Function at 0x439cf0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ecx, ecx
xor ebx, ebx
cmp byte [eax + 0x22], cl
push edi
setne cl
push 0x400
lea edx, [ebp - 0x410]
push ebx
push edx
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x438], ecx
call fcn.004b2d10
mov edx, dword [ebp + 0xc]
xor edi, edi
add esp, 0xc
mov dword [ebp - 0x41c], edi
mov dword [ebp - 0x414], ebx
test edx, edx
jle 0x439ec5
jmp 0x439d66
mov ebx, dword [ebp - 0x414]
cmp ebx, esi
jge 0x439ec5
mov eax, edx
sub eax, edi
xor ecx, ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x430], eax
test eax, eax
jle 0x439e91
mov eax, esi
sub eax, ebx
add eax, 0xfffffff9
mov dword [ebp - 0x434], eax
mov eax, esi
imul eax, edi
mov dword [ebp - 0x424], eax
jmp 0x439db4
mov ecx, dword [ebp - 0x420]
mov esi, dword [ebp - 0x428]
mov eax, dword [ebp - 0x424]
cmp ecx, dword [ebp - 0x434]
jge 0x439e91
add eax, ecx
add eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 0x1984]
mov ecx, dword [ebp - 0x438]
lea eax, [edx + eax*4]
movzx edx, byte [ecx + eax + 2]
movzx edi, byte [ecx + eax]
movzx ebx, byte [ecx + eax + 1]
add ecx, eax
mov eax, 7
add ecx, 6
add dword [ebp - 0x418], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x42c], eax
movzx esi, byte [ecx - 2]
mov eax, esi
sub eax, edi
cdq
xor eax, edx
sub eax, edx
inc dword [ebp + eax*4 - 0x410]
lea eax, [ebp + eax*4 - 0x410]
mov edi, esi
movzx esi, byte [ecx - 1]
mov eax, esi
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
inc dword [ebp + eax*4 - 0x410]
lea eax, [ebp + eax*4 - 0x410]
mov ebx, esi
movzx esi, byte [ecx]
mov eax, esi
sub eax, dword [ebp - 8]
add ecx, 4
cdq
xor eax, edx
sub eax, edx
inc dword [ebp + eax*4 - 0x410]
dec dword [ebp - 0x42c]
lea eax, [ebp + eax*4 - 0x410]
mov dword [ebp - 8], esi
jne 0x439e04
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x428]
add dword [ebp - 0x424], ecx
mov edx, dword [ebp + 0xc]
inc eax
mov dword [ebp - 0x420], eax
cmp eax, dword [ebp - 0x430]
jl 0x439da2
mov esi, ecx
cmp esi, edx
jle 0x439ea7
add dword [ebp - 0x414], edx
mov dword [ebp - 0x41c], 0
jmp 0x439eb7
add dword [ebp - 0x41c], esi
mov dword [ebp - 0x414], 0
mov edi, dword [ebp - 0x41c]
cmp edi, edx
jl 0x439d60
mov ebx, dword [ebp - 0x410]
mov eax, ebx
shl eax, 5
add eax, ebx
cdq
idiv dword [ebp - 0x418]
cmp eax, 0x5f
jl 0x439ef3
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, 1
lea ebx, [ebx]
mov edx, dword [ebp + ecx*4 - 0x410]
mov esi, edx
imul esi, ecx
imul esi, ecx
add eax, esi
test edx, edx
je 0x439ede
mov esi, dword [ebp + ecx*4 - 0x414]
add esi, esi
cmp edx, esi
jg 0x439ede
inc ecx
cmp ecx, 8
jl 0x439f00
xor esi, esi
xor edi, edi
cmp ecx, 0x100
jge 0x439f90
mov edx, pe_nt_image_headers32
sub edx, ecx
cmp edx, 2
jl 0x439f75
lea edx, [ecx + 1]
mov ebx, dword [ebp + ecx*4 - 0x410]
imul ebx, ecx
imul ebx, ecx
add esi, ebx
mov ebx, dword [ebp + ecx*4 - 0x40c]
imul ebx, edx
imul ebx, edx
add ecx, 2
add edi, ebx
add edx, 2
cmp ecx, 0xff
jl 0x439f43
mov ebx, dword [ebp - 0x410]
cmp ecx, 0x100
jge 0x439f8c
mov edx, dword [ebp + ecx*4 - 0x410]
imul edx, ecx
imul edx, ecx
add eax, edx
add edi, esi
add eax, edi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx + ecx*2]
sub ecx, ebx
xor edx, edx
div ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret 8