Function at 0x561530
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5d949b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
lea esi, [edi + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0x50], edi
call fcn.00545350
mov eax, dword [esp + 0x10]
test eax, eax
je 0x561579
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x561586
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov ecx, dword [edi + 8]
call fcn.004975d0
mov edx, dword [edi]
test al, al
jne 0x5615b3
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0
push eax
push ecx
mov ecx, edi
call dword [edx + 0x68]
test eax, eax
je 0x5615c2
mov eax, 1
jmp 0x561ab2
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, edi
call dword [edx + 0x38]
mov edx, dword [edi + 0x24]
mov ebx, dword [edi + 0x28]
push 0xffffffffffffffff
mov ecx, esi
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], ebx
call fcn.00544b40
push 0xffffff
mov ecx, esi
call fcn.00544b30
mov eax, dword [edi + 0x20]
push 4
mov ecx, esi
mov dword [esp + 0x48], eax
call fcn.00544ac0
mov eax, dword [edi + 0x30]
mov ebp, dword [edi + 0x44]
mov dword [esp + 0x18], eax
mov dword [esp + 0x4c], ebp
lea ecx, [eax + eax]
push ecx
mov ecx, esi
call fcn.00544b20
lea edx, [ebp + ebp]
mov ecx, esi
push edx
call fcn.00544b60
lea ecx, [esp + 0x38]
call fcn.00496760
mov ecx, dword [esp + 0x40]
xor ebp, ebp
push 1
mov dword [esp + 0xc0], ebp
call fcn.00496c80
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, esi
call fcn.00545350
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x561658
mov ecx, dword [esp + 0x2c]
cmp ecx, ebp
jne 0x561667
mov ecx, 1
mov eax, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], eax
push ecx
mov ecx, dword [esp + 0x44]
push eax
call fcn.00496a80
test eax, eax
je 0x561694
lea ecx, [esp + 0x38]
mov dword [esp + 0xbc], 0xffffffff
call fcn.004969f0
mov eax, 2
jmp 0x561ab2
mov ecx, dword [esp + 0x40]
call fcn.00496c90
mov edx, dword [edi + 0x5c]
mov ecx, dword [edi + 0x58]
shl edx, 1
shl ecx, 1
push edx
push ecx
push eax
mov ecx, esi
call fcn.00545200
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
sar eax, 1
sar ecx, 1
cmp eax, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
jge 0x5616d1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
jge 0x5616df
mov eax, ecx
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x30]
xor edx, edx
mov dl, byte [esp + 0x32]
mov ecx, esi
and ecx, 0xff
and esi, 0xff00
shl ecx, 0x10
add edx, ecx
mov dword [esp + 0x1c], ebp
add edx, esi
test eax, eax
mov dword [esp + 0x20], edx
jle 0x5617c9
mov esi, dword [edi + 8]
mov ecx, esi
call fcn.00496c00
mov ecx, esi
mov ebx, eax
call fcn.00497810
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x40]
imul edx, ebp
mov esi, ecx
lea ebx, [eax + edx*4]
call fcn.00496c00
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.00497810
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 8]
mov ecx, dword [esp + 0x40]
imul edx, ebp
lea esi, [eax + edx*8]
call fcn.00496c00
mov eax, dword [eax + 8]
xor edx, edx
lea ecx, [esi + eax*4]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x5617b4
mov eax, dword [ecx + 4]
mov ebp, dword [esi + 4]
and eax, 0xff
and ebp, 0xff
add eax, ebp
mov ebp, dword [ecx]
and ebp, 0xff
add ebx, 4
add eax, ebp
mov ebp, dword [esi]
and ebp, 0xff
add esi, 8
add eax, ebp
mov ebp, dword [esp + 0x20]
and eax, 0x3fc
add ecx, 8
shl eax, 0x16
add eax, ebp
inc edx
mov dword [ebx - 4], eax
mov eax, dword [esp + 0x10]
cmp edx, eax
jl 0x561766
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, eax
mov dword [esp + 0x1c], ebp
jl 0x56170e
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
lea esi, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.00544b20
mov edx, dword [esp + 0x4c]
mov ecx, esi
push edx
call fcn.00544b60
cmp ebx, 0xffffffff
je 0x561a69
lea ecx, [esp + 0x50]
call fcn.00560e50
mov eax, dword [0x5da354]
lea ecx, [esi + 4]
push eax
push 0
push ecx
lea ecx, [esp + 0x6c]
mov byte [esp + 0xc8], 1
call fcn.00403f40
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [esp + 0x70], edx
mov edx, dword [esi + 0x20]
mov dword [esp + 0x78], ecx
mov ecx, dword [0x5da354]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x74], eax
mov eax, dword [esi + 0x24]
push ecx
lea edx, [esi + 0x28]
push 0
push edx
lea ecx, [esp + 0x90]
mov dword [esp + 0x8c], eax
call fcn.00403f40
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dl, byte [esi + 0x40]
mov dword [esp + 0x94], eax
mov al, byte [esi + 0x41]
mov dword [esp + 0x98], ecx
mov cl, byte [esi + 0x42]
mov byte [esp + 0x9c], dl
mov edx, dword [esi + 0x44]
mov byte [esp + 0x9d], al
mov eax, dword [esi + 0x48]
mov byte [esp + 0x9e], cl
push ebx
lea ecx, [esp + 0x60]
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa8], eax
call fcn.00544b30
push 0xffffffffffffffff
lea ecx, [esp + 0x60]
call fcn.00544b40
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0x50]
mov dword [esp + 0xac], edx
call fcn.00561250
mov eax, dword [esp + 0x14]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x28], ebx
jle 0x561a3b
mov esi, dword [edi + 8]
mov ecx, esi
call fcn.00496c00
mov ecx, esi
mov ebp, eax
call fcn.00497810
mov ecx, dword [ebp + 8]
imul ecx, ebx
lea edx, [eax + ecx*4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x1c], edx
mov esi, ecx
call fcn.00496c00
mov ecx, esi
mov ebp, eax
call fcn.00497810
mov ecx, dword [ebp + 8]
mov dword [esp + 0x20], 0
imul ecx, ebx
lea edx, [eax + ecx*4]
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [esp + 0x18], edx
jle 0x561a2a
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
mov ebp, dword [edx]
mov esi, ecx
mov edi, ebp
shr esi, 0x18
mov eax, 0xff
shr edi, 0x18
sub eax, esi
imul edi, eax
mov eax, 0x80808081
imul edi
add edx, edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ebx, edx
lea edi, [ebx + esi]
test edi, edi
je 0x5619f4
test ebx, ebx
jne 0x561981
mov edx, dword [esp + 0x18]
mov dword [edx], ecx
jmp 0x5619f4
mov eax, ebp
mov edx, ecx
and eax, 0xff0000
and edx, 0xff0000
imul eax, ebx
imul edx, esi
add eax, edx
xor edx, edx
div edi
mov edx, ecx
and ecx, 0xff
and edx, 0xff00
imul ecx, esi
imul edx, esi
mov ebp, eax
mov eax, dword [esp + 0x18]
and ebp, 0xff0000
mov eax, dword [eax]
and eax, 0xff00
imul eax, ebx
add eax, edx
xor edx, edx
div edi
xor edx, edx
and eax, 0xff00
add ebp, eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
and eax, 0xff
imul eax, ebx
add eax, ecx
mov ecx, dword [esp + 0x1c]
div edi
shl edi, 0x18
add ebp, eax
add ebp, edi
mov dword [ecx], ebp
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov eax, 4
add edi, eax
add esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], edi
inc eax
mov dword [esp + 0x18], esi
cmp eax, ecx
mov dword [esp + 0x20], eax
jl 0x561939
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
mov dword [esp + 0x28], ebx
jl 0x5618e4
mov dword [esp + 0x50], 0x5db48c
lea ecx, [esp + 0x5c]
mov byte [esp + 0xbc], 2
call fcn.00544a40
lea ecx, [esp + 0x50]
mov byte [esp + 0xbc], 0
call fcn.004969f0
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x44]
lea esi, [edi + 0xc]
push edx
mov ecx, esi
call fcn.00544ac0
mov eax, dword [esp + 0x30]
mov ecx, esi
push eax
call fcn.00544b30
push ebx
mov ecx, esi
call fcn.00544b40
mov edi, dword [edi + 8]
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 0x90]
lea ecx, [esp + 0x38]
mov byte [eax], 1
mov dword [esp + 0xbc], 0xffffffff
call fcn.004969f0
xor eax, eax
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xb0
ret