Function at 0x14004a070
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
mov word [rsp + 0x20], r9w
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x110
mov rax, qword [rcx]
mov rdi, qword [rcx + 0x18]
xor esi, esi
mov rax, qword [rax]
mov r11, r8
mov ebp, esi
mov qword [rsp + 0x78], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rsi
cmp byte [rax + 0x51], sil
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rsi
je 0x14004a0cb
lea eax, [rsi + 7]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret
test byte [rdi + 0x28], 0x20
mov qword [rsp + 0x108], rbx
je 0x14004a0e1
mov r9d, 0x18
jmp 0x14004a0f4
test byte [rdx + 0x3c], 8
mov eax, 0x3f
mov r9d, 0x1bf
cmovne r9d, eax
test byte [r8 + 0x5c], 4
je 0x14004a0ff
and r9d, 0xffffffc3
movzx eax, word [rdi + 0x18]
mov r8, qword [r8 + 8]
mov r10d, dword [rdx + 0x44]
movsx rbx, word [r8 + rax*2]
mov rax, qword [rcx + 8]
test ebx, ebx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
js 0x14004a17c
mov rax, qword [r11 + 0x18]
lea rdx, [rbx + rbx*2]
mov rcx, qword [rax + 8]
shl rdx, 4
movzx eax, byte [rdx + rcx + 0x29]
mov ecx, esi
mov byte [rsp + 0x98], al
movsx eax, word [r8]
cmp eax, ebx
je 0x14004a167
movzx edx, word [r11 + 0x58]
cmp ecx, edx
jg 0x14004a1d2
movsx eax, word [r8 + 2]
add r8, 2
add ecx, 1
cmp eax, ebx
jne 0x14004a153
mov rax, qword [r11 + 0x40]
movsxd rcx, ecx
mov rcx, qword [rax + rcx*8]
mov qword [rsp + 0x90], rcx
jmp 0x14004a18c
mov byte [rsp + 0x98], sil
mov qword [rsp + 0x90], rsi
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x9c], r9d
mov dword [rsp + 0xa0], esi
mov dword [rsp + 0xa4], r10d
mov dword [rsp + 0xa8], ebx
mov byte [rsp + 0x99], 2
mov byte [rsp + 0x9a], 2
call fcn.1400439a0
mov r11, qword [rsp + 0x140]
mov rsi, rax
movzx eax, word [rdi + 0x2e]
movzx edx, word [rdi + 0x18]
movzx r8d, word [rdi + 0x2c]
mov r9d, dword [rdi + 0x28]
mov word [rsp + 0x50], ax
mov rax, qword [rdi]
mov qword [rsp + 0x70], rax
movzx eax, word [rdi + 0x16]
mov word [rdi + 0x12], bp
mov word [rsp + 0x32], ax
mov rax, qword [r11 + 0x10]
mov word [rsp + 0x30], dx
movzx eax, word [rax]
mov word [rsp + 0x40], r8w
mov dword [rsp + 0x60], r9d
cmp ax, 0xa
mov word [rsp + 0x64], ax
lea r10, [0x140000000]
jg 0x14004a233
xor ax, ax
mov word [rsp + 0x52], ax
jmp 0x14004a2b9
movsx rax, ax
mov cx, 0x28
cmp rax, 8
jae 0x14004a25f
cmp rax, 2
jae 0x14004a250
xor ax, ax
jmp 0x14004a2b0
add rax, rax
add cx, 0xfff6
cmp rax, 8
jb 0x14004a250
jmp 0x14004a29d
cmp rax, 0xff
jbe 0x14004a280
nop
nop
nop
shr rax, 4
add cx, 0x28
cmp rax, 0xff
ja 0x14004a270
cmp rax, 0xf
jbe 0x14004a29d
nop
nop
nop
shr rax, 1
add cx, 0xa
cmp rax, 0xf
ja 0x14004a290
and eax, 7
movzx eax, word [r10 + rax*2 + 0xbf298]
add ax, cx
sub ax, 0xa
sub ax, 0x21
mov word [rsp + 0x52], ax
mov rcx, rbx
mov qword [rsp + 0x58], rbx
test rsi, rsi
je 0x14004a7bd
movzx ebx, word [rsi + 0x1a]
xor eax, eax
cmp bx, 0x100
mov dword [rsp + 0x44], eax
jne 0x14004a306
test rcx, rcx
js 0x14004a76c
mov rax, qword [rsp + 0x138]
lea rcx, [rcx + rcx*2]
mov rax, qword [rax + 0x20]
add rcx, rcx
mov rax, qword [rax + 8]
cmp byte [rax + rcx*8 + 0x28], 0
jne 0x14004a76c
mov rax, qword [rdi + 8]
test qword [rsi + 0x28], rax
jne 0x14004a76c
bt word [rsi + 0x1c], 8
jae 0x14004a326
cmp bx, 0x10
je 0x14004a76c
mov rcx, qword [rsp + 0x68]
mov word [rdi + 0x2c], r8w
movzx r8d, r8w
mov word [rdi + 0x18], dx
add r8d, 1
mov rdx, rdi
mov dword [rdi + 0x28], r9d
call fcn.140016510
test eax, eax
jne 0x14004a7ad
movzx ecx, word [rdi + 0x2c]
mov rax, qword [rdi + 0x38]
