Function at 0x1800e4c70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov r13, rdx
mov rbx, r9
xor edx, edx
mov rax, rcx
mov dword [rsp + 0x24], edx
mov byte [rsp + 0x21], dl
mov byte [rsp + 0x20], dl
test rcx, rcx
je 0x1800e52bd
test rbx, rbx
je 0x1800e52bd
test r13, r13
je 0x1800e52bd
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1800e52bd
movzx r11d, byte [r9 + 0x1a]
mov r15, qword [rax]
mov qword [rsp + 0x38], r15
test r11b, r11b
je 0x1800e4cff
cmp r11b, 7
jne 0x1800e52bd
cmp qword [r9 + 0x10], rdx
je 0x1800e52bd
cmp byte [r13 + 0x1a], dl
je 0x1800e52b9
cmp r11b, 7
jne 0x1800e4d1d
mov eax, dword [r13 + 8]
xor eax, dword [r9 + 8]
jl 0x1800e52bd
mov r9d, dword [r13 + 4]
test r9d, r9d
je 0x1800e52b9
mov r10d, dword [r13]
test r10d, r10d
je 0x1800e52b9
mov r14d, dword [rcx]
mov edi, r8d
mov r12d, dword [rcx + 4]
and edi, 0xffffffc0
shl r10d, 6
and r14d, 0xffffffc0
shr r8, 0x20
and r12d, 0xffffffc0
and r8d, 0xffffffc0
lea eax, [r10 - 0x7fffffc0]
cmp eax, r8d
jg 0x1800e52bd
shl r9d, 6
mov ecx, r8d
mov eax, 0x7fffffbf
sub ecx, r10d
sub eax, r9d
cmp eax, edi
jl 0x1800e52bd
mov r10d, dword [rbx + 4]
lea eax, [rdi + r9]
mov dword [rsp + 0x28], eax
test r10d, r10d
je 0x1800e4dd7
mov r9d, dword [rbx]
test r9d, r9d
je 0x1800e4dd7
shl r9d, 6
lea eax, [r9 - 0x80000000]
cmp eax, r12d
jg 0x1800e52bd
mov ebp, r12d
mov eax, 0x7fffffff
sub ebp, r9d
mov r9d, r10d
shl r9d, 6
sub eax, r9d
cmp eax, r14d
jl 0x1800e52bd
mov eax, dword [rsp + 0x28]
lea esi, [r14 + r9]
jmp 0x1800e4de7
mov ebp, 0x7fffffff
mov esi, 0x80000000
mov r14d, ebp
mov r12d, esi
cmp edi, r14d
mov r15d, ebp
mov r9d, r14d
cmovl r9d, edi
cmp ecx, ebp
mov dword [rsp + 0x4c], r9d
cmovl r15d, ecx
cmp eax, esi
mov dword [rsp + 0x28], r15d
cmovg esi, eax
mov eax, r15d
sub esi, r9d
sar esi, 6
cmp r8d, r12d
cmovg r12d, r8d
sub r12d, r15d
mov r15, qword [rsp + 0x38]
sar r12d, 6
mov dword [rsp + 0x48], r12d
test esi, esi
je 0x1800e52b9
test r12d, r12d
je 0x1800e52b9
sub edi, r9d
sub ecx, eax
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x2c], ecx
test r10d, r10d
je 0x1800e4e56
cmp dword [rbx], edx
je 0x1800e4e56
sub r14d, r9d
sub ebp, eax
test r11b, r11b
jne 0x1800e4eb6
mov eax, 0x100
mov dword [rbx + 4], esi
mov word [rbx + 0x18], ax
lea esi, [rsi*4]
mov eax, 0x7fffffff
mov dword [rbx], r12d
cdq
mov byte [rbx + 0x1a], 7
idiv esi
mov dword [rbx + 8], esi
cmp eax, r12d
jl 0x1800e52bd
imul esi, r12d
lea r8, [rsp + 0x24]
mov rcx, r15
mov edx, esi
call fcn.18008b480
mov edx, dword [rsp + 0x24]
mov qword [rbx + 0x10], rax
test edx, edx
jne 0x1800e52b5
mov byte [rsp + 0x20], 1
jmp 0x1800e4fbe
cmp r10d, esi
jne 0x1800e4ec4
cmp dword [rbx], r12d
je 0x1800e4fbe
mov eax, dword [rbx + 8]
lea r15d, [rsi*4]
cdq
xor eax, edx
sub eax, edx
mov dword [rsp + 0x30], eax
mov eax, 0x7fffffff
cdq
idiv r15d
cmp eax, r12d
jl 0x1800e52bd
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x24]
mov edx, r15d
imul edx, r12d
call fcn.18008b480
mov edx, dword [rsp + 0x24]
mov r8, rax
mov qword [rsp + 0x50], rax
test edx, edx
jne 0x1800e52b5
cmp dword [rbx + 8], edx
jl 0x1800e4f8d
mov edx, dword [rbx]
mov eax, r12d
mov rdi, qword [rbx + 0x10]
sar ebp, 6
sub eax, ebp
sar r14d, 6
sub eax, edx
shl r14d, 2
imul eax, r15d
movsxd rbp, r14d
add rax, r8
add rbp, rax
movsxd rax, dword [rsp + 0x30]
imul edx, eax
movsxd r15, edx
add r15, rdi
cmp rdi, r15
jae 0x1800e4f81
mov r14, rax
lea eax, [rsi*4]
cdqe
mov rbx, rax
mov r8, r14
mov rdx, rdi
mov rcx, rbp
call fcn.18011c600
add rdi, r14
add rbp, rbx
cmp rdi, r15
jb 0x1800e4f60
mov rbx, qword [rsp + 0xe8]
mov edi, dword [rsp + 0x40]
lea r15d, [rsi*4]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rsp + 0x38]
call fcn.18008b510
mov edx, dword [rsp + 0x24]
mov eax, r15d
neg eax
mov dword [rbx + 4], esi
cmp dword [rbx + 8], 0
mov dword [rbx], r12d
cmovge eax, r15d
mov dword [rbx + 8], eax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x10], rax
cmp byte [r13 + 0x1a], 2
je 0x1800e5029
movups xmm0, xmmword [0x18013b350]
mov rcx, qword [rsp + 0xd0]
mov r9d, 1
movups xmm1, xmmword [0x18013b360]
lea r8, [rsp + 0x60]
mov rdx, r13
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x18013b370]
movsd qword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm1
call sym.Deceitik.dll_FT_Bitmap_Convert
mov dword [rsp + 0x24], eax
mov edx, eax
test eax, eax
jne 0x1800e5252
lea r13, [rsp + 0x60]
mov byte [rsp + 0x21], 1
mov qword [rsp + 0xd8], r13
mov r9d, dword [rbx + 8]
test r9d, r9d
js 0x1800e5233
mov r15, qword [r13 + 0x10]
mov r8d, dword [rsp + 0x2c]
mov eax, dword [rbx]
mov ecx, dword [r13]
sar r8d, 6
sub eax, r8d
sar edi, 6
sub eax, ecx
shl edi, 2
imul ecx, dword [r13 + 8]
imul eax, r9d
mov qword [rsp + 0x38], r15
mov r8d, eax
movsxd rax, edi
add r8, rax
movsxd rax, ecx
add r8, qword [rbx + 0x10]
add rax, r15
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x58], rax
cmp r15, rax
jae 0x1800e5233
mov ecx, dword [rsp + 0xf8]
nop
mov eax, dword [r13 + 4]
mov r12, r15
add rax, r15
mov qword [rsp + 0x50], rax
cmp r15, rax
jae 0x1800e5207
movzx r13d, byte [rsp + 0xfb]
mov rbx, r8
movzx eax, cl
mov rcx, qword [rsp + 0x50]
mov r15d, eax
nop
movzx edx, byte [r12]
mov eax, 0x80808081
movzx r8d, byte [rbx]
mov ebp, 0xff
movzx r11d, byte [rbx + 1]
movzx edi, byte [rbx + 2]
movzx esi, byte [rbx + 3]
lea rbx, [rbx + 4]
imul edx, r13d
mul edx
mov eax, 0x80808081
mov r14d, edx
shr r14d, 7
sub ebp, r14d
imul r8d, ebp
imul r11d, ebp
imul edi, ebp
imul esi, ebp
imul r8d
lea r9d, [r8 + rdx]
mov r8d, r15d
sar r9d, 7
mov eax, r9d
imul r8d, r14d
shr eax, 0x1f
add r9d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
movzx r8d, byte [rsp + 0xf9]
sar edx, 7
mov eax, edx
imul r8d, r14d
shr eax, 0x1f
add edx, eax
mov eax, 0x80808081
add r9b, dl
imul r11d
mov byte [rbx - 4], r9b
lea r9d, [r11 + rdx]
sar r9d, 7
mov eax, r9d
shr eax, 0x1f
add r9d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
movzx r8d, byte [rsp + 0xfa]
sar edx, 7
mov eax, edx
imul r8d, r14d
shr eax, 0x1f
add edx, eax
mov eax, 0x80808081
add r9b, dl
imul edi
mov byte [rbx - 3], r9b
lea r9d, [rdi + rdx]
sar r9d, 7
mov eax, r9d
shr eax, 0x1f
add r9d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x80808081
add r9b, dl
imul esi
mov byte [rbx - 2], r9b
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
add dl, r14b
mov byte [rbx - 1], dl
inc r12
cmp r12, rcx
jb 0x1800e50c0
mov ecx, dword [rsp + 0xf8]
mov rbx, qword [rsp + 0xe8]
mov r15, qword [rsp + 0x38]
mov r13, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x30]
movsxd rax, dword [r13 + 8]
add r15, rax
movsxd rax, dword [rbx + 8]
add r8, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r8
cmp r15, qword [rsp + 0x58]
jb 0x1800e5090
mov edx, dword [rsp + 0x24]
mov r12d, dword [rsp + 0x48]
mov rcx, qword [rsp + 0xf0]
mov eax, dword [rsp + 0x4c]
shl r12d, 6
add r12d, dword [rsp + 0x28]
mov dword [rcx], eax
mov dword [rcx + 4], r12d
test edx, edx
je 0x1800e5295
cmp byte [rsp + 0x20], 0
mov rdi, qword [rsp + 0xd0]
je 0x1800e529d
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi]
call fcn.18008b510
movups xmm0, xmmword [0x18013b350]
mov edx, dword [rsp + 0x24]
movups xmm1, xmmword [0x18013b360]
movups xmmword [rbx], xmm0
movsd xmm0, qword [0x18013b370]
movups xmmword [rbx + 0x10], xmm1
movsd qword [rbx + 0x20], xmm0
jmp 0x1800e529d
mov rdi, qword [rsp + 0xd0]
cmp byte [rsp + 0x21], 0
je 0x1800e52b5
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdi]
call fcn.18008b510
mov edx, dword [rsp + 0x24]
mov eax, edx
jmp 0x1800e52c2
xor eax, eax
jmp 0x1800e52c2
mov eax, 6
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret