Function at 0x408fb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xa0
xor dl, dl
mov word [esp + 2], 0
push ebx
push esi
push edi
push ebp
mov edi, ecx
xor al, al
mov esi, edx
and esi, 0xff
xor ecx, ecx
mov ebp, eax
inc al
and ebp, 0xff
lea ebx, [ebp + ebp*2]
lea ebp, [ebx + ebx*4]
add ebp, esi
cmp al, 6
mov byte [esp + ebp + 0x54], cl
jb 0x408fd1
inc dl
cmp dl, 0xf
jb 0x408fc5
mov byte [esp + 0x11], 0
movzx si, byte [esp + 0x11]
xor bl, bl
mov word [esp + 0x16], si
mov al, bl
and eax, 0xffff00ff
mov word [esp + 0x1c], ax
cmp byte [esp + 0x11], 0xc
mov word [esp + 0x14], ax
ja 0x409138
mov word [esp + 0x38], ax
lea ecx, [esi + 2]
mov word [esp + 0x3a], cx
lea edx, [esi + 1]
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], dx
cmp ax, 6
jge 0x409138
test ax, ax
jl 0x409138
cmp si, 0xd
jge 0x409138
test si, si
jl 0x409138
movsx eax, ax
lea ecx, [eax + eax*2]
movsx edx, si
lea eax, [ecx + ecx*4]
add eax, edx
cmp byte [eax + edi + 0xf00], 0
je 0x409138
lea ebp, [edi + 0xf00]
lea eax, [esp + 0x3c]
push eax
mov ecx, ebp
call fcn.00407aa0
mov ecx, ebp
mov byte [esp + 0x50], al
lea eax, [esp + 0x14]
push eax
call fcn.00407aa0
cmp byte [esp + 0x50], al
jne 0x409138
lea eax, [esp + 0x14]
mov ecx, ebp
push eax
call fcn.00407aa0
mov ecx, ebp
mov byte [esp + 0x50], al
lea eax, [esp + 0x38]
push eax
call fcn.00407aa0
cmp byte [esp + 0x50], al
jne 0x409138
lea ecx, [esp + 0x4c]
push str.Vertical_Stack
call sub.TL221MN.dll_Ordinal_134
push 0
mov ecx, edi
push 1
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004026a0
push eax
mov ecx, edi
call fcn.004027e0
lea ecx, [esp + 0x18]
call sub.TL221MN.dll_Ordinal_137
lea ecx, [esp + 0x4c]
call sub.TL221MN.dll_Ordinal_137
inc word [esp + 0x12]
mov eax, dword [esp + 0x1c]
inc word [edi + 0xf9c]
and eax, 0xffff
mov edx, esi
lea ecx, [eax + eax*2]
and edx, 0xffff
lea eax, [ecx + ecx*4]
add eax, edx
mov byte [esp + eax + 0x56], 1
mov byte [esp + eax + 0x55], 1
mov byte [esp + eax + 0x54], 1
cmp bl, 3
ja 0x4093e1
mov ax, word [esp + 0x14]
add ax, 2
mov cx, word [esp + 0x16]
mov word [esp + 0x30], ax
mov ax, word [esp + 0x14]
inc ax
mov word [esp + 0x32], cx
cmp word [esp + 0x14], 6
mov word [esp + 0x34], ax
mov word [esp + 0x36], cx
jge 0x40927f
cmp word [esp + 0x14], 0
jl 0x40927f
cmp cx, 0xd
jge 0x40927f
test cx, cx
jl 0x40927f
movsx eax, word [esp + 0x14]
lea ecx, [eax + eax*2]
movsx edx, word [esp + 0x16]
lea eax, [ecx + ecx*4]
add eax, edx
cmp byte [eax + edi + 0xf00], 0
je 0x40927f
lea ebp, [edi + 0xf00]
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
call fcn.00407aa0
mov ecx, ebp
mov byte [esp + 0x50], al
lea eax, [esp + 0x34]
push eax
call fcn.00407aa0
cmp byte [esp + 0x50], al
jne 0x40927f
lea eax, [esp + 0x30]
mov ecx, ebp
push eax
call fcn.00407aa0
mov ecx, ebp
mov byte [esp + 0x50], al
lea eax, [esp + 0x14]
push eax
call fcn.00407aa0
cmp byte [esp + 0x50], al
jne 0x40927f
lea ecx, [esp + 0x48]
push str.Horizontal_Stack
call sub.TL221MN.dll_Ordinal_134
push 0
mov ecx, edi
push 1
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004026a0
push eax
mov ecx, edi
call fcn.004027e0
lea ecx, [esp + 0x18]
call sub.TL221MN.dll_Ordinal_137
lea ecx, [esp + 0x48]
call sub.TL221MN.dll_Ordinal_137
inc word [esp + 0x12]
mov ecx, dword [esp + 0x1c]
inc word [edi + 0xf9c]
and ecx, 0xffff
lea eax, [ecx + ecx*2]
xor ecx, ecx
mov cx, word [edi + 0xf9e]
lea edx, [eax + eax*4]
mov eax, esi
add dword [edi + 0xf98], ecx
and eax, 0xffff
add eax, edx
mov byte [esp + eax + 0x72], 1
mov byte [esp + eax + 0x63], 1
mov byte [esp + eax + 0x54], 1
cmp bl, 3
ja 0x4093e1
cmp byte [esp + 0x11], 0xc
ja 0x4093e1
mov ax, word [esp + 0x14]
add ax, 2
mov word [esp + 0x28], ax
mov ax, word [esp + 0x16]
add ax, 2
mov word [esp + 0x2a], ax
mov ax, word [esp + 0x14]
inc ax
mov word [esp + 0x2c], ax
mov ax, word [esp + 0x16]
inc ax
cmp word [esp + 0x14], 6
mov word [esp + 0x2e], ax
jge 0x4093e1
cmp word [esp + 0x14], 0
jl 0x4093e1
cmp word [esp + 0x16], 0xd
jge 0x4093e1
cmp word [esp + 0x16], 0
jl 0x4093e1
movsx eax, word [esp + 0x14]
lea ecx, [eax + eax*2]
movsx edx, word [esp + 0x16]
lea eax, [ecx + ecx*4]
add eax, edx
cmp byte [eax + edi + 0xf00], 0
je 0x4093e1
lea ebp, [edi + 0xf00]
lea eax, [esp + 0x2c]
push eax
mov ecx, ebp
call fcn.00407aa0
mov ecx, ebp
mov byte [esp + 0x50], al
lea eax, [esp + 0x14]
push eax
call fcn.00407aa0
cmp byte [esp + 0x50], al
jne 0x4093e1
lea eax, [esp + 0x14]
mov ecx, ebp
push eax
call fcn.00407aa0
mov ecx, ebp
mov byte [esp + 0x50], al
lea eax, [esp + 0x28]
push eax
call fcn.00407aa0
cmp byte [esp + 0x50], al
jne 0x4093e1
lea ecx, [esp + 0x44]
push str.Diagonal_Stack
call sub.TL221MN.dll_Ordinal_134
push 0
mov ecx, edi
push 1
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004026a0
push eax
mov ecx, edi
call fcn.004027e0
lea ecx, [esp + 0x18]
call sub.TL221MN.dll_Ordinal_137
lea ecx, [esp + 0x44]
call sub.TL221MN.dll_Ordinal_137
inc word [esp + 0x12]
mov eax, dword [esp + 0x1c]
inc word [edi + 0xf9c]
and eax, 0xffff
mov edx, esi
lea ecx, [eax + eax*2]
and edx, 0xffff
lea eax, [ecx + ecx*4]
add eax, edx
xor ecx, ecx
mov byte [esp + eax + 0x74], 1
mov byte [esp + eax + 0x64], 1
mov byte [esp + eax + 0x54], 1
mov cx, word [edi + 0xfa0]
add dword [edi + 0xf98], ecx
cmp bl, 2
jb 0x409543
cmp byte [esp + 0x11], 0xc
ja 0x409543
mov ax, word [esp + 0x14]
sub ax, 2
mov word [esp + 0x20], ax
mov ax, word [esp + 0x16]
add ax, 2
mov word [esp + 0x22], ax
mov ax, word [esp + 0x14]
dec ax
mov word [esp + 0x24], ax
mov ax, word [esp + 0x16]
inc ax
cmp word [esp + 0x14], 6
mov word [esp + 0x26], ax
jge 0x409543
cmp word [esp + 0x14], 0
jl 0x409543
cmp word [esp + 0x16], 0xd
jge 0x409543
cmp word [esp + 0x16], 0
jl 0x409543
movsx ecx, word [esp + 0x14]
lea eax, [ecx + ecx*2]
movsx edx, word [esp + 0x16]
lea ecx, [eax + eax*4]
add ecx, edx
cmp byte [ecx + edi + 0xf00], 0
je 0x409543
lea ebp, [edi + 0xf00]
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
call fcn.00407aa0
mov ecx, ebp
mov byte [esp + 0x50], al
lea eax, [esp + 0x24]
push eax
call fcn.00407aa0
cmp byte [esp + 0x50], al
jne 0x409543
lea eax, [esp + 0x14]
mov ecx, ebp
push eax
call fcn.00407aa0
mov ecx, ebp
mov byte [esp + 0x50], al
lea eax, [esp + 0x20]
push eax
call fcn.00407aa0
cmp byte [esp + 0x50], al
jne 0x409543
lea ecx, [esp + 0x40]
push str.Diagonal_Stack
call sub.TL221MN.dll_Ordinal_134
push 0
mov ecx, edi
push 1
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004026a0
push eax
mov ecx, edi
call fcn.004027e0
lea ecx, [esp + 0x18]
call sub.TL221MN.dll_Ordinal_137
lea ecx, [esp + 0x40]
call sub.TL221MN.dll_Ordinal_137
inc word [esp + 0x12]
mov eax, dword [esp + 0x1c]
inc word [edi + 0xf9c]
and eax, 0xffff
mov edx, esi
lea ecx, [eax + eax*2]
and edx, 0xffff
lea eax, [ecx + ecx*4]
add eax, edx
xor ecx, ecx
mov byte [esp + eax + 0x38], 1
mov byte [esp + eax + 0x46], 1
mov byte [esp + eax + 0x54], 1
mov cx, word [edi + 0xfa0]
add dword [edi + 0xf98], ecx
inc bl
cmp bl, 6
jb 0x409000
inc byte [esp + 0x11]
cmp byte [esp + 0x11], 0xf
jb 0x408ff8
cmp word [esp + 0x12], 0
je 0x4096b5
mov byte [esp + 0x4c], 0
mov si, word [esp + 0x4c]
xor bl, bl
and esi, 0xffff00ff
mov ebp, esi
and ebp, 0xffff
mov al, bl
and eax, 0xffff00ff
mov ecx, eax
and ecx, 0xffff
lea edx, [ecx + ecx*2]
lea ecx, [edx + edx*4]
add ecx, ebp
cmp byte [esp + ecx + 0x54], 0
je 0x40962c
mov word [esp + 0x50], ax
mov word [esp + 0x52], si
cmp word [esp + 0x50], 6
jge 0x4095e3
cmp word [esp + 0x50], 0
jl 0x4095e3
cmp si, 0xd
jge 0x4095e3
test si, si
jl 0x4095e3
movsx eax, word [esp + 0x50]
lea ecx, [eax + eax*2]
movsx edx, si
lea eax, [ecx + ecx*4]
add eax, edx
mov al, byte [eax + edi + 0xf00]
jmp 0x4095e5
xor al, al
cmp al, 1
jb 0x409602
cmp al, 6
ja 0x409602
and eax, 0xff
xor ecx, ecx
mov cx, word [edi + eax*2 + 0xfa0]
add dword [edi + 0xf98], ecx
movsx eax, word [esp + 0x50]
lea ecx, [eax + eax*2]
movsx edx, word [esp + 0x52]
lea eax, [ecx + ecx*4]
lea ecx, [esp + 0x50]
add eax, edx
push ecx
lea ecx, [edi + 0xf00]
mov byte [eax + edi + 0xf00], 0
call fcn.004096d0
inc bl
cmp bl, 6
jb 0x409583
inc byte [esp + 0x4c]
cmp byte [esp + 0x4c], 0xf
jb 0x40956e
mov ecx, edi
call fcn.00409750
mov eax, dword [edi + 0xf98]
lea ecx, [esp + 0x54]
push eax
call sub.TL221MN.dll_Ordinal_133
push eax
lea ecx, [edi + 0x488]
call sub.SV221MN.dll_Ordinal_1884
lea ecx, [esp + 0x54]
call sub.TL221MN.dll_Ordinal_137
mov ax, word [edi + 0xf9c]
lea ecx, [esp + 0x54]
push eax
call sub.TL221MN.dll_Ordinal_129
push eax
lea ecx, [edi + 0x594]
call sub.SV221MN.dll_Ordinal_1884
lea ecx, [esp + 0x54]
call sub.TL221MN.dll_Ordinal_137
mov cx, 0xa
mov ax, word [edi + 0xf9c]
sub dx, dx
div cx
test dx, dx
je 0x4096b5
mov ecx, edi
call fcn.00408940
mov ax, word [esp + 0x12]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xa0
ret