Function at 0x402c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x64
push ebx
xor ebx, ebx
cmp dword [esi + 0xc9c], ebx
mov dword [esp + 0x14], ebx
mov word [esp + 0x1c], bx
mov word [esp + 0x1e], bx
mov word [esp + 0x1a], bx
mov word [esp + 0x18], bx
mov dword [esp + 0x64], ebx
je 0x402f2
mov dword [esp + 0x64], 0x20
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
push 0x54
lea ecx, [esp + 0x1c]
push ecx
push 0x54
mov edx, ecx
push edx
push 0x232fe4
push eax
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne 0x40568
cmp dword [esp + 0x24], ebx
je 0x40568
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40568
push ebp
and eax, 0xffffff
push edi
mov dword [esp + 0x14], eax
je 0x40553
mov edi, dword [esp + 0x18]
jmp 0x40350
mov eax, dword [esp + 0x14]
xor ebx, ebx
lea esp, [esp]
lea ebp, [eax - 1]
xor ebp, eax
and ebp, eax
cmp dword [esi + 0xafc], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
jbe 0x404d3
lea eax, [esi + 0xb50]
mov edi, dword [eax]
cmp dword [esi + edi*4 + 0xb6c], ebp
je 0x40394
add ebx, 1
add eax, 4
cmp ebx, dword [esi + 0xafc]
jb 0x40372
mov dword [esp + 0x10], ebx
jmp 0x404d3
mov edi, dword [esi + ebx*4 + 0xb50]
movzx ebp, word [esp + 0x20]
mov ecx, edi
shl ecx, 4
lea eax, [ecx + esi]
lea edx, [edi + 0xb1]
shl edx, 4
mov ecx, dword [edx + esi]
sub ecx, dword [eax + 0xb08]
mov edx, dword [eax + 0xb14]
sub edx, dword [eax + 0xb0c]
cmp ebp, ecx
mov dword [esp + 0x10], ebx
jb 0x40455
movzx ebp, word [esp + 0x22]
cmp ebp, edx
jb 0x40455
xor edx, edx
cmp ebx, edx
jne 0x403f4
mov ecx, dword [esi + 0xaf4]
test ecx, 0x10000
jne 0x4040f
jmp 0x404cf
cmp ebx, 1
jne 0x404cf
mov ecx, dword [esi + 0xaf4]
test ecx, 0x1000000
je 0x404cf
mov ebp, ebx
neg ebp
sbb ebp, ebp
and ebp, 0xff0000
add ebp, 0x10000
not ebp
and ebp, ecx
mov dword [esi + 0xaf4], ebp
mov dword [eax + 0xb28], edx
mov dword [eax + 0xb2c], edx
movzx ecx, word [esp + 0x20]
lea edx, [edi + 0xb3]
shl edx, 4
mov dword [edx + esi], ecx
movzx ecx, word [esp + 0x22]
mov dword [eax + 0xb34], ecx
jmp 0x404cf
movzx ebx, word [esp + 0x20]
mov ebp, dword [eax + 0xb28]
add ebx, ebp
cmp ebx, ecx
jbe 0x4047b
mov dword [eax + 0xb30], ecx
movzx ebx, word [esp + 0x20]
sub ecx, ebx
mov dword [eax + 0xb28], ecx
jmp 0x40481
mov dword [eax + 0xb30], ebx
movzx ecx, word [esp + 0x22]
mov ebx, dword [eax + 0xb2c]
add ecx, ebx
cmp ecx, edx
jbe 0x404a7
mov dword [eax + 0xb34], edx
movzx ecx, word [esp + 0x22]
sub edx, ecx
mov dword [eax + 0xb2c], edx
jmp 0x404ad
mov dword [eax + 0xb34], ecx
mov ebx, dword [esp + 0x10]
mov edx, edi
sub edx, dword [esi + 0xb50]
neg edx
sbb edx, edx
and edx, 0xff0000
add edx, 0x10000
or dword [esi + 0xaf4], edx
mov ebp, dword [esp + 0xc]
cmp ebx, dword [esi + 0xafc]
jae 0x4055f
test byte [esp + 0x6c], 0x20
jne 0x40510
cmp dword [esi + 0xb84], 1
jne 0x404fc
mov eax, dword [esi + 0xae8]
and eax, 0x100000
jmp 0x40507
xor eax, eax
cmp edi, dword [esi + 0xb50]
sete al
test eax, eax
je 0x40510
or byte [esp + 0x4b], 0x10
lea eax, [esp + 0x1c]
push eax
mov eax, edi
mov ecx, esi
call fcn.0003fe00
test eax, eax
je 0x4055f
test dword [esi + 0xaf4], 0x1010000
je 0x40547
mov ecx, edi
shl ecx, 4
push 0
lea ecx, [ecx + esi + 0xb28]
push edi
mov eax, esi
call fcn.00033980
add esp, 8
not ebp
and dword [esp + 0x14], ebp
jne 0x40346
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x64
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret
xor eax, eax
pop ebx
add esp, 0x64
ret