Function at 0x542a8a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [ebx + 0x452b0056], bl
cld
shl eax, 2
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x569aa4]
lea eax, [edx + ecx*4 + 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x569aa4]
lea eax, [edx + ecx*4]
push eax
call fcn.005435e0
add esp, 0xc
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x2d4
push ebx
push esi
push edi
mov ax, word [0x5667c4]
mov word [ebp - 8], ax
mov cl, byte [0x5667c6]
mov byte [ebp - 6], cl
cmp dword [ebp + 0x10], 0
push esi
add byte [eax + 0x7d83fa4d], cl
adc byte [eax], al
jne 0x542ba4
pushfd
pushal
jmp 0x542ae2
sub edx, edx
jo 0x542ac8
jmp 0x542ad9
xor ecx, ecx
je 0x542ac0
jmp 0x542ad2
stc
xor ecx, 3
je 0x542a58
jmp 0x542acf
jmp 0x542add
jae 0x542acb
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x542ac2
jmp 0x542abc
sbb al, 0xdb
jmp 0x542ae5
jmp 0x542ab6
popal
popfd
push 0x2cc
push 0
lea edx, [ebp - 0x2d4]
push edx
call fcn.005439d0
add esp, 0xc
pushal
xor eax, eax
jne 0x542b04
jmp 0x542b19
jmp 0x542b39
xor eax, eax
jne 0x542b21
jp 0x542b17
jo 0x542b1b
push cs
jmp 0x542b1c
jb 0x542b20
jns 0x542b05
call dword [0x74097900]
invalid
jns 0x542b22
je 0x542b0b
jmp 0x542aa4
xchg ebx, ebx
jp 0x542b10
mov al, byte [0x85c76133]
sub al, 0xfd
invalid
xor esp, dword [ecx - 0x39]
test dword [edi*8 + 0x1ffff], ebp
add dword [eax], eax
popal
mov dword [ebp - 0x2d4], 0x10001
pushal
xor eax, eax
jne 0x542b34
jmp 0x542b49
jmp 0x542b69
xor eax, eax
jne 0x542b51
jp 0x542b47
jo 0x542b4b
jmp 0x542b4c
jb 0x542b50
jns 0x542b35
call dword [0x74097900]
invalid
jns 0x542b52
je 0x542b3b
jmp 0x542ad4
xchg ebx, ebx
jp 0x542b40
mov al, byte [0x858d6133]
sub al, 0xfd
invalid
xor esp, dword [ecx - 0x73]
test dword [edi*8 - 0x74af0001], ebp
dec ebp
or byte [ebx - 0xadfbaf], cl
adc eax, sym.imp.KERNEL32.dll_GetThreadContext
popal
lea eax, [ebp - 0x2d4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
pushfd
pushal
jmp 0x542b96
sub edx, edx
jo 0x542b7c
jmp 0x542b8d
xor ecx, ecx
je 0x542b74
jmp 0x542b86
stc
xor ecx, 3
je 0x542b0c
jmp 0x542b83
jmp 0x542b91
jae 0x542b7f
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x542b76
jmp 0x542b70
sbb al, 0xdb
jmp 0x542b99
jmp 0x542b6a
popal
popfd
mov eax, dword [ebp - 0x21c]
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
test ecx, ecx
je 0x542c46
lea edx, [ebp - 4]
push edx
push 2
push 0x569aa8
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
pushal
xor eax, eax
jne 0x542bd7
jmp 0x542bec
jmp 0x542c0c
xor eax, eax
jne 0x542bf4
jp 0x542bea
jo 0x542bee
jmp 0x542bef
jb 0x542bf3
jns 0x542bd8
call dword [0x74097900]
invalid
jns 0x542bf5
je 0x542bde
jmp 0x542b77
xchg ebx, ebx
jp 0x542be3
mov al, byte [0x458d6133]
xor esp, dword [ecx - 0x73]
inc ebp
popal
lea eax, [ebp - 4]
cld
push eax
push 2
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
pushfd
pushal
jmp 0x542c3f
or byte [ebx + 0x15ff5108], cl
pop esp
popal
push esi
add byte [eax + 0x70d22beb], bl
push cs
sub edx, edx
jo 0x542c25
jmp 0x542c36
xor ecx, ecx
je 0x542c1d
jmp 0x542c2f
stc
xor ecx, 3
je 0x542bb5
jmp 0x542c2c
jmp 0x542c3a
jae 0x542c28
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x542c1f
jmp 0x542c19
sbb al, 0xdb
jmp 0x542c42
jmp 0x542c13
popal
popfd
jmp 0x542c95
lea edx, [ebp - 4]
push edx
push 2
push 0x569aa8
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
pushfd
pushal
jmp 0x542c90
sub edx, edx
jo 0x542c76
jmp 0x542c87
xor ecx, ecx
je 0x542c6e
jmp 0x542c80
stc
xor ecx, 3
je 0x542c06
jmp 0x542c7d
jmp 0x542c8b
jae 0x542c79
sbb bl, bl
sbb bl, bl
xor ebx, ebx
jmp 0x542c70
jmp 0x542c6a
sbb al, 0xdb
jmp 0x542c93
jmp 0x542c64
popal
popfd
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret