Function at 0x4872d0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x20], r9w
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0x128
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdi, qword [rcx + 0x18]
xor r11d, r11d
mov qword [rsp + 0x78], rax
mov rax, qword [rax]
mov rsi, r8
cmp byte [rax + 0x50], r11b
mov dword [rsp + 0x50], r11d
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], r11
je 0x487332
lea eax, [r11 + 7]
jmp 0x487b44
test byte [rdi + 0x28], 0x20
je 0x487340
mov r9d, Ordinal_27
jmp 0x48735a
cmp dword [r8 + 0x58], r11d
jle 0x487354
test byte [rdx + 0x3c], 8
jne 0x487354
mov r9d, 0xbf
jmp 0x48735a
mov r9d, 0x3f
test byte [r8 + 0x64], 4
je 0x487365
and r9d, 0xffffffc3
movzx eax, word [rdi + 0x18]
mov r8, qword [r8 + 8]
mov r10d, dword [rdx + 0x48]
mov qword [rsp + 0x120], rbx
movsx rbx, word [r8 + rax*2]
mov rax, qword [rcx + 8]
test ebx, ebx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x118], rbp
js 0x4873f5
mov rax, qword [rsi + 0x18]
lea rdx, [rbx + rbx*2]
mov rcx, qword [rax + 8]
add rdx, rdx
movzx eax, byte [rcx + rdx*8 + 0x29]
mov ecx, r11d
mov byte [rsp + 0x98], al
movsx eax, word [r8]
cmp eax, ebx
je 0x4873db
movzx edx, word [rsi + 0x60]
cmp ecx, edx
jg 0x4873f0
movsx eax, word [r8 + 2]
add r8, 2
inc ecx
cmp eax, ebx
jne 0x4873c8
mov rax, qword [rsi + 0x40]
movsxd rcx, ecx
mov rcx, qword [rax + rcx*8]
mov qword [rsp + 0x90], rcx
jmp 0x487405
mov rbp, r11
jmp 0x487444
mov byte [rsp + 0x98], r11b
mov qword [rsp + 0x90], r11
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x9c], r9d
mov dword [rsp + 0xa0], r11d
mov dword [rsp + 0xa4], r10d
mov dword [rsp + 0xa8], ebx
mov byte [rsp + 0x99], 2
mov byte [rsp + 0x9a], 2
call fcn.00485ac0
mov rbp, rax
mov eax, dword [rdi + 0x28]
movzx r9d, word [rdi + 0x18]
movzx r8d, word [rdi + 0x1a]
movzx r11d, word [rdi + 0x2c]
mov dword [rsp + 0x5c], eax
mov rax, qword [rdi]
mov qword [rsp + 0x70], rax
movzx eax, word [rdi + 0x16]
mov word [rdi + 0x12], 0
mov rdx, qword [rsi + 0x10]
mov word [rsp + 0x36], ax
mov word [rsp + 0x38], r9w
movzx eax, word [rdx]
mov word [rsp + 0x56], r8w
mov word [rsp + 0x34], r11w
cmp ax, 0xa
mov word [rsp + 0x58], ax
lea r10, [0x00400000]
jg 0x4874a9
xor ax, ax
mov word [rsp + 0x54], ax
jmp 0x487529
movsx rax, ax
mov cx, Ordinal_41
cmp rax, 8
jae 0x4874d1
cmp rax, 2
jae 0x4874c2
xor ax, ax
jmp 0x487520
add rax, rax
add cx, 0xfff6
cmp rax, 8
jb 0x4874c2
jmp 0x48750d
cmp rax, 0xff
jbe 0x4874f0
nop
nop
shr rax, 4
add cx, 0x28
cmp rax, 0xff
ja 0x4874e0
cmp rax, 0xf
jbe 0x48750d
nop
nop
nop
shr rax, 1
add cx, 0xa
cmp rax, 0xf
ja 0x487500
and eax, 7
movzx eax, word [r10 + rax*2 + 0x32d468]
add ax, cx
sub ax, 0xa
sub ax, 0x21
mov word [rsp + 0x54], ax
cmp r9w, r8w
jne 0x487637
movzx eax, word [rsi + 0x5e]
movzx ecx, r9w
inc ecx
cmp ecx, eax
jge 0x48762d
movzx esi, r9w
cmp word [rdx + rsi*2 + 2], 0x2a
jl 0x487623
movzx r8d, word [rdi + 0x2c]
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
inc r8d
call fcn.0044bf00
test eax, eax
mov dword [rsp + 0x50], eax
jne 0x48760d
inc word [rdi + 0x18]
inc word [rdi + 0x1a]
movzx edx, word [rdi + 0x2c]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rsp + 0x140]
mov qword [rcx + rdx*8], 0
inc word [rdi + 0x2c]
or dword [rdi + 0x28], 0x8000
mov rcx, qword [rax + 0x10]
movzx r9d, word [rcx + rsi*2]
sub r9w, word [rcx + rsi*2 + 2]
test rbp, rbp
je 0x4875ba
add r9w, 0xa
sub word [rdi + 0x16], r9w
add r9w, word [rsp + 0x148]
mov rsi, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
add r9w, 5
mov r8, rax
mov rdx, rsi
call fcn.004872d0
mov ax, word [rsp + 0x36]
mov r9w, word [rsp + 0x38]
mov r11w, word [rsp + 0x34]
mov word [rdi + 0x16], ax
mov ax, word [rsp + 0x56]
mov word [rdi + 0x1a], ax
mov word [rdi + 0x18], r9w
jmp 0x48763f
mov rsi, qword [rsp + 0x138]
mov r9w, word [rsp + 0x38]
mov r11w, word [rsp + 0x34]
jmp 0x48763f
mov rsi, qword [rsp + 0x138]
jmp 0x48763f
mov rsi, qword [rsp + 0x138]
jmp 0x48763f
mov rsi, qword [rsp + 0x138]
mov r10, rbx
mov qword [rsp + 0x68], rbx
mov ebx, dword [rsp + 0x50]
test ebx, ebx
jne 0x487aff
test rbp, rbp
je 0x487aff
movzx r8d, word [rbp + 0x1a]
mov dword [rsp + 0x30], 0
cmp r8w, 0x80
mov word [rsp + 0x5a], r8w
jne 0x48769a
test r10, r10
js 0x487ac8
mov rax, qword [rsi + 0x20]
lea rcx, [r10 + r10*2]
mov rax, qword [rax + 8]
add rcx, rcx
cmp byte [rax + rcx*8 + 0x28], 0
jne 0x487ac8
mov rax, qword [rdi + 8]
test qword [rbp + 0x28], rax
jne 0x487ac8
mov eax, dword [rsp + 0x5c]
movzx ecx, r11w
mov word [rdi + 0x18], r9w
mov dword [rdi + 0x28], eax
movzx eax, word [rdi + 0x2e]
inc ecx
cmp eax, ecx
mov word [rdi + 0x2c], r11w
jge 0x487729
lea esi, [rcx + 7]
mov rcx, qword [rsp + 0x60]
and esi, 0xfffffff8
movsxd rdx, esi
shl rdx, 3
call fcn.0043b030
test rax, rax
mov rbx, rax
je 0x487afb
movzx r8d, word [rdi + 0x2e]
mov rdx, qword [rdi + 0x30]
mov rcx, rax
shl r8, 3
call sub.msvcrt.dll_memcpy
mov rdx, qword [rdi + 0x30]
lea rcx, [rdi + 0x40]
cmp rdx, rcx
je 0x487716
mov rcx, qword [rsp + 0x60]
call fcn.00425ea0
mov r8w, word [rsp + 0x5a]
mov r10, qword [rsp + 0x68]
mov qword [rdi + 0x30], rbx
mov word [rdi + 0x2e], si
movzx ecx, word [rdi + 0x2c]
mov rax, qword [rdi + 0x30]
mov qword [rax + rcx*8], rbp
inc word [rdi + 0x2c]
mov rcx, qword [rsp + 0x70]
or rcx, qword [rbp + 0x28]
mov rax, qword [rdi + 8]
not rax
and rcx, rax
test r8b, 1
mov qword [rdi], rcx
je 0x4877aa
mov rax, qword [rbp]
or dword [rdi + 0x28], 4
bt dword [rax + 4], 0xb
jae 0x487778
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov esi, reloc.WLDAP32.dll_Ordinal_46
jmp 0x4878d4
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x4878b6
movsxd rax, dword [rcx]
test eax, eax
je 0x4878c6
mov rcx, rax
call fcn.00427280
mov rcx, qword [rsp + 0x40]
movsx esi, ax
mov rax, qword [rsp + 0x48]
jmp 0x4878d4
test r8b, 2
je 0x487821
or dword [rdi + 0x28], 1
test r10, r10
mov edx, dword [rdi + 0x28]
js 0x487807
cmp word [rsp + 0x148], 0
jne 0x4878a6
mov r9, qword [rsp + 0x140]
movzx eax, word [rdi + 0x18]
movzx ecx, word [r9 + 0x5e]
dec ecx
cmp eax, ecx
jne 0x487896
cmp byte [r9 + 0x62], 0
jne 0x487807
mov esi, dword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
bts edx, 0x10
mov dword [rdi + 0x28], edx
jmp 0x4878d4
mov esi, dword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
bts edx, 0xc
mov dword [rdi + 0x28], edx
jmp 0x4878d4
test r8b, r8b
jns 0x48783d
or dword [rdi + 0x28], 8
mov esi, dword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
jmp 0x4878d4
test r8b, 0x24
je 0x48785c
or dword [rdi + 0x28], 0x22
mov esi, dword [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov rax, rbp
mov qword [rsp + 0x48], rbp
jmp 0x4878d4
or dword [rdi + 0x28], 0x12
test byte [rdi + 0x28], 0x20
mov rcx, rbp
mov qword [rsp + 0x40], rbp
je 0x487889
movzx ecx, word [rdi + 0x2c]
mov rax, qword [rdi + 0x30]
mov esi, dword [rsp + 0x30]
mov rax, qword [rax + rcx*8 - 0x10]
mov rcx, rbp
mov qword [rsp + 0x48], rax
jmp 0x4878d4
mov esi, dword [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x48], rax
jmp 0x4878d4
mov esi, dword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
jmp 0x4878d4
mov esi, dword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
jmp 0x4878d4
mov esi, dword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
jmp 0x4878d4
mov esi, dword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
test byte [rdi + 0x28], 2
je 0x4878fc
mov rbp, qword [rsp + 0x130]
mov r9, rcx
mov rcx, qword [rsp + 0x78]
mov r8, rax
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call fcn.004375d0
jmp 0x487962
inc word [rdi + 0x18]
movzx eax, word [rbp + 0x18]
movzx ecx, word [rdi + 0x18]
test ax, ax
jg 0x487923
test r10, r10
js 0x487923
mov rbp, qword [rsp + 0x130]
sub ax, si
add word [rdi + 0x16], ax
jmp 0x487962
mov rax, qword [rsp + 0x140]
mov rdx, rcx
mov rax, qword [rax + 0x10]
movzx ecx, word [rax + rcx*2]
sub cx, word [rax + rdx*2 - 2]
add word [rdi + 0x16], cx
test r8b, r8b
movzx eax, word [rdi + 0x16]
jns 0x48795a
mov rbp, qword [rsp + 0x130]
add ax, 0xa
mov word [rdi + 0x16], ax
jmp 0x487962
mov rbp, qword [rsp + 0x130]
mov rax, qword [rsp + 0x138]
mov r9w, word [rsp + 0x54]
mov rax, qword [rax + 0x20]
movsx ecx, word [rax + 0x46]
mov rax, qword [rsp + 0x140]
movsx eax, word [rax + 0x5c]
imul eax, eax, 0xf
cdq
idiv ecx
mov r8d, eax
add r8w, word [rdi + 0x16]
inc r8w
cmp r9w, r8w
jl 0x4879df
movsx eax, r8w
movsx edx, r9w
lea ecx, [rax + 0x31]
cmp edx, ecx
jle 0x4879b1
mov r8w, r9w
jmp 0x487a19
add eax, 0x1f
cmp edx, eax
jle 0x4879be
lea r8d, [r9 + 1]
jmp 0x487a19
movsx rax, r8w
movsx rcx, r9w
sub rcx, rax
lea rax, [0x00400000]
movzx r8d, byte [rcx + rax + 0x29b360]
add r8w, r9w
jmp 0x487a19
movsx ecx, r9w
movsx edx, r8w
lea eax, [rcx + 0x31]
cmp edx, eax
jg 0x487a19
lea eax, [rcx + 0x1f]
cmp edx, eax
jle 0x4879fb
inc r8w
jmp 0x487a19
movsx rcx, r8w
movsx rax, r9w
sub rcx, rax
lea rax, [0x00400000]
movzx eax, byte [rcx + rax + 0x29b360]
add r8w, ax
test dword [rdi + 0x28], 0x140
mov word [rdi + 0x14], r8w
jne 0x487a3c
movzx edx, word [rdi + 0x16]
movzx ecx, r8w
add dx, 0x10
call fcn.00427200
mov word [rdi + 0x14], ax
movzx ecx, word [rsp + 0x148]
movzx ebx, word [rdi + 0x16]
movzx r8d, word [rsp + 0x58]
lea eax, [rcx + rsi]
mov rdx, rdi
add word [rdi + 0x14], ax
lea eax, [rcx + rsi]
add word [rdi + 0x16], ax
mov rcx, qword [rbp + 8]
call fcn.00437b00
mov rdx, rdi
mov rcx, rbp
call fcn.0044c560
mov dword [rsp + 0x50], eax
mov eax, dword [rdi + 0x28]
test al, 2
cmovne bx, word [rsp + 0x36]
test al, 0x10
mov word [rdi + 0x16], bx
jne 0x487abb
mov rcx, qword [rsp + 0x140]
movzx eax, word [rcx + 0x60]
cmp word [rdi + 0x18], ax
jae 0x487abb
add si, word [rsp + 0x148]
mov rdx, qword [rsp + 0x138]
mov r8, rcx
movzx r9d, si
mov rcx, rbp
call fcn.004872d0
mov ax, word [rsp + 0x36]
mov ebx, dword [rsp + 0x50]
mov word [rdi + 0x16], ax
lea rcx, [rsp + 0x80]
call fcn.00485ac0
test ebx, ebx
mov r10, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x138]
mov r9w, word [rsp + 0x38]
mov r11w, word [rsp + 0x34]
mov rbp, rax
je 0x487653
jmp 0x487aff
mov ebx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x118]
mov qword [rdi], rax
mov ax, word [rsp + 0x38]
mov word [rdi + 0x18], ax
mov ax, word [rsp + 0x56]
mov word [rdi + 0x1a], ax
mov eax, dword [rsp + 0x5c]
mov dword [rdi + 0x28], eax
mov ax, word [rsp + 0x36]
mov word [rdi + 0x16], ax
mov ax, word [rsp + 0x34]
mov word [rdi + 0x2c], ax
mov eax, ebx
mov rbx, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x110]
add rsp, 0x128
ret