Function at 0x40b520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], edx
mov edx, ecx
push ebx
push esi
push edi
mov esi, dword [edx + 4]
xor edi, edi
xor bl, bl
mov dword [ebp - 8], edx
lea ecx, [esi - 0xb]
cmp eax, ecx
cmova eax, ecx
mov dword [ebp + 0x1c], eax
cmp dword [edx + 0xa4], edi
jne 0x40b7d3
lea eax, [esi - 0x10]
cmp eax, 0x3f0
ja 0x40b7d3
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x418]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0040a450
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b7b1
mov eax, dword [ebp - 0x418]
mov edx, 2
movzx ecx, al
movzx eax, ah
xor eax, 2
or ecx, eax
mov dword [ebp - 0xc], ecx
cmp esi, edx
jbe 0x40b5cf
mov al, byte [ebp + edx - 0x418]
inc edx
mov cl, al
neg cl
or cl, al
not cl
shr cl, 7
or bl, cl
mov al, bl
neg al
or al, bl
not al
movzx eax, al
shr eax, 7
add edi, eax
cmp edx, esi
jb 0x40b5a6
mov edx, dword [ebp - 0xc]
lea eax, [edi - 8]
movzx ecx, bl
mov ebx, esi
neg ecx
shr eax, 0x1f
shr ecx, 0x1f
sub ebx, edi
dec ecx
sub ebx, 3
and ecx, 1
or ecx, eax
or edx, ecx
mov ecx, edx
neg ecx
or ecx, edx
shr ecx, 0x1f
neg ecx
mov eax, ecx
mov dword [ebp - 4], ecx
not dword [ebp - 4]
not eax
and ebx, eax
mov eax, ecx
mov dword [ebp - 8], ebx
and ecx, 0x4100
mov ebx, dword [ebp + 0x1c]
and eax, ebx
mov edi, dword [ebp - 8]
or edi, eax
mov eax, ebx
sub eax, edi
mov dword [ebp - 8], edi
shr eax, 0x1f
mov edi, eax
or eax, edx
neg edi
mov edx, eax
shr edi, 0x1f
neg edx
neg edi
or edx, eax
and dword [ebp - 4], edi
and dword [ebp - 4], 0x4400
or dword [ebp - 4], ecx
mov ecx, 0xb
neg dword [ebp - 4]
shr edx, 0x1f
neg edx
mov dword [ebp - 0xc], edi
cmp esi, ecx
jbe 0x40b70c
lea eax, [esi - 0xb]
cmp eax, 0x40
jb 0x40b6f6
and eax, 0x3f
mov edi, esi
sub edi, eax
movsx eax, dl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
pandn xmm2, xmmword [0x448990]
nop word [eax + eax]
movups xmm0, xmmword [ebp + ecx - 0x418]
movaps xmm1, xmm2
pand xmm1, xmm0
movups xmmword [ebp + ecx - 0x418], xmm1
movups xmm0, xmmword [ebp + ecx - 0x408]
movaps xmm1, xmm2
pand xmm1, xmm0
movups xmmword [ebp + ecx - 0x408], xmm1
movups xmm0, xmmword [ebp + ecx - 0x3f8]
movaps xmm1, xmm2
pand xmm1, xmm0
movups xmmword [ebp + ecx - 0x3f8], xmm1
movups xmm0, xmmword [ebp + ecx - 0x3e8]
movaps xmm1, xmm2
pand xmm1, xmm0
movups xmmword [ebp + ecx - 0x3e8], xmm1
add ecx, 0x40
cmp ecx, edi
jb 0x40b690
mov edi, dword [ebp - 0xc]
cmp ecx, esi
jae 0x40b70c
not dl
nop dword [eax]
and byte [ebp + ecx - 0x418], dl
inc ecx
cmp ecx, esi
jb 0x40b700
mov eax, edi
sub esi, ebx
not eax
and edi, ebx
and eax, dword [ebp - 8]
or eax, edi
lea edi, [ebp - 0x418]
add edi, esi
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x40b79c
neg eax
mov dword [ebp - 0xc], ebx
lea edx, [ebx - 1]
mov dword [ebp - 8], eax
mov esi, ebx
mov ecx, eax
xor eax, eax
shr ecx, 0x1f
mov dword [ebp - 0x14], ecx
test edx, edx
je 0x40b77b
mov esi, ecx
neg esi
shr esi, 0x1f
neg esi
mov ecx, esi
not ecx
mov dword [ebp - 0x10], ecx
mov dl, byte [eax + edi]
mov cl, byte [eax + edi + 1]
movzx ebx, cl
and ebx, dword [ebp - 0x10]
movzx ecx, dl
and ecx, esi
or ebx, ecx
mov byte [eax + edi], bl
inc eax
mov ebx, dword [ebp + 0x1c]
lea edx, [ebx - 1]
cmp eax, edx
jb 0x40b753
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
movzx eax, byte [edi + ebx - 1]
neg ecx
shr ecx, 0x1f
neg ecx
and ecx, eax
mov eax, dword [ebp - 8]
inc eax
mov byte [edi + ebx - 1], cl
sub esi, 1
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esi
jne 0x40b735
push ebx
push edi
push dword [ebp + 0x18]
call sub.ntdll.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
push 0x400
lea eax, [ebp - 0x418]
push 0
push eax
mov eax, dword [sub.ntdll.dll_memset]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffbf80
pop ebx
mov esp, ebp
pop ebp
ret