Function at 0x1004f580
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x28
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0x18], ecx
push esi
push edi
lea eax, [ebp + 0x10]
test ecx, ecx
je 0x1004f5c0
mov edi, dword [ecx]
mov edx, eax
mov esi, edi
and esi, 0xf
sub eax, esi
sub edx, esi
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, eax
xor eax, eax
test esi, esi
cmovne eax, edx
mov ecx, dword [ecx + edi + 0x13c]
mov ebx, dword [eax + edi + 0x140]
jmp 0x1004f5c4
xor ecx, ecx
xor ebx, ebx
mov eax, ecx
mov dword [esp + 0x14], ebx
cdq
mov esi, eax
mov dword [esp + 0x10], ecx
xor esi, edx
mov eax, ebx
sub esi, edx
cdq
mov ebx, eax
mov dword [esp + 0x30], esi
xor ebx, edx
sub ebx, edx
test esi, esi
jle 0x1004fb56
test ebx, ebx
jle 0x1004fb56
push 4
call fcn.102709ea
mov edi, eax
mov dword [esp + 0x30], eax
add esp, 4
test edi, edi
je 0x1004fb56
push 0
push 8
push ebx
mov edx, esi
xor ecx, ecx
call fcn.10001ab0
add esp, 0xc
mov dword [esp + 0x34], eax
test eax, eax
je 0x1004fb4d
push 0x10
push eax
call fcn.102705fd
mov esi, eax
add esp, 8
mov dword [edi], esi
test esi, esi
je 0x1004fb4d
push dword [esp + 0x34]
push 0
push esi
call fcn.1026c8e0
push 0x100
lea eax, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], ebp
push 0xff
push eax
mov dword [esi + 0x10c], ebp
mov dword [esi + 0x108], ebp
call fcn.1026c8e0
mov dword [esi + 0x120], 1
xor eax, eax
push 0x103d71d5
push 8
mov dword [esi + 0x114], ebp
mov dword [esi + 0x118], ebp
mov word [esi + 0x110], ax
call fcn.10269fcd
add esp, 0x20
mov dword [esp + 0x34], eax
test eax, eax
je 0x1004f6cd
push 0x18
mov dword [eax], ebp
mov dword [eax + 4], ebp
call fcn.10269f9d
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ecx], eax
jmp 0x1004f6cf
xor ecx, ecx
mov dword [esi + 0x11c], ecx
mov eax, 0x10
mov ecx, esi
mov dword [esi + 0x124], ebp
and ecx, 0xf
mov dword [esi + 0x128], ebp
sub eax, ecx
mov dword [esi + 0x12c], ebp
neg ecx
push edi
sbb ecx, ecx
and ecx, eax
mov eax, dword [esp + 0x34]
mov dword [ecx + esi + 0x138], 0x28
mov dword [ecx + esi + 0x13c], eax
mov dword [ecx + esi + 0x140], ebx
mov dword [ecx + esi + 0x144], 0x80001
mov dword [ecx + esi + 0x148], ebp
mov dword [ecx + esi + 0x158], 0x100
mov dword [ecx + esi + 0x15c], 0x100
mov dword [ecx + esi + 0x150], 0xb13
mov dword [ecx + esi + 0x154], 0xb13
call sym.FreeImage32.dll__FreeImage_GetPalette_4
xor ecx, ecx
inc eax
nop dword [eax]
mov byte [eax + 1], cl
lea eax, [eax + 4]
mov byte [eax - 4], cl
mov byte [eax - 5], cl
inc ecx
cmp ecx, 0x100
jl 0x1004f760
mov eax, dword [esp + 0x10]
lea ebx, [eax*4]
push ebx
mov dword [esp + 0x2c], ebx
call fcn.102709ea
mov esi, eax
push ebx
mov dword [esp + 0x20], esi
call fcn.102709ea
push dword [esp + 0x30]
mov ebx, eax
push 0
push esi
mov dword [esp + 0x30], ebx
call fcn.1026c8e0
push dword [esp + 0x3c]
push 0
push ebx
call fcn.1026c8e0
xor ebx, ebx
add esp, 0x20
xor esi, esi
cmp dword [esp + 0x14], ebx
jle 0x1004f87f
imul ebp, ebp, 0x41c64e6d
push esi
push dword [esp + 0x24]
add ebp, 0x3039
call sym.FreeImage32.dll__FreeImage_GetScanLine_8
push esi
push edi
movzx ecx, byte [eax]
mov eax, ebp
add ecx, ebx
sar eax, 0xc
cdq
mov ebx, 0x81
idiv ebx
xor ebx, ebx
mov eax, 0xff
add edx, 0x3f
cmp ecx, edx
cmovg ebx, eax
sub ecx, ebx
mov dword [esp + 0x3c], ecx
call sym.FreeImage32.dll__FreeImage_GetScanLine_8
inc esi
mov byte [eax], bl
mov ebx, dword [esp + 0x34]
cmp esi, dword [esp + 0x14]
jl 0x1004f7c5
xor ebx, ebx
xor esi, esi
nop word [eax + eax]
imul ebp, ebp, 0x41c64e6d
push esi
push dword [esp + 0x24]
add ebp, 0x3039
call sym.FreeImage32.dll__FreeImage_GetScanLine_8
mov ecx, dword [esp + 0x10]
push esi
push edi
movzx ecx, byte [eax + ecx - 1]
mov eax, ebp
add ecx, ebx
sar eax, 0xc
cdq
mov ebx, 0x81
idiv ebx
xor ebx, ebx
mov eax, 0xff
add edx, 0x3f
cmp ecx, edx
cmovg ebx, eax
sub ecx, ebx
mov dword [esp + 0x3c], ecx
call sym.FreeImage32.dll__FreeImage_GetScanLine_8
mov ecx, dword [esp + 0x10]
inc esi
mov byte [eax + ecx - 1], bl
mov ebx, dword [esp + 0x34]
cmp esi, dword [esp + 0x14]
jl 0x1004f820
jmp 0x1004f885
xor ebp, ebp
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1004f8ef
