Function at 0x1400389e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1390]
mov eax, 0x1490
call fcn.1400412a0
sub rsp, rax
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rbp + 0x1380], rax
mov rbx, qword [rcx]
xor edx, edx
xor r14b, r14b
mov qword [rcx + 0x10], rdx
mov qword [rcx + 8], rdx
mov r12, rcx
mov qword [rcx + 0x18], rdx
mov r15d, 1
mov rcx, rbx
mov byte [rsp + 0x41], r14b
mov byte [rsp + 0x40], 0
mov r13d, edx
mov dword [rsp + 0x48], edx
mov r14d, edx
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x4c], edx
call fcn.140037390
test eax, eax
je 0x14003955a
mov rcx, rbx
call fcn.140030800
mov rcx, rbx
mov esi, eax
call fcn.140030800
shl esi, 0x10
mov rcx, rbx
add esi, eax
mov dword [rsp + 0x60], esi
call fcn.140030800
mov rcx, rbx
mov edi, eax
call fcn.140030800
shl edi, 0x10
lea edx, [rdi + rax]
mov dword [rsp + 0x64], edx
mov rax, qword [rsp + 0x60]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x49484452
ja 0x140038e43
je 0x140038bd8
cmp ecx, 0x43674249
je 0x140038bcb
cmp ecx, 0x49444154
je 0x140038b36
cmp ecx, 0x49454e44
jne 0x140038e57
test r15d, r15d
jne 0x14003955a
mov rdi, qword [r12 + 8]
test rdi, rdi
je 0x14003955a
mov eax, dword [r12 + 0x20]
imul eax, dword [rbx]
add eax, 7
shr eax, 3
imul eax, dword [rbx + 8]
inc eax
imul eax, dword [rbx + 4]
movsxd rsi, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x140039170
mov qword [r12 + 0x10], rax
jmp 0x14003955a
test r15d, r15d
jne 0x14003955a
cmp byte [rsp + 0x40], r15b
je 0x140038b4f
test r14d, r14d
je 0x14003955a
mov ecx, dword [rsp + 0x48]
lea edi, [rsi + rcx]
cmp edi, ecx
jl 0x14003955a
cmp edi, r13d
jbe 0x140038ba8
test r13d, r13d
jne 0x140038b75
mov r13d, 0x1000
cmp esi, r13d
cmova r13d, eax
cmp edi, r13d
jbe 0x140038b88
nop word [rax + rax]
add r13d, r13d
cmp edi, r13d
ja 0x140038b80
mov rcx, qword [r12 + 8]
mov edx, r13d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14003955a
mov ecx, dword [rsp + 0x48]
mov qword [r12 + 8], rax
mov edx, ecx
mov r8d, esi
add rdx, qword [r12 + 8]
mov rcx, rbx
call fcn.140030730
test eax, eax
je 0x14003955a
mov dword [rsp + 0x48], edi
jmp 0x14003915b
mov dword [rsp + 0x4c], 1
jmp 0x140038e6a
test r15d, r15d
je 0x14003955a
mov dword [rsp + 0x44], 0
cmp esi, 0xd
jne 0x14003955a
mov rcx, rbx
call fcn.140030800
mov rcx, rbx
mov edi, eax
call fcn.140030800
shl edi, 0x10
add eax, edi
mov dword [rbx], eax
cmp eax, 0x1000000
ja 0x14003955a
mov rcx, rbx
call fcn.140030800
mov rcx, rbx
mov edi, eax
call fcn.140030800
shl edi, 0x10
lea ecx, [rax + rdi]
mov dword [rbx + 4], ecx
cmp ecx, 0x1000000
ja 0x14003955a
mov rax, qword [rbx + 0xb8]
cmp rax, qword [rbx + 0xc0]
jae 0x140038c5c
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140038c82
cmp dword [rbx + 0x30], 0
je 0x140038c80
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140038c82
xor cl, cl
mov rax, rbx
mov edx, 0x30
movzx eax, cl
mov dword [r12 + 0x20], eax
lea rdi, [rdx + rbx]
cmp eax, 0x10
ja 0x14003955a
mov ecx, 0x10116
bt ecx, eax
jae 0x14003955a
mov rax, qword [rbx + 0xb8]
cmp rax, qword [rbx + 0xc0]
jae 0x140038ccc
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140038cf1
cmp dword [rdi], 0
je 0x140038cef
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140038cf1
xor cl, cl
movzx esi, cl
mov dword [rsp + 0x54], esi
cmp esi, 6
ja 0x14003955a
cmp esi, 3
jne 0x140038d19
cmp dword [r12 + 0x20], 0x10
je 0x14003955a
mov byte [rsp + 0x40], sil
jmp 0x140038d23
test sil, 1
jne 0x14003955a
cmp rax, qword [rbx + 0xc0]
jb 0x140038d40
cmp dword [rdi], 0
je 0x140038d55
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
test cl, cl
jne 0x14003955a
cmp rax, qword [rbx + 0xc0]
jb 0x140038d72
cmp dword [rdi], 0
je 0x140038d87
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
test cl, cl
jne 0x14003955a
cmp rax, qword [rbx + 0xc0]
jae 0x140038d9f
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140038dc4
cmp dword [rdi], 0
je 0x140038dc2
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140038dc4
xor cl, cl
movzx r15d, cl
mov dword [rsp + 0x50], r15d
cmp r15d, 1
ja 0x14003955a
mov ecx, dword [rbx]
test ecx, ecx
je 0x14003955a
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x14003955a
xor edx, edx
mov eax, 0x40000000
div ecx
cmp byte [rsp + 0x40], 0
jne 0x140038e2b
xor edx, edx
mov r8d, esi
shr r8d, 2
mov ecx, esi
and ecx, 2
and r8d, 1
or ecx, 1
add r8d, ecx
div r8d
mov dword [rbx + 8], r8d
cmp eax, r9d
jb 0x14003955a
jmp 0x140039156
shr eax, 2
mov dword [rbx + 8], 1
cmp eax, r9d
jb 0x14003955a
jmp 0x140039156
cmp ecx, 0x504c5445
je 0x140038fff
cmp ecx, 0x74524e53
je 0x140038ec5
test r15d, r15d
jne 0x14003955a
bt edx, 0x1d
jae 0x140039533
test esi, esi
jns 0x140038e81
mov rax, qword [rbx + 0xc0]
mov qword [rbx + 0xb8], rax
jmp 0x14003915b
cmp qword [rbx + 0x10], 0
je 0x140038eb6
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xb8]
cmp ecx, esi
jge 0x140038eb6
mov rax, qword [rbx + 0xc0]
sub esi, ecx
mov rcx, qword [rbx + 0x28]
mov edx, esi
mov qword [rbx + 0xb8], rax
call qword [rbx + 0x18]
jmp 0x14003915b
movsxd rax, esi
add qword [rbx + 0xb8], rax
jmp 0x14003915b
test r15d, r15d
jne 0x14003955a
cmp qword [r12 + 8], 0
jne 0x14003955a
cmp byte [rsp + 0x40], r15b
je 0x140038f6e
test r14d, r14d
je 0x14003955a
cmp esi, r14d
ja 0x14003955a
xor edi, edi
mov byte [rsp + 0x40], 4
test esi, esi
je 0x14003915b
nop word [rax + rax]
mov rax, qword [rbx + 0xb8]
cmp rax, qword [rbx + 0xc0]
jae 0x140038f2f
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140038f55
cmp dword [rbx + 0x30], 0
je 0x140038f53
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140038f55
xor dl, dl
lea eax, [rdi*4 + 3]
inc edi
mov byte [rbp + rax + 0xf80], dl
cmp edi, esi
jb 0x140038f10
jmp 0x14003915b
mov ecx, dword [rbx + 8]
test cl, 1
je 0x14003955a
lea eax, [rcx + rcx]
cmp esi, eax
jne 0x14003955a
xor esi, esi
mov byte [rsp + 0x41], 1
cmp dword [r12 + 0x20], 0x10
jne 0x140038fbe
test ecx, ecx
jle 0x14003915b
lea rdi, [rbp + 0xf74]
mov rcx, rbx
call fcn.140030800
inc esi
mov word [rdi], ax
lea rdi, [rdi + 2]
cmp esi, dword [rbx + 8]
jl 0x140038fa3
jmp 0x14003915b
test ecx, ecx
jle 0x14003915b
lea rdi, [rbp + 0xf70]
lea r15, [0x140049290]
mov rcx, rbx
call fcn.140030800
movsxd rcx, dword [r12 + 0x20]
lea rdi, [rdi + 1]
movzx eax, al
inc esi
movzx edx, byte [rcx + r15]
imul eax, edx
mov byte [rdi - 1], al
cmp esi, dword [rbx + 8]
jl 0x140038fd4
jmp 0x140039156
test r15d, r15d
jne 0x14003955a
cmp esi, 0x300
ja 0x14003955a
mov eax, 0xaaaaaaab
mul esi
mov r14d, edx
shr r14d, 1
mov dword [rsp + 0x58], r14d
