Function at 0x406962
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp - 0x34], eax
je 0x406c3b
movzx ecx, word [eax + 0xe]
cmp dword [ebp + 0x18], 0
push 1
mov dword [ebp - 0x4c], ecx
pop edx
jne 0x406997
mov dword [ebp + 0x18], edx
cmp ecx, edx
je 0x4069b8
cmp ecx, 4
je 0x4069b8
cmp ecx, 8
je 0x4069b8
cmp ecx, 0x10
je 0x4069b8
cmp ecx, 0x18
je 0x4069b8
cmp ecx, 0x20
jne 0x406c3b
mov ecx, dword [eax + 4]
mov edi, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push 8
push dword [ebp + 0x10]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x58], eax
push edi
call fcn.00404a52
add esp, 0xc
mov dword [ebp - 0x50], eax
test eax, eax
jne 0x4069ea
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x406c3b
push eax
call esi
test eax, eax
mov dword [ebp - 0x30], eax
je 0x4069dc
push 2
mov ecx, 0xc0
pop eax
mov esi, 0xe0
cmp dword [ebp + 0x18], eax
lea edx, [edi + edi*2]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x24], edx
jne 0x406aae
xor edi, edi
mov eax, edi
xor edx, edx
and eax, ecx
mov ebx, ecx
imul eax, eax, 0xff
add eax, 0x60
div ebx
xor edx, edx
mov ebx, esi
mov byte [ebp + edi - 0x158], al
mov eax, edi
and eax, 0x38
imul eax, eax, 0x3fc
add eax, 0x70
div ebx
xor edx, edx
mov ebx, ecx
mov byte [ebp + edi - 0x258], al
mov eax, edi
and eax, 6
imul eax, eax, 0x1fe0
add eax, 0x60
div ebx
inc edi
mov edx, 0x100
cmp edi, edx
mov byte [ebp + edi - 0x359], al
jb 0x406a25
mov edi, dword [ebp - 0x30]
mov eax, dword [edi]
add eax, edi
xor edi, edi
inc eax
mov bl, byte [ebp + edi - 0x158]
inc edi
mov byte [eax + 1], bl
mov bl, byte [ebp + edi - 0x259]
mov byte [eax], bl
mov bl, byte [ebp + edi - 0x359]
mov byte [eax - 1], bl
add eax, 4
cmp edi, edx
jb 0x406a89
cmp dword [ebp + 0x18], 3
jne 0x406b58
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x44], 6
xor edi, edi
mov eax, edi
xor edx, edx
and eax, esi
mov ebx, esi
imul eax, eax, 0xff
add eax, 0x70
div ebx
xor edx, edx
mov byte [ebp + edi - 0x158], al
mov eax, edi
and eax, 0x1c
imul eax, eax, 0x7f8
add eax, 0x70
div ebx
xor edx, edx
mov ebx, ecx
mov byte [ebp + edi - 0x258], al
mov eax, edi
and eax, 3
imul eax, eax, 0x3fc0
add eax, 0x60
div ebx
inc edi
mov edx, 0x100
cmp edi, edx
mov byte [ebp + edi - 0x359], al
jb 0x406ad1
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
add eax, ecx
xor ecx, ecx
inc eax
mov bl, byte [ebp + ecx - 0x158]
inc ecx
mov byte [eax + 1], bl
mov bl, byte [ebp + ecx - 0x259]
mov byte [eax], bl
mov bl, byte [ebp + ecx - 0x359]
mov byte [eax - 1], bl
add eax, 4
cmp ecx, edx
jb 0x406b33
cmp dword [ebp + 0x18], 4
jne 0x406c00
mov eax, 0x80
push 0x40
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], 2
xor ecx, ecx
pop edi
mov esi, 0x100
mov edx, ecx
and dx, ax
imul edx, edx, 0xff
add edx, edi
shr edx, 7
mov byte [ebp + ecx - 0x158], dl
mov edx, ecx
and edx, edi
imul edx, edx, 0x1fe
add edx, edi
shr edx, 7
mov byte [ebp + ecx - 0x258], dl
mov edx, ecx
and edx, 0x20
imul edx, edx, 0x3fc
add edx, edi
shr edx, 7
mov byte [ebp + ecx - 0x358], dl
inc ecx
cmp ecx, esi
jb 0x406b88
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
add eax, ecx
xor ecx, ecx
inc eax
mov dl, byte [ebp + ecx - 0x158]
inc ecx
mov byte [eax + 1], dl
mov dl, byte [ebp + ecx - 0x259]
mov byte [eax], dl
mov dl, byte [ebp + ecx - 0x359]
mov byte [eax - 1], dl
add eax, 4
cmp ecx, esi
jb 0x406bdb
mov esi, dword [ebp - 0x34]
mov eax, dword [esi]
add eax, esi
cmp dword [ebp + 0x18], 1
mov dword [ebp - 0x28], eax
je 0x406c42
call fcn.00406115
mov eax, dword [ebp - 0x24]
mov edi, eax
shl edi, 2
push edi
call fcn.0042df00
push edi
mov dword [ebp - 0x2c], eax
call fcn.0042df00
cmp dword [ebp - 0x2c], 0
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
je 0x406c3b
test eax, eax
jne 0x406c42
xor eax, eax
jmp 0x4072c8
cmp dword [ebp + 0x18], 2
jl 0x40729d
cmp dword [esi + 0x10], 3
jne 0x406c5a
mov eax, dword [esi]
lea eax, [eax + esi + 0xc]
jmp 0x406c64
mov eax, dword [esi + 0x20]
mov ecx, dword [esi]
lea eax, [ecx + eax*4]
add eax, esi
and dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jle 0x406dab
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
cmp esi, dword [ebp - 0x1c]
jl 0x406c9d
mov eax, dword [ebp - 0x1c]
lea esi, [eax - 1]
mov eax, dword [ebp - 0x4c]
dec eax
je 0x406d06
sub eax, 3
je 0x406cd7
sub eax, 4
je 0x406cce
sub eax, 0x10
jne 0x406d42
mov eax, dword [ebp - 0x18]
lea eax, [eax + esi*2]
add esi, eax
movzx eax, byte [esi + 2]
movzx ebx, byte [esi + 1]
movzx edi, byte [esi]
mov dword [ebp - 4], eax
jmp 0x406d42
mov eax, dword [ebp - 0x18]
movzx eax, byte [esi + eax]
jmp 0x406d2c
mov eax, esi
push 2
cdq
pop ecx
idiv ecx
mov eax, esi
test edx, edx
cdq
jne 0x406cf5
mov ecx, dword [ebp - 0x18]
sub eax, edx
sar eax, 1
mov al, byte [eax + ecx]
shr al, 4
jmp 0x406d01
mov ecx, dword [ebp - 0x18]
sub eax, edx
sar eax, 1
mov al, byte [eax + ecx]
and al, 0xf
movzx eax, al
jmp 0x406d2c
mov eax, esi
push 8
cdq
pop ecx
mov bl, 1
idiv ecx
push 7
mov eax, esi
pop ecx
push 8
sub ecx, edx
shl bl, cl
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 0x18]
and bl, byte [eax + ecx]
je 0x406d29
mov bl, 1
movzx eax, bl
mov ecx, dword [ebp - 0x28]
movzx ebx, byte [ecx + eax*4 + 1]
movzx edi, byte [ecx + eax*4]
lea eax, [ecx + eax*4]
movzx ecx, byte [eax + 2]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x1c], 0
je 0x406d84
mov ecx, 0x100
mov eax, ecx
sub eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 4], eax
cmp dword [ebp - 4], ecx
jle 0x406d62
mov dword [ebp - 4], ecx
mov eax, ecx
sub eax, ebx
cdq
sub eax, edx
sar eax, 1
add ebx, eax
cmp ebx, ecx
jle 0x406d73
mov ebx, ecx
mov eax, ecx
sub eax, edi
cdq
sub eax, edx
sar eax, 1
add edi, eax
cmp edi, ecx
jle 0x406d84
mov edi, ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
add eax, 4
mov dword [eax], ebx
add eax, 4
mov dword [eax], edi
add eax, 4
inc dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x406c81
and dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], 0
jle 0x40729d
mov ebx, 0xff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ecx
dec eax
cmp dword [ebp - 0x18], eax
je 0x4070da
push dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x58]
inc eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp eax, esi
jl 0x406df3
lea eax, [esi - 1]
mov ecx, dword [ebp - 0x34]
cmp dword [ecx + 0x10], 3
jne 0x406e04
mov edx, dword [ecx]
lea edx, [edx + ecx + 0xc]
jmp 0x406e0e
mov edx, dword [ecx + 0x20]
mov esi, dword [ecx]
lea edx, [esi + edx*4]
add edx, ecx
mov ecx, dword [ebp - 0x34]
xor edi, edi
movzx esi, word [ecx + 0xe]
imul esi, dword [ecx + 4]
add esi, 0x1f
shr esi, 3
and esi, 0x1ffffffc
imul esi, eax
add esi, edx
cmp dword [ebp + 0xc], edi
jle 0x4070da
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, eax
cmp ebx, dword [ebp - 0x1c]
jl 0x406e4f
mov eax, dword [ebp - 0x1c]
lea ebx, [eax - 1]
push dword [ebp + 0xc]
lea eax, [edi + 1]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
jl 0x406e71
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x406e7b
lea eax, [ebx + 1]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
sub edx, ebx
and dword [ebp - 4], ecx
xor edi, edi
dec eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
je 0x407000
sub eax, 3
je 0x406f9f
sub eax, 4
je 0x406f6b
sub eax, 8
je 0x406f1d
sub eax, 8
je 0x406eeb
sub eax, 8
jne 0x40706f
cmp ebx, dword [ebp - 0x10]
jge 0x406ff2
lea ebx, [esi + ebx*4 + 1]
mov dword [ebp - 0xc], edx
movzx eax, byte [ebx + 1]
add dword [ebp - 4], eax
movzx eax, byte [ebx]
add ecx, eax
movzx eax, byte [ebx - 1]
add edi, eax
add ebx, 4
dec dword [ebp - 0xc]
jne 0x406ecc
jmp 0x406ff2
cmp ebx, dword [ebp - 0x10]
jge 0x406ff2
lea eax, [esi + ebx*2]
mov dword [ebp - 0xc], edx
lea ebx, [ebx + eax + 1]
movzx eax, byte [ebx + 1]
add dword [ebp - 4], eax
movzx eax, byte [ebx]
add ecx, eax
movzx eax, byte [ebx - 1]
add edi, eax
add ebx, 3
dec dword [ebp - 0xc]
jne 0x406efe
jmp 0x406ff2
cmp ebx, dword [ebp - 0x10]
jge 0x406ff2
mov eax, dword [ebp - 8]
lea ebx, [esi + ebx*2]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], eax
mov edx, 0xf8
movzx eax, word [ebx]
mov ecx, eax
mov ebx, eax
shr ecx, 7
and ecx, edx
and eax, 0x1f
add dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
shr ebx, 2
and ebx, edx
lea edi, [edi + eax*8]
add ecx, ebx
mov ebx, dword [ebp - 0x10]
inc ebx
mov dword [ebp - 0xc], ecx
inc ebx
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
jne 0x406f37
jmp 0x406ff2
cmp ebx, dword [ebp - 0x10]
mov eax, ebx
mov dword [ebp - 0x14], eax
jge 0x406ff2
movzx eax, byte [eax + esi]
mov edx, dword [ebp - 0x28]
lea eax, [edx + eax*4]
movzx edx, byte [eax + 2]
add dword [ebp - 4], edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
add edi, eax
mov eax, dword [ebp - 0x14]
add ecx, edx
inc eax
cmp eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jl 0x406f75
jmp 0x406ff2
cmp ebx, dword [ebp - 0x10]
mov eax, ebx
mov dword [ebp - 0x14], eax
jge 0x406ff2
push 2
cdq
pop ebx
idiv ebx
mov eax, dword [ebp - 0x14]
test edx, edx
cdq
jne 0x406fc4
sub eax, edx
sar eax, 1
movzx eax, byte [eax + esi]
shr eax, 4
jmp 0x406fce
sub eax, edx
sar eax, 1
mov al, byte [eax + esi]
and eax, 0xf
mov edx, dword [ebp - 0x28]
lea eax, [edx + eax*4]
movzx edx, byte [eax + 2]
add dword [ebp - 4], edx
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
add edi, eax
mov eax, dword [ebp - 0x14]
add ecx, edx
inc eax
cmp eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jl 0x406fa9
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, ecx
jmp 0x407061
cmp ebx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
jge 0x407054
mov eax, dword [ebp - 0x14]
push 8
cdq
pop ecx
idiv ecx
mov eax, dword [ebp - 0x14]
push 7
pop ecx
push 1
pop ebx
push 8
sub ecx, edx
shl ebx, cl
cdq
pop ecx
idiv ecx
movzx eax, byte [eax + esi]
and ebx, eax
je 0x40702f
push 1
pop ebx
mov eax, dword [ebp - 0x28]
movzx ecx, byte [eax + ebx*4 + 2]
add dword [ebp - 4], ecx
lea eax, [eax + ebx*4]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
add dword [ebp - 0xc], ecx
add edi, eax
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x407008
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 8]
mov ecx, eax
mov eax, edi
cdq
idiv dword [ebp - 8]
mov edi, eax
cmp dword [ebp + 0x1c], 0
je 0x4070b1
mov ebx, 0x100
mov eax, ebx
sub eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jle 0x40708f
mov dword [ebp - 4], ebx
mov eax, ebx
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
add ecx, eax
cmp ecx, ebx
jle 0x4070a0
mov ecx, ebx
mov eax, ebx
sub eax, edi
cdq
sub eax, edx
sar eax, 1
add edi, eax
cmp edi, ebx
jle 0x4070b1
mov edi, ebx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax], edx
add eax, 4
mov dword [eax], ecx
add eax, 4
mov dword [eax], edi
mov edi, dword [ebp - 0x54]
add eax, 4
cmp edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
jl 0x406e35
mov ebx, 0xff
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x10], 3
jne 0x4070eb
mov ecx, dword [eax]
lea ecx, [ecx + eax + 0xc]
jmp 0x4070f5
mov ecx, dword [eax + 0x20]
mov edx, dword [eax]
lea ecx, [edx + ecx*4]
add ecx, eax
movzx esi, word [eax + 0xe]
imul esi, dword [eax + 4]
add esi, 0x1f
and dword [ebp - 8], 0
shr esi, 3
and esi, 0x1ffffffc
mov edi, dword [ebp - 0x2c]
imul esi, dword [ebp - 0x18]
add esi, ecx
cmp dword [ebp + 0xc], 0
jle 0x40728e
mov eax, dword [ebp - 0x24]
lea edx, [eax + 8]
mov ecx, dword [edi]
mov eax, dword [edi + 4]
add edi, 4
mov dword [ebp - 0xc], eax
add edi, 4
mov dword [ebp - 0x10], ecx
mov eax, dword [edi]
add edi, 4
test ecx, ecx
mov dword [ebp - 0x14], eax
jge 0x407147
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], ebx
jle 0x40714f
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0xc], 0
jge 0x407159
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], ebx
jle 0x407161
mov dword [ebp - 0xc], ebx
test eax, eax
jge 0x40716a
xor eax, eax
mov dword [ebp - 0x14], eax
cmp eax, ebx
jle 0x407173
mov eax, ebx
mov dword [ebp - 0x14], eax
and eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
and ebx, dword [ebp - 0x38]
sar eax, cl
mov ecx, dword [ebp - 0x40]
sar ebx, cl
mov ecx, dword [ebp - 0x10]
and ecx, dword [ebp - 0x48]
or eax, ebx
mov ebx, 0x100
or eax, ecx
mov byte [esi], al
movzx ecx, byte [ebp + eax - 0x158]
sub ebx, ecx
movzx ecx, byte [ebp + eax - 0x258]
add dword [ebp - 0x10], ebx
mov ebx, 0x100
movzx eax, byte [ebp + eax - 0x358]
sub ebx, ecx
mov ecx, dword [ebp - 0xc]
add ecx, ebx
mov ebx, 0x100
sub ebx, eax
mov eax, dword [ebp + 0xc]
add dword [ebp - 0x14], ebx
dec eax
cmp dword [ebp - 8], eax
je 0x4071f6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x453d78]
add dword [edi], eax
mov eax, dword [ecx*4 + 0x453d78]
add dword [edi + 4], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x453d78]
add dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
dec eax
cmp dword [ebp - 0x18], eax
je 0x407279
mov eax, dword [ebp - 0x10]
shl eax, 2
shl ecx, 2
mov ebx, dword [eax + 0x454578]
add dword [edx - 8], ebx
mov ebx, dword [ecx + 0x454578]
add dword [edx - 4], ebx
mov ebx, dword [ebp - 0x14]
shl ebx, 2
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebx + 0x454578]
add dword [edx], ebx
cmp dword [ebp - 8], 0
jle 0x40724f
mov ebx, dword [eax + 0x454d78]
add dword [edx - 0x14], ebx
mov ebx, dword [ecx + 0x454d78]
add dword [edx - 0x10], ebx
mov ebx, dword [ebp - 0x20]
mov ebx, dword [ebx + 0x454d78]
add dword [edx - 0xc], ebx
mov ebx, dword [ebp + 0xc]
dec ebx
cmp dword [ebp - 8], ebx
je 0x407276
mov eax, dword [eax + 0x455578]
add dword [edx + 4], eax
mov eax, dword [ecx + 0x455578]
add dword [edx + 8], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x455578]
add dword [edx + 0xc], eax
add edx, 0xc
inc dword [ebp - 8]
inc esi
mov eax, dword [ebp - 8]
mov ebx, 0xff
cmp eax, dword [ebp + 0xc]
jl 0x407126
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x10]
jl 0x406dbe
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
push dword [ebp - 0x50]
call esi
cmp dword [ebp + 0x18], 1
je 0x4072c5
push dword [ebp - 0x2c]
call fcn.0042deb8
push dword [ebp - 0x24]
call fcn.0042deb8
pop ecx
pop ecx
mov eax, dword [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret