Function at 0x40d240
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4538c0]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
push edi
push 0x2f
push esi
mov dword [esp + 0x18], eax
call fcn.004233d0
mov ebx, eax
add esp, 8
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x40d276
mov byte [ebx], 0
push 0x2d
push esi
call fcn.004233d0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x40d28b
mov byte [ebp], 0
push esi
call fcn.0041aa40
add esp, 4
cmp eax, 0xffffffff
jne 0x40d2c0
test ebx, ebx
je 0x40d2a0
mov byte [ebx], 0x2f
test ebp, ebp
je 0x40d2a8
mov byte [ebp], 0x2d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042255f
add esp, 0x2c
ret
lea eax, [esp + 0x1c]
push eax
push esi
push 0x2e
call fcn.0041a7a0
add esp, 0xc
test ebp, ebp
je 0x40d2d8
mov byte [ebp], 0x2d
test eax, eax
je 0x40d2a8
mov si, word [esp + 0x1c]
mov edi, 4
mov ebx, dword [esp + 0x10]
cmp si, 0x17
mov eax, 0x10
mov ecx, edi
cmove ecx, eax
add ebx, 8
push ecx
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x28]
lea ecx, [esp + 0x24]
cmp si, 0x17
cmovne eax, ecx
push eax
push ebx
call fcn.00423770
mov ecx, dword [esp + 0x1c]
add esp, 0xc
movzx eax, si
mov dword [ecx + 4], eax
test ebp, ebp
je 0x40d425
inc ebp
push ebp
call fcn.0041aa40
add esp, 4
cmp eax, 0xffffffff
je 0x40d2a8
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x2e
call fcn.0041a7a0
add esp, 0xc
test eax, eax
jne 0x40d368
lea eax, [edi - 2]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042255f
add esp, 0x2c
ret
mov si, word [esp + 0x1c]
lea eax, [esp + 0x24]
mov ebp, dword [esp + 0x10]
cmp si, 0x17
mov ecx, 0x10
cmove edi, ecx
add ebp, 0x18
lea ecx, [esp + 0x20]
cmp si, 0x17
push edi
cmovne eax, ecx
push eax
push ebp
call fcn.00423770
mov ecx, dword [esp + 0x1c]
add esp, 0xc
movzx eax, si
cmp eax, dword [ecx + 4]
jne 0x40d40d
sub edi, 4
jb 0x40d3c2
nop dword [eax + eax]
mov eax, dword [ebp]
cmp eax, dword [ebx]
jne 0x40d3c9
add ebp, 4
add ebx, 4
sub edi, 4
jae 0x40d3b0
xor ecx, ecx
cmp edi, 0xfffffffc
je 0x40d405
movzx ecx, byte [ebp]
movzx eax, byte [ebx]
sub ecx, eax
jne 0x40d405
cmp edi, 0xfffffffd
je 0x40d405
movzx ecx, byte [ebp + 1]
movzx eax, byte [ebx + 1]
sub ecx, eax
jne 0x40d405
cmp edi, 0xfffffffe
je 0x40d405
movzx ecx, byte [ebp + 2]
movzx eax, byte [ebx + 2]
sub ecx, eax
jne 0x40d405
cmp edi, 0xffffffff
je 0x40d405
movzx ecx, byte [ebp + 3]
movzx eax, byte [ebx + 3]
sub ecx, eax
test ecx, ecx
jns 0x40d4da
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042255f
add esp, 0x2c
ret
push dword [esp + 0x14]
push ebx
mov ebx, ecx
lea eax, [ebx + 0x18]
push eax
call fcn.00423770
mov eax, dword [esp + 0x24]
add esp, 0xc
test eax, eax
je 0x40d4da
mov byte [eax], 0x2f
mov ecx, 0x10
cmp word [esp + 0x1c], 0x17
mov esi, edi
cmove esi, ecx
inc eax
push eax
call fcn.0042f67d
add esp, 4
test eax, eax
js 0x40d4ef
lea ecx, [esi*8]
cmp eax, ecx
jg 0x40d4ef
mov edi, 8
cdq
idiv edi
sub edi, edx
mov ebp, eax
and edi, reloc.WS2_32.dll_getsockopt
jns 0x40d48d
dec edi
or edi, 0xfffffff8
inc edi
xor ecx, ecx
test edi, edi
setg cl
add ecx, ebp
cmp esi, ecx
jle 0x40d4b1
lea eax, [ebx + 0x17]
add eax, esi
sub esi, ecx
mov byte [eax - 0x10], 0
lea eax, [eax - 1]
mov byte [eax + 1], 0xff
sub esi, 1
jne 0x40d4a1
test edi, edi
je 0x40d4da
mov al, byte [ebx + ebp + 8]
lea edx, [edi - 1]
mov cl, byte [ebx + ebp + 0x18]
movzx eax, al
movzx ecx, cl
btr eax, edx
bts ecx, edx
dec edx
sub edi, 1
jne 0x40d4c0
mov byte [ebx + ebp + 8], al
mov byte [ebx + ebp + 0x18], cl
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042255f
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042255f
add esp, 0x2c
ret