Function at 0x18004e6a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1380]
mov eax, 0x1480
call fcn.1801109a0
sub rsp, rax
mov rax, qword [0x180166040]
xor rax, rsp
mov qword [rbp + 0x1370], rax
mov rdi, qword [rcx]
xor edx, edx
xor r15b, r15b
mov qword [rcx + 0x10], rdx
mov qword [rcx + 8], rdx
mov r12, rcx
mov qword [rcx + 0x18], rdx
mov r14d, 1
mov rcx, rdi
mov byte [rsp + 0x41], r15b
mov byte [rsp + 0x40], 0
mov r15d, edx
mov dword [rsp + 0x50], edx
mov r13d, edx
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x5c], edx
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x54], edx
call fcn.18004d2a0
test eax, eax
je 0x18004f160
mov rcx, rdi
call fcn.1800482f0
mov rcx, rdi
mov esi, eax
call fcn.1800482f0
shl esi, 0x10
mov rcx, rdi
add esi, eax
call fcn.1800482f0
mov rcx, rdi
mov ebx, eax
call fcn.1800482f0
shl ebx, 0x10
lea ecx, [rax + rbx]
mov eax, esi
mov ebx, ecx
shl rbx, 0x20
or rbx, rax
mov qword [rsp + 0x60], rbx
cmp ecx, 0x49484452
ja 0x18004eb40
je 0x18004e8e5
cmp ecx, 0x43674249
je 0x18004e889
cmp ecx, 0x49444154
je 0x18004e7f8
cmp ecx, 0x49454e44
jne 0x18004eb54
test r14d, r14d
jne 0x18004f160
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x18004f160
mov r14d, dword [rsp + 0x4c]
mov eax, r14d
imul eax, dword [rdi]
add eax, 7
shr eax, 3
imul eax, dword [rdi + 8]
inc eax
imul eax, dword [rdi + 4]
movsxd rsi, eax
mov rcx, rsi
call fcn.1800e1184
mov rcx, rax
test rax, rax
jne 0x18004ee39
mov qword [r12 + 0x10], rax
jmp 0x18004f160
test r14d, r14d
jne 0x18004f160
cmp byte [rsp + 0x40], r14b
je 0x18004e811
test r13d, r13d
je 0x18004f160
mov esi, dword [rsp + 0x50]
lea eax, [rbx + rsi]
cmp eax, esi
jl 0x18004f160
cmp eax, r15d
jbe 0x18004e863
test r15d, r15d
jne 0x18004e837
mov r15d, 0x1000
cmp ebx, r15d
cmova r15d, ebx
cmp eax, r15d
jbe 0x18004e848
nop dword [rax]
add r15d, r15d
cmp eax, r15d
ja 0x18004e840
mov rcx, qword [r12 + 8]
mov edx, r15d
call fcn.1800e1168
test rax, rax
je 0x18004f160
mov qword [r12 + 8], rax
mov rdx, rsi
mov r8d, ebx
add rdx, qword [r12 + 8]
mov rcx, rdi
call fcn.180048220
test eax, eax
je 0x18004f160
add esi, ebx
mov dword [rsp + 0x50], esi
jmp 0x18004ee24
mov dword [rsp + 0x54], 1
test esi, esi
jns 0x18004e8a8
mov rax, qword [rdi + 0xc0]
mov qword [rdi + 0xb8], rax
jmp 0x18004ee24
cmp qword [rdi + 0x10], 0
je 0x18004ebb7
mov ecx, dword [rdi + 0xc0]
sub ecx, dword [rdi + 0xb8]
cmp ecx, esi
jge 0x18004ebb7
mov rax, qword [rdi + 0xc0]
sub ebx, ecx
mov rcx, qword [rdi + 0x28]
mov edx, ebx
mov qword [rdi + 0xb8], rax
call qword [rdi + 0x18]
jmp 0x18004ee24
test r14d, r14d
je 0x18004f160
mov dword [rsp + 0x48], 0
cmp esi, 0xd
jne 0x18004f160
mov rcx, rdi
call fcn.1800482f0
mov rcx, rdi
mov ebx, eax
call fcn.1800482f0
shl ebx, 0x10
add eax, ebx
mov dword [rdi], eax
cmp eax, 0x1000000
ja 0x18004f160
mov rcx, rdi
call fcn.1800482f0
mov rcx, rdi
mov ebx, eax
call fcn.1800482f0
shl ebx, 0x10
add eax, ebx
mov dword [rdi + 4], eax
cmp eax, 0x1000000
ja 0x18004f160
mov rax, qword [rdi + 0xb8]
cmp rax, qword [rdi + 0xc0]
jae 0x18004e967
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004e98d
