Function at 0x40cffaed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movsx esi, word [edi + 8]
mov eax, dword [edi]
xor edx, edx
mov dword [ebp + 0xc], edx
cmp esi, edx
je 0x40cffb40
mov cl, byte [ebp + 0x18]
or cl, 1
add eax, 0x28
mov dword [eax - 0x1c], edx
mov dword [eax], edx
mov dword [eax - 0x18], edx
mov dword [eax - 0x14], edx
mov dword [eax - 0x10], edx
mov dword [eax - 0xc], edx
mov dword [eax - 8], edx
mov dword [eax - 4], edx
mov dl, byte [eax - 0x21]
xor dl, byte [ebp + 0x18]
dec esi
test cl, dl
jne 0x40cffb35
inc dword [ebp + 0xc]
xor edx, edx
add eax, 0x1cc
cmp esi, edx
jne 0x40cffb10
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0x10], edx
je 0x40cffba5
cmp dword [ebp + 0x10], 2
jne 0x40cffb81
cmp word [ebx + 0xbc], 1
jne 0x40cffb81
push 8
pop ecx
mov eax, 0x40d02084
mov esi, eax
dec ecx
sub eax, 0x10
cmp esi, 0x40d02004
je 0x40cffb75
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jl 0x40cffb60
mov ax, word [ebx + ecx*2 + 0xac]
mov word [ebx + 0x66], ax
movzx eax, word [ebx + 0x66]
cmp ax, dx
je 0x40cffb9f
push dword [ebp + 0x18]
push eax
movsx eax, word [edi + 8]
push eax
push dword [edi]
call fcn.40cff551
cwde
xor edx, edx
jmp 0x40cffba1
xor eax, eax
mov word [ebx + 0x68], ax
mov eax, dword [edi + 0xc]
mov esi, dword [edi + 4]
mov dword [ebp + 0x10], eax
cmp eax, edx
je 0x40cffc1b
mov al, byte [ebp + 0x14]
dec dword [ebp + 0x10]
cmp al, 0xff
je 0x40cffbc1
cmp al, byte [esi + 7]
jne 0x40cffc13
push dword [ebp + 0x18]
movzx eax, word [ebx + 0x68]
push eax
movzx eax, word [edi + 8]
push eax
push dword [edi]
push esi
call fcn.40cff70c
movzx ecx, byte [esi + 6]
imul ecx, ecx, 0x1cc
add ecx, dword [edi]
inc dword [ecx + 0xc]
add dword [ecx + 0x28], eax
movzx eax, byte [esi]
add dword [ecx + 0x10], eax
movzx eax, byte [esi + 1]
add dword [ecx + 0x14], eax
movzx eax, byte [esi + 2]
add dword [ecx + 0x18], eax
movzx eax, byte [esi + 3]
add dword [ecx + 0x1c], eax
movzx eax, byte [esi + 4]
add dword [ecx + 0x20], eax
movzx eax, byte [esi + 5]
add dword [ecx + 0x24], eax
xor edx, edx
add esi, 8
cmp dword [ebp + 0x10], edx
jne 0x40cffbb2
movsx eax, word [edi + 8]
mov ecx, dword [edi]
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x10], edx
cmp eax, edx
je 0x40cffd0a
mov al, byte [ecx + 7]
dec dword [ebp + 0x18]
test al, 1
jne 0x40cffcfb
mov esi, dword [ecx + 0xc]
cmp esi, edx
je 0x40cffcfb
mov edi, dword [ecx + 0x28]
add dword [ebp + 0x10], edi
test al, 2
je 0x40cffcfb
mov eax, dword [ecx + 0x10]
xor edx, edx
mov edi, esi
sar edi, 1
add eax, edi
div esi
xor edx, edx
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x14]
add eax, edi
div esi
xor edx, edx
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0x18]
add eax, edi
div esi
xor edx, edx
mov dword [ecx + 0x18], eax
mov eax, dword [ecx + 0x1c]
add eax, edi
div esi
xor edx, edx
mov dword [ecx + 0x1c], eax
mov eax, dword [ecx + 0x20]
add eax, edi
div esi
xor edx, edx
mov dword [ecx + 0x20], eax
mov eax, dword [ecx + 0x24]
add eax, edi
div esi
mov dword [ecx + 0x24], eax
mov al, byte [ecx + 0x10]
cmp byte [ecx], al
jne 0x40cffcd1
mov dl, byte [ecx + 1]
cmp dl, byte [ecx + 0x14]
jne 0x40cffcd1
mov dl, byte [ecx + 2]
cmp dl, byte [ecx + 0x18]
jne 0x40cffcd1
mov dl, byte [ecx + 3]
cmp dl, byte [ecx + 0x1c]
jne 0x40cffcd1
mov dl, byte [ecx + 4]
cmp dl, byte [ecx + 0x20]
jne 0x40cffcd1
mov dl, byte [ecx + 5]
cmp dl, byte [ecx + 0x24]
je 0x40cffcf9
mov byte [ecx], al
mov al, byte [ecx + 0x14]
mov byte [ecx + 1], al
mov al, byte [ecx + 0x18]
mov byte [ecx + 2], al
mov al, byte [ecx + 0x1c]
mov byte [ecx + 3], al
mov al, byte [ecx + 0x20]
mov byte [ecx + 4], al
mov al, byte [ecx + 0x24]
mov byte [ecx + 5], al
mov al, byte [ecx + 7]
or al, 4
mov byte [ecx + 7], al
xor edx, edx
add ecx, 0x1cc
cmp dword [ebp + 0x18], edx
jne 0x40cffc2f
mov ecx, dword [ebx + 0x414]
lea eax, [ebx + 0x418]
inc word [eax]
movzx eax, word [eax]
cmp ecx, edx
je 0x40cffd4e
movsx esi, word [ebx + 0x41a]
cwde
imul eax, eax, 0x64
cdq
idiv esi
cmp eax, 0x64
jle 0x40cffd36
push 0x64
pop eax
push eax
push 1
push dword [ebx + 0x410]
call ecx
test eax, eax
je 0x40cffd4e
push 1
push ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14