Function at 0x59f4b0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6cd98e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x64]
mov dword [esp + 0x2c], ebp
call fcn.0062eab0
xor edi, edi
lea ecx, [esp + 0x14]
mov dword [esp + 0xfc], edi
call fcn.0061d780
lea ecx, [esp + 0x44]
mov byte [esp + 0xfc], 1
call fcn.0061d780
mov al, byte [esp + 0x13]
mov dword [esp + 0x1c], edi
mov byte [esp + 0x18], al
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
lea ecx, [esp + 0x70]
mov byte [esp + 0xfc], 3
call fcn.0061aaa0
lea ecx, [esp + 0x54]
mov byte [esp + 0xfc], 4
call fcn.0063bb20
lea ecx, [esp + 0xa4]
mov byte [esp + 0xfc], 5
call fcn.0063bb20
push 0x6c
push 0xf1
push 0x10
lea ecx, [esp + 0xc0]
mov byte [esp + 0x108], 6
call fcn.00555f00
push 0x6c
push 0xf1
push 0xfe
lea ecx, [esp + 0xe0]
mov byte [esp + 0x108], 7
call fcn.00555f00
mov al, byte [0x72bd0c]
mov byte [esp + 0xfc], 8
test al, al
mov byte [esp + 0x3e], 1
mov byte [esp + 0x3f], 0x3f
mov byte [esp + 0x34], 2
mov byte [esp + 0x35], 0x3c
mov byte [esp + 0x36], 0x41
je 0x59f5ec
lea esi, [ebp + 8]
mov dword [esp + 0x28], 0x14
call fcn.006a7255
cdq
mov ecx, 0xff
idiv ecx
mov ecx, esi
mov ebx, edx
call fcn.0061dc40
cmp ax, 0x14
jg 0x59f5e1
push ebx
mov ecx, esi
call fcn.0061dc20
mov eax, dword [esp + 0x28]
dec eax
mov dword [esp + 0x28], eax
jne 0x59f5bd
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x713888
call fcn.0061d820
lea ecx, [esp + 0x18]
call fcn.0061dab0
mov ebx, dword [esp + 0x104]
lea ecx, [esp + 0x14]
mov eax, ebx
push ebx
and eax, 0xff
push 4
lea eax, [eax + eax*4]
lea esi, [eax + eax*4]
shl esi, 1
mov dword [esp + 0x58], esi
mov dl, byte [esi + 0x6e232c]
mov byte [esp + 0x1b], dl
call fcn.0061dbc0
push 8
lea ecx, [esp + 0x58]
mov byte [ebp + 0xf], 0
mov byte [ebp + 0xc], 0xff
call fcn.0062daa0
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push edi
call fcn.0061d7b0
lea ecx, [esp + 0x58]
call fcn.0062d730
cmp bl, 6
je 0x59f674
cmp bl, 7
je 0x59f674
cmp bl, 8
je 0x59f674
xor edi, edi
jmp 0x59f679
mov edi, 4
mov dword [esp + 0x4c], edi
mov al, byte [ebp + 0xf]
test al, al
jne 0x59f69d
push ebx
mov ecx, ebp
mov byte [ebp + 0xe], 0
call fcn.0059e840
test ax, ax
je 0x59fbaa
mov byte [ebp + 0xf], 1
cmp bl, 6
jae 0x59f6e4
sub esp, 0x24
lea ecx, [esp + 0x78]
mov eax, esp
mov dword [esp + 0x54], esp
push 0
push ecx
push eax
mov ecx, 0x72baa8
call fcn.00628090
lea ecx, [esp + 0x94]
call fcn.0061ac40
mov al, byte [0x72bd0c]
test al, al
jne 0x59f6e4
lea ecx, [esp + 0x70]
call fcn.0061b070
test ax, ax
je 0x59fc35
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 6
push 0x713454
mov byte [ebp + 0xc], 0xff
call fcn.0061d820
push ecx
mov byte [esp + 0x108], 0xa
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x713860
call fcn.0061d820
mov ecx, dword [0x72bae8]
mov byte [esp + 0x108], 8
call fcn.0062c790
movzx ax, byte [esp + 0x13]
cmp di, ax
mov dword [esp + 0x28], edi
mov word [esp + 0x4a], ax
jge 0x59fb8e
movsx edx, word [esp + 0x28]
lea ecx, [esp + 0x14]
mov bl, byte [edx + esi + 0x6e232d]
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x40]
push eax
push 3
call fcn.0061dbc0
mov cl, byte [esp + 0x28]
inc cl
push ecx
push 5
lea ecx, [esp + 0x1c]
call fcn.0061dbc0
mov al, byte [0x72bd0c]
test al, al
jne 0x59f97b
cmp bl, 0x41
je 0x59f879
cmp bl, 0x42
je 0x59f879
cmp bl, 0x43
je 0x59f879
cmp bl, 0x44
je 0x59f879
cmp bl, 0x45
je 0x59f879
cmp bl, 0x46
je 0x59f879
cmp bl, 0x47
je 0x59f879
cmp bl, 0x48
je 0x59f879
cmp bl, 0x49
je 0x59f879
cmp bl, 0x4d
je 0x59f879
cmp bl, 0x4e
je 0x59f879
cmp bl, 0x4f
je 0x59f879
cmp bl, byte [ebp + 0xc]
je 0x59f9a5
cmp bl, 0xff
je 0x59f9a5
mov byte [ebp + 0xc], bl
xor edi, edi
push 0
lea ecx, [esp + 0x74]
call fcn.0061b060
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x59f81b
xor eax, eax
jmp 0x59f823
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
movsx ecx, di
cmp ecx, eax
jae 0x59f972
push ecx
push 0
lea ecx, [esp + 0x78]
call fcn.0061b060
mov ecx, eax
call fcn.00690c60
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0061d790
lea esi, [ebp + 8]
mov ecx, esi
call fcn.0061dab0
mov ecx, esi
call fcn.0061dc40
cmp ax, 4
jle 0x59f876
push 4
mov ecx, esi
call fcn.0061daa0
cmp al, bl
je 0x59f972
inc edi
jmp 0x59f805
cmp bl, byte [ebp + 0xc]
je 0x59f9a5
cmp bl, 0xff
je 0x59f9a5
mov byte [ebp + 0xc], bl
mov byte [esp + 0x36], bl
mov dword [esp + 0x30], 0
jmp 0x59f8a0
mov ebp, dword [esp + 0x2c]
sub esp, 0x24
lea eax, [esp + 0x58]
mov edx, esp
mov dword [esp + 0x5c], esp
push 0
push 1
push eax
push edx
lea ecx, [esp + 0xe8]
call fcn.00556960
lea ecx, [esp + 0x94]
call fcn.0061ac40
push 0
lea ecx, [esp + 0x74]
call fcn.0061b060
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x59fcf5
mov edi, dword [eax + 8]
sub edi, ecx
sar edi, 2
test di, di
je 0x59fcf5
xor ebp, ebp
test di, di
jle 0x59f94a
mov ecx, dword [esp + 0x2c]
lea esi, [ecx + 8]
movsx edx, bp
push edx
push 0
lea ecx, [esp + 0x78]
call fcn.0061b060
mov ecx, eax
call fcn.00690c60
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.0061d790
mov ecx, esi
call fcn.0061dab0
mov ecx, esi
call fcn.0061dc40
cmp ax, 4
jle 0x59f944
push 4
mov ecx, esi
call fcn.0061daa0
cmp bl, al
je 0x59f94a
inc ebp
cmp bp, di
jl 0x59f900
mov eax, dword [esp + 0x30]
inc eax
cmp ax, 2
mov dword [esp + 0x30], eax
jl 0x59f89c
lea eax, [esp + 0x3e]
lea ecx, [esp + 0xd4]
push eax
call fcn.00556d40
mov ebp, dword [esp + 0x2c]
mov al, byte [0x72bd0c]
test al, al
je 0x59f9a5
xor esi, esi
add ebp, 8
call fcn.006a7255
cdq
mov ecx, 0xff
idiv ecx
mov ecx, ebp
push edx
push esi
call fcn.0061dbc0
inc esi
cmp si, 0x14
jl 0x59f980
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.0061d790
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x98]
push eax
call fcn.0059c8c0
mov esi, eax
mov eax, dword [esi + 8]
mov edi, dword [0x6dd1fc]
mov ebp, eax
mov byte [esp + 0xfc], 0xc
cmp edi, ebp
jae 0x59f9e2
mov ebp, edi
lea ecx, [esp + 0x18]
cmp ecx, esi
jne 0x59fa54
cmp dword [esp + 0x20], ebp
jae 0x59f9f5
call fcn.006a6707
lea ecx, [esp + 0x18]
call fcn.00414b70
mov eax, dword [esp + 0x20]
sub eax, ebp
cmp eax, edi
jae 0x59fa0a
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jbe 0x59fa46
mov edx, dword [esp + 0x1c]
sub eax, edi
push eax
lea ecx, [edx + ebp]
lea edx, [ecx + edi]
push edx
push ecx
call fcn.006a6c70
mov esi, dword [esp + 0x2c]
add esp, 0xc
sub esi, edi
lea ecx, [esp + 0x18]
push ebx
push esi
call fcn.00414230
test al, al
je 0x59fa46
push esi
lea ecx, [esp + 0x1c]
call fcn.00414210
lea ecx, [esp + 0x18]
call fcn.00414b70
jmp 0x59fadd
xor ebx, ebx
cmp ebp, ebx
jbe 0x59faa3
cmp ebp, eax
jne 0x59faa3
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x59fa6a
mov eax, 0x6dd1f8
cmp byte [eax - 1], 0xfe
jae 0x59faa3
push 1
lea ecx, [esp + 0x1c]
call fcn.004138c0
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x59fa87
mov eax, 0x6dd1f8
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 8]
mov dword [esp + 0x20], ecx
mov esi, dword [esi + 0xc]
mov dword [esp + 0x24], esi
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x59fadd
push 1
push ebp
lea ecx, [esp + 0x20]
call fcn.00414230
test al, al
je 0x59fadd
mov esi, dword [esi + 4]
cmp esi, ebx
jne 0x59fabf
mov esi, 0x6dd1f8
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov eax, ecx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.00414210
mov eax, dword [esp + 0x98]
mov byte [esp + 0xfc], 8
cmp eax, ebx
je 0x59fb0d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x59fb04
cmp al, 0xff
je 0x59fb04
dec al
mov byte [ecx], al
jmp 0x59fb0d
push ecx
call fcn.006a64d0
add esp, 4
push ebx
push 0xffff
sub esp, 0x10
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
call fcn.00413060
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
mov byte [esp + 0x11c], 0xd
call fcn.0061d790
mov ecx, dword [0x72bae8]
mov byte [esp + 0x118], 8
call fcn.0062c9a0
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x50]
inc eax
cmp ax, word [esp + 0x4a]
mov dword [esp + 0x28], eax
jl 0x59f743
mov ebx, dword [esp + 0x104]
mov edi, dword [esp + 0x4c]
mov ecx, dword [0x72bae8]
push 0
call fcn.0062ce90
cmp ax, 0xb
je 0x59fe08
jmp 0x59f67d
lea ecx, [esp + 0xd4]
mov byte [esp + 0xfc], 7
call fcn.00555f30
lea ecx, [esp + 0xb4]
mov byte [esp + 0xfc], 6
call fcn.00555f30
lea ecx, [esp + 0xa4]
mov byte [esp + 0xfc], 5
call fcn.0062d500
lea ecx, [esp + 0x54]
mov byte [esp + 0xfc], 4
call fcn.0062d500
lea ecx, [esp + 0x70]
mov byte [esp + 0xfc], 3
call fcn.0061ab90
mov eax, dword [esp + 0x1c]
xor esi, esi
cmp eax, esi
je 0x59fdbe
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x59fdb5
cmp al, 0xff
je 0x59fdb5
dec al
mov byte [ecx], al
jmp 0x59fdbe
xor esi, esi
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x7137f4
call fcn.0061d820
push ecx
mov byte [esp + 0x10c], 9
mov ecx, esp
mov dword [esp + 0x50], esp
push 6
push 0x713840
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0x10c], 8
call fcn.0061ef70
push esi
push esi
mov ecx, 0x72baa8
call fcn.00623e40
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x1c]
lea ecx, [esp + 0xd4]
mov byte [esp + 0xfc], 7
call fcn.00555f30
lea ecx, [esp + 0xb4]
mov byte [esp + 0xfc], 6
call fcn.00555f30
lea ecx, [esp + 0xa4]
mov byte [esp + 0xfc], 5
call fcn.0062d500
lea ecx, [esp + 0x54]
mov byte [esp + 0xfc], 4
call fcn.0062d500
lea ecx, [esp + 0x70]
mov byte [esp + 0xfc], 3
call fcn.0061ab90
mov eax, dword [esp + 0x1c]
jmp 0x59fc0e
xor esi, esi
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x7137f4
call fcn.0061d820
push ecx
mov byte [esp + 0x10c], 0xb
mov ecx, esp
mov dword [esp + 0x50], esp
push 6
push 0x713840
call fcn.0061d820
mov ecx, 0x72bae0
mov byte [esp + 0x10c], 8
call fcn.0061ef70
push esi
push esi
mov ecx, 0x72baa8
call fcn.00623e40
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x1c]
lea ecx, [esp + 0xd4]
mov byte [esp + 0xfc], 7
call fcn.00555f30
lea ecx, [esp + 0xb4]
mov byte [esp + 0xfc], 6
call fcn.00555f30
lea ecx, [esp + 0xa4]
mov byte [esp + 0xfc], 5
call fcn.0062d500
lea ecx, [esp + 0x54]
mov byte [esp + 0xfc], 4
call fcn.0062d500
lea ecx, [esp + 0x70]
mov byte [esp + 0xfc], 3
call fcn.0061ab90
mov eax, dword [esp + 0x1c]
jmp 0x59fc0e
push ecx
call fcn.006a64d0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov byte [esp + 0xfc], 1
call fcn.0061d8c0
lea ecx, [esp + 0x14]
mov byte [esp + 0xfc], 0
call fcn.0061d8c0
lea ecx, [esp + 0x64]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0061d8c0
xor ax, ax
jmp 0x59fee7
xor esi, esi
mov ecx, 0x72baa8
push esi
push esi
call fcn.00623e40
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x1c]
lea ecx, [esp + 0xd4]
mov byte [esp + 0xfc], 7
call fcn.00555f30
lea ecx, [esp + 0xb4]
mov byte [esp + 0xfc], 6
call fcn.00555f30
lea ecx, [esp + 0xa4]
mov byte [esp + 0xfc], 5
call fcn.0062d500
lea ecx, [esp + 0x54]
mov byte [esp + 0xfc], 4
call fcn.0062d500
lea ecx, [esp + 0x70]
mov byte [esp + 0xfc], 3
call fcn.0061ab90
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x59fea1
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x59fe98
cmp al, 0xff
je 0x59fe98
dec al
mov byte [ecx], al
jmp 0x59fea1
push ecx
call fcn.006a64d0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov byte [esp + 0xfc], 1
call fcn.0061d8c0
lea ecx, [esp + 0x14]
mov byte [esp + 0xfc], 0
call fcn.0061d8c0
lea ecx, [esp + 0x64]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0061d8c0
mov ax, 1
mov ecx, dword [esp + 0xf4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xf0
ret 4