mov qword [rax + rcx*8], rsi
add word [rdi + 0x2c], 1
mov rcx, qword [rsi + 0x28]
or rcx, qword [rsp + 0x70]
mov rax, qword [rdi + 8]
movzx edx, word [rdi + 0x2c]
not rax
and rcx, rax
test bl, 1
mov qword [rdi], rcx
je 0x14004a3e4
mov rax, qword [rsi]
or dword [rdi + 0x28], 4
bt dword [rax + 4], 0xb
jae 0x14004a3ab
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
mov eax, 0x2e
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x38]
jmp 0x14004a562
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x14004a53b
movsxd rax, dword [rcx]
test eax, eax
je 0x14004a52a
mov rcx, rax
call fcn.140007c20
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cwde
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x38]
jmp 0x14004a562
test bl, 0x82
je 0x14004a458
or dword [rdi + 0x28], 1
mov r9, qword [rsp + 0x58]
mov edx, dword [rdi + 0x28]
test r9, r9
js 0x14004a442
cmp word [rsp + 0x148], 0
jne 0x14004a558
mov r8, qword [rsp + 0x140]
movzx eax, word [rdi + 0x18]
movzx ecx, word [r8 + 0x56]
sub ecx, 1
cmp eax, ecx
jne 0x14004a54c
test byte [r8 + 0x5c], 8
jne 0x14004a442
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
bts edx, 0x10
mov dword [rdi + 0x28], edx
jmp 0x14004a562
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
bts edx, 0xc
mov dword [rdi + 0x28], edx
jmp 0x14004a562
bt bx, 8
jae 0x14004a477
or dword [rdi + 0x28], 8
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
jmp 0x14004a562
test bl, 0x24
je 0x14004a4e8
or dword [rdi + 0x28], 0x22
xor eax, eax
bt word [rsi + 0x1c], 8
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
jae 0x14004a523
mov rcx, qword [rsp + 0x68]
movzx r8d, dx
lea rax, [rsi + 0x38]
add r8d, 1
mov rdx, rdi
mov qword [rsp + 0x38], rax
call fcn.140016510
test eax, eax
jne 0x14004a79b
movzx ecx, word [rdi + 0x2c]
mov rax, qword [rdi + 0x38]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x58]
mov qword [rax + rcx*8], r8
add word [rdi + 0x2c], 1
or dword [rdi + 0x28], 0x10
mov rax, r8
mov rcx, rsi
jmp 0x14004a562
or dword [rdi + 0x28], 0x12
test byte [rdi + 0x28], 0x20
mov rax, rsi
mov qword [rsp + 0x38], rax
je 0x14004a515
mov rax, qword [rdi + 0x38]
mov r9, qword [rsp + 0x58]
movzx ecx, dx
mov rcx, qword [rax + rcx*8 - 0x10]
mov rax, rsi
mov qword [rsp + 0x48], rcx
jmp 0x14004a562
mov r9, qword [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x48], rcx
jmp 0x14004a562
mov r9, qword [rsp + 0x58]
jmp 0x14004a562
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
jmp 0x14004a562
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
jmp 0x14004a562
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
jmp 0x14004a562
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
test byte [rdi + 0x28], 2
je 0x14004a58e
mov rbp, qword [rsp + 0x130]
mov r8, rcx
mov rcx, qword [rsp + 0x78]
mov r9, rax
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call fcn.140009640
mov esi, dword [rsp + 0x44]
jmp 0x14004a603
add word [rdi + 0x18], 1
movzx eax, word [rsi + 0x18]
movzx ecx, word [rdi + 0x18]
test ax, ax
jg 0x14004a5ba
test r9, r9
js 0x14004a5ba
mov esi, dword [rsp + 0x44]
mov rbp, qword [rsp + 0x130]
sub ax, si
add word [rdi + 0x16], ax
jmp 0x14004a603
mov rax, qword [rsp + 0x140]
mov rdx, rcx
mov rax, qword [rax + 0x10]
movzx ecx, word [rax + rcx*2]
sub cx, word [rax + rdx*2 - 2]
add word [rdi + 0x16], cx
bt bx, 8
movzx eax, word [rdi + 0x16]
jae 0x14004a5f7
mov esi, dword [rsp + 0x44]
mov rbp, qword [rsp + 0x130]
add ax, 0xa
mov word [rdi + 0x16], ax
jmp 0x14004a603
mov esi, dword [rsp + 0x44]
mov rbp, qword [rsp + 0x130]
