Function at 0x140002899
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
sub rsp, 0x5a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x540], rcx
mov qword [rbp + 0x3b8], 0
lea rax, str.C:WindowsSYSTEM32_ntdll.dll
mov qword [rbp + 0x430], rax
mov dword [rbp + 0x42c], 0x60
mov eax, dword [rbp + 0x42c]
mov rax, qword gs:[rax]
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x418], rax
mov dword [rbp + 0x414], 0
mov rax, qword [rbp + 0x418]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x408], rax
mov rax, qword [rbp + 0x408]
imul eax, eax, 0x123881
mov dword [rbp + 0x414], eax
mov rax, qword [rbp + 0x408]
add rax, 0x20
mov qword [rbp + 0x400], rax
mov rax, qword [rbp + 0x400]
mov rax, qword [rax]
mov qword [rbp + 0x3f8], rax
mov rax, qword [rbp + 0x3f8]
movsxd rdx, eax
imul rdx, rdx, 0x38e38e39
shr rdx, 0x20
sar edx, 2
sar eax, 0x1f
sub eax, edx
add dword [rbp + 0x414], eax
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x41
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x1b0]
mov eax, 0
mov ecx, 0x41
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [rbp + 0x3f8]
mov qword [rbp + 0x3f0], rax
jmp 0x140002a62
mov rax, qword [rbp + 0x3f0]
sub rax, 0x10
mov qword [rbp + 0x3e8], rax
mov rax, qword [rbp + 0x3e8]
sub eax, 0x41223
add dword [rbp + 0x414], eax
mov rax, qword [rbp + 0x3e8]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x3e0], rax
mov rax, qword [rbp + 0x430]
mov qword [rbp + 0x3d8], rax
jmp 0x1400029fc
add qword [rbp + 0x3e0], 2
add qword [rbp + 0x3d8], 2
mov rax, qword [rbp + 0x3e0]
movzx edx, word [rax]
mov rax, qword [rbp + 0x3d8]
movzx eax, word [rax]
cmp dx, ax
jne 0x140002a24
mov rax, qword [rbp + 0x3e0]
movzx eax, word [rax]
test ax, ax
jne 0x1400029ec
mov rax, qword [rbp + 0x3e0]
movzx eax, word [rax]
movzx edx, ax
mov rax, qword [rbp + 0x3d8]
movzx eax, word [rax]
movzx eax, ax
sub edx, eax
test edx, edx
jne 0x140002a51
mov rax, qword [rbp + 0x3e8]
mov r8, qword [rax + 0x30]
jmp 0x140002a77
mov rax, qword [rbp + 0x3f0]
mov rax, qword [rax]
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp + 0x400]
cmp rax, qword [rbp + 0x3f0]
jne 0x1400029a6
nop
mov qword [rbp + 0x518], r8
mov rax, qword [rbp + 0x518]
xor eax, dword [rbp + 0x514]
mov edx, dword [rbp + 0x514]
imul eax, edx
mov dword [rbp + 0x514], eax
mov rax, qword [rbp + 0x518]
mov qword [rbp + 0x490], rax
lea rax, str.RtlInitUnicodeString
mov qword [rbp + 0x488], rax
mov dword [rbp + 0x484], 0
mov rax, qword [rbp + 0x490]
mov qword [rbp + 0x478], rax
mov rax, qword [rbp + 0x478]
imul eax, eax, 0x123881
mov dword [rbp + 0x484], eax
mov rax, qword [rbp + 0x478]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x490]
add rax, rdx
mov qword [rbp + 0x470], rax
mov rax, qword [rbp + 0x470]
movsxd rdx, eax
imul rdx, rdx, 0x38e38e39
shr rdx, 0x20
sar edx, 2
sar eax, 0x1f
sub eax, edx
add dword [rbp + 0x484], eax
mov rax, qword [rbp + 0x470]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x490]
add rax, rdx
mov qword [rbp + 0x468], rax
mov rax, qword [rbp + 0x468]
sub eax, 0x41223
add dword [rbp + 0x484], eax
mov rax, qword [rbp + 0x468]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x490]
add rax, rdx
mov qword [rbp + 0x460], rax
mov rax, qword [rbp + 0x468]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x490]
add rax, rdx
mov qword [rbp + 0x458], rax
mov rax, qword [rbp + 0x468]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x490]
add rax, rdx
mov qword [rbp + 0x450], rax
mov dword [rbp + 0x44c], 0
jmp 0x140002cb3
call fcn.14000237d
invalid
mov rax, qword [rbp + 0x468]
mov eax, dword [rax + 0x18]
cmp dword [rbp + 0x44c], eax
jb 0x140002bba
mov eax, 0
mov qword [rbp + 0x508], rax
mov rdx, qword [rbp + 0x540]
lea rax, [rbp + 0x3c0]
mov r8, qword [rbp + 0x508]
mov rcx, rax
call r8
call fcn.14000237d
invalid