Function at 0x411510
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xcc
mov eax, dword [0x49d548]
xor eax, esp
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xd8]
push ebx
mov ebx, dword [esp + 0xd4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x38], eax
mov eax, dword [ebx]
mov dword [esp + 0x2c], ebx
mov dword [eax + 8], 0
mov eax, dword [esp + 0xe4]
mov dword [esp + 0xc], eax
cmp eax, 4
ja 0x411d80
push esi
push ebx
call fcn.004150c0
mov esi, dword [ebx]
add esp, 4
test eax, eax
jne 0x4115a4
push eax
push dword [esi + 8]
push ebx
call fcn.00415540
add esp, 0xc
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00478d37
add esp, 0xcc
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esi + 8]
mov dword [esp + 0x20], edx
test eax, eax
jne 0x4115c4
cmp edx, 3
setge al
lea eax, [eax*2 + 1]
mov dword [esp + 0x10], eax
mov ecx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [esp + 0x18], ecx
push ebp
push edi
cmp edx, 3
jne 0x4115fb
cmp dword [ebx + 0x47ec], 3
je 0x4115f0
cmp dword [ebx + 0x47e8], 0
jne 0x4115fb
cmp dword [ebx + 0x47e4], 0
jne 0x4115fb
mov ebp, 1
mov dword [esp + 0x30], ebp
jmp 0x411606
xor ebp, ebp
mov dword [esp + 0x30], ebp
cmp edx, 3
jne 0x411619
cmp eax, 3
jge 0x411619
test ebp, ebp
jne 0x411619
mov dword [esp + 0x28], 1
jmp 0x411627
mov ecx, esi
test edx, edx
jle 0x411712
mov ecx, dword [esp + 0x20]
lea edi, [ebx + 0x46a0]
mov dword [esp + 0x10], 0
lea ebp, [esp + 0x64]
mov dword [esp + 0x1c], edi
nop dword [eax]
mov eax, dword [ebx]
mov eax, dword [eax]
add eax, 3
push eax
call ecx
add esp, 4
mov dword [edi + 0x34], eax
test eax, eax
je 0x411779
mov eax, dword [ebx + 0x4684]
cdq
idiv dword [edi]
mov dword [ebp + 0x10], 0
mov esi, eax
mov eax, dword [ebx + 0x4688]
cdq
idiv dword [edi + 4]
xor edx, edx
mov dword [ebp], esi
mov edi, eax
mov ecx, eax
mov dword [ebp + 4], edi
sar ecx, 1
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebx]
mov eax, dword [ecx]
dec eax
add eax, esi
div esi
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x28]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp esi, 1
jne 0x4116bf
cmp edi, esi
jne 0x4116ae
mov eax, 0x411db0
jmp 0x4116e6
mov esi, 1
cmp edi, 2
jne 0x4116d0
mov eax, 0x41dbc0
jmp 0x4116e6
cmp esi, 2
jne 0x4116e1
cmp edi, 1
jne 0x4116d0
mov eax, 0x41d890
jmp 0x4116e6
cmp esi, 2
jne 0x4116e1
cmp edi, esi
jne 0x4116e1
mov eax, dword [ebx + 0x4814]
jmp 0x4116e6
mov eax, 0x41d840
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
inc esi
mov ecx, dword [esp + 0x20]
add edi, 0x48
mov dword [ebp - 0xc], eax
add ebp, 0x20
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], edi
cmp esi, dword [esp + 0x28]
jl 0x411640
mov esi, dword [ebx]
mov ecx, esi
mov ebp, dword [esp + 0x18]
mov eax, ecx
mov edi, dword [esi + 4]
mov esi, dword [esi]
test ebp, ebp
js 0x411786
test esi, esi
js 0x411786
je 0x411733
mov eax, 0x7fffffff
cdq
idiv esi
cmp ebp, eax
jg 0x411788
mov eax, esi
mov edx, ecx
imul eax, ebp
mov dword [esp + 0x2c], eax
test eax, eax
js 0x411782
test edi, edi
js 0x411782
je 0x411756
mov eax, 0x7fffffff
cdq
idiv edi
cmp dword [esp + 0x2c], eax
jg 0x411788
imul esi, edi
imul esi, ebp
cmp esi, 0x7ffffffe
jg 0x411788
lea eax, [esi + 1]
push eax
call dword [esp + 0x24]
mov ecx, dword [ebx]
add esp, 4
mov edi, eax
mov dword [esp + 0x20], eax
jmp 0x41178e
mov eax, dword [ebx]
push 0
push dword [eax + 8]
jmp 0x411796
mov ecx, edx
jmp 0x411788
mov ecx, eax
xor edi, edi
mov dword [esp + 0x20], edi
test edi, edi
jne 0x4117c4
push edi
push dword [ecx + 8]
push ebx
call fcn.00415540
add esp, 0xc
mov dword [0x49ddd0], 0x47ee7c
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00478d37
add esp, 0xcc
ret
xor eax, eax
mov dword [esp + 0x2c], eax
cmp dword [ecx + 4], eax
jbe 0x411d3a
mov ebp, dword [esp + 0x48]
mov esi, dword [ecx]
mov edx, dword [esp + 0x18]
imul esi, eax
mov dword [esp + 0x10], 0
imul esi, edx
add esi, edi
cmp dword [esp + 0x28], 0
jle 0x411880
lea ebp, [ebx + 0x46bc]
mov ebx, dword [esp + 0x28]
lea edi, [esp + 0x70]
mov eax, dword [edi - 8]
sar eax, 1
cmp dword [edi], eax
jl 0x411814
mov edx, dword [edi - 0x14]
jmp 0x411817
mov edx, dword [edi - 0x10]
jl 0x41181e
mov eax, dword [edi - 0x10]
jmp 0x411821
mov eax, dword [edi - 0x14]
push dword [edi - 0xc]
push dword [edi - 4]
push edx
push eax
push dword [ebp + 0x18]
call dword [edi - 0x18]
mov edx, dword [esp + 0x24]
add esp, 0x14
mov dword [esp + edx*4 + 0x48], eax
mov eax, dword [edi]
inc eax
mov dword [edi], eax
cmp eax, dword [edi - 8]
jl 0x411863
inc dword [edi + 4]
mov eax, dword [edi + 4]
mov ecx, dword [edi - 0x10]
mov dword [edi], 0
mov dword [edi - 0x14], ecx
cmp eax, dword [ebp]
jge 0x411863
mov eax, dword [ebp + 4]
add eax, ecx
mov dword [edi - 0x10], eax
inc edx
add edi, 0x20
add ebp, 0x48
mov dword [esp + 0x10], edx
cmp edx, ebx
jl 0x411806
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x48]
mov edx, dword [esp + 0x18]
mov ecx, dword [ebx]
cmp edx, 3
jl 0x411ac4
mov eax, dword [ecx + 8]
cmp eax, 3
jne 0x411913
cmp dword [esp + 0x30], 0
je 0x4118f4
xor edi, edi
cmp dword [ecx], edi
jbe 0x411abd
mov ecx, dword [esp + 0x4c]
add esi, 2
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], ebp
sub ebp, ecx
sub eax, ecx
mov dword [esp + 0x10], eax
nop dword [eax]
movzx eax, byte [ecx + ebp]
lea ecx, [ecx + 1]
mov byte [esi - 2], al
inc edi
movzx eax, byte [ecx - 1]
mov byte [esi - 1], al
mov eax, dword [esp + 0x10]
movzx eax, byte [eax + ecx - 1]
mov byte [esi], al
mov byte [esi + 1], 0xff
add esi, edx
mov eax, dword [ebx]
cmp edi, dword [eax]
jb 0x4118c0
mov ebp, dword [esp + 0x48]
mov ecx, eax
jmp 0x411d24
mov eax, dword [ebx + 0x4810]
push edx
push dword [ecx]
push dword [esp + 0x58]
push dword [esp + 0x58]
push ebp
push esi
call eax
mov ecx, dword [ebx]
add esp, 0x18
jmp 0x411d24
cmp eax, 4
jne 0x411a9a
mov eax, dword [ebx + 0x47e8]
test eax, eax
jne 0x4119d9
mov dword [esp + 0x10], eax
cmp dword [ecx], eax
jbe 0x411abd
mov edx, dword [esp + 0x54]
mov eax, ebp
mov ecx, dword [esp + 0x4c]
sub eax, edx
mov edi, dword [esp + 0x18]
sub ecx, edx
mov dword [esp + 0x34], ecx
add esi, 2
mov ecx, dword [esp + 0x50]
mov ebp, edx
sub ecx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ecx
nop
movzx ecx, byte [eax + ebp]
lea ebp, [ebp + 1]
movzx edx, byte [ebp - 1]
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi - 2], al
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + ebp - 1]
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi - 1], al
mov eax, dword [esp + 0x24]
movzx ecx, byte [eax + ebp - 1]
imul ecx, edx
mov byte [esi + 1], 0xff
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
mov ecx, dword [esp + 0x10]
shr eax, 8
inc ecx
mov byte [esi], al
add esi, edi
mov eax, dword [ebx]
mov dword [esp + 0x10], ecx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x14]
jb 0x411960
mov ebp, dword [esp + 0x48]
mov ecx, dword [ebx]
jmp 0x411d24
mov ecx, dword [ecx]
mov edi, dword [ebx + 0x4810]
push edx
push ecx
push dword [esp + 0x58]
push dword [esp + 0x58]
push ebp
push esi
cmp eax, 2
jne 0x411a8e
call edi
mov eax, dword [ebx]
add esp, 0x18
mov dword [esp + 0x14], 0
cmp dword [eax], 0
jbe 0x411abd
mov edi, dword [esp + 0x18]
add esi, 2
mov ebp, dword [esp + 0x14]
nop dword [eax]
mov eax, dword [esp + 0x54]
movzx edx, byte [eax + ebp]
inc ebp
movzx eax, byte [esi - 2]
not al
movzx ecx, al
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi - 2], al
movzx eax, byte [esi - 1]
not al
movzx ecx, al
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi - 1], al
movzx eax, byte [esi]
not al
movzx ecx, al
imul ecx, edx
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi], al
add esi, edi
mov eax, dword [ebx]
cmp ebp, dword [eax]
jb 0x411a20
mov ebp, dword [esp + 0x48]
mov ecx, eax
jmp 0x411d24
call edi
mov ecx, dword [ebx]
add esp, 0x18
jmp 0x411d24
xor edx, edx
cmp dword [ecx], edx
jbe 0x411abd
mov edi, dword [esp + 0x18]
inc esi
mov al, byte [edx + ebp]
inc edx
mov byte [esi + 1], al
mov byte [esi], al
mov byte [esi - 1], al
mov byte [esi + 2], 0xff
add esi, edi
mov eax, dword [ebx]
cmp edx, dword [eax]
jb 0x411aa5
mov ecx, dword [ebx]
jmp 0x411d24
cmp dword [esp + 0x30], 0
je 0x411ba1
mov eax, dword [ecx]
xor edi, edi
cmp edx, 1
jne 0x411b3b
test eax, eax
je 0x411d24
mov eax, dword [esp + 0x4c]
mov edx, ebp
sub eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
sub eax, ebp
sub esi, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], eax
nop dword [eax]
movzx eax, byte [eax + edx]
lea edx, [edx + 1]
imul ecx, eax, 0x1d
inc edi
movzx eax, byte [edx + ebp - 1]
imul eax, eax, 0x96
add ecx, eax
movzx eax, byte [edx - 1]
imul eax, eax, 0x4d
add ecx, eax
mov eax, dword [esp + 0x24]
shr ecx, 8
mov byte [esi + edx - 1], cl
mov ecx, dword [ebx]
cmp edi, dword [ecx]
jb 0x411b00
mov ebp, dword [esp + 0x48]
jmp 0x411d24
test eax, eax
je 0x411d24
mov eax, dword [esp + 0x4c]
mov edx, ebp
sub eax, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
sub eax, ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], eax
nop dword [eax]
movzx eax, byte [edx + eax]
lea edx, [edx + 1]
imul ecx, eax, 0x1d
lea esi, [esi + 2]
movzx eax, byte [edx + ebp - 1]
inc edi
imul eax, eax, 0x96
add ecx, eax
movzx eax, byte [edx - 1]
imul eax, eax, 0x4d
mov byte [esi - 1], 0xff
add ecx, eax
mov eax, dword [esp + 0x24]
shr ecx, 8
mov byte [esi - 2], cl
mov ecx, dword [ebx]
cmp edi, dword [ecx]
jb 0x411b60
mov ebp, dword [esp + 0x48]
jmp 0x411d24
cmp dword [ecx + 8], 4
jne 0x411cdd
mov eax, dword [ebx + 0x47e8]
test eax, eax
jne 0x411c86
mov dword [esp + 0x10], eax
cmp dword [ecx], eax
jbe 0x411d24
mov ecx, dword [esp + 0x54]
mov edi, ebp
mov eax, dword [esp + 0x4c]
sub edi, ecx
sub eax, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov edx, ecx
mov eax, dword [esp + 0x50]
sub eax, ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], eax
nop dword [eax + eax]
movzx eax, byte [edx]
mov ecx, dword [esp + 0x14]
movzx edi, byte [edx + edi]
mov ebp, dword [esp + 0x24]
imul edi, eax
movzx ecx, byte [edx + ecx]
imul ecx, eax
movzx edx, byte [edx + ebp]
imul edx, eax
sub edi, 0xffffff80
mov byte [esi + 1], 0xff
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
sub edx, 0xffffff80
add eax, ecx
shr eax, 8
movzx eax, al
imul ecx, eax, 0x96
mov eax, edx
shr eax, 8
add eax, edx
mov edx, dword [esp + 0x1c]
shr eax, 8
inc edx
movzx eax, al
imul eax, eax, 0x1d
mov dword [esp + 0x1c], edx
add ecx, eax
mov eax, edi
shr eax, 8
add eax, edi
mov edi, dword [esp + 0x34]
shr eax, 8
movzx eax, al
imul eax, eax, 0x4d
add ecx, eax
mov eax, dword [esp + 0x10]
shr ecx, 8
inc eax
mov byte [esi], cl
mov ecx, dword [ebx]
add esi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
cmp eax, dword [ecx]
jb 0x411bf0
mov ebp, dword [esp + 0x48]
jmp 0x411d24
cmp eax, 2
jne 0x411cdd
xor edi, edi
cmp dword [ecx], edi
jbe 0x411d24
mov edx, dword [esp + 0x54]
mov eax, ebp
mov ebp, dword [esp + 0x18]
sub eax, edx
mov dword [esp + 0x14], eax
mov al, byte [edx + eax]
lea edx, [edx + 1]
not al
inc edi
movzx ecx, al
movzx eax, byte [edx - 1]
imul ecx, eax
mov byte [esi + 1], 0xff
sub ecx, 0xffffff80
mov eax, ecx
shr eax, 8
add eax, ecx
shr eax, 8
mov byte [esi], al
add esi, ebp
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
cmp edi, dword [ecx]
jb 0x411ca5
mov ebp, dword [esp + 0x48]
jmp 0x411d24
mov eax, dword [ecx]
cmp edx, 1
jne 0x411d02
xor edx, edx
test eax, eax
je 0x411d24
mov edi, ebp
sub edi, esi
nop
mov al, byte [edi + esi]
lea esi, [esi + 1]
mov byte [esi - 1], al
inc edx
mov ecx, dword [ebx]
cmp edx, dword [ecx]
jb 0x411cf0
jmp 0x411d24
xor edx, edx
test eax, eax
je 0x411d24
nop dword [eax + eax]
mov al, byte [edx + ebp]
lea esi, [esi + 2]
mov byte [esi - 2], al
inc edx
mov byte [esi - 1], 0xff
mov ecx, dword [ebx]
cmp edx, dword [ecx]
jb 0x411d10
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [ecx + 4]
jb 0x4117d7
push 0
push dword [ecx + 8]
push ebx
call fcn.00415540
mov eax, dword [ebx]
add esp, 0xc
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, dword [esp + 0x40]
mov eax, dword [eax + 4]
mov dword [ecx], eax
test edx, edx
je 0x411d79
mov eax, dword [ebx]
xor ecx, ecx
cmp dword [eax + 8], 3
setge cl
lea ecx, [ecx*2 + 1]
mov dword [edx], ecx
mov eax, edi
jmp 0x4117ab
mov ecx, dword [esp + 0xcc]
xor eax, eax
pop ebx
xor ecx, esp
mov dword [0x49ddd0], 0x47ef34
call fcn.00478d37
add esp, 0xcc
ret