Function at 0x4b64f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x428
mov eax, dword [0x598b80]
xor eax, esp
mov dword [esp + 0x424], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x438]
mov esi, ecx
push 0
push 3
push 0
push 0
push 0
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], edi
call fcn.004acbc0
push 0x56c798
push edi
mov dword [esi], vtable.Fl_PNM_Image.0
call fcn.004d41c0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4b654d
mov dword [esi + 0x10], 0xfffffffe
jmp 0x4b6998
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
lea eax, [esp + 0x34]
push ebp
push 0x400
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x4b658a
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push edi
push str.Early_end_of_file_in_PNM_file___s__
call dword [0x59805c]
add esp, 0xc
mov dword [esi + 0x10], 0xfffffffe
jmp 0x4b6997
inc eax
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
mov dword [esp + 0x18], eax
movsx ecx, byte [ecx]
push ecx
call edi
add esp, 8
test eax, eax
je 0x4b65c7
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
movsx eax, byte [eax]
push eax
call edi
add esp, 4
test eax, eax
jne 0x4b65b1
cmp dword [esp + 0x14], 7
jne 0x4b65d9
mov eax, 0x55e0cc
mov dword [esp + 0x10], eax
jmp 0x4b65e5
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b66a5
cmp dword [esi + 4], 0
jne 0x4b6644
mov al, byte [eax]
test al, al
je 0x4b662a
cmp al, 0x23
je 0x4b662a
movsx eax, al
push eax
call edi
add esp, 4
test eax, eax
je 0x4b661f
push 0xa
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov dword [esi + 4], eax
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x1c]
jmp 0x4b663b
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
jmp 0x4b663e
push ebp
lea eax, [esp + 0x38]
push 0x400
push eax
call ebx
mov dword [esp + 0x1c], eax
add esp, 0xc
test eax, eax
jne 0x4b65e5
jmp 0x4b66a5
test eax, eax
je 0x4b66a5
cmp dword [esi + 8], 0
jne 0x4b66a5
mov al, byte [eax]
test al, al
je 0x4b668d
cmp al, 0x23
je 0x4b668d
movsx eax, al
push eax
call edi
add esp, 4
test eax, eax
je 0x4b6682
push 0xa
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov dword [esi + 8], eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x1c]
jmp 0x4b669e
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
jmp 0x4b66a1
push ebp
lea eax, [esp + 0x38]
push 0x400
push eax
call ebx
mov dword [esp + 0x1c], eax
add esp, 0xc
test eax, eax
jne 0x4b6648
mov ecx, dword [esp + 0x14]
cmp ecx, 1
je 0x4b67a2
cmp ecx, 4
je 0x4b67a2
xor ebx, ebx
mov dword [esp + 0x1c], ebx
test eax, eax
je 0x4b6728
test ebx, ebx
jne 0x4b6724
mov al, byte [eax]
test al, al
je 0x4b6708
cmp al, 0x23
je 0x4b6708
movsx eax, al
push eax
call edi
add esp, 4
test eax, eax
je 0x4b66fd
push 0xa
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], ebx
jmp 0x4b671d
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
jmp 0x4b6720
push ebp
lea eax, [esp + 0x38]
push 0x400
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
mov dword [esp + 0x1c], eax
add esp, 0xc
test eax, eax
jne 0x4b66c5
mov ecx, dword [esp + 0x14]
cmp ecx, 2
je 0x4b673c
cmp ecx, 4
je 0x4b673c
mov edx, 3
cmp ecx, 5
jne 0x4b6741
mov edx, 1
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 8]
mov eax, ecx
mov edi, dword [esi + 4]
imul eax, edi
imul eax, edx
cmp eax, dword [0x596dbc]
jbe 0x4b67b4
push dword [esp + 0x20]
push str.PNM_file___s__is_too_large__n
call dword [0x598058]
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0xc
mov dword [esi + 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 8], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0xfffffffd
jmp 0x4b6997
mov ebx, 1
mov dword [esp + 0x1c], ebx
cmp ecx, ebx
je 0x4b673c
jmp 0x4b6728
imul ecx, edi
imul ecx, edx
push ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esi + 0x24], eax
cmp dword [esi + 8], 0
mov dword [esi + 0x28], 1
mov dword [esp + 0x20], 0
jle 0x4b698d
mov eax, dword [esp + 0x14]
mov ecx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
dec eax
mov dword [esp + 0x30], eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x14], ecx
nop dword [eax]
mov edx, dword [esi + 0xc]
mov edi, dword [esi + 4]
mov esi, edx
imul esi, edi
mov dword [esp + 0x24], esi
imul esi, eax
mov eax, dword [esp + 0x28]
add esi, dword [eax + 0x24]
mov eax, dword [esp + 0x30]
cmp eax, 6
ja case.default.0x4b6826
jmp dword [eax*4 + 0x4b6a88]
test edi, edi
jle case.default.0x4b6826
lea eax, [esp + 0x18]
push eax
push 0x56c7b0
push ebp
call fcn.004b6ab0
add esp, 0xc
cmp eax, 1
jne 0x4b6856
mov al, byte [esp + 0x18]
dec al
mov byte [esi], al
inc esi
dec edi
test edi, edi
jg 0x4b6835
jmp 0x4b6973
test edi, edi
jle case.default.0x4b6826
nop dword [eax + eax]
lea eax, [esp + 0x18]
push eax
push 0x56c7b0
push ebp
call fcn.004b6ab0
add esp, 0xc
cmp eax, 1
jne 0x4b6896
imul eax, dword [esp + 0x18], 0xff
cdq
idiv ebx
mov byte [esi], al
inc esi
dec edi
test edi, edi
jg 0x4b6870
jmp 0x4b6973
test edi, edi
jle case.default.0x4b6826
nop dword [eax + eax]
lea eax, [esp + 0x18]
push eax
push 0x56c7b0
push ebp
call fcn.004b6ab0
add esp, 0xc
cmp eax, 1
jne 0x4b68d6
imul eax, dword [esp + 0x18], 0xff
cdq
idiv ebx
mov byte [esi], al
inc esi
lea eax, [esp + 0x18]
push eax
push 0x56c7b0
push ebp
call fcn.004b6ab0
add esp, 0xc
cmp eax, 1
jne 0x4b68fc
imul eax, dword [esp + 0x18], 0xff
cdq
idiv ebx
mov byte [esi], al
inc esi
lea eax, [esp + 0x18]
push eax
push 0x56c7b0
push ebp
call fcn.004b6ab0
add esp, 0xc
cmp eax, 1
jne 0x4b6922
imul eax, dword [esp + 0x18], 0xff
cdq
idiv ebx
mov byte [esi], al
inc esi
dec edi
test edi, edi
jg 0x4b68b0
jmp 0x4b6973
push ebp
call ecx
add esp, 4
mov cl, al
mov bl, 0x80
test edi, edi
jle 0x4b696f
lea eax, [esi + 1]
mov dword [esp + 0x24], eax
mov al, bl
and al, cl
neg al
sbb al, al
and al, 1
dec al
mov byte [esi], al
cmp bl, 1
jbe 0x4b6955
shr bl, 1
jmp 0x4b6966
mov bl, 0x80
cmp edi, 1
jbe 0x4b6966
push ebp
call dword [esp + 0x18]
add esp, 4
mov cl, al
mov esi, dword [esp + 0x24]
dec edi
test edi, edi
jg 0x4b6937
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [esi + 8]
jl 0x4b6800
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop ebx
mov ecx, dword [esp + 0x430]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00515f8b
add esp, 0x428
ret 4
cmp ebx, 0x100
jge 0x4b69c9
push ebp
push edx
push edi
push esi
call dword [esp + 0x3c]
add esp, 0x10
jmp 0x4b6973
mov edi, dword [esp + 0x24]
test edi, edi
jle case.default.0x4b6826
push ebp
call ecx
movzx eax, al
push ebp
mov dword [esp + 0x20], eax
call dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea esi, [esi + 1]
movzx eax, al
dec edi
shl ecx, 8
add esp, 8
or ecx, eax
imul eax, ecx, 0xff
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
cdq
idiv ebx
mov byte [esi - 1], al
test edi, edi
jg 0x4b69d1
jmp case.default.0x4b6826
test edi, edi
jle case.default.0x4b6826
push ebp
call ecx
movzx ebx, al
lea esi, [esi + 3]
mov eax, ebx
dec edi
shr eax, 5
add esp, 4
imul ecx, eax, 0xff
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esi - 3], al
mov eax, ebx
shr eax, 2
and bl, 3
and eax, 7
imul ecx, eax, 0xff
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [esp + 0x14]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esi - 2], al
movzx eax, bl
imul eax, eax, 0x55
mov byte [esi - 1], al
test edi, edi
jg 0x4b6a18
mov ebx, dword [esp + 0x1c]
jmp case.default.0x4b6826