mov ecx, dword [eax]
cmp dword [ecx + 0x120], 0
je 0x1004f8ef
mov esi, dword [ecx + 0x128]
mov ebx, 0x10
test esi, esi
jne 0x1004f8f4
lea edx, [ecx + 0x130]
mov eax, ebx
and edx, 0xf
sub eax, edx
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edx + ecx + 0x158]
add edx, ecx
add eax, 0x58
lea ecx, [edx + eax*4]
xor eax, eax
cmp dword [edx + 0x148], 3
mov edx, 0xc
cmove eax, edx
add ecx, eax
mov eax, ebx
mov esi, ecx
and esi, 0xf
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
add esi, ecx
jmp 0x1004f8f4
xor esi, esi
lea ebx, [esi + 0x10]
mov ecx, dword [edi]
cmp dword [ecx + 0x120], 0
jne 0x1004f903
xor eax, eax
jmp 0x1004f951
mov eax, dword [ecx + 0x128]
test eax, eax
jne 0x1004f951
lea edx, [ecx + 0x130]
mov eax, ebx
and edx, 0xf
sub eax, edx
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edx + ecx + 0x158]
add edx, ecx
add eax, 0x58
lea ecx, [edx + eax*4]
xor eax, eax
cmp dword [edx + 0x148], 3
mov edx, 0xc
cmove eax, edx
add ecx, eax
mov eax, ecx
and eax, 0xf
sub ebx, eax
neg eax
sbb eax, eax
and eax, ebx
add eax, ecx
xor ecx, ecx
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x10], ecx
jle 0x1004f9e0
sub eax, esi
mov dword [esp + 0x34], eax
mov edi, eax
jmp 0x1004f974
mov ecx, dword [esp + 0x34]
movzx eax, byte [esi]
lea esi, [esi + 1]
add ecx, eax
imul ebp, ebp, 0x41c64e6d
mov ebx, 0x81
add ebp, 0x3039
mov eax, ebp
sar eax, 0xc
cdq
idiv ebx
xor ebx, ebx
mov eax, 0xff
add edx, 0x3f
cmp ecx, edx
cmovg ebx, eax
mov eax, 0x7f
sub ecx, ebx
mov byte [edi + esi - 1], bl
mov dword [esp + 0x34], ecx
movzx ecx, byte [esi - 1]
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x24]
sar eax, 1
sub eax, ebx
add eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + edx*4], eax
inc edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], edx
cmp edx, eax
jl 0x1004f970
mov edi, dword [esp + 0x2c]
jmp 0x1004f9e8
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
mov esi, 1
mov dword [esp + 0x34], esi
cmp dword [esp + 0x14], esi
jle 0x1004fb34
dec eax
mov dword [esp + 0x2c], eax
push esi
push dword [esp + 0x24]
call sym.FreeImage32.dll__FreeImage_GetScanLine_8
push esi
mov ebx, eax
push edi
mov dword [esp + 0x38], ebx
call sym.FreeImage32.dll__FreeImage_GetScanLine_8
movzx esi, byte [ebx]
xor ecx, ecx
mov dword [esp + 0x24], eax
cmp byte [eax], cl
mov eax, 0xff
cmovne ecx, eax
mov eax, 0x7f
sub eax, esi
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
add eax, esi
mov esi, 1
mov dword [ebp], eax
cmp dword [esp + 0x2c], esi
jle 0x1004fab8
mov ebx, dword [esp + 0x18]
sub ebp, ebx
mov eax, dword [ebx + ebp]
lea edx, [ebx + 4]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [ebx + 8]
lea eax, [eax + eax*2]
add ecx, eax
mov eax, dword [edx]
lea eax, [eax + eax*4]
add ecx, eax
add ecx, dword [ebx]
mov ecx, ecx
test ecx, ecx
jns 0x1004fa7b
add ecx, 0xf
sar ecx, 4
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
movzx eax, byte [esi + eax]
add eax, ecx
cmp eax, 0x7f
lea ecx, [eax - 0xff]
cmovle ecx, eax
setle al
dec al
mov byte [ebx + esi], al
lea ebx, [edx]
mov eax, dword [esp + 0x1c]
mov dword [eax + esi*4], ecx
inc esi
cmp esi, dword [esp + 0x2c]
jl 0x1004fa52
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
xor ecx, ecx
movzx esi, byte [ebx]
cmp byte [eax], cl
mov eax, 0xff
cmovne ecx, eax
mov eax, 0x7f
sub eax, esi
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
sub eax, ecx
xor ecx, ecx
add eax, esi
mov dword [ebp], eax
mov eax, dword [esp + 0x24]
movzx esi, byte [ebx + edx - 1]
cmp byte [eax + edx - 1], cl
mov eax, 0xff
cmovne ecx, eax
mov eax, 0x7f
sub eax, esi
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
mov ecx, dword [esp + 0x28]
add eax, esi
mov esi, dword [esp + 0x34]
inc esi
mov dword [esp + 0x34], esi
mov dword [ecx + ebp - 4], eax
mov ecx, ebp
mov eax, dword [esp + 0x18]
mov ebp, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebp
cmp esi, dword [esp + 0x14]
jl 0x1004fa04
push ecx
call fcn.10270662
push ebp
call fcn.10270662
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push edi
call fcn.10270662
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret