Function at 0x10044850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0xf894], eax
mov edx, 1
shl dx, cl
mov dword [esi + 0xf890], ecx
mov dword [esi + 0xf884], ecx
dec ecx
mov eax, 1
shl eax, cl
push edi
xor edi, edi
dec dx
mov dword [esi + 0xf898], eax
inc eax
mov dword [esi + 0xf89c], eax
mov ax, word [esi + 0xf898]
add ax, 2
mov ecx, esi
mov dword [esi + 0xf88c], edi
mov dword [esi + 0x208], edi
mov dword [esi + 0x204], edi
mov word [esi + 0xf888], dx
mov word [esi + 0xf88a], ax
mov dword [esi + 0xf8a0], edi
call sym.NitroPDFPreviewHandler.dll_protected:_int___thiscall_CxImageGIF::GifNextPixel_void_
mov dword [ebp + 8], eax
xor ecx, ecx
mov eax, 0x138b
add eax, eax
inc ecx
cmp eax, 0x10000
jl 0x100448d3
mov eax, 8
sub eax, ecx
push 0x138b
mov ecx, esi
mov dword [ebp - 4], eax
call sym.NitroPDFPreviewHandler.dll_protected:_void___thiscall_CxImageGIF::cl_hash_long_int_
movzx ecx, word [esi + 0xf898]
push ecx
mov ecx, esi
call sym.NitroPDFPreviewHandler.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
mov ecx, esi
call sym.NitroPDFPreviewHandler.dll_protected:_int___thiscall_CxImageGIF::GifNextPixel_void_
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x10044a24
push ebx
jmp 0x10044923
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
movsx edi, ax
shl edi, cl
mov ebx, eax
shl ebx, 0xc
add ebx, dword [ebp + 8]
xor edi, dword [ebp + 8]
mov ecx, dword [esi + edi*4 + 0x8340]
lea eax, [esi + edi*4 + 0x8340]
cmp ecx, ebx
jne 0x10044958
movzx edx, word [esi + edi*2 + 0xd16c]
mov dword [ebp + 8], edx
jmp 0x10044a10
test ecx, ecx
js 0x10044992
mov ecx, 0x138b
sub ecx, edi
test edi, edi
jne 0x10044970
mov ecx, 1
lea esp, [esp]
lea edx, [ecx*4]
sub eax, edx
sub edi, ecx
jns 0x10044988
add edi, 0x138b
add eax, 0x4e2c
mov edx, dword [eax]
cmp edx, ebx
je 0x100449cc
test edx, edx
jg 0x10044970
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
call sym.NitroPDFPreviewHandler.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
movzx eax, word [esi + 0xf88a]
mov edx, dword [ebp + 0xc]
mov ecx, 0x1000
mov dword [ebp + 8], edx
cmp ax, cx
jge 0x100449d9
mov word [esi + edi*2 + 0xd16c], ax
inc word [esi + 0xf88a]
mov dword [esi + edi*4 + 0x8340], ebx
jmp 0x10044a10
movzx eax, word [esi + edi*2 + 0xd16c]
mov dword [ebp + 8], eax
jmp 0x10044a10
push 0x138b
mov ecx, esi
call sym.NitroPDFPreviewHandler.dll_protected:_void___thiscall_CxImageGIF::cl_hash_long_int_
movzx eax, word [esi + 0xf898]
mov dx, word [esi + 0xf898]
add dx, 2
push eax
mov ecx, esi
mov word [esi + 0xf88a], dx
mov dword [esi + 0xf88c], 1
call sym.NitroPDFPreviewHandler.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
mov ecx, esi
call sym.NitroPDFPreviewHandler.dll_protected:_int___thiscall_CxImageGIF::GifNextPixel_void_
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x10044920
pop ebx
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
call sym.NitroPDFPreviewHandler.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
movzx edx, word [esi + 0xf89c]
push edx
mov ecx, esi
call sym.NitroPDFPreviewHandler.dll_protected:_void___thiscall_CxImageGIF::output_short_int_
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8