Function at 0x1001fc75
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
push edi
test esi, esi
jne 0x1001fc8f
xor eax, eax
jmp 0x1002006f
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, 0x88
je 0x1001fcb7
cmp edi, 0x86
je 0x1001fcb7
cmp edi, 0x81
je 0x1001fcb7
mov byte [ebp + 0xb], bl
cmp edi, 0x80
jne 0x1001fcbb
mov byte [ebp + 0xb], 1
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.10091cb5
mov eax, 0x1014e2b4
push eax
mov dword [ebp - 0x24], eax
call fcn.1000534d
mov dword [ebp - 0x20], eax
mov eax, 0x1014e59c
push eax
mov dword [ebp - 0x1c], eax
call fcn.1000534d
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10014e51
cmp edi, 2
mov ecx, esi
sete al
movzx eax, al
push eax
push ebx
push ebx
call fcn.10091d5c
movzx eax, al
mov ecx, esi
push eax
call fcn.10091d6f
movzx eax, al
mov ecx, esi
push eax
call fcn.10091d4a
movzx eax, al
push eax
call fcn.10020778
push 0x14
mov dword [ebp - 0x20], eax
call fcn.10126fbc
add esp, 0x1c
test eax, eax
je 0x1001fd4b
mov ecx, eax
call fcn.1001ed49
mov ebx, eax
mov dword [ebp - 8], eax
jmp 0x1001fd4e
mov dword [ebp - 8], ebx
push str.Font
lea ecx, [ebp - 0x18]
call fcn.100139c3
push str.Type
lea ecx, [ebp - 0x14]
call fcn.100139c3
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1001f4dd
lea ecx, [ebp - 0x14]
call fcn.10013aa3
lea ecx, [ebp - 0x18]
call fcn.10013aa3
push 8
call fcn.10126fbc
pop ecx
test eax, eax
je 0x1001fd9d
push esi
mov ecx, eax
call fcn.100ab580
jmp 0x1001fd9f
xor eax, eax
cmp byte [ebp + 0xb], 0
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
jne 0x1001feef
push 0x18
call fcn.10126fbc
pop ecx
test eax, eax
je 0x1001fdc9
mov ecx, eax
call fcn.10022930
mov edi, eax
mov dword [ebp + 8], eax
jmp 0x1001fdce
xor edi, edi
mov dword [ebp + 8], edi
push 0x20
pop ebx
mov ecx, dword [ebp - 4]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
push eax
mov ecx, esi
call fcn.10091ce9
push eax
mov ecx, edi
call fcn.100229d0
inc ebx
cmp ebx, 0x80
jl 0x1001fdd1
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 8]
test edi, edi
je 0x1001fe56
cmp edi, 1
je 0x1001fe56
cmp edi, 2
je 0x1001fe56
push ebx
push edi
mov edi, dword [ebp - 0xc]
mov ecx, edi
call fcn.100205d7
cmp eax, 8
jae 0x1001febf
mov eax, dword [eax*8 + 0x1014fbe4]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 4]
movzx eax, word [eax + ebx*2]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
push eax
mov ecx, esi
call fcn.10091ce9
push eax
mov ecx, edi
call fcn.100229d0
mov eax, dword [ebp + 0xc]
inc ebx
cmp ebx, 0x80
jl 0x1001fe2b
jmp 0x1001feb9
push str.WinAnsiEncoding
lea ecx, [ebp + 0x10]
call fcn.100139c3
push str.Encoding
lea ecx, [ebp + 0xc]
call fcn.100139c3
lea eax, [ebp + 0x10]
mov ecx, ebx
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.1001f4dd
lea ecx, [ebp + 0xc]
call fcn.10013aa3
lea ecx, [ebp + 0x10]
call fcn.10013aa3
mov ebx, dword [ebp + 8]
mov edi, 0x80
mov ecx, dword [ebp - 4]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
push eax
mov ecx, esi
call fcn.10091ce9
push eax
mov ecx, ebx
call fcn.100229d0
inc edi
cmp edi, 0xff
jle 0x1001fe97
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push ecx
mov ecx, esp
push eax
call fcn.10015ff4
mov ecx, esi
call fcn.10091d6f
movzx eax, al
mov ecx, esi
push eax
call fcn.10091d4a
movzx eax, al
push eax
push ebx
call fcn.10021875
add esp, 0x14
jmp 0x1001ff24
sub esp, 0x28
lea ecx, [ebp - 4]
mov eax, esp
push ecx
mov dword [eax], 0x1014fe14
mov dword [eax + 8], ecx
mov ecx, esp
mov dword [eax + 4], esi
mov dword [eax + 0x24], eax
lea eax, [ebp - 0x10]
push eax
call fcn.10015ff4
push dword [ebp + 0x10]
push edi
mov edi, dword [ebp - 0xc]
mov ecx, edi
push ebx
call fcn.1002198a
mov dword [ebp - 0x18], eax
push ebx
mov ecx, edi
call fcn.100223c7
mov eax, dword [esi + 8]
test eax, eax
je 0x1001ff3b
mov edi, dword [eax + 0x10]
mov dword [ebp + 8], edi
jmp 0x1001ff3f
and dword [ebp + 8], 0
lea eax, [ebp - 0x34]
xorps xmm0, xmm0
push eax
mov ecx, esi
movups xmmword [ebp - 0x34], xmm0
call fcn.10091bf9
push 0x18
call fcn.10126fbc
pop ecx
test eax, eax
je 0x1001ff6b
mov ecx, eax
call fcn.10022930
mov edi, eax
mov dword [ebp + 0xc], eax
jmp 0x1001ff70
xor edi, edi
mov dword [ebp + 0xc], edi
push dword [ebp - 0x34]
mov ecx, edi
call fcn.100229d0
push dword [ebp - 0x28]
mov ecx, edi
call fcn.100229d0
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.100229d0
push dword [ebp - 0x30]
mov ecx, edi
call fcn.100229d0
mov eax, dword [esi + 8]
test eax, eax
je 0x1001ffac
mov eax, dword [eax + 0xc]
push 5
cdq
pop ecx
idiv ecx
mov edi, eax
jmp 0x1001ffed
mov ecx, dword [ebp - 4]
push 0x69
mov eax, dword [ecx]
call dword [eax + 4]
push eax
mov ecx, esi
call fcn.10091ce9
xor ebx, ebx
mov edi, eax
inc ebx
mov ecx, dword [ebp - 4]
movsx eax, byte [ebx + str.iI_1CapHeight]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
push eax
mov ecx, esi
call fcn.10091ce9
test eax, eax
jle 0x1001ffe4
cmp eax, edi
cmovl edi, eax
inc ebx
cmp ebx, 4
jb 0x1001ffc3
mov ebx, dword [ebp - 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.10091c72
push eax
mov ecx, esi
call fcn.10091bdb
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [ebp - 0x20]
push ecx
mov ecx, esp
push eax
call fcn.10015ff4
call fcn.100207c8
add esp, 0x1c
lea ecx, [ebp + 0xc]
mov esi, eax
push str.FontDescriptor
call fcn.100139c3
push esi
mov esi, dword [ebp - 0xc]
mov ecx, esi
call fcn.100223c7
mov ecx, dword [ebp - 0x18]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
call fcn.1001f5c2
lea ecx, [ebp + 0xc]
call fcn.10013aa3
mov ecx, dword [esi + 0x28]
push 0
push ebx
call fcn.10038b7f
mov ecx, dword [ebp - 4]
mov esi, eax
test ecx, ecx
je 0x10020065
mov edx, dword [ecx]
push 1
call dword [edx]
lea ecx, [ebp - 0x10]
call fcn.10013aa3
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc