Function at 0x10049de0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0xa0
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0x98], eax
mov eax, dword [0x10066c20]
mov ecx, dword [0x10066c1c]
mov edx, eax
add edx, 0xe0dce5bc
sub edx, 1
sub edx, 0xe0dce5bc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x9d], al
cmp ecx, 0xa
setl cl
mov byte [esp + 0x9e], cl
xor al, 0xff
mov byte [esp + 0x9f], al
mov al, byte [esp + 0x9e]
mov ah, byte [esp + 0x9d]
mov ch, byte [esp + 0x9f]
mov dl, al
xor dl, 0xff
mov byte [esp + 0x8e], dl
mov cl, 1
xor cl, 1
mov byte [esp + 0x8f], cl
and ch, 0xff
mov byte [esp + 0x90], ch
and ah, cl
mov byte [esp + 0x91], ah
and dl, 0xff
mov byte [esp + 0x92], dl
and al, cl
mov byte [esp + 0x93], al
mov cl, byte [esp + 0x93]
mov al, byte [esp + 0x92]
mov ah, byte [esp + 0x91]
mov dl, byte [esp + 0x90]
or dl, ah
mov byte [esp + 0x8c], dl
or al, cl
mov byte [esp + 0x8d], al
mov cl, byte [esp + 0x8e]
mov al, byte [esp + 0x9f]
mov ah, byte [esp + 0x8d]
mov dl, byte [esp + 0x8c]
xor dl, ah
mov byte [esp + 0x8a], dl
or al, cl
mov byte [esp + 0x8b], al
mov al, byte [esp + 0x8a]
mov dl, byte [esp + 0x8f]
mov cl, byte [esp + 0x8b]
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
mov byte [esp + 0x89], al
mov al, byte [esp + 0x89]
test al, 1
jne 0x10049f32
jmp 0x1004a324
mov eax, dword [0x10066c20]
mov dword [esp + 0x7c], eax
mov ecx, dword [0x10066c1c]
mov dword [esp + 0x80], ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
mov dword [esp + 0x84], eax
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x7c]
imul eax, ecx
mov dword [esp + 0x78], eax
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x75], al
cmp ecx, 0xa
setl cl
mov byte [esp + 0x76], cl
and al, cl
mov byte [esp + 0x77], al
mov al, byte [esp + 0x77]
mov dl, byte [esp + 0x76]
mov cl, byte [esp + 0x75]
xor cl, dl
or al, cl
mov byte [esp + 0x74], al
mov al, byte [esp + 0x74]
test al, 1
jne 0x10049fb5
jmp 0x1004a345
mov eax, dword [esp + 0x94]
add eax, 0x19
mov dword [esp + 0x6c], eax
mov eax, dword [0x10065384]
mov eax, dword [eax + 0x3ecde990]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x70]
cmp eax, 1
sete al
mov byte [esp + 0x63], al
mov eax, dword [0x10066c20]
mov dword [esp + 0x64], eax
mov eax, dword [0x10066c1c]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x64]
xor edx, edx
sub edx, 1
mov ecx, eax
add ecx, edx
imul eax, ecx
and eax, 1
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x5c]
cmp ecx, 0
sete cl
mov byte [esp + 0x5a], cl
cmp eax, 0xa
setl al
mov byte [esp + 0x5b], al
mov ch, byte [esp + 0x5b]
mov dh, byte [esp + 0x5a]
mov al, dh
xor al, 0xff
mov cl, ch
xor cl, 0xff
mov bl, 1
xor bl, 0
mov byte [esp + 0x57], bl
mov dl, al
and dl, 0
and dh, bl
mov ah, cl
and ah, 0
and ch, bl
or dl, dh
or ah, ch
xor dl, ah
mov byte [esp + 0x58], dl
or al, cl
xor al, 0xff
mov byte [esp + 0x59], al
mov al, byte [esp + 0x58]
mov cl, byte [esp + 0x59]
mov dl, byte [esp + 0x57]
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x1004a07f
jmp 0x1004a345
mov eax, dword [0x10066c20]
mov ecx, dword [0x10066c1c]
mov dword [esp + 0x4c], ecx
xor edx, edx
sub edx, 1
mov ecx, eax
add ecx, edx
imul eax, ecx
and eax, 1
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
cmp ecx, 0
sete cl
mov byte [esp + 0x4a], cl
cmp eax, 0xa
setl al
mov byte [esp + 0x4b], al
mov al, byte [esp + 0x4a]
mov cl, byte [esp + 0x4b]
mov dl, al
xor dl, 0xff
mov byte [esp + 0x45], dl
xor cl, 0xff
mov byte [esp + 0x46], cl
mov cl, 1
xor cl, 1
mov byte [esp + 0x47], cl
and dl, 0xff
mov byte [esp + 0x48], dl
and al, cl
mov byte [esp + 0x49], al
mov al, byte [esp + 0x47]
mov dl, byte [esp + 0x46]
mov cl, byte [esp + 0x45]
mov bl, byte [esp + 0x49]
mov ah, byte [esp + 0x48]
mov dh, byte [esp + 0x4b]
mov ch, dl
and ch, 0xff
and dh, al
or ah, bl
or ch, dh
xor ah, ch
mov byte [esp + 0x42], ah
or cl, dl
xor cl, 0xff
mov byte [esp + 0x43], cl
or al, 1
mov byte [esp + 0x44], al
mov cl, byte [esp + 0x44]
mov al, byte [esp + 0x43]
and al, cl
mov byte [esp + 0x41], al
mov cl, byte [esp + 0x41]
mov al, byte [esp + 0x42]
or al, cl
test al, 1
jne 0x1004a148
jmp 0x1004a324
mov cl, byte [esp + 0x63]
xor eax, eax
test cl, 1
mov dword [esp + 0x3c], eax
jne 0x1004a1f0
jmp 0x1004a160
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x38], eax
mov bh, byte [edx + eax]
mov esi, 0x19
xor edx, edx
div esi
mov eax, dword [esp + 0x38]
mov bl, byte [ecx + edx]
mov dl, bh
xor dl, 0xff
and dl, 0xa1
mov cl, 0xff
xor cl, 0xa1
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0xa1
and bl, cl
mov ecx, dword [esp + 0x98]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0x40
mov dword [esp + 0x3c], eax
jne 0x1004a160
mov eax, dword [0x10065384]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
add eax, 0x3ecde990
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [eax], 1
jmp 0x1004a1f0
mov eax, dword [0x10066c20]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x10066c1c]
mov dword [esp + 0x24], ecx
mov ecx, eax
sub ecx, 0x8d610535
sub ecx, 1
add ecx, 0x8d610535
imul eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x23], al
mov cl, byte [esp + 0x23]
mov eax, dword [esp + 0x24]
cmp eax, 0xa
setl al
mov byte [esp + 0x20], al
xor cl, 0xff
mov byte [esp + 0x21], cl
xor al, 0xff
mov byte [esp + 0x22], al
mov cl, byte [esp + 0x22]
mov al, byte [esp + 0x21]
mov ch, byte [esp + 0x20]
mov dh, byte [esp + 0x23]
mov bl, 1
xor bl, 1
mov byte [esp + 0x1d], bl
mov dl, al
and dl, 0xff
and dh, bl
mov ah, cl
and ah, 0xff
and ch, bl
or dl, dh
or ah, ch
xor dl, ah
mov byte [esp + 0x1e], dl
or al, cl
xor al, 0xff
mov byte [esp + 0x1f], al
mov al, byte [esp + 0x1e]
mov cl, byte [esp + 0x1f]
mov dl, byte [esp + 0x1d]
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x1004a2a8
jmp 0x1004a35c
mov eax, dword [0x10066c20]
mov ecx, dword [0x10066c1c]
mov dword [esp + 0x14], ecx
mov ecx, eax
add ecx, 0xcbaed88a
sub ecx, 1
sub ecx, 0xcbaed88a
imul eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
and eax, 1
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
mov byte [esp + 0xe], dl
xor al, cl
mov byte [esp + 0xf], al
mov cl, byte [esp + 0xf]
mov al, byte [esp + 0xe]
or al, cl
mov byte [esp + 0xd], al
mov al, byte [esp + 0xd]
test al, 1
jne 0x1004a31b
jmp 0x1004a35c
add esp, 0xa0
pop esi
pop ebx
ret
mov eax, dword [0x10065384]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add eax, 0x3ecde990
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
jmp 0x10049f32
mov eax, dword [0x10065384]
add eax, 0x3ecde990
mov dword [esp], eax
mov eax, dword [esp]
mov eax, dword [eax]
jmp 0x10049fb5
jmp 0x1004a2a8