Function at 0x535b20
Capabilities:
Access peb ldr_data
Encrypt data using rc4 ksa
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b86f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x84]
mov dword [esp + 0x30], ebx
call fcn.00620f50
xor esi, esi
lea ecx, [esp + 0x14]
mov dword [esp + 0xe8], esi
call fcn.0060fe70
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], 1
call fcn.0060d180
lea ecx, [esp + 0x44]
mov byte [esp + 0xe8], 2
call fcn.0060fe70
mov al, byte [esp + 0x13]
mov dword [esp + 0x1c], esi
mov byte [esp + 0x18], al
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0062da70
push 0x6c
push 0xf1
push 0x10
lea ecx, [esp + 0xac]
mov byte [esp + 0xf4], 5
call fcn.00548440
push 0x6c
push 0xf1
push 0xfe
lea ecx, [esp + 0xcc]
mov byte [esp + 0xf4], 6
call fcn.00548440
push ecx
mov byte [esp + 0xec], 7
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x70dfdc
mov byte [esp + 0x4a], 1
mov byte [esp + 0x4b], 0x3f
mov byte [esp + 0x38], 2
mov byte [esp + 0x39], 0x3c
mov byte [esp + 0x3a], 0x41
call fcn.0060ff10
lea ecx, [esp + 0x18]
call fcn.006101a0
mov ecx, dword [esp + 0xf0]
mov eax, ecx
push ecx
and eax, 0xff
push 4
lea ecx, [esp + 0x1c]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x54], eax
mov dl, byte [eax + 0x6d28e8]
mov byte [esp + 0x1b], dl
call fcn.006102b0
push 8
lea ecx, [esp + 0x54]
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xc], 0xff
call fcn.0061ff40
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push esi
call fcn.0060fea0
lea ecx, [esp + 0x54]
call fcn.0061fbd0
mov al, byte [0x71bb5c]
test al, al
je 0x535cb3
lea esi, [ebx + 8]
mov ebp, 0x14
call fcn.00698605
cdq
mov ecx, 0xff
idiv ecx
mov ecx, esi
mov edi, edx
call fcn.00610330
cmp ax, 0x14
jg 0x535cb0
push edi
mov ecx, esi
call fcn.00610310
dec ebp
jne 0x535c8c
mov al, byte [ebx + 0xf]
test al, al
jne 0x535cda
mov edx, dword [esp + 0xf0]
mov ecx, ebx
push edx
mov byte [ebx + 0xe], 0
call fcn.005913d0
test ax, ax
je 0x5361bc
mov byte [ebx + 0xf], 1
mov al, byte [0x71bb5c]
test al, al
jne 0x535d1f
sub esp, 0x24
xor esi, esi
mov eax, esp
mov dword [esp + 0x4c], esp
lea ecx, [esp + 0x74]
push esi
push ecx
push eax
mov ecx, 0x71b8f8
call fcn.0061a8f0
lea ecx, [esp + 0x84]
call fcn.0060d330
lea ecx, [esp + 0x60]
call fcn.0060d760
test ax, ax
je 0x536200
jmp 0x535d21
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x703454
mov byte [ebx + 0xc], 0xff
call fcn.0060ff10
push ecx
mov byte [esp + 0xf4], 9
mov ecx, esp
mov dword [esp + 0x40], esp
push 6
push 0x703860
call fcn.0060ff10
mov ecx, dword [0x71b938]
mov byte [esp + 0xf4], 7
call fcn.0061ec30
movzx ax, byte [esp + 0x13]
cmp ax, si
mov dword [esp + 0x34], esi
mov word [esp + 0x4a], ax
jle 0x53619f
movsx edx, word [esp + 0x34]
mov eax, dword [esp + 0x4c]
mov bl, byte [edx + eax + 0x6d28e9]
mov byte [esp + 0x40], bl
mov ecx, dword [esp + 0x40]
push ecx
push 3
lea ecx, [esp + 0x1c]
call fcn.006102b0
mov dl, byte [esp + 0x34]
lea ecx, [esp + 0x14]
inc dl
push edx
push 5
call fcn.006102b0
mov al, byte [0x71bb5c]
test al, al
je 0x535df1
mov eax, dword [esp + 0x30]
xor esi, esi
lea edi, [eax + 8]
call fcn.00698605
cdq
mov ecx, 0xff
idiv ecx
mov ecx, edi
push edx
push esi
call fcn.006102b0
inc esi
cmp si, 0x14
jl 0x535dc7
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x535fc1
cmp bl, 0x41
je 0x535e99
cmp bl, 0x42
je 0x535e99
cmp bl, 0x43
je 0x535e99
cmp bl, 0x44
je 0x535e99
cmp bl, 0x45
je 0x535e99
cmp bl, 0x46
je 0x535e99
mov ebp, dword [esp + 0x30]
xor edi, edi
push 0
lea ecx, [esp + 0x64]
call fcn.0060d6a0
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x535e3b
xor eax, eax
jmp 0x535e43
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
movsx ecx, di
cmp ecx, eax
jae 0x535fc1
push ecx
push 0
lea ecx, [esp + 0x68]
call fcn.0060d6a0
mov ecx, eax
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0060fe80
lea esi, [ebp + 8]
mov ecx, esi
call fcn.006101a0
mov ecx, esi
call fcn.00610330
cmp ax, 4
jle 0x535e96
push 4
mov ecx, esi
call fcn.00610190
cmp al, bl
je 0x535fc1
inc edi
jmp 0x535e25
mov ebp, dword [esp + 0x30]
cmp bl, byte [ebp + 0xc]
je 0x535fc1
cmp bl, 0xff
je 0x535fc1
mov byte [ebp + 0xc], bl
mov byte [esp + 0x2e], bl
mov dword [esp + 0x28], 0
sub esp, 0x24
lea eax, [esp + 0x50]
mov edx, esp
mov dword [esp + 0x5c], esp
push 0
push 3
push eax
push edx
lea ecx, [esp + 0xd4]
call fcn.00548ea0
lea ecx, [esp + 0x84]
call fcn.0060d330
push 0
lea ecx, [esp + 0x64]
call fcn.0060d6a0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x536312
mov edx, dword [eax + 8]
sub edx, ecx
test edx, 0xfffffffc
je 0x536312
xor edi, edi
push 0
lea ecx, [esp + 0x64]
call fcn.0060d6a0
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x535f28
xor eax, eax
jmp 0x535f30
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
movsx esi, di
cmp esi, eax
jae 0x535f9d
push 0
lea ecx, [esp + 0x64]
call fcn.0060d6a0
mov eax, dword [eax + 4]
lea ecx, [eax + esi*4]
call fcn.00610330
cmp ax, 4
jle 0x535f6f
push 0
lea ecx, [esp + 0x64]
call fcn.0060d6a0
mov eax, dword [eax + 4]
push 4
lea ecx, [eax + esi*4]
call fcn.00610190
cmp bl, al
je 0x535f72
inc edi
jmp 0x535f12
movsx eax, di
push eax
push 0
lea ecx, [esp + 0x68]
call fcn.0060d6a0
mov ecx, eax
call fcn.00413600
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.0060fe80
lea ecx, [ebp + 8]
call fcn.006101a0
mov eax, dword [esp + 0x28]
inc eax
cmp ax, 3
mov dword [esp + 0x28], eax
jl 0x535ebe
lea ecx, [esp + 0x3e]
push ecx
lea ecx, [esp + 0xc4]
call fcn.00549280
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.0060fe80
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x94]
push eax
call fcn.00536510
mov esi, eax
mov eax, dword [esi + 8]
mov edi, dword [0x6ce1fc]
mov ebp, eax
mov byte [esp + 0xe8], 0xb
cmp edi, ebp
jae 0x535ffe
mov ebp, edi
lea ecx, [esp + 0x18]
cmp ecx, esi
jne 0x536072
cmp dword [esp + 0x20], ebp
jae 0x536011
call fcn.00697ab7
lea ecx, [esp + 0x18]
call fcn.00414980
mov eax, dword [esp + 0x20]
sub eax, ebp
cmp eax, edi
jae 0x536026
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jbe 0x536062
mov edx, dword [esp + 0x1c]
sub eax, edi
push eax
lea ecx, [edx + ebp]
lea edx, [ecx + edi]
push edx
push ecx
call fcn.00698020
mov esi, dword [esp + 0x2c]
add esp, 0xc
sub esi, edi
lea ecx, [esp + 0x18]
push ebx
push esi
call fcn.00414210
test al, al
je 0x536062
push esi
lea ecx, [esp + 0x1c]
call fcn.004141f0
push ebx
push ebx
lea ecx, [esp + 0x20]
call fcn.004140d0
jmp 0x5360fd
xor ebx, ebx
cmp ebp, ebx
jbe 0x5360c1
cmp ebp, eax
jne 0x5360c1
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x536088
mov eax, 0x6ce1f8
cmp byte [eax - 1], 0xfe
jae 0x5360c1
push 1
lea ecx, [esp + 0x1c]
call fcn.004138a0
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x5360a5
mov eax, 0x6ce1f8
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 8]
mov dword [esp + 0x20], ecx
mov esi, dword [esi + 0xc]
mov dword [esp + 0x24], esi
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x5360fd
push 1
push ebp
lea ecx, [esp + 0x20]
call fcn.00414210
test al, al
je 0x5360fd
mov esi, dword [esi + 4]
cmp esi, ebx
jne 0x5360dd
mov esi, 0x6ce1f8
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ebp
mov byte [ecx + ebp], 0
mov eax, dword [esp + 0x94]
mov byte [esp + 0xe8], 7
cmp eax, ebx
je 0x53612d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x536124
cmp al, 0xff
je 0x536124
dec al
mov byte [ecx], al
jmp 0x53612d
push ecx
call fcn.00697880
add esp, 4
push ebx
push 0xffff
sub esp, 0x10
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
call fcn.00412ff0
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
mov byte [esp + 0x108], 0xc
call fcn.0060fe80
mov ecx, dword [0x71b938]
mov byte [esp + 0x104], 7
call fcn.0061ee40
mov eax, dword [esp + 0x34]
inc eax
cmp ax, word [esp + 0x4a]
mov dword [esp + 0x34], eax
jl 0x535d7f
mov ebx, dword [esp + 0x30]
mov ecx, dword [0x71b938]
xor esi, esi
push esi
call fcn.0061f330
cmp ax, 0xb
je 0x536426
jmp 0x535cb3
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe8], 6
call fcn.00548470
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe8], 5
call fcn.00548470
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0061f9a0
mov eax, dword [esp + 0x1c]
xor esi, esi
jmp 0x536293
push esi
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x7037f4
call fcn.0060ff10
push ecx
mov byte [esp + 0xf8], 8
mov ecx, esp
mov dword [esp + 0x50], esp
push 6
push 0x703840
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0xf8], 7
call fcn.006115e0
push esi
push esi
mov ecx, 0x71b8f8
call fcn.006166b0
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x1c]
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe8], 6
call fcn.00548470
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe8], 5
call fcn.00548470
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0061f9a0
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x5362b4
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x5362ab
cmp al, 0xff
je 0x5362ab
dec al
mov byte [ecx], al
jmp 0x5362b4
push ecx
call fcn.00697880
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov byte [esp + 0xe8], 2
call fcn.0060ffb0
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], 1
call fcn.0060d280
lea ecx, [esp + 0x14]
mov byte [esp + 0xe8], 0
call fcn.0060ffb0
lea ecx, [esp + 0x84]
mov dword [esp + 0xe8], 0xffffffff
call fcn.0060ffb0
xor ax, ax
jmp 0x5364f1
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 6
push 0x7037f4
call fcn.0060ff10
push ecx
mov byte [esp + 0xf8], 0xa
mov ecx, esp
mov dword [esp + 0x50], esp
push 6
push 0x703840
call fcn.0060ff10
mov ecx, 0x71b930
mov byte [esp + 0xf8], 7
call fcn.006115e0
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x1c]
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe8], 6
call fcn.00548470
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe8], 5
call fcn.00548470
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0061f9a0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5363bc
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x5363b3
cmp al, 0xff
je 0x5363b3
dec al
mov byte [ecx], al
jmp 0x5363bc
push ecx
call fcn.00697880
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0xe8], 2
call fcn.0060ffb0
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], 1
call fcn.0060d280
lea ecx, [esp + 0x14]
mov byte [esp + 0xe8], 0
call fcn.0060ffb0
lea ecx, [esp + 0x84]
mov dword [esp + 0xe8], 0xffffffff
call fcn.0060ffb0
xor ax, ax
jmp 0x5364f1
push esi
push esi
mov ecx, 0x71b8f8
call fcn.006166b0
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x1c]
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe8], 6
call fcn.00548470
lea ecx, [esp + 0xa0]
mov byte [esp + 0xe8], 5
call fcn.00548470
lea ecx, [esp + 0x50]
mov byte [esp + 0xe8], 4
call fcn.0061f9a0
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x536497
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x53648e
cmp al, 0xff
je 0x53648e
dec al
mov byte [ecx], al
jmp 0x536497
push ecx
call fcn.00697880
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov byte [esp + 0xe8], 2
call fcn.0060ffb0
lea ecx, [esp + 0x60]
mov byte [esp + 0xe8], 1
call fcn.0060d280
lea ecx, [esp + 0x14]
mov byte [esp + 0xe8], 0
call fcn.0060ffb0
lea ecx, [esp + 0x84]
mov dword [esp + 0xe8], 0xffffffff
call fcn.0060ffb0
mov ax, 1
mov ecx, dword [esp + 0xe0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xdc
ret 4