Function at 0x524a70
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
xor edi, edi
mov ebp, ecx
cmp dword [0x683128], edi
jne 0x524de2
cmp dword [0x683124], edi
jne 0x524de2
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x24], edi
je 0x524aeb
mov ecx, dword [0x6938b0]
xor bl, bl
cmp ecx, edi
je 0x524ab1
push esi
call fcn.004d61a0
test al, al
je 0x524ab1
mov bl, 1
mov ecx, dword [0x693a38]
cmp ecx, edi
je 0x524ac7
push esi
call fcn.0047c2a0
test al, al
je 0x524ac7
mov bl, 1
push esi
mov ecx, 0x6a3a68
call fcn.004feab0
test al, al
jne 0x524ada
test bl, bl
je 0x524aeb
mov eax, dword [0x6a01bc]
mov dword [0x6a4ad8], eax
pop esi
pop ebx
pop edi
pop ebp
ret 4
xor ebx, ebx
cmp dword [esi + 0x3c], edi
jne 0x524b17
cmp dword [esi + 0x40], edi
jne 0x524b17
cmp dword [esi + 0x24], edi
je 0x524b03
mov ebx, 1
jmp 0x524b0d
cmp dword [esi + 0x28], edi
je 0x524b0d
mov ebx, 2
cmp dword [esi + 0x48], edi
je 0x524b1c
or ebx, 8
jmp 0x524b1c
mov ebx, 4
cmp dword [esi + 0x28], edi
je 0x524b28
mov dword [ebp + 0xc], 1
cmp dword [esi + 0x58], edi
je 0x524b30
mov dword [ebp + 0xc], edi
mov ecx, 0x69e250
call fcn.0040fd40
test eax, eax
je 0x524b56
cmp dword [esi + 0x34], edi
je 0x524b56
cmp dword [ebp + 0xc], edi
je 0x524b56
push edi
mov ecx, 0x69e250
call fcn.004a35f0
mov dword [ebp + 0xc], edi
cmp ebx, edi
jne 0x524bd6
mov eax, dword [0x6a01bc]
mov ecx, eax
sub ecx, dword [0x6a4ad4]
cmp ecx, 0xc8
jbe 0x524ae4
mov dword [0x6a4ad4], eax
mov eax, dword [esi + 0x64]
mov esi, dword [esi + 0x60]
push eax
push esi
call fcn.0054a460
mov esi, eax
mov eax, dword [0x6a4ad0]
add esp, 8
cmp eax, esi
je 0x524baf
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [0x6a4ad0], esi
cmp esi, edi
jne 0x524ae4
cmp dword [0x682738], 7
je 0x524ae4
push edi
mov ecx, 0x682708
call fcn.0041ee30
pop esi
pop ebx
pop edi
pop ebp
ret 4
mov eax, ebx
and eax, 1
mov dword [esp + 0x14], eax
je 0x524c21
mov eax, dword [0x6a01bc]
cmp eax, dword [0x6a4acc]
jle 0x524c00
add eax, 0x3e8
mov dword [0x6a4ac8], edi
mov dword [0x6a4acc], eax
jmp 0x524c21
mov eax, dword [0x6a4ac8]
inc eax
cmp eax, 8
mov dword [0x6a4ac8], eax
jle 0x524c21
mov ecx, dword [0x691894]
push edi
push edi
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x70]
push eax
push ecx
call fcn.0054a460
mov edi, eax
add esp, 8
test edi, edi
je 0x524d5e
mov eax, dword [edi + 4]
test eax, eax
je 0x524cc7
cmp eax, 0xa
je 0x524cc7
cmp eax, 1
jne 0x524c5a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
jmp 0x524ccf
cmp eax, 2
jne 0x524c69
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
jmp 0x524ccf
cmp eax, 5
jne 0x524c78
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
jmp 0x524ccf
cmp eax, 4
jne 0x524c93
push 0
push 0x13e
push str..MouseEventThrower.cpp
call fcn.00527110
add esp, 0xc
jmp 0x524cd3
cmp eax, 7
jne 0x524ca2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
jmp 0x524ccf
cmp eax, 9
jne 0x524cb1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
jmp 0x524ccf
push 0
push 0x14c
push str..MouseEventThrower.cpp
call fcn.00527110
add esp, 0xc
jmp 0x524cd3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push edi
push ebx
call eax
test bl, 4
je 0x524d01
mov eax, dword [edi + 4]
test eax, eax
je 0x524cf5
cmp eax, 0xa
je 0x524cf5
cmp eax, 1
jne 0x524d01
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edi
push eax
mov eax, dword [edx + 0x2c]
jmp 0x524cff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
push edi
push ebx
call eax
cmp dword [esp + 0x14], 0
je 0x524ae4
mov ecx, dword [0x69e254]
cmp edi, ecx
je 0x524ae4
push 0
call fcn.00499080
mov ecx, dword [0x69e254]
cmp byte [ecx + 0x452], 0
jne 0x524d4c
cmp dword [edi + 4], 7
jne 0x524d4c
pop esi
pop ebx
pop edi
pop ebp
mov dword [esp + 4], 0
mov ecx, 0x69e250
jmp fcn.004a35f0
push edi
mov ecx, 0x69e250
call fcn.004a35f0
pop esi
pop ebx
pop edi
pop ebp
ret 4
cmp dword [esp + 0x14], 0
je 0x524d90
mov eax, dword [0x6a01bc]
mov edx, eax
sub edx, dword [0x6a4ac4]
cmp edx, 0x190
jb 0x524ae4
mov dword [0x6a4ac4], eax
mov dword [0x6a4ad8], eax
mov eax, dword [esi + 0x74]
mov esi, dword [esi + 0x70]
jmp 0x524dbd
test bl, 8
je 0x524ae4
mov eax, dword [0x6a01bc]
mov ecx, eax
sub ecx, dword [0x6a4ad8]
cmp ecx, 0x190
jb 0x524ae4
mov dword [0x6a4ad8], eax
mov eax, dword [esi + 0x64]
mov esi, dword [esi + 0x60]
push eax
push esi
call fcn.0054a540
add esp, 8
test eax, eax
je 0x524ae4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x18]
push ebx
call eax
pop esi
pop ebx
pop edi
pop ebp
ret 4
mov eax, dword [0x6a4ad0]
cmp eax, edi
je 0x524dfc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [0x6a4ad0], edi
mov ecx, dword [0x6a01bc]
pop edi
mov dword [0x6a4ad8], ecx
pop ebp
ret 4