Function at 0x140047b30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1380]
mov eax, 0x1480
call fcn.1400906b0
sub rsp, rax
mov rax, qword [0x1400b2010]
xor rax, rsp
mov qword [rbp + 0x1370], rax
mov r14, rcx
mov byte [rsp + 0x40], 0
xor ecx, ecx
mov dword [rsp + 0x44], 1
xor r12b, r12b
mov dword [rsp + 0x48], ecx
mov r15d, ecx
mov dword [rsp + 0x4c], ecx
mov rbx, qword [r14]
mov r13d, ecx
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x50], ecx
mov qword [r14 + 0x10], rcx
mov qword [r14 + 8], rcx
mov qword [r14 + 0x18], rcx
mov byte [rsp + 0x41], r12b
mov r12d, ecx
mov rcx, rbx
call fcn.140046650
test eax, eax
je 0x140048695
mov rcx, rbx
call fcn.1400400f0
mov rcx, rbx
mov esi, eax
call fcn.1400400f0
shl esi, 0x10
mov rcx, rbx
add esi, eax
call fcn.1400400f0
mov rcx, rbx
mov edi, eax
call fcn.1400400f0
shl edi, 0x10
lea ecx, [rdi + rax]
cmp ecx, 0x49484452
ja 0x140047f7b
je 0x140047d0c
cmp ecx, 0x43674249
je 0x140047cff
cmp ecx, 0x49444154
je 0x140047c71
cmp ecx, 0x49454e44
jne 0x140047f8f
cmp dword [rsp + 0x44], 0
jne 0x140048695
mov rdi, qword [r14 + 8]
test rdi, rdi
je 0x140048695
mov eax, dword [r14 + 0x20]
imul eax, dword [rbx]
add eax, 7
shr eax, 3
imul eax, dword [rbx + 8]
inc eax
imul eax, dword [rbx + 4]
movsxd rsi, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x1400482a7
mov qword [r14 + 0x10], rax
jmp 0x140048695
cmp dword [rsp + 0x44], 0
jne 0x140048695
cmp byte [rsp + 0x40], 0
je 0x140047c8c
test r12d, r12d
je 0x140048695
mov eax, dword [rsp + 0x48]
lea edi, [rsi + rax]
cmp edi, eax
jl 0x140048695
cmp edi, r15d
jbe 0x140047cdd
test r15d, r15d
jne 0x140047cb7
mov r15d, 0x1000
cmp esi, r15d
cmova r15d, esi
cmp edi, r15d
jbe 0x140047cbf
add r15d, r15d
cmp edi, r15d
ja 0x140047cb7
mov rcx, qword [r14 + 8]
mov edx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x140048695
mov qword [r14 + 8], rax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov r8d, esi
add rdx, qword [r14 + 8]
mov rcx, rbx
call fcn.140040020
test eax, eax
je 0x140048695
mov dword [rsp + 0x48], edi
jmp 0x140048292
mov dword [rsp + 0x50], 1
jmp 0x140047fa4
cmp dword [rsp + 0x44], 0
je 0x140048695
mov dword [rsp + 0x44], 0
cmp esi, 0xd
jne 0x140048695
mov rcx, rbx
call fcn.1400400f0
mov rcx, rbx
mov edi, eax
call fcn.1400400f0
shl edi, 0x10
add eax, edi
mov dword [rbx], eax
cmp eax, 0x1000000
ja 0x140048695
mov rcx, rbx
call fcn.1400400f0
mov rcx, rbx
mov edi, eax
call fcn.1400400f0
shl edi, 0x10
lea ecx, [rax + rdi]
mov dword [rbx + 4], ecx
cmp ecx, 0x1000000
ja 0x140048695
mov rax, qword [rbx + 0xb8]
cmp rax, qword [rbx + 0xc0]
jae 0x140047d92
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140047db8
cmp dword [rbx + 0x30], 0
je 0x140047db6
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140047db8
xor cl, cl
movzx eax, cl
mov dword [r14 + 0x20], eax
cmp eax, 1
je 0x140047ddb
cmp eax, 0x10
ja 0x140048695
mov ecx, 0x10114
bt ecx, eax
jae 0x140048695
mov rax, qword [rbx + 0xb8]
cmp rax, qword [rbx + 0xc0]
jae 0x140047dfa
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140047e20
cmp dword [rbx + 0x30], 0
je 0x140047e1e
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140047e20
xor cl, cl
movzx edi, cl
mov dword [rsp + 0x54], edi
cmp edi, 6
ja 0x140048695
cmp edi, 3
jne 0x140047e4b
cmp dword [r14 + 0x20], 0x10
je 0x140048695
movzx esi, dil
mov byte [rsp + 0x40], dil
jmp 0x140047e5a
test dil, 1
jne 0x140048695
movzx esi, byte [rsp + 0x40]
cmp rax, qword [rbx + 0xc0]
jb 0x140047e78
cmp dword [rbx + 0x30], 0
je 0x140047e8d
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
test cl, cl
jne 0x140048695
cmp rax, qword [rbx + 0xc0]
jb 0x140047eab
cmp dword [rbx + 0x30], 0
je 0x140047ec0
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
test cl, cl
jne 0x140048695
cmp rax, qword [rbx + 0xc0]
jae 0x140047ed8
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140047efe
cmp dword [rbx + 0x30], 0
je 0x140047efc
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140047efe
xor cl, cl
movzx r13d, cl
mov dword [rsp + 0x4c], r13d
cmp r13d, 1
ja 0x140048695
mov ecx, dword [rbx]
test ecx, ecx
je 0x140048695
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x140048695
xor edx, edx
mov eax, 0x40000000
div ecx
test sil, sil
jne 0x140047f63
xor edx, edx
mov r8d, edi
shr r8d, 2
mov ecx, edi
and ecx, 2
and r8d, 1
or ecx, 1
add r8d, ecx
div r8d
mov dword [rbx + 8], r8d
cmp eax, r9d
jb 0x140048695
jmp 0x140048292
shr eax, 2
mov dword [rbx + 8], 1
cmp eax, r9d
jb 0x140048695
jmp 0x140048292
cmp ecx, 0x504c5445
je 0x140048142
cmp ecx, 0x74524e53
je 0x140047fff
cmp dword [rsp + 0x44], 0
jne 0x140048695
bt ecx, 0x1d
jae 0x14004866e
test esi, esi
jns 0x140047fbb
mov rax, qword [rbx + 0xc0]
mov qword [rbx + 0xb8], rax
jmp 0x140048292
cmp qword [rbx + 0x10], 0
je 0x140047ff0
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xb8]
cmp ecx, esi
jge 0x140047ff0
mov rax, qword [rbx + 0xc0]
sub esi, ecx
mov rcx, qword [rbx + 0x28]
mov edx, esi
mov qword [rbx + 0xb8], rax
call qword [rbx + 0x18]
jmp 0x140048292
movsxd rax, esi
add qword [rbx + 0xb8], rax
jmp 0x140048292
cmp dword [rsp + 0x44], 0
jne 0x140048695
cmp qword [r14 + 8], 0
jne 0x140048695
cmp byte [rsp + 0x40], 0
je 0x1400480ae
test r12d, r12d
je 0x140048695
cmp esi, r12d
ja 0x140048695
xor edi, edi
mov byte [rsp + 0x40], 4
test esi, esi
je 0x140048292
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0xb8]
cmp rax, qword [rbx + 0xc0]
jae 0x14004806f
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140048095
cmp dword [rbx + 0x30], 0
je 0x140048093
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140048095
xor dl, dl
lea eax, [rdi*4 + 3]
inc edi
mov byte [rbp + rax + 0xf70], dl
cmp edi, esi
jb 0x140048050
jmp 0x140048292
mov ecx, dword [rbx + 8]
test cl, 1
je 0x140048695
lea eax, [rcx + rcx]
cmp esi, eax
jne 0x140048695
xor esi, esi
mov byte [rsp + 0x41], 1
cmp dword [r14 + 0x20], 0x10
jne 0x1400480fd
test ecx, ecx
jle 0x140048292
lea rdi, [rbp + 0xf64]
mov rcx, rbx
call fcn.1400400f0
inc esi
mov word [rdi], ax
lea rdi, [rdi + 2]
cmp esi, dword [rbx + 8]
jl 0x1400480e2
jmp 0x140048292
test ecx, ecx
jle 0x140048292
lea rdi, [rbp + 0xf60]
lea r13, [0x14009cbd8]
mov rcx, rbx
call fcn.1400400f0
movsxd rcx, dword [r14 + 0x20]
lea rdi, [rdi + 1]
movzx eax, al
inc esi
movzx edx, byte [rcx + r13]
imul eax, edx
mov byte [rdi - 1], al
cmp esi, dword [rbx + 8]
jl 0x140048113
mov r13d, dword [rsp + 0x4c]
jmp 0x140048292
cmp dword [rsp + 0x44], 0
jne 0x140048695
cmp esi, 0x300
ja 0x140048695
mov eax, 0xaaaaaaab
mul esi
mov r12d, edx
shr r12d, 1
lea eax, [r12 + r12*2]
cmp eax, esi
jne 0x140048695
xor esi, esi
test r12d, r12d
je 0x140048292
mov r8, qword [rbx + 0xb8]
mov rdx, qword [rbx + 0xc0]
cmp r8, rdx
jae 0x140048199
movzx ecx, byte [r8]
inc r8
jmp 0x1400481bc
cmp dword [rbx + 0x30], 0
je 0x1400481e2
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
mov rdx, qword [rbx + 0xc0]
movzx ecx, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xb8], r8
lea edi, [rsi*4]
mov byte [rbp + rdi + 0xf70], cl
mov r9d, edi
cmp r8, rdx
jae 0x1400481f4
movzx r9d, byte [r8]
inc r8
jmp 0x140048218
lea edi, [rsi*4]
mov byte [rbp + rdi + 0xf70], 0
mov r9d, edi
cmp dword [rbx + 0x30], 0
je 0x14004823f
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
mov rdx, qword [rbx + 0xc0]
movzx r9d, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xb8], r8
lea eax, [rdi + 1]
mov byte [rbp + rax + 0xf70], r9b
cmp r8, rdx
jae 0x14004824b
movzx edx, byte [r8]
inc r8
mov qword [rbx + 0xb8], r8
jmp 0x140048272
lea eax, [r9 + 1]
mov byte [rbp + rax + 0xf70], 0
cmp dword [rbx + 0x30], 0
je 0x140048270
mov rcx, rbx
call fcn.14003ffb0
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xb8], r8
jmp 0x140048272
xor dl, dl
lea eax, [rdi + 2]
inc esi
mov byte [rbp + rax + 0xf70], dl
lea eax, [rdi + 3]
mov byte [rbp + rax + 0xf70], 0xff
cmp esi, r12d
jb 0x140048184
mov rcx, rbx
call fcn.1400400f0
mov rcx, rbx
call fcn.1400400f0
jmp 0x140047bc0
movsxd rax, dword [rsp + 0x48]
xor r15d, r15d
add rax, rdi
mov qword [rbp - 0x80], rcx
mov qword [rsp + 0x68], rax
mov edx, r15d
lea rax, [rsi + rcx]
mov qword [rsp + 0x78], rcx
mov esi, dword [rsp + 0x50]
lea rcx, [rsp + 0x60]
test esi, esi
mov qword [rsp + 0x60], rdi
mov qword [rbp - 0x78], rax
sete dl
mov dword [rbp - 0x70], 1
call fcn.140046490
test eax, eax
je 0x14004865e
mov rax, qword [rbp - 0x80]
mov edi, dword [rsp + 0x78]
sub edi, dword [rbp - 0x80]
mov qword [r14 + 0x10], rax
test rax, rax
je 0x140048695
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + 8], r15
mov eax, dword [rbx + 8]
movzx r15d, byte [rsp + 0x40]
lea r9d, [rax + 1]
cmp r9d, 4
jne 0x140048334
test r15b, r15b
je 0x1400483d1
movzx r12d, byte [rsp + 0x41]
test r12b, r12b
jne 0x140048342
mov r9d, eax
mov eax, dword [rsp + 0x54]
mov r8d, edi
mov dword [rbx + 0xc], r9d
mov rcx, r14
mov rdx, qword [r14 + 0x10]
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
mov eax, dword [r14 + 0x20]
mov dword [rsp + 0x20], eax
call fcn.140047780
test eax, eax
je 0x140048695
test r12b, r12b
je 0x140048490
mov rcx, qword [r14]
mov eax, dword [rcx + 4]
imul eax, dword [rcx]
cmp dword [r14 + 0x20], 0x10
mov rcx, qword [r14 + 0x18]
jne 0x14004841a
test eax, eax
je 0x140048490
cmp dword [rbx + 0xc], 2
jne 0x1400483dc
movzx r8d, word [rbp + 0xf64]
xor r13d, r13d
mov edx, eax
nop
cmp word [rcx], r8w
lea rcx, [rcx + 4]
mov eax, 0xffff
cmove ax, r13w
mov word [rcx - 2], ax
sub rdx, 1
jne 0x1400483b0
jmp 0x140048493
movzx r12d, byte [rsp + 0x41]
jmp 0x140048342
movzx edx, word [rbp + 0xf68]
movzx r8d, word [rbp + 0xf66]
movzx r9d, word [rbp + 0xf64]
xor r13d, r13d
cmp word [rcx], r9w
jne 0x14004840e
cmp word [rcx + 2], r8w
jne 0x14004840e
cmp word [rcx + 4], dx
jne 0x14004840e
mov word [rcx + 6], r13w
add rcx, 8
sub rax, 1
jne 0x1400483f3
jmp 0x140048493
test eax, eax
je 0x140048490
cmp dword [rbx + 0xc], 2
jne 0x14004845b
movzx r8d, byte [rbp + 0xf60]
xor r13d, r13d
mov edx, eax
nop dword [rax]
nop word [rax + rax]
cmp byte [rcx], r8b
lea rcx, [rcx + 2]
mov eax, 0xff
cmove eax, r13d
mov byte [rcx - 1], al
sub rdx, 1
jne 0x140048440
jmp 0x140048493
movzx edx, byte [rbp + 0xf62]
movzx r8d, byte [rbp + 0xf61]
movzx r9d, byte [rbp + 0xf60]
cmp byte [rcx], r9b
jne 0x140048486
cmp byte [rcx + 1], r8b
jne 0x140048486
cmp byte [rcx + 2], dl
jne 0x140048486
mov byte [rcx + 3], 0
add rcx, 4
sub rax, 1
jne 0x140048472
xor r13d, r13d
test esi, esi
je 0x14004858a
cmp dword [0x1400b2e3c], 0
je 0x14004858a
cmp dword [rbx + 0xc], 2
jle 0x14004858a
mov rax, qword [r14]
mov r10, qword [r14 + 0x18]
mov ecx, dword [rax + 4]
imul ecx, dword [rax]
test ecx, ecx
je 0x14004858a
cmp dword [rax + 0xc], 3
jne 0x1400484ef
mov edx, ecx
nop
movzx ecx, byte [r10]
movzx eax, byte [r10 + 2]
mov byte [r10], al
mov byte [r10 + 2], cl
lea r10, [r10 + 3]
sub rdx, 1
jne 0x1400484d0
jmp 0x14004858a
cmp dword [0x1400b2e38], 0
je 0x14004856e
mov esi, ecx
nop word [rax + rax]
movzx eax, byte [r10 + 3]
movzx ecx, byte [r10]
movzx edi, byte [r10 + 2]
test al, al
je 0x140048553
mov r8d, eax
mov r9d, eax
movzx eax, byte [r10 + 1]
xor edx, edx
imul eax, eax, 0xff
shr r8d, 1
add eax, r8d
div r9d
xor edx, edx
mov byte [r10 + 1], al
imul eax, ecx, 0xff
add eax, r8d
div r9d
xor edx, edx
mov r11d, eax
imul eax, edi, 0xff
add eax, r8d
div r9d
jmp 0x14004855b
movzx r11d, cl
movzx eax, dil
mov byte [r10], al
mov byte [r10 + 2], r11b
add r10, 4
sub rsi, 1
jne 0x140048500
jmp 0x14004858a
mov edx, ecx
movzx ecx, byte [r10]
movzx eax, byte [r10 + 2]
mov byte [r10], al
mov byte [r10 + 2], cl
lea r10, [r10 + 4]
sub rdx, 1
jne 0x140048570
test r15b, r15b
je 0x140048641
mov dword [rbx + 0xc], 4
movzx eax, r15b
mov dword [rbx + 8], eax
mov rax, qword [r14]
mov rbx, qword [r14 + 0x18]
mov edi, dword [rax + 4]
imul edi, dword [rax]
test edi, edi
js 0x140048695
cmp edi, 0x1fffffff
jg 0x140048695
lea eax, [rdi*4]
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140048695
test edi, edi
je 0x140048631
lea r8, [rax + 2]
mov r9d, edi
nop dword [rax]
movzx edx, byte [rbx]
lea r8, [r8 + 4]
lea rbx, [rbx + 1]
movzx eax, byte [rbp + rdx*4 + 0xf70]
mov byte [r8 - 6], al
movzx eax, byte [rbp + rdx*4 + 0xf71]
mov byte [r8 - 5], al
movzx eax, byte [rbp + rdx*4 + 0xf72]
mov byte [r8 - 4], al
movzx eax, byte [rbp + rdx*4 + 0xf73]
mov byte [r8 - 3], al
sub r9, 1
jne 0x1400485f0
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + 0x18], rsi
jmp 0x140048649
test r12b, r12b
je 0x140048649
inc dword [rbx + 8]
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
mov qword [r14 + 0x10], r13
jmp 0x140048697
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + 0x10], r15
jmp 0x140048695
mov eax, ecx
mov byte [0x1400b22eb], cl
shr eax, 0x18
mov byte [str.XXXX_PNG_chunk_not_known], al
mov eax, ecx
shr eax, 0x10
mov byte [0x1400b22e9], al
mov eax, ecx
shr eax, 8
mov byte [0x1400b22ea], al
xor eax, eax
mov rcx, qword [rbp + 0x1370]
xor rcx, rsp
call fcn.14008f590
lea r11, [rsp + 0x1480]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret