Function at 0x1004de90
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
sub esp, 0xcc
mov eax, dword [esp + 0xdc]
mov dword [esp + 0xc0], eax
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0xc4], ecx
add eax, 0x12
mov dword [esp + 0xc8], eax
mov eax, dword [0x100653a4]
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xbc]
add eax, 0x280f380c
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xb8]
mov eax, dword [eax]
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0xb4]
cmp eax, 1
sete al
mov byte [esp + 0xb3], al
mov cl, byte [esp + 0xb3]
xor eax, eax
test cl, 1
mov dword [esp + 0xac], eax
jne 0x1004e28c
jmp 0x1004df1f
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0xc8]
mov dword [esp + 0xa8], eax
mov bh, byte [edx + eax]
mov esi, 0x12
xor edx, edx
div esi
mov eax, dword [esp + 0xa8]
mov bl, byte [ecx + edx]
mov dl, bh
xor dl, 0xff
and dl, 0x1d
mov cl, 0xff
xor cl, 0x1d
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0x1d
and bl, cl
mov ecx, dword [esp + 0xc4]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 1
sub eax, ecx
cmp eax, 0xb
mov dword [esp + 0xac], eax
jne 0x1004df1f
mov eax, dword [0x10066be8]
mov ecx, dword [0x10066be4]
mov dword [esp + 0xa0], ecx
xor edx, edx
sub edx, 1
mov ecx, eax
add ecx, edx
imul eax, ecx
and eax, 1
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
cmp eax, 0
sete ah
cmp ecx, 0xa
setl al
mov ch, ah
xor ch, 0xff
mov byte [esp + 0x99], ch
mov dl, al
xor dl, 0xff
mov byte [esp + 0x9a], dl
mov cl, 1
xor cl, 1
mov byte [esp + 0x9b], cl
and ch, 0xff
mov byte [esp + 0x9c], ch
and ah, cl
mov byte [esp + 0x9d], ah
and dl, 0xff
mov byte [esp + 0x9e], dl
and al, cl
mov byte [esp + 0x9f], al
mov cl, byte [esp + 0x9a]
mov al, byte [esp + 0x99]
mov ch, byte [esp + 0x9f]
mov ah, byte [esp + 0x9e]
mov dh, byte [esp + 0x9d]
mov dl, byte [esp + 0x9c]
or dl, dh
or ah, ch
xor dl, ah
mov byte [esp + 0x97], dl
or al, cl
xor al, 0xff
mov byte [esp + 0x98], al
mov al, byte [esp + 0x97]
mov cl, byte [esp + 0x98]
mov dl, byte [esp + 0x9b]
or dl, 1
and cl, dl
or al, cl
mov byte [esp + 0x96], al
mov al, byte [esp + 0x96]
test al, 1
jne 0x1004e096
jmp 0x1004e49c
mov eax, dword [0x100653a4]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x90]
mov dword [eax + 0x280f380c], 1
mov eax, dword [0x10066be8]
mov dword [esp + 0x88], eax
mov eax, dword [0x10066be4]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x88]
mov ecx, eax
add ecx, 0xe2099d2a
sub ecx, 1
sub ecx, 0xe2099d2a
imul eax, ecx
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x84]
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
mov byte [esp + 0x83], al
mov al, byte [esp + 0x83]
test al, 1
jne 0x1004e12d
jmp 0x1004e49c
mov eax, dword [0x10066be8]
mov dword [esp + 0x74], eax
mov ecx, dword [0x10066be4]
mov dword [esp + 0x78], ecx
add eax, 0x9aaaae07
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x7c]
sub eax, 1
sub eax, 0x9aaaae07
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
imul eax, ecx
and eax, 1
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x6c]
cmp ecx, 0
sete cl
mov byte [esp + 0x67], cl
cmp eax, 0xa
setl al
mov byte [esp + 0x68], al
xor cl, 0xff
mov byte [esp + 0x69], cl
xor al, 0xff
mov byte [esp + 0x6a], al
mov al, 1
xor al, 0
mov byte [esp + 0x6b], al
mov dl, byte [esp + 0x6b]
mov ah, byte [esp + 0x6a]
mov cl, byte [esp + 0x69]
mov dh, byte [esp + 0x68]
mov bl, byte [esp + 0x67]
mov al, cl
and al, 0
and bl, dl
mov ch, ah
and ch, 0
and dh, dl
or al, bl
or ch, dh
xor al, ch
or cl, ah
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
mov byte [esp + 0x66], al
mov al, byte [esp + 0x66]
test al, 1
jne 0x1004e1e4
jmp 0x1004e4bf
mov eax, dword [0x10066be8]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
mov ecx, dword [0x10066be4]
mov dword [esp + 0x58], ecx
sub eax, 0xdeb8d21b
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x5c]
sub eax, 1
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x54]
add ecx, 0xdeb8d21b
imul eax, ecx
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x53], al
mov al, byte [esp + 0x53]
mov ecx, dword [esp + 0x58]
cmp ecx, 0xa
setl cl
mov byte [esp + 0x51], cl
xor al, 0xff
mov byte [esp + 0x52], al
mov cl, byte [esp + 0x52]
mov dh, byte [esp + 0x51]
mov bl, byte [esp + 0x53]
mov ah, dh
xor ah, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and bl, dl
mov ch, ah
and ch, 0xff
and dh, dl
or al, bl
or ch, dh
xor al, ch
or cl, ah
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x1004e287
jmp 0x1004e4bf
jmp 0x1004e28c
mov eax, dword [0x10066be8]
mov dword [esp + 0x48], eax
mov eax, dword [0x10066be4]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x48]
add eax, 0x9c2146fb
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x44]
sub eax, 1
sub eax, 0x9c2146fb
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
imul eax, ecx
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x3f], al
mov cl, byte [esp + 0x3f]
mov eax, dword [esp + 0x4c]
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
mov byte [esp + 0x3e], al
mov al, byte [esp + 0x3e]
test al, 1
jne 0x1004e2fe
jmp 0x1004e4c4
mov eax, dword [0x10066be8]
mov ecx, dword [0x10066be4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x3b], al
cmp ecx, 0xa
setl cl
mov byte [esp + 0x3c], cl
xor al, 0xff
mov byte [esp + 0x3d], al
mov al, byte [esp + 0x3c]
xor al, 0xff
mov byte [esp + 0x39], al
mov al, 1
xor al, 1
mov byte [esp + 0x3a], al
mov cl, byte [esp + 0x39]
mov al, byte [esp + 0x3d]
mov bl, byte [esp + 0x3a]
mov ch, byte [esp + 0x3c]
mov dh, byte [esp + 0x3b]
mov dl, al
and dl, 0xff
and dh, bl
mov ah, cl
and ah, 0xff
and ch, bl
or dl, dh
or ah, ch
xor dl, ah
mov byte [esp + 0x37], dl
or al, cl
mov byte [esp + 0x38], al
mov cl, byte [esp + 0x3a]
mov al, byte [esp + 0x38]
xor al, 0xff
or cl, 1
and al, cl
mov byte [esp + 0x36], al
mov cl, byte [esp + 0x36]
mov al, byte [esp + 0x37]
or al, cl
mov byte [esp + 0x35], al
mov al, byte [esp + 0x35]
test al, 1
jne 0x1004e3a8
jmp 0x1004e4c9
mov eax, dword [0x10066be8]
mov dword [esp + 0x30], eax
mov eax, dword [0x10066be4]
mov dword [esp + 0x28], eax
xor eax, eax
sub eax, 1
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ecx, eax
add ecx, edx
imul eax, ecx
and eax, 1
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp eax, 0
sete al
mov byte [esp + 0x21], al
cmp ecx, 0xa
setl cl
mov byte [esp + 0x22], cl
and al, cl
mov byte [esp + 0x23], al
mov cl, byte [esp + 0x22]
mov al, byte [esp + 0x21]
xor al, cl
mov byte [esp + 0x20], al
mov cl, byte [esp + 0x20]
mov al, byte [esp + 0x23]
or al, cl
test al, 1
jne 0x1004e420
jmp 0x1004e4c9
mov eax, dword [0x10066be8]
mov dword [esp + 0x18], eax
mov eax, dword [0x10066be4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
sub eax, 0x6d39faa3
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub ecx, 1
add ecx, 0x6d39faa3
imul eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
and eax, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp eax, 0
sete al
mov byte [esp + 0xb], al
mov cl, byte [esp + 0xb]
mov eax, dword [esp + 0x1c]
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1004e493
jmp 0x1004e4c4
add esp, 0xcc
pop esi
pop ebx
ret
mov eax, dword [0x100653a4]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x280f380c
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1004e096
jmp 0x1004e1e4
jmp 0x1004e2fe
jmp 0x1004e3a8