mov rax, qword [rsp + 0x138]
mov r9w, word [rsp + 0x52]
mov rax, qword [rax + 0x20]
movsx ecx, word [rax + 0x3c]
mov rax, qword [rsp + 0x140]
movsx eax, word [rax + 0x54]
imul eax, eax, 0xf
cdq
idiv ecx
mov r8d, eax
add r8w, word [rdi + 0x16]
add r8w, 1
cmp r9w, r8w
jl 0x14004a681
movsx ecx, r8w
movsx edx, r9w
lea eax, [rcx + 0x31]
cmp edx, eax
jle 0x14004a653
mov r8w, r9w
jmp 0x14004a6bc
lea eax, [rcx + 0x1f]
cmp edx, eax
jle 0x14004a660
lea r8d, [r9 + 1]
jmp 0x14004a6bc
movsx rax, r8w
movsx rcx, r9w
sub rcx, rax
lea rax, [0x140000000]
movzx r8d, byte [rcx + rax + 0xabce0]
add r8w, r9w
jmp 0x14004a6bc
movsx ecx, r9w
movsx edx, r8w
lea eax, [rcx + 0x31]
cmp edx, eax
jg 0x14004a6bc
lea eax, [rcx + 0x1f]
cmp edx, eax
jle 0x14004a69e
add r8w, 1
jmp 0x14004a6bc
movsx rcx, r8w
movsx rax, r9w
sub rcx, rax
lea rax, [0x140000000]
movzx eax, byte [rcx + rax + 0xabce0]
add r8w, ax
test dword [rdi + 0x28], 0x140
mov word [rdi + 0x14], r8w
jne 0x14004a6df
movzx edx, word [rdi + 0x16]
movzx ecx, r8w
add dx, 0x10
call fcn.140007cb0
mov word [rdi + 0x14], ax
movzx ecx, word [rsp + 0x148]
movzx ebx, word [rdi + 0x16]
movzx r8d, word [rsp + 0x64]
lea eax, [rcx + rsi]
mov rdx, rdi
add word [rdi + 0x14], ax
lea eax, [rcx + rsi]
add word [rdi + 0x16], ax
mov rcx, qword [rbp + 8]
call fcn.1400092b0
mov rdx, rdi
mov rcx, rbp
call fcn.14001f9b0
mov ecx, dword [rdi + 0x28]
test cl, 2
mov ebp, eax
cmovne bx, word [rsp + 0x32]
test cl, 0x10
mov word [rdi + 0x16], bx
jne 0x14004a763
mov rax, qword [rsp + 0x140]
movzx ecx, word [rax + 0x58]
cmp word [rdi + 0x18], cx
jae 0x14004a763
add si, word [rsp + 0x148]
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
movzx r9d, si
mov r8, rax
call fcn.14004a070
mov cx, word [rsp + 0x32]
mov word [rdi + 0x16], cx
lea rcx, [rsp + 0x80]
call fcn.1400439a0
test ebp, ebp
mov rcx, qword [rsp + 0x58]
mov dx, word [rsp + 0x30]
mov r8w, word [rsp + 0x40]
mov r9d, dword [rsp + 0x60]
mov rsi, rax
je 0x14004a2c1
jmp 0x14004a7bd
mov dx, word [rsp + 0x30]
mov r8w, word [rsp + 0x40]
mov r9d, dword [rsp + 0x60]
jmp 0x14004a7bd
mov dx, word [rsp + 0x30]
mov r8w, word [rsp + 0x40]
mov r9d, dword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov si, word [rsp + 0x32]
mov word [rdi + 0x18], dx
mov qword [rdi], rax
mov ax, word [rsp + 0x50]
mov dword [rdi + 0x28], r9d
cmp dx, ax
mov word [rdi + 0x16], si
mov word [rdi + 0x2c], r8w
mov word [rdi + 0x2e], ax
jne 0x14004a8ca
mov r11, qword [rsp + 0x140]
movzx ecx, dx
movzx eax, word [r11 + 0x56]
add ecx, 1
cmp ecx, eax
jge 0x14004a8ca
test byte [r11 + 0x5c], 0x40
jne 0x14004a8ca
mov rax, qword [r11 + 0x10]
movzx ebx, dx
cmp word [rax + rbx*2 + 2], 0x2a
jl 0x14004a8ca
mov rcx, qword [rsp + 0x68]
movzx r8d, r8w
mov rdx, rdi
add r8d, 1
call fcn.140016510
test eax, eax
mov ebp, eax
jne 0x14004a8ca
add word [rdi + 0x18], 1
add word [rdi + 0x2e], 1
movzx ecx, word [rdi + 0x2c]
mov rax, qword [rdi + 0x38]
mov rdx, qword [rsp + 0x138]
mov qword [rax + rcx*8], 0
add word [rdi + 0x2c], 1
or dword [rdi + 0x28], 0x8000
mov rcx, qword [rsp + 0x140]
mov r8, rcx
mov rax, qword [rcx + 0x10]
mov rcx, qword [rsp + 0x130]
movzx r9d, word [rax + rbx*2]
sub r9w, word [rax + rbx*2 + 2]
sub word [rdi + 0x16], r9w
add r9w, word [rsp + 0x148]
add r9w, 5
call fcn.14004a070
mov ax, word [rsp + 0x30]
mov word [rdi + 0x16], si
mov word [rdi + 0x18], ax
mov ax, word [rsp + 0x50]
mov word [rdi + 0x2e], ax
mov eax, dword [rsp + 0x60]
mov dword [rdi + 0x28], eax
mov eax, ebp
mov rbx, qword [rsp + 0x108]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret