Function at 0x49fd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r10b, pe_nt_image_headers64
cmp byte [rcx + 0x10], 0x80
mov r8b, pe_nt_image_headers64
je 0x49fdbc
mov r8d, dword [rcx + 0x10]
mov r9d, dword [rcx + 0x14]
shl r9, 0x20
or r9, r8
movabs rax, 0xffffffffff00
and rax, r9
shr rax, 8
cmp byte [rcx + 0x16], 0x80
je 0x49fde3
mov r10d, dword [rcx + 0x16]
movzx r9d, word [rcx + 0x1a]
shl r9, 0x20
or r9, r10
movabs r11, 0xffffffffff00
and r11, r9
shr r11, 8
mov r13, qword [rcx]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x48], r8b
mov dword [rsp + 0x49], eax
mov rcx, rax
shr rcx, 0x20
mov byte [rsp + 0x4d], cl
mov qword [rsp + 0x60], r10
mov byte [rsp + 0x4e], r10b
mov dword [rsp + 0x4f], r11d
mov qword [rsp + 0x58], r11
mov r9, r11
shr r9, 0x20
mov byte [rsp + 0x53], r9b
mov rsi, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
mov qword [rsp + 0x28], rdx
cmp r8b, 0x80
jne 0x49ffde
test r13, r13
je 0x49ffcc
cmp r13, qword [rsp + 0x30]
je 0x49ffcc
mov rax, qword [rsp + 0x28]
mov rdi, qword [rax + 0x20]
nop word [rax + rax]
movzx eax, byte [r13]
mov r12b, 1
lea ecx, [rax - 9]
cmp ecx, 0x1e
ja case.default.0x49fe8e
mov ebx, 0x745c
xor r14d, r14d
lea rdx, [0x004a0148]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
xor ebp, ebp
mov r15d, 2
jmp rcx
mov ebx, 0x6e5c
jmp 0x49fefd
cmp eax, 0x5c
jne case.0x49fe8e.11
mov ebx, 0x5c5c
xor r14d, r14d
xor ebp, ebp
mov r15d, 2
jmp case.0x49fe8e.9
cmp al, 0x80
mov ecx, pe_nt_image_headers64
cmovb ecx, eax
test al, al
js 0x49ff91
cmp al, 0x20
jb 0x49ff91
cmp al, 0x7f
je 0x49ff91
movzx ebx, cl
mov r15d, 1
mov r14b, 1
xor r12d, r12d
jmp 0x49ff00
mov ebx, 0x725c
jmp 0x49fefd
mov ebx, 0x225c
jmp 0x49fefd
mov ebx, 0x275c
xor r14d, r14d
xor ebp, ebp
movzx edx, bl
mov rcx, rsi
call rdi
mov ecx, eax
xor cl, 1
movzx ecx, cl
test r14b, r14b
jne 0x49ff78
test al, al
jne 0x49ff78
movzx edx, bh
mov rcx, rsi
call rdi
or r12b, al
je 0x49ff40
movzx eax, al
mov ecx, 2
jmp 0x49ff75
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov rcx, rsi
call rdi
mov ecx, 2
test al, al
jne 0x49ff78
shr ebx, 0x18
mov rcx, rsi
mov edx, ebx
call rdi
or bpl, al
cmp bpl, 1
jne 0x4a012e
movzx eax, al
mov ecx, 4
sub rcx, rax
cmp rcx, r15
jb 0x4a0105
inc r13
cmp r13, qword [rsp + 0x30]
jne 0x49fe60
jmp 0x49ffcc
mov ecx, eax
and ecx, 0xf
shr rax, 4
lea rdx, [0x004dc7d4]
movzx eax, byte [rax + rdx]
movzx ecx, byte [rcx + rdx]
shl ecx, 0x18
shl eax, 0x10
lea ebx, [rax + rcx]
add ebx, 0x785c
mov r15d, 4
mov bpl, 1
xor r14d, r14d
xor r12d, r12d
jmp case.0x49fe8e.9
cmp byte [rsp + 0x60], 0x80
jne 0x4a006c
xor eax, eax
jmp 0x4a0107
movzx ebx, cl
shr rax, 0x18
movzx r14d, al
cmp bl, r14b
mov rcx, rax
cmova rcx, rbx
movzx r15d, cl
cmp r14b, 5
mov ecx, 4
cmovae ecx, eax
movzx edi, cl
lea r12, [r14 - 1]
mov rbp, rdi
neg rbp
inc r14b
neg r15
nop word cs:[rax + rax]
lea rax, [r15 + r12]
cmp rax, 0xffffffffffffffff
je 0x49fe3a
lea rax, [r12 + rbp]
mov byte [rsp + 0x4c], r14b
cmp rax, 0xffffffffffffffff
je 0x4a0118
movzx edx, byte [rsp + r12 + 0x49]
mov rcx, rsi
mov rax, qword [rsp + 0x28]
call qword [rax + 0x20]
inc r12
inc r14b
test al, al
je 0x4a0020
mov al, 1
cmp r12, rbx
jae 0x49fe3a
jmp 0x4a0107
movabs rax, 0xffffffffff
mov rcx, qword [rsp + 0x58]
and rcx, rax
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x18
movzx r14d, cl
movzx eax, bl
movzx ecx, r14b
cmp al, r14b
cmovbe eax, ecx
movzx r15d, al
cmp r14b, 5
mov eax, 4
cmovae eax, ecx
movzx edi, al
lea r12, [r14 - 1]
mov r13, rdi
neg r13
inc r14b
neg r15
nop dword [rax]
lea rax, [r15 + r12]
cmp rax, 0xffffffffffffffff
je 0x49ffd7
lea rax, [r12 + r13]
mov byte [rsp + 0x52], r14b
cmp rax, 0xffffffffffffffff
je 0x4a0118
movzx edx, byte [rsp + r12 + 0x4f]
mov rcx, rsi
mov rax, qword [rsp + 0x28]
call qword [rax + 0x20]
inc r12
inc r14b
test al, al
je 0x4a00c0
mov al, 1
cmp r12, rbx
jae 0x49ffd7
jmp 0x4a0107
mov al, 1
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x004dc838]
mov edx, 4
mov rcx, rdi
call dbg.panic_bounds_check
ud2
lea r8, [0x004dc838]
mov ecx, 4
mov edx, 4
call dbg.panic_bounds_check
ud2