cmp dword [rdi + 0x30], 0
je 0x18004e98b
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004e98d
xor cl, cl
movzx ecx, cl
mov dword [rsp + 0x4c], ecx
cmp ecx, 8
ja 0x18004f160
mov edx, 0x116
bt edx, ecx
jae 0x18004f160
cmp rax, qword [rdi + 0xc0]
jae 0x18004e9c3
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004e9e9
cmp dword [rdi + 0x30], 0
je 0x18004e9e7
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004e9e9
xor cl, cl
movzx ebx, cl
mov dword [rsp + 0x5c], ebx
cmp ebx, 6
ja 0x18004f160
cmp ebx, 3
jne 0x18004ea07
movzx esi, bl
mov byte [rsp + 0x40], bl
jmp 0x18004ea15
test bl, 1
jne 0x18004f160
movzx esi, byte [rsp + 0x40]
cmp rax, qword [rdi + 0xc0]
jb 0x18004ea33
cmp dword [rdi + 0x30], 0
je 0x18004ea48
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
test cl, cl
jne 0x18004f160
cmp rax, qword [rdi + 0xc0]
jb 0x18004ea66
cmp dword [rdi + 0x30], 0
je 0x18004ea7b
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
test cl, cl
jne 0x18004f160
cmp rax, qword [rdi + 0xc0]
jae 0x18004ea93
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004eab9
cmp dword [rdi + 0x30], 0
je 0x18004eab7
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004eab9
xor cl, cl
movzx r14d, cl
mov dword [rsp + 0x58], r14d
cmp r14d, 1
ja 0x18004f160
mov ecx, dword [rdi]
test ecx, ecx
je 0x18004f160
mov r9d, dword [rdi + 4]
test r9d, r9d
je 0x18004f160
xor edx, edx
mov eax, 0x40000000
div ecx
test sil, sil
jne 0x18004eb23
xor edx, edx
mov r8d, ebx
shr r8d, 2
mov ecx, ebx
and ecx, 2
and r8d, 1
or ecx, 1
add r8d, ecx
div r8d
mov dword [rdi + 8], r8d
cmp eax, r9d
jb 0x18004f160
mov r14d, dword [rsp + 0x48]
jmp 0x18004ee24
shr eax, 2
mov dword [rdi + 8], 1
cmp eax, r9d
jb 0x18004f160
mov r14d, dword [rsp + 0x48]
jmp 0x18004ee24
cmp ecx, 0x504c5445
je 0x18004ecd2
cmp ecx, 0x74524e53
je 0x18004ebc6
test r14d, r14d
jne 0x18004f160
mov ecx, dword [rsp + 0x64]
bt ecx, 0x1d
jae 0x18004f139
test ebx, ebx
jns 0x18004eb82
mov rax, qword [rdi + 0xc0]
mov qword [rdi + 0xb8], rax
jmp 0x18004ee24
cmp qword [rdi + 0x10], 0
je 0x18004ebb7
mov ecx, dword [rdi + 0xc0]
sub ecx, dword [rdi + 0xb8]
cmp ecx, ebx
jge 0x18004ebb7
mov rax, qword [rdi + 0xc0]
sub ebx, ecx
mov rcx, qword [rdi + 0x28]
mov edx, ebx
mov qword [rdi + 0xb8], rax
call qword [rdi + 0x18]
jmp 0x18004ee24
movsxd rax, ebx
add qword [rdi + 0xb8], rax
jmp 0x18004ee24
test r14d, r14d
jne 0x18004f160
cmp qword [r12 + 8], 0
jne 0x18004f160
cmp byte [rsp + 0x40], r14b
je 0x18004ec6e
test r13d, r13d
je 0x18004f160
cmp ebx, r13d
ja 0x18004f160
xor esi, esi
mov byte [rsp + 0x40], 4
test ebx, ebx
je 0x18004ee24
nop word [rax + rax]
mov rax, qword [rdi + 0xb8]
cmp rax, qword [rdi + 0xc0]
jae 0x18004ec2f
movzx edx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004ec55
cmp dword [rdi + 0x30], 0
je 0x18004ec53
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx edx, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004ec55
xor dl, dl
lea eax, [rsi*4 + 3]
inc esi
mov byte [rbp + rax + 0xf70], dl
cmp esi, ebx
jb 0x18004ec10
jmp 0x18004ee24
mov ecx, dword [rdi + 8]
test cl, 1
je 0x18004f160
lea eax, [rcx + rcx]
cmp ebx, eax
jne 0x18004f160
xor esi, esi
mov byte [rsp + 0x41], 1
test ecx, ecx
jle 0x18004ee24
movsxd r14, dword [rsp + 0x4c]
lea rcx, [0x18012e168]
add r14, rcx
lea rbx, [rsp + 0x44]
mov rcx, rdi
call fcn.1800482f0
movzx ecx, byte [r14]
lea rbx, [rbx + 1]
movzx edx, al
inc esi
imul edx, ecx
mov byte [rbx - 1], dl
cmp esi, dword [rdi + 8]
jl 0x18004eca8
mov r14d, dword [rsp + 0x48]
jmp 0x18004ee24
test r14d, r14d
jne 0x18004f160
cmp esi, 0x300
ja 0x18004f160
mov eax, 0xaaaaaaab
mul esi
mov r13d, edx
shr r13d, 1
lea eax, [r13*2]
add eax, r13d
cmp eax, esi
jne 0x18004f160
xor esi, esi
test r13d, r13d
je 0x18004ee24
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdi + 0xb8]
cmp rdx, qword [rdi + 0xc0]
jae 0x18004ed3f
movzx ecx, byte [rdx]
inc rdx
mov qword [rdi + 0xb8], rdx
jmp 0x18004ed66
cmp dword [rdi + 0x30], 0
je 0x18004ed64
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx ecx, byte [rax]
lea rdx, [rax + 1]
mov qword [rdi + 0xb8], rdx
jmp 0x18004ed66
xor cl, cl
lea ebx, [rsi*4]
mov byte [rbp + rbx + 0xf70], cl
cmp rdx, qword [rdi + 0xc0]
jae 0x18004ed8d
movzx r8d, byte [rdx]
inc rdx
mov qword [rdi + 0xb8], rdx
jmp 0x18004edb6
cmp dword [rdi + 0x30], 0
je 0x18004edb3
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx r8d, byte [rax]
lea rdx, [rax + 1]
mov qword [rdi + 0xb8], rdx
jmp 0x18004edb6
xor r8b, r8b
lea eax, [rbx + 1]
mov byte [rbp + rax + 0xf70], r8b
cmp rdx, qword [rdi + 0xc0]
jae 0x18004eddb
movzx r8d, byte [rdx]
lea rax, [rdx + 1]
mov qword [rdi + 0xb8], rax
jmp 0x18004ee03
cmp dword [rdi + 0x30], 0
je 0x18004ee00
mov rcx, rdi
call fcn.1800481b0
mov rax, qword [rdi + 0xb8]
movzx r8d, byte [rax]
inc rax
mov qword [rdi + 0xb8], rax
jmp 0x18004ee03
xor r8b, r8b
lea eax, [rbx + 2]
inc esi
mov byte [rbp + rax + 0xf70], r8b
lea eax, [rbx + 3]
mov byte [rbp + rax + 0xf70], 0xff
cmp esi, r13d
jb 0x18004ed20
mov rcx, rdi
call fcn.1800482f0
mov rcx, rdi
call fcn.1800482f0
jmp 0x18004e734
movsxd rax, dword [rsp + 0x50]
mov r13d, dword [rsp + 0x54]
add rax, rbx
mov qword [rsp + 0x78], rax
lea rax, [rsi + rcx]
xor esi, esi
mov qword [rbp - 0x70], rcx
mov edx, esi
mov qword [rbp - 0x78], rcx
test r13d, r13d
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x68], rax
sete dl
mov dword [rbp - 0x60], 1
call fcn.18004cfe0
test eax, eax
je 0x18004f129
mov rax, qword [rbp - 0x70]
mov ebx, dword [rbp - 0x78]
sub ebx, dword [rbp - 0x70]
mov qword [r12 + 0x10], rax
test rax, rax
je 0x18004f160
mov rcx, qword [r12 + 8]
call fcn.1800e1170
mov qword [r12 + 8], rsi
mov eax, dword [rdi + 8]
movzx esi, byte [rsp + 0x40]
lea r9d, [rax + 1]
cmp r9d, 4
jne 0x18004eec5
test sil, sil
je 0x18004ef4b
movzx r15d, byte [rsp + 0x41]
test r15b, r15b
jne 0x18004eed3
mov r9d, eax
mov eax, dword [rsp + 0x58]
mov r8d, ebx
mov ecx, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov rcx, r12
mov dword [rdi + 0xc], r9d
mov rdx, qword [r12 + 0x10]
mov dword [rsp + 0x20], r14d
call fcn.18004e2c0
test eax, eax
je 0x18004f160
test r15b, r15b
je 0x18004ef8e
mov rax, qword [r12]
mov rcx, qword [r12 + 0x18]
mov edx, dword [rax + 4]
imul edx, dword [rax]
test edx, edx
je 0x18004ef8e
cmp dword [rdi + 0xc], 2
jne 0x18004ef56
movzx r8d, byte [rsp + 0x44]
xor r14d, r14d
nop
cmp byte [rcx], r8b
lea rcx, [rcx + 2]
mov eax, 0xff
cmove eax, r14d
mov byte [rcx - 1], al
sub rdx, 1
jne 0x18004ef30
jmp 0x18004ef91
movzx r15d, byte [rsp + 0x41]
jmp 0x18004eed3
movzx r8d, byte [rsp + 0x45]
movzx r9d, byte [rsp + 0x44]
mov eax, edx
movzx edx, byte [rsp + 0x46]
nop dword [rax]
cmp byte [rcx], r9b
jne 0x18004ef84
cmp byte [rcx + 1], r8b
jne 0x18004ef84
cmp byte [rcx + 2], dl
jne 0x18004ef84
mov byte [rcx + 3], 0
add rcx, 4
sub rax, 1
jne 0x18004ef70
xor r14d, r14d
test r13d, r13d
je 0x18004f07a
cmp dword [0x180185f08], 0
je 0x18004f07a
cmp dword [rdi + 0xc], 2
jle 0x18004f07a
mov rax, qword [r12]
mov r9, qword [r12 + 0x18]
mov ecx, dword [rax + 4]
imul ecx, dword [rax]
test ecx, ecx
je 0x18004f07a
cmp dword [rax + 0xc], 3
jne 0x18004efef
mov edx, ecx
movzx ecx, byte [r9]
movzx eax, byte [r9 + 2]
mov byte [r9], al
mov byte [r9 + 2], cl
lea r9, [r9 + 3]
sub rdx, 1
jne 0x18004efd0
jmp 0x18004f07a
cmp dword [0x180185ec4], 0
je 0x18004f05b
mov r11d, ecx
nop dword [rax + rax]
movzx eax, byte [r9 + 3]
movzx r10d, byte [r9]
movzx ecx, byte [r9 + 2]
test al, al
je 0x18004f045
mov r8d, eax
xor edx, edx
movzx eax, byte [r9 + 1]
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r9 + 1], al
imul eax, r10d, 0xff
div r8d
xor edx, edx
mov r10d, eax
imul eax, ecx, 0xff
div r8d
jmp 0x18004f048
movzx eax, cl
mov byte [r9], al
mov byte [r9 + 2], r10b
add r9, 4
sub r11, 1
jne 0x18004f000
jmp 0x18004f07a
mov edx, ecx
nop dword [rax]
movzx ecx, byte [r9]
movzx eax, byte [r9 + 2]
mov byte [r9], al
mov byte [r9 + 2], cl
lea r9, [r9 + 4]
sub rdx, 1
jne 0x18004f060
test sil, sil
je 0x18004f113
mov dword [rdi + 0xc], 4
movzx eax, sil
mov dword [rdi + 8], eax
mov rax, qword [r12]
mov rbx, qword [r12 + 0x18]
mov edi, dword [rax + 4]
imul edi, dword [rax]
lea ecx, [rdi*4]
call fcn.1800e1184
mov rsi, rax
test rax, rax
je 0x18004f160
test edi, edi
je 0x18004f104
lea r8, [rax + 2]
mov r9d, edi
movzx edx, byte [rbx]
lea r8, [r8 + 4]
lea rbx, [rbx + 1]
movzx eax, byte [rbp + rdx*4 + 0xf70]
movzx ecx, byte [rbp + rdx*4 + 0xf73]
mov byte [r8 - 6], al
movzx eax, byte [rbp + rdx*4 + 0xf71]
mov byte [r8 - 5], al
movzx eax, byte [rbp + rdx*4 + 0xf72]
mov byte [r8 - 4], al
mov byte [r8 - 3], cl
sub r9, 1
jne 0x18004f0c3
mov rcx, qword [r12 + 0x18]
call fcn.1800e1170
mov qword [r12 + 0x18], rsi
mov rcx, qword [r12 + 0x10]
call fcn.1800e1170
mov eax, 1
mov qword [r12 + 0x10], r14
jmp 0x18004f162
mov rcx, qword [rbp - 0x70]
call fcn.1800e1170
mov qword [r12 + 0x10], rsi
jmp 0x18004f160
mov eax, ecx
mov byte [0x180168603], cl
shr eax, 0x18
mov byte [str.XXXX_PNG_chunk_not_known], al
mov eax, ecx
shr eax, 0x10
mov byte [0x180168601], al
mov eax, ecx
shr eax, 8
mov byte [0x180168602], al
xor eax, eax
mov rcx, qword [rbp + 0x1370]
xor rcx, rsp
call fcn.1800b6030
lea r11, [rsp + 0x1480]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret