Function at 0x4e92d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x597734
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x597760
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x59778c
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x5977bc
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x597800
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x59782c
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x597858
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x597888
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x5978cc
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.004daa80
nop word cs:[eax + eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov edx, dword [edi + 0x1c]
test dl, 0x10
jne 0x4e9325
test dl, 0x20
jne 0x4e935d
mov eax, ecx
mov edx, ecx
sar al, 7
xor dl, al
sub dl, al
cmp dl, 0x64
jb 0x4e93b6
add dl, dl
mov esi, 0x24
add dl, 0x38
movzx eax, dl
mov dl, 1
movzx eax, word [eax + 0x593cfe]
mov word [ebp - 0x67], ax
jmp 0x4e93c0
xor edx, edx
lea esi, [ebp - 0xc]
mov ch, cl
nop dword [eax]
mov ebx, ecx
shr ch, 4
and bl, 0xf
mov bh, bl
mov eax, ebx
add al, 0x57
or bh, 0x30
cmp bl, 0xa
movzx ebx, bh
movzx eax, al
cmovb eax, ebx
inc edx
cmp cl, 0x10
mov cl, ch
mov byte [esi - 1], al
lea esi, [esi - 1]
jae 0x4e9330
jmp 0x4e939a
xor edx, edx
lea esi, [ebp - 0xc]
mov ch, cl
nop word cs:[eax + eax]
nop
mov eax, ecx
shr ch, 4
and al, 0xf
mov ah, al
mov ebx, eax
add bl, 0x37
or ah, 0x30
cmp al, 0xa
movzx eax, ah
movzx ebx, bl
cmovb ebx, eax
inc edx
cmp cl, 0x10
mov cl, ch
mov byte [esi - 1], bl
lea esi, [esi - 1]
jae 0x4e9370
mov ecx, pe_nt_image_headers32
sub ecx, edx
cmp ecx, 0x81
jae 0x4e9410
push edx
push esi
push 2
push 0x593cfa
push 1
jmp 0x4e93fc
mov esi, 0x26
cmp dl, 0xa
jae 0x4e93cc
or dl, 0x30
mov byte [ebp + esi - 0x8c], dl
jmp 0x4e93e0
movzx eax, dl
mov esi, 0x25
movzx eax, word [eax + eax + 0x593cfe]
mov word [ebp - 0x67], ax
xor edx, edx
test cl, cl
mov ecx, 0x27
lea eax, [ebp + esi - 0x8c]
setns dl
sub ecx, esi
push ecx
push eax
push 0
push 1
push edx
push edi
call fcn.004de480
add esp, 0x18
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x593ce8
push pe_nt_image_headers32
push ecx
call fcn.004e06f0
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov edx, dword [edi + 0x1c]
test dl, 0x10
jne 0x4e9477
test dl, 0x20
jne 0x4e94ad
movzx esi, cl
cmp cl, 0x64
jb 0x4e9504
lea eax, [esi + esi*4]
mov edx, 0x24
lea ebx, [esi + eax*8]
shr ebx, 0xc
imul eax, ebx, 0x64
sub cl, al
movzx eax, cl
mov ecx, ebx
movzx eax, word [eax + eax + 0x593cfe]
mov word [ebp - 0x67], ax
jmp 0x4e950e
xor edx, edx
lea esi, [ebp - 0xc]
mov ch, cl
nop
mov ebx, ecx
shr ch, 4
and bl, 0xf
mov bh, bl
mov eax, ebx
add al, 0x57
or bh, 0x30
cmp bl, 0xa
movzx ebx, bh
movzx eax, al
cmovb eax, ebx
inc edx
cmp cl, 0x10
mov cl, ch
mov byte [esi - 1], al
lea esi, [esi - 1]
jae 0x4e9480
jmp 0x4e94ea
xor edx, edx
lea esi, [ebp - 0xc]
mov ch, cl
nop word cs:[eax + eax]
nop
mov eax, ecx
shr ch, 4
and al, 0xf
mov ah, al
mov ebx, eax
add bl, 0x37
or ah, 0x30
cmp al, 0xa
movzx eax, ah
movzx ebx, bl
cmovb ebx, eax
inc edx
cmp cl, 0x10
mov cl, ch
mov byte [esi - 1], bl
lea esi, [esi - 1]
jae 0x4e94c0
mov ecx, pe_nt_image_headers32
sub ecx, edx
cmp ecx, 0x81
jae 0x4e9555
push edx
push esi
push 2
push 0x593cfa
jmp 0x4e953f
mov edx, 0x26
cmp cl, 0xa
jae 0x4e951a
or cl, 0x30
mov byte [ebp + edx - 0x8c], cl
jmp 0x4e952b
movzx eax, word [esi + esi + 0x593cfe]
mov edx, 0x25
mov word [ebp - 0x67], ax
mov ecx, 0x27
lea eax, [ebp + edx - 0x8c]
sub ecx, edx
push ecx
push eax
push 0
push 1
push 1
push edi
call fcn.004de480
add esp, 0x18
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x593ce8
push pe_nt_image_headers32
push ecx
call fcn.004e06f0
nop word cs:[eax + eax]
nop
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
movzx edi, word [ecx]
mov edx, dword [ebx + 0x1c]
test dl, 0x10
jne 0x4e95f9
test dl, 0x20
jne 0x4e9630
mov edx, edi
neg dx
cmovs dx, di
movzx eax, dx
cmp eax, 0x270f
jbe 0x4e9691
shr eax, 4
imul eax, eax, 0x347
shr eax, 0x13
imul ecx, eax, 0x2710
sub edx, ecx
movzx ecx, dx
imul ecx, ecx, 0x147b
shr ecx, 0x13
imul esi, ecx, 0x64
movzx ecx, word [ecx + ecx + 0x593cfe]
sub edx, esi
mov esi, 0x23
movzx edx, dx
movzx edx, word [edx + edx + 0x593cfe]
mov word [ebp - 0x69], cx
mov word [ebp - 0x67], dx
mov edx, eax
jmp 0x4e96c9
xor edx, edx
lea esi, [ebp - 0xc]
nop
movzx ebx, di
mov eax, ebx
mov edi, ebx
and al, 0xf
shr edi, 4
mov ah, al
mov ecx, eax
add cl, 0x57
or ah, 0x30
cmp al, 0xa
movzx eax, ah
movzx ecx, cl
cmovb ecx, eax
inc edx
cmp bx, 0x10
mov byte [esi - 1], cl
lea esi, [esi - 1]
jae 0x4e9600
jmp 0x4e966e
xor edx, edx
lea esi, [ebp - 0xc]
nop word cs:[eax + eax]
nop
movzx ebx, di
mov eax, ebx
mov edi, ebx
and al, 0xf
shr edi, 4
mov ecx, eax
mov ah, al
or cl, 0x30
add ah, 0x37
cmp al, 0xa
movzx ecx, cl
movzx eax, ah
cmovb eax, ecx
inc edx
cmp bx, 0x10
mov byte [esi - 1], al
lea esi, [esi - 1]
jae 0x4e9640
mov ecx, pe_nt_image_headers32
sub ecx, edx
cmp ecx, 0x81
jae 0x4e971d
push edx
push esi
push 2
push 0x593cfa
push 1
push dword [ebp + 0xc]
jmp 0x4e970a
mov esi, 0x27
cmp dx, 0x63
jbe 0x4e96c3
shr eax, 2
mov esi, 0x25
imul eax, eax, 0x147b
shr eax, 0x11
imul ecx, eax, 0x64
sub edx, ecx
movzx ecx, dx
mov edx, eax
movzx ecx, word [ecx + ecx + 0x593cfe]
mov word [ebp - 0x67], cx
cmp dx, 0xa
jae 0x4e96d6
or dl, 0x30
mov byte [ebp + esi - 0x8d], dl
dec esi
jmp 0x4e96ec
movzx eax, dx
movzx eax, word [eax + eax + 0x593cfe]
mov word [ebp + esi - 0x8e], ax
add esi, 0xfffffffe
xor edx, edx
test di, di
mov ecx, 0x27
lea eax, [ebp + esi - 0x8c]
setns dl
sub ecx, esi
push ecx
push eax
push 0
push 1
push edx
push ebx
call fcn.004de480
add esp, 0x18
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x593ce8
push pe_nt_image_headers32
push ecx
call fcn.004e06f0
nop dword [eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
movzx ecx, word [ecx]
mov edx, dword [edi + 0x1c]
test dl, 0x10
jne 0x4e97b1
test dl, 0x20
jne 0x4e97f0
movzx esi, cx
cmp esi, 0x270f
jbe 0x4e9851
shr esi, 4
imul esi, esi, 0x347
shr esi, 0x13
imul eax, esi, 0x2710
sub ecx, eax
movzx eax, cx
imul eax, eax, 0x147b
shr eax, 0x13
imul edx, eax, 0x64
movzx eax, word [eax + eax + 0x593cfe]
sub ecx, edx
mov edx, 0x23
movzx ecx, cx
movzx ecx, word [ecx + ecx + 0x593cfe]
mov word [ebp - 0x69], ax
mov word [ebp - 0x67], cx
mov ecx, esi
jmp 0x4e9889
xor edi, edi
lea esi, [ebp - 0xc]
nop word cs:[eax + eax]
movzx ebx, cx
mov eax, ebx
mov ecx, ebx
and al, 0xf
shr ecx, 4
mov ah, al
mov edx, eax
add dl, 0x57
or ah, 0x30
cmp al, 0xa
movzx eax, ah
movzx edx, dl
cmovb edx, eax
inc edi
cmp bx, 0x10
mov byte [esi - 1], dl
lea esi, [esi - 1]
jae 0x4e97c0
jmp 0x4e982e
xor edi, edi
lea esi, [ebp - 0xc]
nop word cs:[eax + eax]
nop
movzx ebx, cx
mov eax, ebx
mov ecx, ebx
and al, 0xf
shr ecx, 4
mov ah, al
mov edx, eax
add dl, 0x37
or ah, 0x30
cmp al, 0xa
movzx eax, ah
movzx edx, dl
cmovb edx, eax
inc edi
cmp bx, 0x10
mov byte [esi - 1], dl
lea esi, [esi - 1]
jae 0x4e9800
mov ecx, pe_nt_image_headers32
sub ecx, edi
cmp ecx, 0x81
jae 0x4e98d6
push edi
push esi
push 2
push 0x593cfa
push 1
push dword [ebp + 0xc]
jmp 0x4e98c3
mov edx, 0x27
cmp cx, 0x63
jbe 0x4e9883
shr esi, 2
mov edx, 0x25
imul esi, esi, 0x147b
shr esi, 0x11
imul eax, esi, 0x64
sub ecx, eax
movzx eax, cx
mov ecx, esi
movzx eax, word [eax + eax + 0x593cfe]
mov word [ebp - 0x67], ax
cmp cx, 0xa
jae 0x4e9896
or cl, 0x30
mov byte [ebp + edx - 0x8d], cl
dec edx
jmp 0x4e98ac
movzx eax, cx
movzx eax, word [eax + eax + 0x593cfe]
mov word [ebp + edx - 0x8e], ax
add edx, 0xfffffffe
mov ecx, 0x27
lea eax, [ebp + edx - 0x8c]
sub ecx, edx
push ecx
push eax
push 0
push 1
push 1
push edi
call fcn.004de480
add esp, 0x18
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x593ce8
push pe_nt_image_headers32
push ecx
call fcn.004e06f0
nop word cs:[eax + eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x84
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [eax]
mov eax, dword [ecx + 0x1c]
test al, 0x10
jne 0x4e99e3
test al, 0x20
jne 0x4e9a24
mov ecx, edi
mov eax, 0x27
mov dword [ebp - 0x10], edi
neg ecx
cmovs ecx, edi
cmp ecx, 0x2710
jb 0x4e9a7e
mov esi, 0x27
nop word [eax + eax]
mov eax, ecx
mov edx, 0xd1b71759
mul edx
mov eax, ecx
shr edx, 0xd
imul ebx, edx, 0x2710
sub eax, ebx
imul ebx, eax, 0x147b
shr ebx, 0x13
imul edi, ebx, 0x64
sub eax, edi
movzx edi, word [ebx + ebx + 0x593cfe]
cmp ecx, 0x5f5e0ff
mov ecx, edx
movzx eax, ax
movzx eax, word [eax + eax + 0x593cfe]
mov word [ebp + esi - 0x94], di
mov word [ebp + esi - 0x92], ax
lea eax, [esi - 4]
mov esi, eax
ja 0x4e9940
cmp edx, 0x63
jbe 0x4e99c7
movzx ecx, dx
shr ecx, 2
imul ecx, ecx, 0x147b
shr ecx, 0x11
imul esi, ecx, 0x64
sub edx, esi
movzx edx, dx
movzx edx, word [edx + edx + 0x593cfe]
mov word [ebp + eax - 0x92], dx
add eax, 0xfffffffe
mov edx, ecx
mov esi, dword [ebp - 0x10]
cmp edx, 0xa
jae 0x4e9a8e
or dl, 0x30
mov byte [ebp + eax - 0x91], dl
dec eax
jmp 0x4e9aa1
xor eax, eax
lea esi, [ebp - 0x10]
mov edx, edi
nop word [eax + eax]
mov ecx, edi
shr edx, 4
mov dword [ebp - 0x10], edi
mov ebx, ecx
and bl, 0xf
mov bh, bl
mov ecx, ebx
add cl, 0x57
or bh, 0x30
cmp bl, 0xa
movzx edi, bh
movzx ecx, cl
cmovb ecx, edi
inc eax
cmp dword [ebp - 0x10], 0x10
mov edi, edx
mov byte [esi - 1], cl
lea esi, [esi - 1]
jae 0x4e99f0
jmp 0x4e9a62
xor eax, eax
lea esi, [ebp - 0x10]
mov edx, edi
nop dword [eax + eax]
mov ecx, edi
shr edx, 4
mov dword [ebp - 0x10], edi
mov ebx, ecx
and bl, 0xf
mov bh, bl
mov ecx, ebx
add cl, 0x37
or bh, 0x30
cmp bl, 0xa
movzx edi, bh
movzx ecx, cl
cmovb ecx, edi
inc eax
cmp dword [ebp - 0x10], 0x10
mov edi, edx
mov byte [esi - 1], cl
lea esi, [esi - 1]
jae 0x4e9a30
mov edx, pe_nt_image_headers32
sub edx, eax
cmp edx, 0x81
jae 0x4e9ad1
push eax
push esi
push 2
push 0x593cfa
push 1
jmp 0x4e9abb
mov edx, ecx
cmp edx, 0x63
ja 0x4e999b
jmp 0x4e99c7
movzx ecx, word [edx + edx + 0x593cfe]
mov word [ebp + eax - 0x92], cx
add eax, 0xfffffffe
mov edx, 0x27
not esi
lea ecx, [ebp + eax - 0x90]
sub edx, eax
shr esi, 0x1f
push edx
push ecx
push 0
push 1
push esi
push dword [ebp + 0xc]
call fcn.004de480
add esp, 0x18
add esp, 0x84
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x593ce8
push pe_nt_image_headers32
push edx
call fcn.004e06f0
nop word cs:[eax + eax]
nop dword [eax + eax]