Function at 0x478f2a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x10], ebx
call fcn.004fe01c
pop ecx
pop ecx
test eax, eax
je 0x478f63
cmp dword [ebp - 0x10], ebx
je 0x478f5c
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.004f2e18
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push esi
call fcn.004f4362
add esp, 0x2c
cmp dword [ebp - 0x14], 0x10
jne 0x478f9a
push esi
call fcn.004f440e
pop ecx
cmp dword [ebp - 8], 3
jne 0x478fa7
push esi
call fcn.004f44d8
pop ecx
cmp dword [ebp - 0x14], 8
jge 0x478fb4
push esi
call fcn.004f44d8
pop ecx
push 0x10
push edi
push esi
call fcn.004f42c9
add esp, 0xc
test eax, eax
je 0x478fcb
push esi
call fcn.004f44d8
pop ecx
cmp dword [ebp - 8], ebx
je 0x478fd6
cmp dword [ebp - 8], 4
jne 0x478fdd
push esi
call fcn.004f4500
pop ecx
lea eax, [ebp - 0x40]
push eax
push edi
push esi
call fcn.004f4338
add esp, 0xc
test eax, eax
je 0x47900b
fld qword [ebp - 0x40]
sub esp, 0x10
fstp qword [esp + 8]
fld qword [0x531320]
fstp qword [esp]
push esi
call fcn.004f4496
add esp, 0x14
push edi
push esi
call fcn.004f34ce
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push esi
call fcn.004f4362
push edi
push esi
call fcn.004f42e3
push edi
push esi
call fcn.004f42f9
movzx eax, al
add esp, 0x3c
push 0xa
mov dword [ebp - 0x24], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xc]
neg eax
mov dword [ebp - 0x64], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x60], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x5e], ax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
mov dword [ebp - 0x6c], 0x28
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x478f5c
cmp dword [ebp - 0x18], ebx
je 0x478f5c
test byte [ebp - 8], 2
je 0x4790a9
push esi
call fcn.004f7c3f
pop ecx
push esi
call fcn.004f7c4c
pop ecx
mov ecx, dword [esi + 0xd0]
mov dword [esi + 0xd4], ecx
mov ecx, dword [ebp - 4]
shl ecx, 2
cmp eax, ebx
mov dword [ebp - 0x34], ecx
jle 0x4791a4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xc], ebx
jbe 0x47919b
xor esi, esi
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x18]
add esi, eax
push ebx
push esi
push dword [ebp + 8]
call fcn.004f3500
add esp, 0xc
cmp dword [ebp - 0x24], 3
jne 0x47912f
mov edi, dword [ebp - 4]
dec edi
cmp edi, ebx
jl 0x479180
mov eax, edi
imul eax, eax, 3
lea ecx, [eax + esi + 1]
lea eax, [esi + edi*4 + 2]
mov byte [eax + 1], 0xff
mov dl, byte [ecx + 1]
mov byte [eax], dl
mov dl, byte [ecx]
mov byte [eax - 1], dl
mov dl, byte [ecx - 1]
mov byte [eax - 2], dl
dec edi
sub eax, 4
sub ecx, 3
cmp edi, ebx
jge 0x47910e
jmp 0x479180
cmp dword [ebp - 0x30], ebx
je 0x479180
cmp dword [ebp - 0x24], 4
jne 0x479180
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 4], ebx
jbe 0x479180
movzx ecx, byte [esi + 3]
movzx eax, byte [esi]
imul eax, ecx
cdq
mov edi, 0xff
idiv edi
mov byte [esi], al
movzx eax, byte [esi + 1]
imul eax, ecx
cdq
idiv edi
add esi, 4
mov byte [esi - 3], al
movzx eax, byte [esi - 2]
imul eax, ecx
cdq
mov ecx, edi
idiv ecx
inc dword [ebp - 0x1c]
mov byte [esi - 2], al
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jb 0x479142
inc dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], esi
cmp eax, dword [ebp - 0xc]
jb 0x4790e1
mov esi, dword [ebp + 8]
dec dword [ebp - 0x2c]
jne 0x4790d0
push dword [ebp + 0xc]
push esi
call fcn.004f3947
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
jmp 0x478f5e