Function at 0x5434a0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 ksa
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6c7f63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x84]
mov dword [esp + 0x30], ebx
call fcn.0062eab0
xor esi, esi
lea ecx, [esp + 0x14]
mov dword [esp + 0xe8], esi
call fcn.0061d780
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], 1
call fcn.0061aaa0
lea ecx, [esp + 0x44]
mov byte [esp + 0xe8], 2
call fcn.0061d780
mov al, byte [esp + 0x13]
mov dword [esp + 0x1c], esi
mov byte [esp + 0x18], al
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0063bb20
push 0x6c
push 0xf1
push 0x10
lea ecx, [esp + 0xac]
mov byte [esp + 0xf4], 5
call fcn.00555f00
push 0x6c
push 0xf1
push 0xfe
lea ecx, [esp + 0xcc]
mov byte [esp + 0xf4], 6
call fcn.00555f00
push ecx
mov byte [esp + 0xec], 7
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x71e150
mov byte [esp + 0x4a], 1
mov byte [esp + 0x4b], 0x3f
mov byte [esp + 0x38], 2
mov byte [esp + 0x39], 0x3c
mov byte [esp + 0x3a], 0x41
call fcn.0061d820
lea ecx, [esp + 0x18]
call fcn.0061dab0
mov ecx, dword [esp + 0xf0]
mov eax, ecx
push ecx
and eax, 0xff
push 4
lea ecx, [esp + 0x1c]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x54], eax
mov dl, byte [eax + 0x6e1918]
mov byte [esp + 0x1b], dl
call fcn.0061dbc0
push 8
lea ecx, [esp + 0x54]
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xc], 0xff
call fcn.0062daa0
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push esi
call fcn.0061d7b0
lea ecx, [esp + 0x54]
call fcn.0062d730
mov al, byte [0x72bd0c]
test al, al
je 0x543633
lea esi, [ebx + 8]
mov ebp, 0x14
call fcn.006a7255
cdq
mov ecx, 0xff
idiv ecx
mov ecx, esi
mov edi, edx
call fcn.0061dc40
cmp ax, 0x14
jg 0x543630
push edi
mov ecx, esi
call fcn.0061dc20
dec ebp
jne 0x54360c
mov al, byte [ebx + 0xf]
test al, al
jne 0x54365a
mov edx, dword [esp + 0xf0]
mov ecx, ebx
push edx
mov byte [ebx + 0xe], 0
call fcn.0059ebd0
test ax, ax
je 0x543b3c
mov byte [ebx + 0xf], 1
mov al, byte [0x72bd0c]
test al, al
jne 0x54369f
sub esp, 0x24
xor esi, esi
mov eax, esp
mov dword [esp + 0x4c], esp
lea ecx, [esp + 0x74]
push esi
push ecx
push eax
mov ecx, 0x72baa8
call fcn.00628090
lea ecx, [esp + 0x84]
call fcn.0061ac40
lea ecx, [esp + 0x60]
call fcn.0061b070
test ax, ax
je 0x543b80
jmp 0x5436a1
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x713454
mov byte [ebx + 0xc], 0xff
call fcn.0061d820
push ecx
mov byte [esp + 0xf4], 9
mov ecx, esp
mov dword [esp + 0x40], esp
push 6
push 0x713860
call fcn.0061d820
mov ecx, dword [0x72bae8]
mov byte [esp + 0xf4], 7
call fcn.0062c790
movzx ax, byte [esp + 0x13]
cmp ax, si
mov dword [esp + 0x34], esi
mov word [esp + 0x4a], ax
jle 0x543b1f
movsx edx, word [esp + 0x34]
mov eax, dword [esp + 0x4c]
mov bl, byte [edx + eax + 0x6e1919]
mov byte [esp + 0x40], bl
mov ecx, dword [esp + 0x40]
push ecx
push 3
lea ecx, [esp + 0x1c]
call fcn.0061dbc0
mov dl, byte [esp + 0x34]
lea ecx, [esp + 0x14]
inc dl
push edx
push 5
call fcn.0061dbc0
mov al, byte [0x72bd0c]
test al, al
je 0x543771
mov eax, dword [esp + 0x30]
xor esi, esi
lea edi, [eax + 8]
call fcn.006a7255
cdq
mov ecx, 0xff
idiv ecx
mov ecx, edi
push edx
push esi
call fcn.0061dbc0
inc esi
cmp si, 0x14
jl 0x543747
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x543941
cmp bl, 0x41
je 0x543819
cmp bl, 0x42
je 0x543819
cmp bl, 0x43
je 0x543819
cmp bl, 0x44
je 0x543819
cmp bl, 0x45
je 0x543819
cmp bl, 0x46
je 0x543819
mov ebp, dword [esp + 0x30]
xor edi, edi
push 0
lea ecx, [esp + 0x64]
call fcn.0061b060
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x5437bb
xor eax, eax
jmp 0x5437c3
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
movsx ecx, di
cmp ecx, eax
jae 0x543941
push ecx
push 0
lea ecx, [esp + 0x68]
call fcn.0061b060
mov ecx, eax
call fcn.00690c60
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0061d790
lea esi, [ebp + 8]
mov ecx, esi
call fcn.0061dab0
mov ecx, esi
call fcn.0061dc40
cmp ax, 4
jle 0x543816
push 4
mov ecx, esi
call fcn.0061daa0
cmp al, bl
je 0x543941
inc edi
jmp 0x5437a5
mov ebp, dword [esp + 0x30]
cmp bl, byte [ebp + 0xc]
je 0x543941
cmp bl, 0xff
je 0x543941
mov byte [ebp + 0xc], bl
mov byte [esp + 0x2e], bl
mov dword [esp + 0x28], 0
sub esp, 0x24
lea eax, [esp + 0x50]
mov edx, esp
mov dword [esp + 0x5c], esp
push 0
push 3
push eax
push edx
lea ecx, [esp + 0xd4]
call fcn.00556960
lea ecx, [esp + 0x84]
call fcn.0061ac40
push 0
lea ecx, [esp + 0x64]
call fcn.0061b060
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x543c92
mov edx, dword [eax + 8]
sub edx, ecx
test edx, 0xfffffffc
je 0x543c92
xor edi, edi
push 0
lea ecx, [esp + 0x64]
call fcn.0061b060
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x5438a8
xor eax, eax
jmp 0x5438b0
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
movsx esi, di
cmp esi, eax
jae 0x54391d
push 0
lea ecx, [esp + 0x64]
call fcn.0061b060
mov eax, dword [eax + 4]
lea ecx, [eax + esi*4]
call fcn.0061dc40
cmp ax, 4
jle 0x5438ef
push 0
lea ecx, [esp + 0x64]
call fcn.0061b060
mov eax, dword [eax + 4]
push 4
lea ecx, [eax + esi*4]
call fcn.0061daa0
cmp bl, al
je 0x5438f2
inc edi
jmp 0x543892
movsx eax, di
push eax
push 0
lea ecx, [esp + 0x68]
call fcn.0061b060
mov ecx, eax
call fcn.00690c60
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.0061d790
lea ecx, [ebp + 8]
call fcn.0061dab0
mov eax, dword [esp + 0x28]
inc eax
cmp ax, 3
mov dword [esp + 0x28], eax
jl 0x54383e
lea ecx, [esp + 0x3e]
push ecx
lea ecx, [esp + 0xc4]
call fcn.00556d40
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.0061d790
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x94]
push eax
call fcn.00543e90
mov esi, eax
mov eax, dword [esi + 8]
mov edi, dword [0x6dd1fc]
mov ebp, eax
mov byte [esp + 0xe8], 0xb
cmp edi, ebp
jae 0x54397e
mov ebp, edi
lea ecx, [esp + 0x18]
cmp ecx, esi
jne 0x5439f2
cmp dword [esp + 0x20], ebp
jae 0x543991
call fcn.006a6707
lea ecx, [esp + 0x18]
call fcn.00414b70
mov eax, dword [esp + 0x20]
sub eax, ebp
cmp eax, edi
jae 0x5439a6
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jbe 0x5439e2
mov edx, dword [esp + 0x1c]
sub eax, edi
push eax
lea ecx, [edx + ebp]
lea edx, [ecx + edi]
push edx
push ecx
call fcn.006a6c70
mov esi, dword [esp + 0x2c]
add esp, 0xc
sub esi, edi
lea ecx, [esp + 0x18]
push ebx
push esi
call fcn.00414230
test al, al
je 0x5439e2
push esi
lea ecx, [esp + 0x1c]
call fcn.00414210
push ebx
push ebx
lea ecx, [esp + 0x20]
call fcn.004140f0
jmp 0x543a7d
xor ebx, ebx
cmp ebp, ebx
jbe 0x543a41
cmp ebp, eax
jne 0x543a41
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x543a08
mov eax, 0x6dd1f8
cmp byte [eax - 1], 0xfe
jae 0x543a41
push 1
lea ecx, [esp + 0x1c]
call fcn.004138c0
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x543a25
mov eax, 0x6dd1f8
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 8]
mov dword [esp + 0x20], ecx
mov esi, dword [esi + 0xc]
mov dword [esp + 0x24], esi
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x543a7d
push 1
push ebp
lea ecx, [esp + 0x20]
call fcn.00414230
test al, al
je 0x543a7d
mov esi, dword [esi + 4]
cmp esi, ebx
jne 0x543a5d
mov esi, 0x6dd1f8
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ebp
mov byte [ecx + ebp], 0
mov eax, dword [esp + 0x94]
mov byte [esp + 0xe8], 7
cmp eax, ebx
je 0x543aad
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x543aa4
cmp al, 0xff
je 0x543aa4
dec al
mov byte [ecx], al
jmp 0x543aad
push ecx
call fcn.006a64d0
add esp, 4
push ebx
push 0xffff
sub esp, 0x10
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
call fcn.00413060
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
