Function at 0x41dd80
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x218
push ebx
push esi
mov esi, ecx
xor bx, bx
push edi
mov ecx, 0x80
mov al, byte [esi + 0x166]
mov dl, byte [esi + 0xa0]
shr al, 2
mov bl, al
mov al, dl
inc al
lea edi, [esp + 0x24]
imul byte [esi + 0x156]
mov byte [esp + 0x1c], al
xor eax, eax
rep stosd dword es:[edi], eax
mov al, byte [esi + 0x158]
mov cl, byte [esi + 0x162]
dec eax
je 0x41dde5
dec eax
je 0x41ddd3
mov byte [esp + 0xe], 0
jmp 0x41ddef
xor eax, eax
mov ax, word [esi + 0x160]
shr eax, 1
shl eax, cl
sar eax, 0x10
jmp 0x41ddeb
mov al, byte [esi + 0x166]
mov byte [esp + 0xe], al
mov al, byte [esi + 0xf2]
and al, 8
mov byte [esp + 0x1b], al
je 0x41de0d
cmp word [esi + 0xf4], 0xff
mov byte [esp + 0xf], 0
jne 0x41de12
mov byte [esp + 0xf], 1
mov al, byte [esi + 0x34]
xor ecx, ecx
mov cl, byte [esi + 0x161]
mov byte [esp + 0x24], al
mov al, byte [esi + 0x160]
mov byte [esp + 0x25], cl
mov cl, byte [esp + 0x1c]
mov byte [esp + 0x26], al
mov al, byte [esi + 0x166]
mov byte [esp + 0x27], 0
test dl, dl
mov byte [esp + 0x28], al
mov byte [esp + 0x29], cl
jne 0x41de58
mov eax, dword [esi + 0x13c]
mov byte [esp + 0x32], dl
test eax, eax
je 0x41de5d
mov byte [esp + 0x32], 1
mov al, byte [esi + 0x189]
push ebp
test dl, dl
setne dl
mov byte [esp + 0x37], dl
mov byte [esp + 0x38], al
mov al, byte [esi + 0x18a]
xor edx, edx
mov dl, byte [esi + 0x18b]
mov byte [esp + 0x3a], al
mov al, byte [esi + 0x18c]
mov byte [esp + 0x39], dl
mov dl, al
mov byte [esp + 0x3c], al
mov al, byte [esp + 0x1f]
mov byte [esp + 0x3d], cl
shr dl, 8
test al, al
mov byte [esp + 0x3b], dl
mov byte [esp + 0x14], 0
je 0x41dee1
test cl, cl
jbe 0x41ded9
mov edi, dword [esp + 0x20]
xor eax, eax
mov ax, word [esi + 0xf4]
xor ebp, ebp
and edi, 0xff
mov edx, 1
mov ecx, ebp
shl edx, cl
test eax, edx
je 0x41ded5
inc byte [esp + 0x14]
inc ebp
dec edi
jne 0x41dec4
mov al, byte [esp + 0x14]
mov byte [esp + 0x3d], al
mov cl, byte [esi + 0x157]
mov al, byte [esi + 0x162]
mov byte [esp + 0x49], cl
mov cl, byte [esp + 0x12]
mov byte [esp + 0x48], al
mov al, byte [esi + 0x165]
mov byte [esp + 0x55], cl
mov cl, byte [esi + 0x34]
mov dl, byte [esi + 0x163]
mov byte [esp + 0x54], al
and ecx, 0xff
mov al, 1
shl al, cl
mov ebp, dword [esi + 0x103cc]
mov cl, byte [esi + 0x148]
mov byte [esp + 0x4a], dl
mov dl, byte [esi + 0x159]
mov byte [esp + 0x56], dl
mov byte [esp + 0x58], cl
dec al
mov byte [esp + 0x5c], 0
mov byte [esp + 0x57], al
mov al, byte [esi + 0x164]
mov dl, al
and dl, 1
test ebp, ebp
mov byte [esp + 0x5b], dl
je 0x41df65
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x5c]
mov byte [esp + 0x67], 1
test edx, edx
je 0x41df6a
mov byte [esp + 0x67], 0
test al, 2
je 0x41df73
mov byte [esp + 0x5c], 1
test al, 4
je 0x41df7c
mov byte [esp + 0x5c], 2
mov dl, byte [esp + 0x13]
mov edi, dword [esi + 8]
mov byte [esp + 0x68], dl
mov al, byte [edi + 0xa2]
cmp al, 0xff
je 0x41dfa7
and eax, 0xff
xor ecx, ecx
mov cl, byte [edi + 0xe2]
mov al, byte [ecx + eax*4 + 0x4b75ac]
jmp 0x41dfb5
xor edx, edx
mov dl, byte [edi + 0xe2]
mov al, byte [edx + 0x4b75b0]
mov ecx, dword [edi + 0xdc]
test ecx, ecx
movzx ax, al
je 0x41dfd3
mov ecx, dword [edi + 0x5c]
test ecx, ecx
jne 0x41dfd3
test ebp, ebp
mov byte [esp + 0x72], 1
je 0x41dfd8
mov byte [esp + 0x72], 0
mov dl, byte [esi + 0x10268]
xor ecx, ecx
mov cl, ah
mov byte [esp + 0x74], al
mov byte [esp + 0x73], cl
mov byte [esp + 0x77], dl
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x41e0fb
cmp dword [edi + 0x60], 0x64
je 0x41e0fb
push 0
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov edx, dword [esi + 8]
add esp, 8
mov eax, dword [edx + 0x60]
cmp eax, 0x32
ja 0x41e082
test eax, eax
mov byte [esp + 0x18], 0
jbe 0x41e10b
mov edi, dword [sym.imp.MSVCRT.dll_rand]
call edi
cdq
mov ecx, 0x64
idiv ecx
mov byte [esp + 0x24], dl
mov eax, dword [esp + 0x24]
mov edx, eax
and edx, 0xff
mov cl, byte [esp + edx + 0x78]
test cl, cl
jne 0x41e033
and eax, 0xff
mov byte [esp + eax + 0x78], 1
mov al, byte [esp + 0x18]
inc al
mov byte [esp + 0x18], al
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x18]
mov edx, dword [eax + 0x60]
and ecx, 0xff
cmp ecx, edx
jb 0x41e033
jmp 0x41e10b
mov ecx, 0x19
mov eax, 0x1010101
lea edi, [esp + 0x78]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 0x60]
mov eax, 0x64
sub eax, ecx
je 0x41e10b
mov edi, dword [sym.imp.MSVCRT.dll_rand]
call edi
cdq
mov ecx, 0x64
idiv ecx
mov byte [esp + 0x24], dl
mov eax, dword [esp + 0x24]
mov edx, eax
and edx, 0xff
cmp byte [esp + edx + 0x78], 1
jne 0x41e0a9
and eax, 0xff
mov ecx, 0x64
mov byte [esp + eax + 0x78], 0
mov al, byte [esp + 0x18]
inc al
mov byte [esp + 0x18], al
mov eax, dword [esi + 8]
mov edx, dword [eax + 0x60]
sub ecx, edx
mov edx, dword [esp + 0x18]
and edx, 0xff
cmp edx, ecx
jb 0x41e0a9
jmp 0x41e10b
mov ecx, 0x19
mov eax, 0x1010101
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 8]
mov edi, ebx
and edi, 0xffff
mov cl, byte [eax + 0x5c]
mov al, bl
lea edx, [edi - 1]
lea ebp, [edi + edi]
sar edx, 8
mov byte [esp + 0xea], dl
lea edx, [ebp - 1]
dec al
mov byte [esp + 0xe7], cl
sar edx, 8
mov byte [esp + 0xeb], al
xor ecx, ecx
mov byte [esp + 0xee], dl
mov al, bl
mov cl, bh
mov edx, ebp
shl al, 1
lea ebp, [edi + edi*2]
mov byte [esp + 0xec], cl
mov cl, al
mov byte [esp + 0xf1], al
lea eax, [ebp - 1]
dec cl
sar eax, 8
mov byte [esp + 0xf2], al
mov al, bl
mov byte [esp + 0xef], cl
add al, 0x55
mov cl, 3
mov byte [esp + 0xed], bl
imul cl
mov byte [esp + 0xf3], al
mov al, bl
imul cl
sar edx, 8
mov byte [esp + 0xf0], dl
mov edx, ebp
sar edx, 8
mov byte [esp + 0xf4], dl
lea edx, [edi*4 - 1]
shl bl, 2
mov byte [esp + 0xf5], al
mov al, 0x4c
sar edx, 8
dec bl
mov byte [esp + 0xf6], dl
mov byte [esp + 0xf7], bl
mov byte [esp + 0xf8], al
mov byte [esp + 0xf9], al
mov byte [esp + 0xfe], al
mov cl, 0x69
mov al, 0x86
mov dl, 0xaa
mov bl, 0xb3
mov byte [esp + 0xe8], 0
mov byte [esp + 0xe9], 0
mov byte [esp + 0xfa], 0x46
mov byte [esp + 0xfb], 0x54
mov byte [esp + 0xfc], 0x41
mov byte [esp + 0xfd], 0x42
mov byte [esp + 0xff], 0x45
mov byte [esp + 0x100], cl
mov byte [esp + 0x101], al
mov byte [esp + 0x102], 5
mov byte [esp + 0x103], 0x8f
mov byte [esp + 0x104], cl
mov byte [esp + 0x105], al
mov byte [esp + 0x106], dl
mov byte [esp + 0x107], 0x55
mov byte [esp + 0x108], bl
mov byte [esp + 0x109], bl
mov byte [esp + 0x10a], 0xb9
mov byte [esp + 0x10b], 0xab
mov byte [esp + 0x10c], 0xbe
mov byte [esp + 0x10d], 0xbd
mov byte [esp + 0x10e], bl
mov byte [esp + 0x10f], 0xba
mov byte [esp + 0x110], cl
mov byte [esp + 0x111], al
mov byte [esp + 0x115], al
mov eax, 0xff
mov byte [esp + 0x114], cl
mov al, byte [esi + 0xf2]
xor ecx, ecx
test al, 8
mov byte [esp + 0x112], 5
mov byte [esp + 0x113], 0x8f
mov byte [esp + 0x116], dl
mov byte [esp + 0x117], 0x55
lea edi, [esp + 0x198]
pop ebp
je 0x41e338
mov dl, byte [esp + 0x1c]
xor al, al
test dl, dl
mov byte [esp + 0x10], cl
jbe 0x41e352
xor edi, edi
mov di, word [esi + 0xf4]
mov ebx, 1
shl ebx, cl
test edi, ebx
je 0x41e32f
mov ebx, dword [esp + 0x10]
and ebx, 0xff
mov byte [esp + ebx + 0x194], al
mov bl, byte [esp + 0x10]
inc bl
mov byte [esp + 0x10], bl
inc al
inc ecx
cmp al, dl
jb 0x41e309
jmp 0x41e352
mov dl, byte [esp + 0x1c]
xor al, al
test dl, dl
jbe 0x41e352
lea ecx, [esp + 0x194]
mov byte [ecx], al
inc al
inc ecx
cmp al, dl
jb 0x41e349
lea ecx, [esp + 0x1a4]
lea eax, [esi + 0x10272]
mov edi, 0x80
mov dl, byte [eax]
add eax, 2
mov byte [ecx], dl
inc ecx
dec edi
jne 0x41e364
mov al, byte [esi + 0x10270]
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov byte [esp + 0x69], al
call fcn.0042b490
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x218
ret