Function at 0x402730
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
mov ecx, 0xfffffff5
push rbp
push rdi
push rsi
push rbx
xor esi, esi
sub rsp, 0x58
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x40276b
movzx eax, word [rsp + 0x34]
xor esi, esi
or ax, word [rsp + 0x36]
sete sil
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
cmp word [rax], 0x22
lea rbx, [rax + 2]
sete dl
jmp 0x40279b
cmp ax, 0x20
ja 0x40278b
test dl, 1
je 0x4027b0
mov ecx, edx
add rbx, 2
xor ecx, 1
cmp ax, 0x22
cmove edx, ecx
movzx eax, word [rbx]
test ax, ax
jne 0x402780
mov ecx, esi
call fcn.00401f00
nop word [rax + rax]
add rbx, 2
movzx eax, word [rbx]
lea edx, [rax - 1]
cmp dx, 0x1f
jbe 0x4027b0
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x4027a3
movzx ecx, word [rbx + 2]
mov r12, qword [sym.imp.ntdll.dll_toupper]
lea rdi, [rbx + 4]
call r12
mov ebp, eax
lea eax, [rax - 0x43]
cmp eax, 0x15
ja case.0x4027f7.69
lea rdx, [0x00403dac]
movsxd rax, dword [rdx + rax*4]
add rdx, rax
jmp rdx
xor ebx, ebx
call fcn.00402350
test eax, eax
setne bl
test esi, esi
nop
nop
nop
nop
nop
nop
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ecx, word [rbx + 4]
lea rdi, [rbx + 6]
call r12
mov r13d, eax
lea eax, [rax - 0x44]
cmp eax, 1
ja case.0x4027f7.69
movzx eax, word [rbx + 6]
cmp ax, 9
je 0x402840
cmp ax, 0x20
jne 0x402853
nop
add rdi, 2
movzx eax, word [rdi]
cmp ax, 0x20
je 0x402840
cmp ax, 9
je 0x402840
xor edx, edx
xor ecx, ecx
call fcn.004019a0
test rax, rax
mov r12, rax
je 0x402a87
cmp ebp, 0x43
je 0x402a0d
cmp r13d, 0x44
mov rdx, rdi
je 0x4029cf
lea rcx, str.Locking__S...
call sub.msvcrt.dll_printf
xor edx, edx
cmp ebp, 0x4e
mov r8, rdi
sete dl
mov rcx, r12
lea edx, [rdx*8 + 0x222044]
call main
mov ebx, eax
test ebx, ebx
js 0x402a40
lea rcx, [0x00403d5d]
call sub.msvcrt.dll_puts
mov rcx, r12
not ebx
call sub.ntdll.dll_NtClose
shr ebx, 0x1f
jmp 0x402805
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
xor ebx, ebx
call fcn.00401010
test eax, eax
jne 0x4028f2
jmp 0x402805
add rdi, 2
movzx eax, word [rdi]
cmp ax, 0x20
je 0x4028ee
cmp ax, 9
je 0x4028ee
mov rcx, rdi
call qword [sym.imp.ntdll.dll__wtoi]
xor edx, edx
cdqe
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.004019a0
test rax, rax
mov rbx, rax
je 0x4029fc
lea r8, [rsp + 0x20]
mov r9d, 0x10
mov edx, 0x222400
mov rcx, rax
call fcn.00401520
mov rcx, rbx
mov edi, eax
call sub.ntdll.dll_NtClose
test edi, edi
js 0x402a53
mov edx, dword [rsp + 0x20]
lea rcx, str._d_is_now_de_protected._n
mov ebx, 1
call sub.msvcrt.dll_printf
jmp 0x402805
xor ebx, ebx
call fcn.00401ea0
test eax, eax
setne bl
jmp 0x402805
xor ecx, ecx
xor ebx, ebx
call fcn.004011c0
test eax, eax
setne bl
jmp 0x402805
mov ecx, 1
call fcn.00401f00
mov rcx, rdi
xor ebx, ebx
call fcn.00402160
test eax, eax
setne bl
jmp 0x402805
xor ecx, ecx
call fcn.00401f00
lea rcx, str.Press_enter...
call sub.msvcrt.dll_printf
nop
call sub.msvcrt.dll_getchar
cmp eax, 0xa
jne 0x4029c0
jmp 0x40280d
lea rcx, str.Unlocking__S...
call sub.msvcrt.dll_printf
xor edx, edx
cmp ebp, 0x4e
mov r8, rdi
sete dl
mov rcx, r12
lea edx, [rdx*8 + 0x222048]
call main
mov ebx, eax
jmp 0x4028a6
lea rcx, str.Failed_to_open_install_WinD_device.
call sub.msvcrt.dll_puts
jmp 0x402805
cmp r13d, 0x45
je 0x402a6d
lea rdx, str.Disa
lea rcx, str._sbling_global_registry_callbacks...
call sub.msvcrt.dll_printf
mov edx, 0x222000
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.00401520
mov ebx, eax
jmp 0x4028a6
lea rcx, str.error__08x_n
mov edx, ebx
call sub.msvcrt.dll_printf
jmp 0x4028ba
mov edx, dword [rsp + 0x20]
lea rcx, str.Failed_to_de_protect__d__status__08x_n
mov r8d, edi
xor ebx, ebx
call sub.msvcrt.dll_printf
jmp 0x402805
lea rdx, [0x00403da5]
lea rcx, str._sbling_global_registry_callbacks...
call sub.msvcrt.dll_printf
mov edx, 0x222004
jmp 0x402a2b
lea rcx, str.Failed_to_open_install_WinD_device.
xor ebx, ebx
call sub.msvcrt.dll_puts
jmp 0x402805