mov byte [esp + 0x108], 0xc
call fcn.0061d790
mov ecx, dword [0x72bae8]
mov byte [esp + 0x104], 7
call fcn.0062c9a0
mov eax, dword [esp + 0x34]
inc eax
cmp ax, word [esp + 0x4a]
mov dword [esp + 0x34], eax
jl 0x5436ff
mov ebx, dword [esp + 0x30]
mov ecx, dword [0x72bae8]
xor esi, esi
push esi
call fcn.0062ce90
cmp ax, 0xb
je 0x543da6
jmp 0x543633
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe8], 6
call fcn.00555f30
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe8], 5
call fcn.00555f30
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0062d500
mov eax, dword [esp + 0x1c]
xor esi, esi
jmp 0x543c13
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x7137f4
call fcn.0061d820
push ecx
mov byte [esp + 0xf8], 8
mov ecx, esp
mov dword [esp + 0x50], esp
push 6
push 0x713840
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0xf8], 7
call fcn.0061ef70
push esi
push esi
mov ecx, 0x72baa8
call fcn.00623e40
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x1c]
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe8], 6
call fcn.00555f30
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe8], 5
call fcn.00555f30
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0062d500
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x543c34
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x543c2b
cmp al, 0xff
je 0x543c2b
dec al
mov byte [ecx], al
jmp 0x543c34
push ecx
call fcn.006a64d0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov byte [esp + 0xe8], 2
call fcn.0061d8c0
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], 1
call fcn.0061ab90
lea ecx, [esp + 0x14]
mov byte [esp + 0xe8], 0
call fcn.0061d8c0
lea ecx, [esp + 0x84]
mov dword [esp + 0xe8], 0xffffffff
call fcn.0061d8c0
xor ax, ax
jmp 0x543e71
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x7137f4
call fcn.0061d820
push ecx
mov byte [esp + 0xf8], 0xa
mov ecx, esp
mov dword [esp + 0x50], esp
push 6
push 0x713840
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0xf8], 7
call fcn.0061ef70
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x1c]
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe8], 6
call fcn.00555f30
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe8], 5
call fcn.00555f30
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0062d500
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x543d3c
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x543d33
cmp al, 0xff
je 0x543d33
dec al
mov byte [ecx], al
jmp 0x543d3c
push ecx
call fcn.006a64d0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0xe8], 2
call fcn.0061d8c0
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], 1
call fcn.0061ab90
lea ecx, [esp + 0x14]
mov byte [esp + 0xe8], 0
call fcn.0061d8c0
lea ecx, [esp + 0x84]
mov dword [esp + 0xe8], 0xffffffff
call fcn.0061d8c0
xor ax, ax
jmp 0x543e71
push esi
push esi
mov ecx, 0x72baa8
call fcn.00623e40
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x1c]
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe8], 6
call fcn.00555f30
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe8], 5
call fcn.00555f30
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0062d500
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x543e17
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x543e0e
cmp al, 0xff
je 0x543e0e
dec al
mov byte [ecx], al
jmp 0x543e17
push ecx
call fcn.006a64d0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov byte [esp + 0xe8], 2
call fcn.0061d8c0
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], 1
call fcn.0061ab90
lea ecx, [esp + 0x14]
mov byte [esp + 0xe8], 0
call fcn.0061d8c0
lea ecx, [esp + 0x84]
mov dword [esp + 0xe8], 0xffffffff
call fcn.0061d8c0
mov ax, 1
mov ecx, dword [esp + 0xe0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xdc
ret 4