lea eax, [r14 + r14*2]
cmp eax, esi
jne 0x14003955a
test r14d, r14d
je 0x140039156
lea rdi, [rbx + 0x30]
nop
mov rdx, qword [rbx + 0xb8]
mov rsi, rdi
cmp rdx, qword [rbx + 0xc0]
jae 0x140039062
movzx ecx, byte [rdx]
inc rdx
mov qword [rbx + 0xb8], rdx
jmp 0x140039088
cmp dword [rdi], 0
je 0x140039086
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
lea rdx, [rax + 1]
mov qword [rbx + 0xb8], rdx
jmp 0x140039088
xor cl, cl
lea r14d, [r15*4]
mov byte [rbp + r14 + 0xf80], cl
cmp rdx, qword [rbx + 0xc0]
jae 0x1400390b5
movzx r8d, byte [rdx]
lea rdi, [rbx + 0x30]
inc rdx
mov qword [rbx + 0xb8], rdx
jmp 0x1400390dd
cmp dword [rdi], 0
je 0x1400390da
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx r8d, byte [rax]
lea rdx, [rax + 1]
mov qword [rbx + 0xb8], rdx
jmp 0x1400390dd
xor r8b, r8b
lea eax, [r14 + 1]
mov byte [rbp + rax + 0xf80], r8b
cmp rdx, qword [rbx + 0xc0]
jae 0x140039103
movzx r8d, byte [rdx]
lea rax, [rdx + 1]
mov qword [rbx + 0xb8], rax
jmp 0x14003912d
cmp dword [rsi], 0
mov rdi, rsi
je 0x14003912a
mov rcx, rbx
call fcn.1400306c0
mov rax, qword [rbx + 0xb8]
movzx r8d, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x14003912d
xor r8b, r8b
lea eax, [r14 + 2]
inc r15d
mov byte [rbp + rax + 0xf80], r8b
lea eax, [r14 + 3]
mov r14d, dword [rsp + 0x58]
mov byte [rbp + rax + 0xf80], 0xff
cmp r15d, r14d
jb 0x140039040
mov r15d, dword [rsp + 0x44]
mov rcx, rbx
call fcn.140030800
mov rcx, rbx
call fcn.140030800
jmp 0x140038a70
movsxd rax, dword [rsp + 0x48]
xor r13d, r13d
mov r15d, dword [rsp + 0x4c]
add rax, rdi
mov qword [rsp + 0x78], rax
mov edx, r13d
lea rax, [rsi + rcx]
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x78], rcx
test r15d, r15d
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
sete dl
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x60], 1
call fcn.1400371c0
test eax, eax
je 0x140039522
mov rax, qword [rbp - 0x70]
mov edi, dword [rbp - 0x78]
sub edi, dword [rbp - 0x70]
mov qword [r12 + 0x10], rax
test rax, rax
je 0x14003955a
mov rcx, qword [r12 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx esi, byte [rsp + 0x40]
mov qword [r12 + 8], r13
mov eax, dword [rbx + 8]
lea r9d, [rax + 1]
cmp r9d, 4
jne 0x1400391ff
test sil, sil
je 0x1400392a1
movzx r14d, byte [rsp + 0x41]
test r14b, r14b
jne 0x14003920d
mov r9d, eax
mov eax, dword [rsp + 0x50]
mov r8d, edi
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov rcx, r12
mov dword [rbx + 0xc], r9d
mov eax, dword [r12 + 0x20]
mov rdx, qword [r12 + 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400385d0
test eax, eax
je 0x14003955a
test r14b, r14b
je 0x140039350
mov rcx, qword [r12]
mov eax, dword [rcx + 4]
imul eax, dword [rcx]
cmp dword [r12 + 0x20], 0x10
mov rcx, qword [r12 + 0x18]
jne 0x1400392e7
test eax, eax
je 0x140039350
cmp dword [rbx + 0xc], 2
jne 0x1400392ac
movzx r8d, word [rbp + 0xf74]
mov edx, eax
nop
cmp word [rcx], r8w
lea rcx, [rcx + 4]
mov eax, 0xffff
cmove ax, r13w
mov word [rcx - 2], ax
sub rdx, 1
jne 0x140039280
jmp 0x140039350
movzx r14d, byte [rsp + 0x41]
jmp 0x14003920d
movzx edx, word [rbp + 0xf78]
movzx r8d, word [rbp + 0xf76]
movzx r9d, word [rbp + 0xf74]
cmp word [rcx], r9w
jne 0x1400392db
cmp word [rcx + 2], r8w
jne 0x1400392db
cmp word [rcx + 4], dx
jne 0x1400392db
mov word [rcx + 6], r13w
add rcx, 8
sub rax, 1
jne 0x1400392c3
jmp 0x140039350
test eax, eax
je 0x140039350
cmp dword [rbx + 0xc], 2
jne 0x14003931b
movzx r8d, byte [rbp + 0xf70]
mov edx, eax
nop dword [rax + rax]
cmp byte [rcx], r8b
lea rcx, [rcx + 2]
mov eax, 0xff
cmove eax, r13d
mov byte [rcx - 1], al
sub rdx, 1
jne 0x140039300
jmp 0x140039350
movzx edx, byte [rbp + 0xf72]
movzx r8d, byte [rbp + 0xf71]
movzx r9d, byte [rbp + 0xf70]
cmp byte [rcx], r9b
jne 0x140039346
cmp byte [rcx + 1], r8b
jne 0x140039346
cmp byte [rcx + 2], dl
jne 0x140039346
mov byte [rcx + 3], r13b
add rcx, 4
sub rax, 1
jne 0x140039332
test r15d, r15d
je 0x14003944a
cmp dword [0x140052980], r13d
je 0x14003944a
cmp dword [rbx + 0xc], 2
jle 0x14003944a
mov rax, qword [r12]
mov r10, qword [r12 + 0x18]
mov ecx, dword [rax + 4]
imul ecx, dword [rax]
test ecx, ecx
je 0x14003944a
cmp dword [rax + 0xc], 3
jne 0x1400393af
mov edx, ecx
nop
movzx ecx, byte [r10]
movzx eax, byte [r10 + 2]
mov byte [r10], al
mov byte [r10 + 2], cl
lea r10, [r10 + 3]
sub rdx, 1
jne 0x140039390
jmp 0x14003944a
cmp dword [0x140052988], r13d
je 0x14003942a
mov edi, ecx
nop word [rax + rax]
movzx eax, byte [r10 + 3]
movzx r11d, byte [r10]
movzx ecx, byte [r10 + 2]
test al, al
je 0x140039414
mov r8d, eax
mov r9d, eax
movzx eax, byte [r10 + 1]
xor edx, edx
imul eax, eax, 0xff
shr r8d, 1
add eax, r8d
div r9d
xor edx, edx
mov byte [r10 + 1], al
imul eax, r11d, 0xff
add eax, r8d
div r9d
xor edx, edx
mov r11d, eax
imul eax, ecx, 0xff
add eax, r8d
div r9d
jmp 0x140039417
movzx eax, cl
mov byte [r10], al
mov byte [r10 + 2], r11b
add r10, 4
sub rdi, 1
jne 0x1400393c0
jmp 0x14003944a
mov edx, ecx
nop dword [rax]
movzx ecx, byte [r10]
movzx eax, byte [r10 + 2]
mov byte [r10], al
mov byte [r10 + 2], cl
lea r10, [r10 + 4]
sub rdx, 1
jne 0x140039430
test sil, sil
je 0x140039503
mov dword [rbx + 0xc], 4
movzx eax, sil
mov dword [rbx + 8], eax
mov rax, qword [r12]
mov rbx, qword [r12 + 0x18]
mov edi, dword [rax + 4]
imul edi, dword [rax]
test edi, edi
js 0x14003955a
lea eax, [rdi*4]
cmp edi, 0x1fffffff
jg 0x14003955a
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14003955a
test edi, edi
je 0x1400394f1
lea r8, [rax + 2]
mov r9d, edi
nop dword [rax + rax]
movzx edx, byte [rbx]
lea r8, [r8 + 4]
lea rbx, [rbx + 1]
movzx eax, byte [rbp + rdx*4 + 0xf80]
mov byte [r8 - 6], al
movzx eax, byte [rbp + rdx*4 + 0xf81]
mov byte [r8 - 5], al
movzx eax, byte [rbp + rdx*4 + 0xf82]
mov byte [r8 - 4], al
movzx eax, byte [rbp + rdx*4 + 0xf83]
mov byte [r8 - 3], al
sub r9, 1
jne 0x1400394b0
mov rcx, qword [r12 + 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r12 + 0x18], rsi
jmp 0x14003950b
test r14b, r14b
je 0x14003950b
inc dword [rbx + 8]
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
mov qword [r12 + 0x10], r13
jmp 0x14003955c
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r12 + 0x10], r13
jmp 0x14003955a
mov eax, edx
mov byte [0x14005204b], dl
shr eax, 0x18
mov byte [str.XXXX_PNG_chunk_not_known], al
mov eax, edx
shr eax, 0x10
mov byte [0x140052049], al
mov eax, edx
shr eax, 8
mov byte [0x14005204a], al
xor eax, eax
mov rcx, qword [rbp + 0x1380]
xor rcx, rsp
call fcn.140040240
lea r11, [rsp + 0x1490]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret