Function at 0x414f00
Capabilities:
Encrypt data using rc4 ksa
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x42d9c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x584
push ebx
push ebp
lea eax, [esp + 0x18]
mov ebp, ecx
push esi
push edi
test eax, eax
mov dword [esp + 0x20], ebp
jne 0x41542d
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LockFile]
xor eax, eax
movsx ecx, ax
mov byte [esp + ecx + 0x10], al
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x414f4b
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x414f5b
inc eax
cmp ax, 0x100
jl 0x414f3e
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x414f72
mov byte [esp + 0x18], 0
mov byte [esp + 0x14], 0
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x15], 0
mov byte [esp + 0x1c], 0
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x414f9a
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x414faa
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x414fba
mov eax, dword [esp + 0x1c]
xor ebx, ebx
movsx edx, cx
and eax, 0xff
and ebp, 0xff
lea esi, [esp + edx + 0x10]
mov bl, byte [eax + 0x384]
mov dl, byte [esi]
mov edi, edx
and edi, 0xff
add ebx, edi
add ebx, ebp
and ebx, 0x800000ff
jns 0x415001
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov ebp, dword [esp + 0x18]
mov edi, ebp
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
lea edi, [esp + edi + 0x10]
mov byte [esi], bl
mov esi, 0x57
mov byte [edi], dl
cdq
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x414f94
mov edi, ebp
and edi, 0xff
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x415044
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x415054
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x415064
movsx eax, cx
mov dl, byte [esp + eax + 0x10]
xor ebx, ebx
lea esi, [esp + eax + 0x10]
mov eax, dword [esp + 0x1c]
and eax, 0xff
mov ebp, edx
and ebp, 0xff
mov bl, byte [eax + 0x384]
add edi, ebx
add ebp, edi
mov ebx, ebp
and ebx, 0x800000ff
jns 0x4150a9
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov edi, dword [esp + 0x18]
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
mov byte [esi], bl
mov byte [esp + edi + 0x10], dl
cdq
mov esi, 0x57
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x41503e
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
movsx ecx, ax
mov byte [esp + ecx + 0x10], al
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x4150f6
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x415106
inc eax
cmp ax, 0x100
jl 0x4150e9
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x41511d
mov byte [esp + 0x18], bl
mov byte [esp + 0x14], bl
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x15], bl
mov byte [esp + 0x1c], bl
jmp 0x41513f
xor ebx, ebx
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x415145
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x415155
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x415165
mov eax, dword [esp + 0x1c]
xor ebx, ebx
movsx edx, cx
and eax, 0xff
and ebp, 0xff
lea esi, [esp + edx + 0x10]
mov bl, byte [eax + 0x384]
mov dl, byte [esi]
mov edi, edx
and edi, 0xff
add ebx, edi
add ebx, ebp
and ebx, 0x800000ff
jns 0x4151ac
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov ebp, dword [esp + 0x18]
mov edi, ebp
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
lea edi, [esp + edi + 0x10]
mov byte [esi], bl
mov esi, 0x57
mov byte [edi], dl
cdq
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x41513d
mov edi, ebp
and edi, 0xff
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x4151ef
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x4151ff
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x41520f
movsx eax, cx
mov dl, byte [esp + eax + 0x10]
xor ebx, ebx
lea esi, [esp + eax + 0x10]
mov eax, dword [esp + 0x1c]
and eax, 0xff
mov ebp, edx
and ebp, 0xff
mov bl, byte [eax + 0x384]
add edi, ebx
add ebp, edi
mov ebx, ebp
and ebx, 0x800000ff
jns 0x415254
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov edi, dword [esp + 0x18]
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
mov byte [esi], bl
mov byte [esp + edi + 0x10], dl
cdq
mov esi, 0x57
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x4151e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
xor eax, eax
movsx edx, ax
mov byte [esp + edx + 0x10], al
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x41529c
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x4152ac
inc eax
cmp ax, 0x100
jl 0x41528f
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x4152c3
mov byte [esp + 0x18], cl
mov byte [esp + 0x14], cl
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x15], cl
mov byte [esp + 0x1c], cl
jmp 0x4152e5
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x4152eb
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x4152fb
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x415309
movsx eax, cx
mov dl, byte [esp + eax + 0x10]
xor ebx, ebx
lea esi, [esp + eax + 0x10]
mov eax, dword [esp + 0x1c]
and eax, 0xff
mov edi, edx
and edi, 0xff
and ebp, 0xff
mov bl, byte [eax + 0x384]
add ebx, edi
add ebx, ebp
and ebx, 0x800000ff
jns 0x415352
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov ebp, dword [esp + 0x18]
mov edi, ebp
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
lea edi, [esp + edi + 0x10]
mov byte [esi], bl
mov esi, 0x57
mov byte [edi], dl
cdq
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x4152e3
mov edi, ebp
and edi, 0xff
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x415395
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x4153a5
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x4153b5
mov eax, dword [esp + 0x1c]
xor ebx, ebx
movsx edx, cx
and eax, 0xff
lea esi, [esp + edx + 0x10]
mov bl, byte [eax + 0x384]
mov dl, byte [esi]
add edi, ebx
mov ebp, edx
and ebp, 0xff
add ebp, edi
mov ebx, ebp
and ebx, 0x800000ff
jns 0x4153f8
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov edi, dword [esp + 0x18]
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
mov byte [esi], bl
mov byte [esp + edi + 0x10], dl
cdq
mov esi, 0x57
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x41538f
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
lea edi, [esp + 0x30]
push 0x5e
lea esi, [eax + ecx - 0x5e]
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4353d0]
lea edx, [esp + 0x160]
push 0
push edx
movsw word es:[edi], word [esi]
call dword [eax + 0x21c]
mov eax, dword [0x4353d0]
lea ecx, [esp + 0x3c]
push 0x5e
lea edx, [esp + 0x16c]
push ecx
push edx
call dword [eax + 0x1f8]
add esp, 0x18
test eax, eax
je 0x41581e
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 4]
push 4
lea eax, [ecx + edx - 0x62]
lea ecx, [esp + 0x288]
push eax
call fcn.00419270
lea eax, [esp + 0x30]
push 0x5e
push eax
lea ecx, [esp + 0x28c]
mov dword [esp + 0x5a4], 0
call fcn.00419350
or ebx, 0xffffffff
lea ecx, [esp + 0x284]
mov dword [esp + 0x59c], ebx
call fcn.00419340
push ebp
push 0x415e10
call fcn.0041a5f5
mov eax, dword [esp + 0x38]
add esp, 8
cmp eax, 3
jne 0x41552c
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
push ecx
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x4c]
push edx
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x48]
sub esp, 0x10
mov edx, esp
push 0
push 0
mov dword [edx], eax
mov eax, dword [esp + 0x64]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x68]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
call fcn.0041a560
add esp, 0x28
jmp 0x415552
mov edx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x4c]
push eax
push ecx
push edx
push 0
push 0
call fcn.0041a4fa
add esp, 0x18
push 0
push 0x7d
push 0x39
push 0x39
push 0x31
push 0x37
push 0x38
push 0x33
push 0x32
push 0x33
push 0x36
push 0x32
push 0x46
push 0x32
push 0x2d
push 0x36
push 0x31
push 0x43
push 0x39
push 0x2d
push 0x33
push 0x65
push 0x31
push 0x34
push 0x2d
push 0x33
push 0x34
push 0x30
push 0x46
push 0x2d
push 0x44
push 0x46
push 0x30
push 0x34
push 0x33
push 0x37
push 0x33
push 0x41
lea eax, [esp + 0x138]
push 0x7b
push eax
call fcn.00408c90
mov edx, dword [0x4353d0]
add esp, 0xa0
lea ecx, [esp + 0xa0]
mov edi, 1
push ecx
push 0
push edi
push 0
call dword [edx + 0x68]
push 0
mov dword [ebp + 0xc], eax
mov eax, dword [0x4353d0]
push 0
push edi
push 0
call dword [eax + 0x68]
push 0
push 0x7d
push 0x34
push 0x33
push 0x36
push 0x31
push 0x43
push 0x38
push 0x35
push 0x44
push 0x39
push 0x36
push 0x42
push 0x37
push 0x2d
push 0x46
push 0x46
push 0x42
push 0x41
push 0x2d
push 0x66
mov dword [ebp + 0x10], eax
push 0x36
push 0x34
push 0x34
push 0x2d
push 0x32
push 0x38
push 0x34
push 0x39
push 0x2d
push 0x41
push 0x33
push 0x46
push 0x33
push 0x33
push 0x44
push 0x33
push 0x38
lea ecx, [esp + 0x138]
push 0x7b
push ecx
call fcn.00408c90
mov eax, dword [0x4353d0]
add esp, 0xa0
lea edx, [esp + 0xa0]
push edx
push 0
push edi
push 0
call dword [eax + 0x68]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
mov ecx, dword [0x4353d0]
push ebx
lea eax, [esp + 0x28]
push 0
push eax
push 3
call dword [ecx + 0x80]
sub eax, 0
je 0x415819
dec eax
je 0x415802
dec eax
jne 0x41581e
mov edx, dword [ebp + 0x14]
mov eax, dword [0x4353d0]
push edx
call dword [eax + 0x7c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 4]
push 0x5e
push 0
push ecx
push edx
lea ecx, [esp + 0x114]
call fcn.00419040
lea eax, [esp + 0x90]
lea ecx, [esp + 0x104]
push eax
mov dword [esp + 0x5a0], edi
call fcn.00419170
mov edx, dword [0x4353d0]
lea ecx, [esp + 0x38c]
push ecx
push 0x104
call dword [edx + 0x54]
push 0
push 0x73
push 0x25
push 0x73
lea eax, [esp + 0x1cc]
push 0x25
push eax
call fcn.00408c90
add esp, 0x18
lea ecx, [esp + 0x220]
push 0
push 0x74
push 0x61
push 0x64
push 0x2e
push 0x7d
push 0x43
push 0x32
push 0x37
push 0x32
push 0x43
push 0x32
push 0x45
push 0x43
push 0x31
push 0x44
push 0x35
push 0x31
push 0x2d
push 0x30
push 0x31
push 0x43
push 0x41
push 0x2d
push 0x65
push 0x64
push 0x63
push 0x34
push 0x2d
push 0x38
push 0x34
push 0x45
push 0x45
push 0x2d
push 0x41
push 0x39
push 0x46
push 0x43
push 0x34
push 0x32
push 0x46
push 0x46
push 0x7b
push ecx
call fcn.00408c90
lea edx, [esp + 0x2d0]
lea eax, [esp + 0x43c]
push edx
lea ecx, [esp + 0x270]
push eax
mov eax, dword [0x4353d0]
lea edx, [esp + 0x548]
push ecx
push edx
call dword [eax + 0x1dc]
add esp, 0xc0
mov edx, dword [0x4353d0]
lea ecx, [esp + 0x490]
push 0
push 0x80
push 2
push 0
push edi
push 0x40000000
push ecx
call dword [edx + 0x50]
mov esi, eax
cmp esi, ebx
je 0x4157ea
mov edx, dword [0x4353d0]
lea eax, [esp + 0x20]
push 0
push eax
lea ecx, [esp + 0x98]
push 0x10
push ecx
push esi
call dword [edx + 0x78]
mov eax, dword [0x4353d0]
push esi
call dword [eax + 0x44]
lea ecx, [esp + 0x104]
mov dword [esp + 0x59c], ebx
call fcn.00419130
jmp 0x41566e
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x4353d0]
push ecx
call dword [edx + 0x7c]
call fcn.0041a5d6
jmp 0x41566e
call fcn.0041a5d6
mov ecx, dword [esp + 0x594]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x590
ret