byte [eax + edx]
mov eax, esi
imul eax, dword [ebp - 0x354]
movsx ecx, byte [eax + edx]
mov eax, dword [ebp - 0x338]
add eax, esi
imul ecx, eax
movsx eax, byte [edx + 7]
imul ecx, edi
mov edi, dword [ebp - 0x34c]
movsx ecx, byte [ecx + edx]
movsx esi, byte [ecx + edx]
cdq
idiv dword [ebp - 0x358]
movsx ecx, byte [eax + edi]
mov eax, dword [ebp - 0x338]
cdq
idiv dword [ebp - 0x354]
imul esi, ecx
mov ecx, eax
mov eax, esi
cdq
idiv ecx
mov byte [eax + edi], bl
mov edx, dword [0x43c044]
movsx ecx, byte [edx + 6]
movsx eax, byte [edx + 2]
add ecx, eax
movsx eax, byte [edx + 9]
imul ecx, eax
movsx eax, byte [ecx + edx]
inc byte [eax + edx]
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp eax, 3
jb 0x427860
mov bl, byte [0x43c040]
mov dl, byte [0x43c041]
cmp bl, 8
je 0x427b06
cmp dl, 0x17
jne 0x427b18
mov al, byte [0x43ccd7]
mov cl, byte [0x43c889]
shl al, cl
mov byte [0x43c275], al
test bl, bl
jne 0x427b21
cmp dl, 6
je 0x427b2f
mov al, byte [0x43c04c]
mov cl, al
shl al, cl
mov byte [0x43c0ba], al
mov ax, word [0x43c03c]
test al, al
jne 0x427b49
mov ax, word [0x43c038]
movsx ecx, al
movsx eax, ah
mov dword [eax], ecx
jmp 0x427b73
movsx esi, byte [0x43c039]
mov cl, ah
mov edx, esi
sar edx, cl
movsx ecx, byte [0x43c034]
sub ecx, 4
cmp edx, ecx
je 0x427b73
movsx ecx, byte [0x43c03a]
mov eax, esi
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [0x440ec0]
mov dword [ebp - 0x354], eax
mov eax, dword [0x440ec4]
push 0x104
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x230]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x1f
push 8
call fcn.00431c50
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x360], esi
test esi, esi
jne 0x427bbf
mov esi, 8
mov dword [ebp - 0x360], esi
xor edi, edi
push 0xff
push 1
call fcn.00431c50
mov byte [ebp + edi - 0x230], al
add esp, 8
inc edi
cmp edi, esi
jb 0x427bc1
mov eax, dword [0x444d84]
mov dword [ebp - 0x348], 0
test eax, eax
je 0x427bfa
movsx edx, byte [0x444da1]
xor edx, eax
jmp 0x427bfc
xor edx, edx
mov ecx, 0x444da0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427c04
movsx eax, byte [0x444da2]
sub ecx, edi
xor eax, dword [0x444d88]
add eax, edx
add eax, ecx
add eax, esi
push eax
lea eax, [ebp - 0x374]
push 0x4349e4
push eax
call fcn.0041e810
push 0x64
push 0
movq xmm0, qword [eax]
movq qword [ebp - 0x344], xmm0
mov eax, dword [eax + 8]
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll_memset
push 0x64
lea eax, [ebp - 0x12c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov al, byte [0x444da2]
add esp, 0x24
mov ecx, dword [0x444d88]
movsx edx, al
xor edx, ecx
je 0x427caf
mov ecx, 0x444da0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427c81
sub ecx, edi
lea eax, [ebp - 0x70]
push ecx
push 0x444da0
push 0
push edx
push eax
push 0x445280
call fcn.004310f0
mov ecx, dword [0x444d88]
add esp, 0x18
mov al, byte [0x444da2]
movsx eax, al
xor eax, ecx
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.0041e7a0
mov eax, dword [0x444d84]
add esp, 0xc
test eax, eax
je 0x427d0c
movsx edi, byte [0x444da1]
xor edi, eax
je 0x427d0e
mov ecx, 0x444da0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427ce4
sub ecx, edx
lea eax, [ebp - 0x12c]
push ecx
push 0x444da0
push 0
push edi
push eax
push 0x444e80
call fcn.004310f0
add esp, 0x18
jmp 0x427d0e
xor edi, edi
push edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.0041e7a0
mov ecx, 0x444da0
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427d30
sub ecx, edx
lea eax, [ebp - 0x344]
push ecx
push 0x444da0
push eax
call fcn.0041e7a0
push esi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.0041e7a0
mov al, byte [0x440eac]
add esp, 0x18
cmp al, byte [0x444da0]
jne 0x427de5
mov dl, byte [0x440eaa]
mov al, byte [ebp - 0x70]
cmp dl, al
je 0x427da9
movsx eax, byte [0x440ea9]
movsx ecx, byte [eax + 0x444da0]
movsx eax, byte [0x43c03a]
xor ecx, eax
movsx eax, byte [ecx + 0x43c038]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, byte [ebp - 0x70]
mov dl, byte [0x440eaa]
mov cl, byte [0x440ea9]
cmp cl, al
jne 0x427de5
movsx ecx, cl
movsx eax, dl
movsx eax, byte [ecx + eax + 0x440ea8]
movsx eax, byte [eax + 0x440ea8]
movsx ecx, byte [eax + 0x444da0]
movsx eax, byte [0x43c03a]
xor ecx, eax
movsx eax, byte [ecx + 0x43c038]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
push dword [0x445b44]
lea eax, [ebp - 0x230]
push 0x445b60
push esi
push eax
push eax
call fcn.00430060
lea eax, [ebp - 0x344]
push 2
push eax
call fcn.0041edd0
lea eax, [ebp - 0x348]
push 0
push eax
call fcn.00422990
add esp, 0x24
mov byte [ebp - 0x34e], al
call fcn.00422730
mov ecx, dword [ebp - 0x348]
xor ebx, ebx
test ecx, ecx
je 0x4281c8
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x34c], eax
mov eax, edx
shrd dword [ebp - 0x34c], eax, 8
mov al, dl
mov dword [ebp - 8], edx
and al, 0xf8
cmp al, 0xc0
jne 0x427fc6
mov al, byte [ebp - 0x34c]
xor al, 8
cmp al, 0xde
jne 0x427f4c
mov eax, dword [ecx]
shrd eax, edx, 0x18
xor al, byte [ecx]
cmp al, 0x57
jne 0x427e85
mov ebx, 1
jmp 0x42803e
cmp byte [ebp - 0x34c], bl
je 0x42803e
mov bh, byte [ebp - 0xa]
nop dword [eax]
nop dword [eax + eax]
cmp dword [ebp - 0x35c], 0
je 0x428036
movzx ecx, byte [ebp - 8]
movzx eax, bh
mov edx, eax
shr edx, cl
movzx eax, byte [ebp + eax - 0xc]
movzx eax, byte [ebp + eax - 0xc]
movzx ecx, byte [ebp + eax - 0xc]
mov al, byte [ebp + edx - 0xc]
lea edx, [ebp - 0xc]
mov byte [ebp + ecx - 0xc], al
movzx eax, byte [ebp - 0xa]
movzx eax, byte [ebp + eax - 0xc]
movzx eax, byte [ebp + eax - 0xc]
add edx, eax
mov cl, byte [edx]
movzx eax, cl
inc cl
movzx eax, byte [ebp + eax - 0xc]
mov byte [edx], cl
mov dword [ebp - 0x358], eax
movzx eax, byte [ebp - 0xa]
movzx eax, byte [ebp + eax - 0xc]
inc byte [ebp + eax - 0xc]
movzx eax, byte [ebp - 0xa]
inc byte [ebp + eax - 0xc]
mov bh, byte [ebp - 0xa]
movzx ecx, byte [ebp - 7]
inc bh
movzx edi, byte [ebp - 9]
mov eax, dword [ebp - 0x358]
mov bl, byte [ebp - 0xb]
push ecx
movzx ecx, bh
imul edi, ecx
movzx edx, bl
push edx
inc byte [ebp - 8]
mov byte [ebp - 0xa], bh
imul edi, eax
add edi, edx
cdq
idiv edi
call eax
add esp, 8
test bl, bl
jne 0x427ea0
jmp 0x428036
cmp byte [ecx], bl
je 0x42803e
mov bl, byte [ebp - 0xa]
mov bh, byte [ebp - 0xb]
nop word [eax + eax]
cmp dword [ebp - 0x35c], 0
je 0x428036
movzx ecx, bh
mov eax, ecx
movzx edx, bl
xor eax, edx
shl edx, cl
mov al, byte [ebp + eax - 0xc]
mov byte [ebp + edx - 0xc], al
mov bl, byte [ebp - 0xa]
mov bh, byte [ebp - 0xb]
movzx edi, byte [ebp - 7]
mov cl, bh
movzx eax, bl
inc bh
shl eax, cl
inc bl
movzx ecx, byte [ebp - 9]
movzx edx, bl
imul edi, edx
movzx eax, byte [ebp + eax - 0xc]
push ecx
movzx ecx, byte [ebp - 8]
push edx
imul edi, eax
cdq
mov byte [ebp - 0xb], bh
mov byte [ebp - 0xa], bl
add edi, ecx
idiv edi
call eax
add esp, 8
cmp byte [ebp - 0xc], 0
jne 0x427f60
jmp 0x428036
cmp byte [ebp - 0x34c], bl
je 0x42803e
mov bl, byte [ebp - 9]
mov bh, byte [ebp - 0xb]
mov esi, dword [ebp - 0x35c]
nop word [eax + eax]
test esi, esi
je 0x428030
movzx edx, bl
mov cl, bh
mov eax, edx
shl eax, cl
mov al, byte [ebp + eax - 0xc]
mov byte [ebp + edx - 0xc], al
mov bl, byte [ebp - 9]
movzx edi, byte [ebp - 0xc]
mov bh, byte [ebp - 0xb]
movzx eax, bl
inc bh
inc bl
movzx ecx, bl
push ecx
movzx eax, byte [ebp + eax - 0xc]
movzx ecx, byte [ebp - 0xa]
imul edi, eax
push ecx
movzx ecx, bh
cdq
mov byte [ebp - 9], bl
inc edi
mov byte [ebp - 0xb], bh
imul edi, ecx
idiv edi
call eax
add esp, 8
test bh, bh
jne 0x427fe0
mov esi, dword [ebp - 0x360]
mov ecx, dword [ebp - 0x348]
xor ebx, ebx
mov edi, dword [ebp - 0x364]
test edi, edi
je 0x42805d
lea edx, [ecx + 0x20]
sub edi, edx
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [edi + edx - 1], al
test al, al
jne 0x428050
xor eax, eax
xorps xmm0, xmm0
mov dword [ebp - 0x338], eax
movq qword [ebp - 0xc], xmm0
cmp ebx, 1
jne 0x428184
add ecx, 0x20
mov ebx, ecx
mov dword [ebp - 0x364], ecx
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x428084
sub ebx, edx
lea eax, [ebp - 0xc8]
push 0x55
push 0
push eax
mov edi, dword [ecx + ebx + 1]
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x334]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [0x445b44]
lea eax, [ebp - 0xc8]
push eax
push 0x445b60
push 0x445a40
call fcn.004300b0
push dword [0x445b44]
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x334]
push eax
mov eax, dword [ebp - 0x364]
add eax, 5
add eax, ebx
push edi
push eax
call fcn.0042fab0
add esp, 0x40
lea eax, [ebp - 0xc8]
push 0x55
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [0x445b44]
lea eax, [ebp - 0x334]
push 0x445b60
push esi
push eax
push eax
call fcn.00430060
add esp, 0x20
xor ecx, ecx
test esi, esi
je 0x428173
mov dl, 1
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x334]
cmp al, byte [ebp + ecx - 0x230]
jne 0x428163
inc ecx
cmp ecx, esi
jb 0x428140
mov ecx, dword [ebp - 0x348]
mov eax, dword [ebp - 0x338]
jmp 0x428187
mov ecx, dword [ebp - 0x348]
xor dl, dl
mov eax, dword [ebp - 0x338]
jmp 0x428187
mov dl, byte [ebp - 0xb]
mov ecx, dword [ebp - 0x348]
mov eax, dword [ebp - 0x338]
jmp 0x428187
mov dl, byte [ebp - 0xc]
test esi, esi
je 0x42818f
test eax, eax
jne 0x428191
mov dl, al
push ecx
movzx ebx, dl
call fcn.00432902
add esp, 4
cmp ebx, 1
jne 0x4281c0
mov eax, dword [ebp - 0x354]
cmp eax, dword [0x440ec0]
jne 0x4281c0
mov eax, dword [ebp - 0x368]
cmp eax, dword [0x440ec4]
jne 0x4281c0
xor ebx, ebx
mov ecx, dword [ebp - 0x348]
jmp 0x4281d6
cmp byte [ebp - 0x34e], bl
mov eax, 2
cmove ebx, eax
test esi, esi
mov eax, esi
cmovne eax, ebx
mov dword [ebp - 0x368], eax
jne 0x428246
mov edx, dword [ebp - 0x35c]
xor edi, edi
mov ebx, edx
shl ebx, 5
test edx, edx
je 0x428246
mov eax, dword [ebx + ecx - 8]
sub ebx, 0x20
movups xmm0, xmmword [edi + ecx - 0x20]
shl eax, 5
sub edi, 0x20
dec esi
push edx
push esi
movups xmmword [eax + ecx], xmm0
movups xmm0, xmmword [edi + ecx + 0x10]
movups xmmword [eax + ecx + 0x10], xmm0
mov eax, edx
imul eax, edx
add eax, esi
mov ecx, eax
imul ecx, esi
imul ecx, esi
inc ecx
imul ecx, edx
cdq
idiv ecx
call eax
add esp, 8
test edi, edi
jne 0x428246
mov ecx, dword [ebp - 0x348]
mov edx, dword [ebp - 0x35c]
jmp 0x4281f2
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x368]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041d5bd
mov esp, ebp
pop ebp
ret