Function at 0xdbf342
Capabilities:
Encrypt data using rc4 prga
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 4]
cdq
mov dl, 0x57
cmovb dx, ax
mov edx, dword [ecx + edi + 0x24]
lea eax, [edx + esi*2]
xchg ch, ch
movzx ecx, word [eax + edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], ecx
mov dword [ebp + 8], edx
jmp 0xad3671
mov ebx, dword [eax + edi + 0x18]
test ebx, ebx
je 0xad368e
mov edx, dword [eax + edi + 0x20]
dec ebx
cmp dx, sp
cmp esp, 0x79eb3873
lea edx, [edx + edi]
clc
mov dword [ebp + 8], 0
mov dword [ebp - 0xc], edx
cmp ax, 0x239d
cmc
test ebx, ebx
jl 0xad368e
jmp 0xad6d05
lea ebx, [esi - 1]
cmp esi, 0x25252a8b
test ebx, 0x5b2b7c38
cmp dword [ebp + 8], ebx
jle 0xad6cf4
mov eax, dword [ebp - 4]
bsf si, bp
bsr esi, ebx
mov esi, dword [ebp - 8]
test ebx, 0x514c6c80
cmc
cmp esi, dword [eax + edi + 0x14]
jae 0xad3700
mov ecx, dword [eax + edi + 0x1c]
or dl, ah
rcl dh, cl
lea edx, [ecx + esi*4]
mov ecx, dword [edx + edi]
test esp, 0x47b7282f
test esp, esi
cmc
test ecx, ecx
je 0xad3700
cmp ecx, eax
jb 0xe6be3f
mov edx, dword [ebp - 0x10]
test bp, 0x6754
cmc
lea edx, [edx + eax]
test ax, si
cmp ecx, edx
jae 0xe6be3f
lea eax, [ecx + edi]
mov cl, byte [eax]
mov esi, eax
test dh, 0x59
test cl, cl
je 0xad3700
mov edi, edi
stc
cmp cl, 0x2e
je 0xe6b2ec
mov cl, byte [esi + 1]
inc esi
test cl, cl
jne 0xad36eb
pop esi
bsf bx, ax
shr ebx, cl
pop ebx
inc di
xor eax, eax
mov di, 0x7ec1
pop edi
mov esp, ebp
bswap ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
xor ax, 0x7ec9
cmovl si, bp
shl esi, 0x95
mov eax, dword [ebp + 8]
rcl esi, 0x7d
shld si, bp, 0xab
xadd si, si
lea esi, [ebx + eax]
rol ah, 0x84
mov eax, dword [ebp + 0x10]
push eax
mov eax, esp
sar esi, 1
bt eax, ebp
btr eax, 0xa1
shrd eax, ebp, 0x95
mov eax, dword [edx + esi*4]
add eax, edi
call fcn.00d4c14a
add esp, 4
cmp esi, 0x9e01c78
cmp eax, 0xffffffff
je 0xad3662
test eax, eax
je 0xacff83
cmp eax, 1
jne 0xad3671
inc esi
mov dword [ebp + 8], esi
jmp 0xad3671
push ebp
mov ebp, esp
cmp esi, 0x385b2786
lea esp, [esp - 0x114]
stc
test dx, 0x20c2
push edi
mov edi, dword [ebp + 8]
clc
test edi, edi
je 0xdbf381
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0xdbf381
mov eax, 0x5a4d
cmp bp, cx
cmp word [edi], ax
je 0xe669a2
sub eax, eax
pop edi
mov esp, ebp
xchg bp, bp
movzx ebp, si
bswap ebp
pop ebp
ret
mov edx, dword [edi + 0x3c]
clc
cmc
lea edx, [edx + edi]
test bp, 0x2a81
cmc
stc
cmp dword [edx], 0x4550
jne 0xdbf381
mov eax, dword [edx + 0x78]
cmc
mov dword [ebp - 4], eax
stc
test eax, eax
je 0xdbf381
mov edx, dword [edx + 0x7c]
cmp dl, cl
push ebx
clc
push esi
cmp si, 0x1cfe
test eax, 0x24217612
or esi, 0xffffffff
cmp dx, 0x3b81
mov dword [ebp - 0x10], edx
clc
test ebx, esp
mov dword [ebp - 8], esi
cmp ecx, 0xffff
ja 0xad2cee
sub ecx, dword [eax + edi + 0x10]
test edx, 0x5e264d50
cmc
cmp ecx, dword [eax + edi + 0x14]
jae 0xad3700
mov edx, dword [eax + edi + 0x1c]
test bp, 0x778d
lea ecx, [edx + ecx*4]
cmp ecx, 0x33803821
mov ecx, dword [ecx + edi]
cmc
cmp cx, si
test dx, sp
test ecx, ecx
jne 0xad36b7
pop esi
btr ebx, esi
sbb edi, 0x44c87d48
pop ebx
sub eax, eax
not edi
pop edi
mov esp, ebp
movsx ebp, cx
bswap bp
pop ebp
ret
mov ebx, esi
sub ebx, eax
cmp ebx, 0x104
jae 0xad3700
xor ecx, ecx
cmp esi, ebp
test ebx, ebx
jbe 0xe6b32e
lea edi, [ebp - 0x114]
dec dl
mov dl, 0x4e
sub edi, eax
cmc
not dl
mov dl, byte [eax]
test dl, dl
je 0xe6b32e
mov byte [edi + eax], dl
inc ecx
inc eax
cmp ecx, ebx
jb 0xe6b317
lea eax, [ebp - 0x114]
push eax
cwde
cbw
cmovp eax, esp
mov byte [ebp + ecx - 0x114], 0
movzx ax, ah
not al
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
mov edi, eax
test ebp, ebp
test esi, 0x48f6698b
test edi, edi
jne 0xe6b387
lea ecx, [ebp - 0x114]
movzx ax, cl
mov al, bl
push ecx
movzx eax, bp
cbw
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA_1]
call eax
mov edi, eax
cmp ch, al
test edi, edi
je 0xad3700
cmp byte [esi + 1], 0x23
movsx ecx, sp
not ch
lea ecx, [esi + 1]
je 0xe71cc0
push 0
push ecx
push edi
call fcn.00dbf342
add esp, 0xc
pop esi
mov bx, 0x4e9
movsx bx, dh
pop ebx
bswap edi
cmovp edi, edi
xchg di, di
pop edi
mov esp, ebp
bswap ebp
pop ebp
ret
pop esi
not ah
movsx eax, di
mov ebx, ebx
pop ebx
lea eax, [ecx + edi]
pop edi
mov esp, ebp
bswap bp
pop ebp
ret
mov cl, byte [esi + 2]
stc
clc
add esi, 2
sub edx, edx
test ebx, 0x4cba00fc
stc
test cl, cl
je 0xe71d06
mov al, cl
test esi, 0x550f6922
sub al, 0x30
inc esi
cmp al, 9
ja 0xe71d06
movsx eax, cl
mov cl, byte [esi]
lea edx, [edx + edx*4]
test ebp, 0x143312cf
lea edx, [eax + edx*2 - 0x30]
test cl, cl
jne 0xe71cd9
push 0
push edx
push edi
call fcn.00dbf342
add esp, 0xc
pop esi
mov ebx, 0xb754823
cmova bx, sp
pop ebx
pop edi
mov esp, ebp
xchg ebp, ebp
pop ebp
ret