Function at 0x5bec60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x6c1643
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdc
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esp + 0x34], edi
mov al, byte [esp + 0x33]
mov dword [esp + 0xf4], 1
mov byte [esp + 0x18], al
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
lea ecx, [esp + 0x54]
mov byte [esp + 0xf4], 2
call fcn.0060d180
lea ecx, [esp + 0xc8]
mov byte [esp + 0xf4], 3
call fcn.00546ec0
mov ecx, dword [0x710a00]
mov edx, dword [0x710a04]
mov dword [esp + 0x38], ecx
push 6
push 0x704698
lea ecx, [esp + 0x1c]
mov byte [esp + 0xfc], 4
mov dword [esp + 0x44], edx
call fcn.0060ff10
push 4
lea ecx, [esp + 0x104]
mov byte [esp + 0xf8], 5
call fcn.00610190
push 5
lea ecx, [esp + 0x104]
call fcn.00610190
mov byte [esp + 0x10], al
mov al, byte [esi + 0xc]
cmp al, 0xff
jne 0x5bed9c
mov al, byte [0x71bb5c]
test al, al
je 0x5bed59
lea ebx, [esi + 8]
call fcn.00698605
cdq
mov ecx, 0xff
idiv ecx
mov ecx, ebx
push edx
push edi
call fcn.006102b0
inc edi
cmp di, 0x32
jl 0x5bed32
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5bed98
sub esp, 0x24
lea eax, [esp + 0x5c]
mov edx, esp
mov dword [esp + 0x4c], esp
push 1
push eax
push edx
lea ecx, [esp + 0xf8]
call fcn.00547f90
lea ecx, [esp + 0x78]
call fcn.0060d330
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ecx
lea ecx, [esp + 0x5c]
call fcn.0060d6b0
lea ecx, [esi + 8]
call fcn.006101a0
mov byte [esi + 0xc], 1
add esi, 8
xor ebp, ebp
mov ecx, esi
call fcn.00610330
cmp ax, 0x17
jge 0x5beec2
push 0x70386c
lea edx, [esp + 0x44]
push 0x703868
push edx
call fcn.00698355
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebx, ecx
lea ecx, [esp + 0x1c]
push ebx
call fcn.00414210
test al, al
je 0x5bee0d
mov edi, dword [esp + 0x1c]
mov ecx, ebx
mov eax, ecx
lea esi, [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ebx
mov byte [ecx + ebx], 0
mov esi, dword [esp + 0xfc]
mov dl, byte [esp + 0x18]
xor edi, edi
lea ecx, [esp + 0x18]
mov byte [esi], dl
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [0x6ce1fc]
push eax
push edi
push ecx
mov ecx, esi
call fcn.004136a0
mov dword [esp + 0x34], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0xf4], 4
call fcn.0060ffb0
lea ecx, [esp + 0xc8]
mov byte [esp + 0xf4], 3
call fcn.00546f80
lea ecx, [esp + 0x54]
mov byte [esp + 0xf4], 2
call fcn.0060d280
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x5bee9b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x5bee92
cmp al, 0xff
je 0x5bee92
dec al
mov byte [ecx], al
jmp 0x5bee9b
push ecx
call fcn.00697880
add esp, 4
lea ecx, [esp + 0x100]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov byte [esp + 0xf4], 0
call fcn.0060ffb0
mov eax, esi
jmp 0x5bf832
mov edx, dword [esp + 0x10]
and edx, 0xff
lea eax, [edx - 1]
cmp eax, 0x1a
ja case.default.0x5beed8
jmp dword [eax*4 + 0x5bf850]
push 5
mov ecx, esi
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x6d48f8]
fadd qword [0x6ceb58]
jmp 0x5bef4d
push 5
mov ecx, esi
call fcn.00610190
and eax, 0xff
lea ecx, [eax + eax*4]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
jmp 0x5bef4d
push 6
mov ecx, esi
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x6d48f0]
fstp qword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
lea eax, [esp + 0x48]
push str._.2f
push eax
call fcn.00698355
add esp, 0x10
jmp 0x5bf0bf
push 6
mov ecx, esi
call fcn.00610190
and eax, 0xff
lea ecx, [eax + eax*4]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
jmp 0x5bef4d
push 7
mov ecx, esi
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x6d48e8]
fsub qword [0x6d48e0]
jmp 0x5bef4d
push 8
mov ecx, esi
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x6d48e8]
fsub qword [0x6d48e0]
jmp 0x5bef4d
push 9
mov ecx, esi
call fcn.00610190
and eax, 0xff
shl eax, 3
mov ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax - 8]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
jmp 0x5bef4d
push 0xa
mov ecx, esi
call fcn.00610190
and eax, 0xff
lea ebp, [eax + eax*2]
shl ebp, 1
jmp case.default.0x5beed8
push 0x11
mov ecx, esi
call fcn.00610190
and eax, 0xff
shl eax, 5
jmp 0x5bf0aa
push 0x12
mov ecx, esi
call fcn.00610190
and eax, 0xff
push 0x13
mov ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
mov ecx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fstp qword [esp + 0x2c]
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x6d48d8]
fadd qword [esp + 0x28]
jmp 0x5bef4d
push 0x14
mov ecx, esi
call fcn.00610190
and eax, 0xff
mov ebp, eax
push ebp
lea ecx, [esp + 0x44]
push 0x703498
push ecx
call fcn.00698355
add esp, 0xc
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x5bf6dd
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x5bf0e5
call fcn.0069788b
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x5bf686
mov al, byte [edi - 1]
test al, al
je 0x5bf686
cmp al, 0xff
je 0x5bf686
test ebx, ebx
jne 0x5bf6af
dec al
push ebx
lea ecx, [esp + 0x1c]
mov byte [edi - 1], al
call fcn.004138a0
jmp 0x5bf6dd
push 0x15
mov ecx, esi
call fcn.00610190
and eax, 0xff
mov ecx, eax
shl ecx, 8
sub ecx, eax
mov eax, 0x80808081
shl ecx, 3
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
jmp 0x5bef4d
push 0x16
mov ecx, esi
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jmp 0x5bef47
push 0x16
mov ecx, esi
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x6d03c8]
jmp 0x5bef4d
push 0x20
jmp 0x5bf09e
push 0x17
mov ecx, esi
call fcn.00610190
and eax, 0xff
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
mov eax, 0x80808081
shl ecx, 1
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 0xa]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
jmp 0x5bef4d
push 0x17
mov ecx, esi
call fcn.00610190
and eax, 0xff
lea ecx, [eax + eax*4]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
jmp 0x5bef4d
push 0x19
jmp 0x5bf09e
push 0x1a
jmp 0x5bf09e
push 0x1b
jmp 0x5bf09e
push 0x1c
mov ecx, esi
call fcn.00610190
and eax, 0xff
push 0x1d
mov dword [esp + 0x14], eax
mov ecx, esi
fild dword [esp + 0x14]
fmul qword [0x6d48d0]
fstp qword [esp + 0x2c]
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x6d48c8]
fadd qword [esp + 0x28]
jmp 0x5bef4d
push 0x1d
mov ecx, esi
call fcn.00610190
and eax, 0xff
push 0x1c
mov dword [esp + 0x14], eax
mov ecx, esi
fild dword [esp + 0x14]
fmul qword [0x6d48c0]
fstp qword [esp + 0x2c]
call fcn.00610190
and eax, 0xff
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x6d48b8]
fadd qword [esp + 0x28]
jmp 0x5bef4d
push 0xc
mov ecx, esi
call fcn.00610190
test al, 1
je 0x5bf2b6
push 0x32
jmp 0x5bf2b8
push 0x33
push 5
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0060fe80
lea eax, [esp + 0x7c]
push eax
call fcn.0060f170
add esp, 8
mov ecx, dword [0x6ce1fc]
mov byte [esp + 0xf4], 6
push ecx
push 0
push eax
lea ecx, [esp + 0x24]
call fcn.004136a0
mov eax, dword [esp + 0x7c]
mov byte [esp + 0xf4], 5
test eax, eax
je case.default.0x5beed8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x5bf678
cmp al, 0xff
je 0x5bf678
dec al
mov byte [ecx], al
jmp case.default.0x5beed8
push 0xe
mov ecx, esi
call fcn.00610190
test al, 0x10
je 0x5bf340
push 0x32
jmp 0x5bf342
push 0x33
push 5
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0060fe80
lea eax, [esp + 0x8c]
push eax
call fcn.0060f170
add esp, 8
mov ecx, dword [0x6ce1fc]
mov byte [esp + 0xf4], 7
push ecx
push 0
push eax
lea ecx, [esp + 0x24]
call fcn.004136a0
mov eax, dword [esp + 0x8c]
mov byte [esp + 0xf4], 5
jmp 0x5bf308
push 0xe
mov ecx, esi
call fcn.00610190
test al, 0x20
je 0x5bf3ae
push 0x32
jmp 0x5bf3b0
push 0x33
push 5
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0060fe80
lea eax, [esp + 0xac]
push eax
call fcn.0060f170
add esp, 8
mov ecx, dword [0x6ce1fc]
mov byte [esp + 0xf4], 8
push ecx
push 0
push eax
lea ecx, [esp + 0x24]
call fcn.004136a0
mov eax, dword [esp + 0xac]
mov byte [esp + 0xf4], 5
jmp 0x5bf308
push 0xe
mov ecx, esi
call fcn.00610190
test al, 1
je 0x5bf41c
push 0x32
jmp 0x5bf41e
push 0x33
push 5
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0060fe80
lea eax, [esp + 0x9c]
push eax
call fcn.0060f170
add esp, 8
mov esi, eax
mov ecx, dword [esi + 8]
mov eax, dword [0x6ce1fc]
mov ebx, ecx
mov byte [esp + 0xf4], 9
cmp eax, ebx
jae 0x5bf464
mov ebx, eax
lea edx, [esp + 0x18]
cmp edx, esi
jne 0x5bf498
push eax
push ebx
lea ecx, [esp + 0x20]
call fcn.004140d0
push 0
push 0
lea ecx, [esp + 0x20]
call fcn.004140d0
mov eax, dword [esp + 0x9c]
mov byte [esp + 0xf4], 5
jmp 0x5bf308
test ebx, ebx
jbe 0x5bf4f7
cmp ebx, ecx
jne 0x5bf4f7
mov eax, dword [esi + 4]
test eax, eax
jne 0x5bf4ac
mov eax, 0x6ce1f8
cmp byte [eax - 1], 0xfe
jae 0x5bf4f7
push 1
lea ecx, [esp + 0x1c]
call fcn.004138a0
mov eax, dword [esi + 4]
test eax, eax
jne 0x5bf4c9
mov eax, 0x6ce1f8
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 8]
mov dword [esp + 0x20], ecx
mov esi, dword [esi + 0xc]
mov dword [esp + 0x24], esi
mov cl, byte [eax - 1]
inc cl
mov byte [esp + 0xf4], 5
mov byte [eax - 1], cl
mov eax, dword [esp + 0x9c]
jmp 0x5bf308
push 1
push ebx
lea ecx, [esp + 0x20]
call fcn.00414210
test al, al
je 0x5bf531
mov esi, dword [esi + 4]
test esi, esi
jne 0x5bf513
mov esi, 0x6ce1f8
mov edi, dword [esp + 0x1c]
mov ecx, ebx
mov eax, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.004141f0
mov eax, dword [esp + 0x9c]
mov byte [esp + 0xf4], 5
jmp 0x5bf308
push 0xe
mov ecx, esi
call fcn.00610190
test al, 2
je 0x5bf556
push 0x32
jmp 0x5bf558
push 0x33
push 5
lea ecx, [esp + 0x1c]
call fcn.006102b0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.0060fe80
lea eax, [esp + 0xbc]
push eax
call fcn.0060f170
add esp, 8
mov esi, eax
mov ecx, dword [esi + 8]
mov eax, dword [0x6ce1fc]
mov ebx, ecx
mov byte [esp + 0xf4], 0xa
cmp eax, ebx
jae 0x5bf59e
mov ebx, eax
lea edx, [esp + 0x18]
cmp edx, esi
jne 0x5bf5c3
push eax
push ebx
lea ecx, [esp + 0x20]
call fcn.004140d0
push 0
push 0
lea ecx, [esp + 0x20]
call fcn.004140d0
jmp 0x5bf64a
test ebx, ebx
jbe 0x5bf610
cmp ebx, ecx
jne 0x5bf610
mov eax, dword [esi + 4]
test eax, eax
jne 0x5bf5d7
mov eax, 0x6ce1f8
cmp byte [eax - 1], 0xfe
jae 0x5bf610
push 1
lea ecx, [esp + 0x1c]
call fcn.004138a0
mov eax, dword [esi + 4]
test eax, eax
jne 0x5bf5f4
mov eax, 0x6ce1f8
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 8]
mov dword [esp + 0x20], ecx
mov esi, dword [esi + 0xc]
mov dword [esp + 0x24], esi
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x5bf64a
push 1
push ebx
lea ecx, [esp + 0x20]
call fcn.00414210
test al, al
je 0x5bf64a
mov esi, dword [esi + 4]
test esi, esi
jne 0x5bf62c
mov esi, 0x6ce1f8
mov edi, dword [esp + 0x1c]
mov ecx, ebx
mov eax, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.004141f0
mov eax, dword [esp + 0xbc]
mov byte [esp + 0xf4], 5
test eax, eax
je case.default.0x5beed8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x5bf678
cmp al, 0xff
je 0x5bf678
dec al
mov byte [ecx], al
jmp case.default.0x5beed8
push ecx
call fcn.00697880
add esp, 4
jmp case.default.0x5beed8
test ebx, ebx
jne 0x5bf697
push 1
lea ecx, [esp + 0x1c]
call fcn.004138a0
jmp 0x5bf6dd
mov eax, dword [esp + 0x24]
cmp eax, 0x1f
ja 0x5bf6a4
cmp eax, ebx
jae 0x5bf6bd
push 1
lea ecx, [esp + 0x1c]
call fcn.004138a0
push ebx
lea ecx, [esp + 0x1c]
call fcn.00414870
mov edi, dword [esp + 0x1c]
mov ecx, ebx
lea esi, [esp + 0x40]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], ebx
mov byte [eax + ebx], 0
mov ebx, dword [esp + 0xfc]
mov cl, byte [esp + 0x18]
xor edi, edi
mov byte [ebx], cl
mov ecx, dword [esp + 0x20]
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov eax, dword [0x6ce1fc]
mov ebp, ecx
cmp eax, ebp
jae 0x5bf706
mov ebp, eax
lea edx, [esp + 0x18]
cmp ebx, edx
jne 0x5bf725
push eax
push ebp
mov ecx, ebx
call fcn.004140d0
push edi
push edi
mov ecx, ebx
call fcn.004140d0
jmp 0x5bf7ad
cmp ebp, edi
jbe 0x5bf771
cmp ebp, ecx
jne 0x5bf771
mov eax, dword [esp + 0x1c]
cmp eax, edi
jne 0x5bf73a
mov eax, 0x6ce1f8
cmp byte [eax - 1], 0xfe
jae 0x5bf771
push 1
mov ecx, ebx
call fcn.004138a0
mov eax, dword [esp + 0x1c]
cmp eax, edi
jne 0x5bf756
mov eax, 0x6ce1f8
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x5bf7ad
push 1
push ebp
mov ecx, ebx
call fcn.00414210
test al, al
je 0x5bf7ad
mov esi, dword [esp + 0x1c]
cmp esi, edi
jne 0x5bf78c
mov esi, 0x6ce1f8
mov edi, dword [ebx + 4]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
add ebp, eax
xor edi, edi
mov byte [ebp], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 1
mov byte [esp + 0xf4], 4
call fcn.0060ffb0
lea ecx, [esp + 0xc8]
mov byte [esp + 0xf4], 3
call fcn.00546f80
lea ecx, [esp + 0x54]
mov byte [esp + 0xf4], 2
call fcn.0060d280
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x5bf810
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x5bf807
cmp al, 0xff
je 0x5bf807
dec al
mov byte [ecx], al
jmp 0x5bf810
push ecx
call fcn.00697880
add esp, 4
lea ecx, [esp + 0x100]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov byte [esp + 0xf4], 0
call fcn.0060ffb0
mov eax, ebx
mov ecx, dword [esp + 0xec]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xe8
ret 8