Function at 0x4b21b0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc90
mov eax, dword [0x598b80]
xor eax, esp
mov dword [esp + 0xc8c], eax
push ebp
mov ebp, ecx
mov dword [esp + 0x30], 0
push esi
mov esi, dword [esp + 0xc9c]
xor eax, eax
push edi
mov dword [esp + 0x28], ebp
xor edi, edi
mov dword [esp + 0x54], esi
mov dword [ebp + 4], 0
mov dword [ebp + 0x18], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0x1c], 0
mov dword [esp + 0xc90], eax
mov word [esp + 0xc94], ax
nop
mov ecx, esi
call fcn.004e2ac0
mov byte [esp + edi + 0xc90], al
inc edi
cmp edi, 6
jl 0x4b2210
cmp byte [esp + 0xc90], 0x47
jne 0x4b2d09
cmp byte [esp + 0xc91], 0x49
jne 0x4b2d09
cmp byte [esp + 0xc92], 0x46
jne 0x4b2d09
mov dl, byte [esp + 0xc93]
mov al, byte [esp + 0xc95]
mov cl, byte [esp + 0xc94]
cmp dl, 0x38
jne 0x4b2271
cmp cl, 0x39
jg 0x4b2271
cmp al, 0x61
je 0x4b228e
movsx eax, al
push eax
movsx eax, cl
push eax
movsx eax, dl
push eax
push dword [esi + 0x14]
push str._s_is_version__c_c_c.
call dword [0x598058]
add esp, 0x14
push ebx
mov ecx, esi
call fcn.004e2ba0
movzx eax, ax
mov ecx, esi
mov dword [esp + 0x30], eax
call fcn.004e2ba0
movzx eax, ax
mov ecx, esi
mov dword [esp + 0x34], eax
call fcn.004e2ac0
cmp dword [esi + 0x18], 0
mov bl, al
mov byte [esp + 0x1b], bl
je 0x4b22d4
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x208
jmp 0x4b2cee
push 0x300
lea eax, [esp + 0x998]
push 0
push eax
call fcn.00518d30
add esp, 0xc
test bl, bl
jns 0x4b22fe
movzx ecx, bl
mov ebx, 2
and ecx, 7
shl ebx, cl
jmp 0x4b2300
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x14], ebx
call fcn.004e2ac0
mov ecx, esi
mov byte [esp + 0x2a], al
call fcn.004e2ac0
cmp dword [esi + 0x18], 0
je 0x4b2332
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x212
jmp 0x4b2cee
cmp byte [esp + 0x1b], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x1a], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
jge 0x4b23a8
xor edi, edi
test ebx, ebx
jle 0x4b23a8
lea ebp, [esp + 0x995]
mov ecx, esi
call fcn.004e2ac0
mov bh, al
mov ecx, esi
mov byte [esp + edi + 0x94], bh
call fcn.004e2ac0
mov bl, al
mov ecx, esi
mov byte [esp + edi + 0x194], bl
call fcn.004e2ac0
mov byte [esp + edi + 0x294], al
lea ebp, [ebp + 3]
mov byte [ebp - 4], bh
inc edi
mov byte [ebp - 3], bl
mov ebx, dword [esp + 0x14]
mov byte [ebp - 2], al
cmp edi, ebx
jl 0x4b2365
cmp dword [esi + 0x18], 0
je 0x4b23c4
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x229
jmp 0x4b2cee
mov ecx, esi
call fcn.004e2ac0
cmp dword [esi + 0x18], 0
movzx eax, al
mov dword [esp + 0xc94], eax
jne 0x4b2cdd
xor ebp, ebp
mov dword [esp + 0x50], ebp
cmp eax, 0x21
jne 0x4b258a
mov ecx, esi
call fcn.004e2ac0
mov ecx, esi
mov bl, al
call fcn.004e2ac0
cmp dword [esi + 0x18], 0
movzx ebp, al
jne 0x4b2bfe
cmp bl, 0xf9
jne 0x4b24ab
cmp ebp, 4
jne 0x4b2563
mov ecx, esi
call fcn.004e2ac0
mov bl, al
mov ecx, esi
movzx edi, bl
shr edi, 2
and edi, 7
mov dword [esp + 0x44], edi
call fcn.004e2ba0
movzx edi, ax
mov ecx, esi
mov dword [esp + 0x40], edi
call fcn.004e2ac0
mov ecx, esi
mov byte [esp + 0x13], al
call fcn.004e2ac0
cmp dword [esi + 0x18], 0
movzx ebp, al
jne 0x4b2bbc
mov al, bl
shr bl, 1
and al, 1
and bl, 1
mov byte [esp + 0x12], al
mov byte [esp + 0x1a], bl
mov ebx, dword [esp + 0x14]
cmp dword [esi + 0x18], 0
jne 0x4b2c14
test ebp, ebp
je 0x4b23c4
mov ecx, esi
call fcn.004e2c30
add eax, ebp
mov ecx, esi
push eax
call fcn.004e2bd0
mov ecx, esi
call fcn.004e2ac0
movzx ebp, al
test al, al
jne 0x4b2487
jmp 0x4b23c4
cmp bl, 0xff
jne 0x4b2551
push 0x200
lea eax, [esp + 0x398]
push 0
push eax
call fcn.00518d30
add esp, 0xc
xor edi, edi
test ebp, ebp
je 0x4b24e4
mov ecx, esi
call fcn.004e2ac0
mov byte [esp + edi + 0x394], al
inc edi
cmp edi, ebp
jl 0x4b24d1
mov ecx, esi
call fcn.004e2ac0
cmp dword [esi + 0x18], 0
movzx ebp, al
jne 0x4b2be8
test al, al
je 0x4b251e
lea edi, [esp + edi + 0x394]
mov ecx, esi
call fcn.004e2ac0
mov byte [edi], al
lea edi, [edi + 1]
sub ebp, 1
jne 0x4b2503
mov ecx, esi
call fcn.004e2ac0
movzx ebp, al
cmp dword [esi + 0x18], 0
jne 0x4b2bd2
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x5c]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x394]
mov dword [esp + 0x8c], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x4b2471
cmp bl, 0xfe
je 0x4b2471
cmp bl, 1
je 0x4b2471
mov edi, dword [esi + 0x14]
mov ecx, esi
push ebp
call fcn.004e2c30
sub eax, 3
push eax
movzx eax, bl
push eax
push edi
push str._s:_unknown_GIF_extension_0x_02x_at_offset__ld__length___d
call dword [0x598058]
add esp, 0x14
jmp 0x4b2471
cmp eax, 0x2c
jne 0x4b2c80
mov ecx, esi
call fcn.004e2ba0
movzx eax, ax
mov ecx, esi
mov dword [esp + 0x48], eax
call fcn.004e2ba0
movzx eax, ax
mov ecx, esi
mov dword [esp + 0x4c], eax
call fcn.004e2ba0
movzx eax, ax
mov ecx, esi
mov dword [esp + 0x38], eax
call fcn.004e2ba0
movzx eax, ax
mov ecx, esi
mov dword [esp + 0x24], eax
call fcn.004e2ac0
mov cl, al
mov byte [esp + 0x2b], cl
cmp dword [esi + 0x18], ebp
jne 0x4b2c6a
shr al, 6
and al, 1
mov byte [esp + 0x29], al
test cl, cl
jns 0x4b266e
movzx ecx, cl
lea eax, [esp + 0x694]
push 0x300
and ecx, 7
mov ebx, 2
shl ebx, cl
push 0
push eax
mov dword [esp + 0x20], ebx
call fcn.00518d30
add esp, 0xc
xor edi, edi
test ebx, ebx
jle 0x4b266e
lea ebp, [esp + 0x695]
mov ecx, esi
call fcn.004e2ac0
mov bh, al
mov ecx, esi
mov byte [esp + edi + 0x94], bh
call fcn.004e2ac0
mov bl, al
mov ecx, esi
mov byte [esp + edi + 0x194], bl
call fcn.004e2ac0
mov byte [esp + edi + 0x294], al
lea ebp, [ebp + 3]
mov byte [ebp - 4], bh
inc edi
mov byte [ebp - 3], bl
mov ebx, dword [esp + 0x14]
mov byte [ebp - 2], al
cmp edi, ebx
jl 0x4b2627
mov ebp, dword [esp + 0x50]
cmp dword [esi + 0x18], 0
mov ecx, esi
jne 0x4b2c56
call fcn.004e2ac0
cmp dword [esi + 0x18], 0
movzx edi, al
mov dword [esp + 0x20], edi
jne 0x4b2c40
cmp edi, 2
jb 0x4b269a
cmp edi, 8
jbe 0x4b26ac
push edi
push dword [esi + 0x14]
push str.Fl_GIF_Image:__s_invalid_LZW_initial_code_size__d._n
call dword [0x598058]
add esp, 0xc
inc edi
mov dword [esp + 0xc94], edi
test ebx, ebx
jne 0x4b2737
push dword [esi + 0x14]
push str._s_does_not_have_a_color_table__using_default._n
call dword [0x598058]
mov ecx, dword [esp + 0x28]
mov ebx, 1
shl ebx, cl
mov edi, 2
add esp, 8
mov word [esp + 0x294], 0xff00
mov word [esp + 0x194], 0xff00
mov word [esp + 0x94], 0xff00
cmp ebx, edi
jle 0x4b2737
lea eax, [ebx - 1]
mov ecx, 0x1fe
mov dword [esp + 0x1c], eax
nop dword [eax + eax]
mov eax, ecx
add ecx, 0xff
cdq
idiv dword [esp + 0x1c]
mov byte [esp + edi + 0x294], al
mov byte [esp + edi + 0x194], al
mov byte [esp + edi + 0x94], al
inc edi
cmp edi, ebx
jl 0x4b2710
mov ecx, dword [esp + 0x20]
mov edx, 1
shl edx, cl
cmp edx, 0x100
cmovg edx, ebx
cmp byte [esp + 0x12], 0
mov ebx, edx
mov dword [esp + 0x14], ebx
je 0x4b2884
movzx eax, byte [esp + 0x13]
mov dword [esp + 0x54], eax
mov dword [esp + 0x14], edx
cmp eax, edx
jl 0x4b2884
mov ecx, eax
sub ecx, edx
inc ecx
cmp ecx, 0x10
jb 0x4b2860
lea ebx, [esp + 0x94]
add ebx, edx
lea edi, [esp + 0x94]
mov dword [esp + 0x20], ebx
add edi, eax
lea ebx, [esp + 0x194]
add ebx, edx
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x194]
add ebx, eax
cmp dword [esp + 0x20], ebx
ja 0x4b27bb
cmp edi, dword [esp + 0x14]
jae 0x4b2860
lea ebx, [esp + 0x294]
add ebx, edx
mov dword [esp + 0x1c], ebx
lea ebx, [esp + 0x294]
add ebx, eax
cmp dword [esp + 0x20], ebx
ja 0x4b27e1
cmp edi, dword [esp + 0x1c]
jae 0x4b2860
cmp dword [esp + 0x14], ebx
ja 0x4b27f6
lea edi, [esp + 0x194]
add edi, eax
cmp edi, dword [esp + 0x1c]
jae 0x4b2860
and ecx, 0x8000000f
jns 0x4b2803
dec ecx
or ecx, 0xfffffff0
inc ecx
sub eax, ecx
mov ecx, edx
add edx, 0x10
mov ebx, edx
cmp edx, eax
jle 0x4b2807
sub eax, ecx
add eax, 0x10
cdq
and edx, 0xf
lea edi, [edx + eax]
and edi, 0xfffffff0
push edi
push 0xff
push dword [esp + 0x24]
call fcn.00518d30
push edi
push 0xff
push dword [esp + 0x28]
call fcn.00518d30
push edi
push 0xff
push dword [esp + 0x40]
call fcn.00518d30
mov eax, dword [esp + 0x78]
add esp, 0x24
mov edx, ebx
cmp ebx, eax
jg 0x4b287d
nop dword [eax]
mov byte [esp + edx + 0x294], 0xff
mov byte [esp + edx + 0x194], 0xff
mov byte [esp + edx + 0x94], 0xff
inc edx
cmp edx, eax
jle 0x4b2860
lea ebx, [eax + 1]
mov dword [esp + 0x14], ebx
cmp dword [esi + 0x18], 0
jne 0x4b2c2a
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x38]
imul eax, edi
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
movzx ecx, byte [esp + 0x2d]
add esp, 4
mov dword [esp + 0x1c], eax
push ecx
push ebx
push dword [esp + 0xc9c]
push dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x40]
mov ecx, edi
push eax
push esi
call fcn.004b2d30
cmp dword [edi + 0x10], 0
jne 0x4b2ca7
cmp byte [esp + 0x1a], 0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x40]
je 0x4b2920
not eax
cmp byte [esp + 0x12], 0
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
je 0x4b2940
movzx ecx, byte [esp + 0x13]
jmp 0x4b2943
or ecx, 0xffffffff
movzx eax, byte [esp + 0x2a]
mov dword [esp + 0x7c], eax
xor eax, eax
push 0x2fd
push eax
mov word [esp + 0x39c], ax
mov byte [esp + 0x39e], al
lea eax, [esp + 0x39f]
push eax
mov dword [esp + 0x84], ebx
mov dword [esp + 0x8c], ecx
call fcn.00518d30
add esp, 0xc
cmp byte [esp + 0x2b], 0
jge 0x4b2991
lea eax, [esp + 0x694]
jmp 0x4b29dd
cmp byte [esp + 0x1b], 0
jge 0x4b29a1
lea eax, [esp + 0x994]
jmp 0x4b29dd
xor ecx, ecx
test ebx, ebx
jle 0x4b29d6
lea edx, [esp + 0x395]
nop
mov al, byte [esp + ecx + 0x94]
lea edx, [edx + 3]
mov byte [edx - 4], al
mov al, byte [esp + ecx + 0x194]
mov byte [edx - 3], al
mov al, byte [esp + ecx + 0x294]
inc ecx
mov byte [edx - 2], al
cmp ecx, ebx
jl 0x4b29b0
lea eax, [esp + 0x394]
mov dword [esp + 0x90], eax
lea ecx, [esp + 0x5c]
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x30]
cmp dword [esp + 0x3c], 0
jne 0x4b2b99
cmp byte [esp + 0xca8], 0
mov ecx, dword [esp + 0x38]
je 0x4b2b45
mov eax, dword [esp + 0x30]
cmp ecx, eax
jne 0x4b2a23
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x34]
je 0x4b2b49
mov ecx, dword [esp + 0x34]
mov dword [edi + 4], eax
mov dword [edi + 0x18], eax
mov dword [edi + 8], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0xc], 1
mov edi, ecx
imul edi, eax
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esp + 0x20], eax
cmp byte [esp + 0x12], 0
je 0x4b2a5a
movzx ecx, byte [esp + 0x13]
jmp 0x4b2a5c
xor ecx, ecx
push edi
push ecx
push eax
call fcn.00518d30
mov eax, dword [esp + 0x44]
add esp, 0xc
mov edx, dword [esp + 0x48]
add eax, edx
mov edi, dword [esp + 0x30]
cmp eax, edi
mov ecx, dword [esp + 0x4c]
cmova eax, edi
mov dword [esp + 0xc94], eax
mov eax, dword [esp + 0x24]
add eax, ecx
cmp eax, dword [esp + 0x34]
cmova eax, dword [esp + 0x34]
cmp ecx, eax
jae 0x4b2ae8
mov ebp, dword [esp + 0xc94]
mov edi, ecx
imul edi, dword [esp + 0x30]
sub ebp, edx
mov ebx, dword [esp + 0x1c]
add edi, dword [esp + 0x20]
add edi, edx
sub eax, ecx
mov dword [esp + 0xc94], eax
mov esi, eax
nop dword [eax]
push ebp
push ebx
push edi
call fcn.00517140
add ebx, dword [esp + 0x44]
add esp, 0xc
add edi, dword [esp + 0x30]
sub esi, 1
jne 0x4b2ac0
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
cmp byte [esp + 0x12], 0
je 0x4b2af6
movzx eax, byte [esp + 0x13]
jmp 0x4b2af9
or eax, 0xffffffff
push eax
push ebx
lea eax, [esp + 0x9c]
push eax
push dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x34]
push edi
call fcn.004b1e30
mov ecx, dword [esp + 0x44]
push edi
mov dword [ecx + 0x20], eax
mov eax, dword [esp + 0x40]
add eax, 2
mov dword [ecx + 0x24], 1
mov dword [ecx + 0x14], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
push dword [esp + 0x38]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x20
inc dword [esp + 0x3c]
jmp 0x4b2475
mov edx, dword [esp + 0x24]
cmp byte [esp + 0x12], 0
mov dword [edi + 4], ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 8], edx
mov dword [edi + 0x1c], edx
mov dword [edi + 0xc], 1
je 0x4b2b6a
movzx eax, byte [esp + 0x13]
jmp 0x4b2b6d
or eax, 0xffffffff
push eax
push ebx
lea eax, [esp + 0x9c]
push eax
push edx
push ecx
push dword [esp + 0x30]
call fcn.004b1e30
mov dword [edi + 0x20], eax
add esp, 0x18
mov eax, dword [esp + 0x24]
add eax, 2
mov dword [edi + 0x24], 1
mov dword [edi + 0x14], eax
push dword [esp + 0x1c]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
cmp byte [esp + 0xca8], 0
je 0x4b2ca7
inc dword [esp + 0x3c]
jmp 0x4b2475
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x241
jmp 0x4b2cee
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x250
jmp 0x4b2cee
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x24b
jmp 0x4b2cee
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x238
jmp 0x4b2cee
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x300
jmp 0x4b2cee
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x2ac
jmp 0x4b2cee
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x285
jmp 0x4b2cee
mov edi, dword [esi + 0x14]
call fcn.004e2c30
push eax
push edi
push 0x27e
jmp 0x4b2cee
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x26b
jmp 0x4b2cee
cmp eax, 0x3b
jne 0x4b2cc2
cmp dword [esp + 0x3c], ebp
jne 0x4b2ca7
push dword [esi + 0x14]
push str._s:_no_image_data_found.
call dword [0x59805c]
mov eax, dword [esp + 0x34]
add esp, 8
mov dword [eax + 0x10], 0xffffffff
pop ebx
mov ecx, dword [esp + 0xc98]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00515f8b
add esp, 0xc90
ret 8
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
dec eax
push eax
push dword [esp + 0xc98]
push edi
push str._s:_unknown_GIF_code_0x_02x_at_offset__ld
jmp 0x4b2cf3
mov edi, dword [esi + 0x14]
mov ecx, esi
call fcn.004e2c30
push eax
push edi
push 0x232
push str.__d__Fl_GIF_Image:__s___unexpected_EOF_or_read_error_at_offset__ld
call dword [0x59805c]
mov eax, dword [esp + 0x3c]
add esp, 0x10
mov dword [eax + 0x10], 0xfffffffd
jmp 0x4b2ca7
push dword [esi + 0x14]
push str.Fl_GIF_Image:__s_is_not_a_GIF_file._n
call dword [0x59805c]
add esp, 8
mov dword [ebp + 0x10], 0xfffffffd
jmp 0x4b2ca8