Function at 0x643c874c
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ecx, 6
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x165]
mov esi, 0x643eb581
push ebx
sub esp, 0x17c
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x135]
mov esi, str._irb_8bimResInfo_VResolution
mov ecx, 0x1d
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c877e
xor esi, esi
xor ecx, ecx
mov edi, 0x1c
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x135]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x643c8796
xor ecx, ecx
xor esi, esi
xor ebx, ebx
inc ebx
mov edi, str.This_operation_is_not_supported_with_BTT_enabled.
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
lea edx, [eax + esi]
mov byte [ebp - 0x169], al
mov eax, 0x94a
movzx esi, dl
movzx edx, word [edi]
add edi, 2
test dx, dx
je 0x643c881f
add eax, edx
cmp eax, 0x12a7
jbe 0x643c87fa
mov dword [ebp - 0x170], ecx
call fcn.643d3548
mov ecx, dword [ebp - 0x170]
mov al, byte [ebp + esi - 0x118]
mov edx, dword [0x643e82c0]
mov byte [ebp + ebx - 0x118], al
mov al, byte [ebp - 0x169]
imul edi, edx, 0xdc148375
mov byte [ebp + esi - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov dword [0x643e82c0], edi
lea edi, [ebp - 0x14d]
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + ecx - 0x165]
mov byte [ebp + ecx - 0x14d], al
inc ecx
cmp ecx, 0x18
jne 0x643c87d9
imul edx, edx, 0x695ac48
mov byte [ebp - 0x135], 0
or edx, 0xeb6c5b72
mov dword [0x643e82c0], edx
mov dword [esp], 0x4a5
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push eax
mov dword [esp + 4], str.The_operation_has_failed._CSVFS_is_not_in_redirected_mode.
mov eax, dword [0x643e82c0]
mov dword [esp], eax
call fcn.643d2a58
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 4], 0x1500
mov dword [esp], str.82IiVu51bwKHpmWrYmXNysScK4vQzy9cNDnHe_siR99Dx0ecXFrSWVCSkx_Z4tqRKZGuzess7Y4UWZE3uFzPMwBbI3AvnQKfCcuW2adyPBLE90MnqC4b8UVAyn4npyeM_rb5FELB_E0mW5QxeW4BdWhE6CFhYCCUDlekanuzriuTJoyYVpk8Owhx7WCVNMQBFJ07Gj7aIuCMjkThTxtKoXAK4X0OqDA84YcHVVIK_XQzo0vyali4sQTxPzXhdJub_ZsqIEqnXu3X0ZnFaPWMqjZmnHsx9CB1Ekj_Otd35zGrkAIqj80FzYjq7w0WTiG584RNu4nVJ1yWgZHZNX_3AMe8tVAP15U5wRKzfSLQwtQHFTpQL4rb10VIfVucZykaXeQuftpd8xHutjd8BYdqrAu5GuNqK3ddfdBh_1NCaU54g5pG5ZADEdFMCL0b6P8dknLiSCsVDENkpWbeRG6B6fwrpvCQTVnq4m7YqEua90eVPYM_g9CPF_HV11w42uq_L43Q5Pg9MV49J91sbtbqjF9OLqyn0Y_f_bp921jpxaHWVT5Y7rSGXZh58rFpoXSoNb7A2euGqHl3jDJTDwarDlOug3yj_zfFOc_z3i5xYXCdWdO8YYh7qyzTdSRfINAjuTvBRhXgROFrYrQg5QoxZWCu6D2n01fI0kbQURVkDBt_PmCvCXYcqceZpEUnDrF11AlLXZrc48F1zuzA9UJSXVKq3JsKMfLRdE0fl2FWmRQR5oPT07baDTcUWXenBc7DXxDZEeZGA4_Fsog2AU9vKIYSheE7PulTCyEQpxPBjbBNNoh60g4PirINya_hwqMMrULOS7U1dylrcOjFTxauWTuBwiJctShRfEJHaCSTwv_3vfwkaFKoXjVV2Zct3otMOjDCcxQ8rIvLSFfeSY5OoIDedDVZPJtoz_Nx8FLbDvx0De0CTZpaBD5gecrX1NvfxNczgLAXHwTntZPfyuEK4KQD1djlrXMgIdGCRhjBcfk_dUqiVRAGR0hW9WAopx1pNCG3EFymj9vb8nc1wP_hUYggph2c2OMzejnmDhDC6ZU4VYNCxfLGbKSJLgOqsn9sa7fHSsBD3NgqL0qTVhBXen076dszFTvmbaOwbpRHfqbf6_7idiCaoCgsMtMhzr0tAtAmkMDgfp3YeeAQregDtDyHm3_ISGNn14rpcS0TS1Ugk1lQOQR8OLpZzk7FgjyH3CRu5svA7E10UMZhwKhoUyCkyH53QXlYhWI_kPu04QUDiG8IZmGneFEjYvMpNjb1wSAvvNXXAAleJ9CsvDEaHF8haBjEggANcXz7vmUKS9cHRTS5rdOsxQ6Y5qDPYkGDZp5ZNIxnzUaeTa9zHGwVg_C2d2h7iJvywZd0Mw5mbxoxffpnDroCXGq8USK08Fy1_jooOl1drKyb1OyMMGFySMr_XM_4rnVrvTT7ymMzcsqtbbGTsYf2PNaQkqHaFfTeghoZL_q3QMagexsYeJXFkj7qrlN5UL9xvCaFWGTvaVo3ke4rfJrn01XwDeutwpyMfUmZRxRrOeyf16OlPsFYg37KO8LllgTddkpx2JmH0MzqWkSdMgfAflWk_fhidm2PjRdDqqC5CxPieVWwKaXccI6uCB46geXIS_T2t4ZJMSoST1ULH7nBe7LrNZZc9Pke5A658TKYdYUlwjzqVrG3W4ahlq3bfbztPfWA0PgKf6FaCbyDSYQ_PgUuFezvS2Y1EE3uc6F3hNbjujluhbYJABOALFF9HC5Lk_dcdoIuo9sQ_HAQlErOThow8yhJ_eV3O0EcbRGW6a4FYKpCa63O1QLDidcVSmBhHmbs5sEyCbEvPxBPdiTG57knWrvB5ay9VEKp7q07p0M_Ktt1W2puJ509xCL_arXrrqI7ovvlrIIiGEX4d5OZGr2l7eGBo0KPTMM5l0YHaAF8Wnj8_Ywv0Y_F90aRvAUKLoQqf2BefMAEdfydRImOTpnVvwqGX2HyRaRFR0Hjd5OucPtBcU7Gs1nU5goRLGerhCOkvBPIDrZn6LQdJkyGSxRkaucO_H0VwQLk27d9qGkkiYPHHY1PcoZLVIMzcSsM6bD5pO9NDHNS04pHjWH6kScPKx36KdzxBg6uuWnh5Ub5GKmym2fpqPPQOXIRcQgcMXNeVCCi3jivG1UfrGldBO0CZCFiB0PY51ueKXUMRR_fP9j4rOoJ6kguOXsCxSIZsl4BS4BALOf1rc_7Rrrs8XisZxyB91RxJOgAwAXfFg6O3PHmCStBpNfkrENbygJjXHKc9zu7L94Mf9CXgMA5Vso2C1hIvOSo24oNt8yRmbA6yhpZLAh_BlJDwJAc66oUgXYFCAAwxhD_BZgEdBQBrx_E8pFfcTYlaNQWFUluelM59H452GIeZfTwsC1R7PAtkYnrTkmThG_CzX2HLp_074byXiq2s9znCGL9xK0RN6OlNB5q5vei0jqqDBotbYozPXJTX9qwdU0D51QLbpx84AA9l_9tonqf2wxGBOqpANkF_Y2wE_u7Z3Oaw8W0c6s9d9mn0RVftqO_gSaboHl7bjhEjWoQhsa6FTtqLXBEY1aSudsUgn03qCndDg4lTcTIqAS8QG7P2xRaHRf2vsWS6itR9mtWLVvjL_S4pIJgeWVFjdePUcDNrVm3uJCZgOp5dhN6aCD3eAnz4BiTDYqXOzEckDweosN_hTtWkIJSi6fzJkS9TjFRDJ0nq9QHAx6_gsJIcJsOPARqDEC8OZoXBso9b7FGqO6TDYFDt9NJPyZ3ldytPiIuG_EEbjzuORCi9PfzuQwjEGaZ3P5UC3t40C8NbE5Q9Up7Ku2eR1mMl2QWeBTEhpsapfsPJqCjRgyPZ8jTOifUssY7yWM4EwY6DhOwI6Ed1D8vfT2W5dLytpEAoe9PfTqKddSTfkyuFAHg9BGuAUVimYobSwNUN12nuNeXUT6zLojzG4BRf9tpUjE56o2lPuzk4TuUGCsi5dcsKATvbGTrbMk2DFi09mgSE1VRL2K_cBzyHJSxKx7WxPVTNeHs5rSSwRHcylGnFHG2LEZezrd_nvRU0idu43HdRpZz9F45B1t9Uerce_EYfAw8y0odFD_ARna_cetlwDKFjcDi7tcPThMoNqnxVRObiDwGcF3KRhwXPzX9IrLzqYKpi9ln5e2KJksHbF4vWIFEck0sN6za1vtiYaBwsTHd7QcdO_LRsEFpbpeARdRXun9HVaex3879IxbMW9QVYYaB6h2a9LlbuD1xRDovGw0M6MRK0wzxcUfqXYvQyC_OnnoCosGdFc0CYgfn30UJ3ol64bCw8h3KdfD4XiGEVDp3EsEkylsMcxvdyLSUStBYFxxZi5TvSO2NtA4LYIL1BBU6CFIZotprhwmtxsOFN0x6uEiV8vLxqnnlG1ze4EOkIRi2BVDU_I01zeDwGfTGa8DwD4wt5Koq8D3dVtLMZCkHPR3oK45U56OojEUD2zAOqYDFqwZPpIqNgvJoufZZuaTTYTCEoxoQtm5hgWYwwnkyxEuAKLmBhEjAt74HzrEi4j4PdTpiBrYp1Gejz5FisG3cFWrxsqYV0NXeyCD4ms0RC3lGhvjpVrWPtUiTcgeA2MssKbSOTxAx5VuMF5FYz5oLVDrLyjqr10IimgyhrZgpFxoTbN6nyXnmJLWNkppaFUum2C7ecI8YWcQJl0WBrSr7jdxvNw8bJu_TgKDhpec89BrzoemvPGBojejgGGdsHAz8vnuOX9iC5RhIxehka2q2ZvH7iCc4F5WgFZmZNBEM_vKw6KkeBNElnZgCxZVoHnvbQWwGCIyipqDC20Fqjtu7TdeOzb9ulUoAwHkhGXPuFjMni_29HRhNVrlHcAYueoaUsnaV5b0LS1yWmlSZR0YBF303LbvlnP_swgVj3EZx3YLq9utKl633dJSC1JKNByTF9jXhke0gUeC0YqGLkVSx090qJA7bemKiWgZ2LzVaEe_tUNkVY5FmjzP6X5JNfgIyJNx8HEjSLpernYFKCiwj_ZESza1BVSp723p0U6AhjUIavoTUXzNJOMa7m0m
call fcn.643cb468
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret