Function at 0x18018b7d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rdi
push r12
push r15
sub rsp, 0x70
mov r10d, dword [rcx + 0x13c]
mov r15d, r8d
mov eax, dword [rcx + 0x10c]
mov edi, r10d
sar edi, 8
mov ebp, r8d
sar r15d, 8
mov r12d, edx
mov rbx, rcx
cmp edi, eax
jl 0x18018b810
cmp r15d, eax
jge 0x18018b81f
mov eax, dword [rcx + 0x108]
cmp edi, eax
jge 0x18018b83a
cmp r15d, eax
jge 0x18018b83a
mov eax, 0x138
mov dword [rcx + 0x13c], ebp
mov dword [rcx + rax], r12d
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rcx + 0x138]
mov r9d, r12d
mov qword [rsp + 0x68], rsi
mov ecx, ebp
mov qword [rsp + 0x60], r13
sub r9d, eax
mov qword [rsp + 0x58], r14
sub ecx, r10d
sar edx, 8
mov r14d, eax
sar r14d, 8
mov dword [rsp + 0xa0], edx
movzx r13d, al
movzx esi, r10b
cmp r14d, edx
jne 0x18018b881
cmp edi, r15d
je 0x18018bb77
test ecx, ecx
jne 0x18018b895
mov r8d, r15d
mov rcx, rbx
call fcn.18018bbd0
jmp 0x18018bb9f
test r9d, r9d
jne 0x18018b93d
test ecx, ecx
jle 0x18018b900
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x118]
mov eax, pe_nt_image_headers64
sub eax, esi
inc edi
mov r8d, edi
mov edx, r14d
add dword [rcx + 4], eax
mov eax, pe_nt_image_headers64
mov rcx, qword [rbx + 0x118]
sub eax, esi
imul eax, r13d
xor esi, esi
add eax, eax
add dword [rcx + 8], eax
mov rcx, rbx
call fcn.18018bbd0
cmp edi, r15d
jne 0x18018b8b0
jmp 0x18018bb77
mov rax, qword [rbx + 0x118]
dec edi
mov r8d, edi
mov edx, r14d
sub dword [rax + 4], esi
mov eax, r13d
mov rcx, qword [rbx + 0x118]
imul eax, esi
mov esi, pe_nt_image_headers64
neg eax
add eax, eax
add dword [rcx + 8], eax
mov rcx, rbx
call fcn.18018bbd0
cmp edi, r15d
jne 0x18018b900
jmp 0x18018bb77
movsxd r8, r9d
mov rax, r13
movsxd r10, ecx
mov rbp, rsi
imul rax, r10
imul rbp, r8
mov r12d, 0xffffffff
sub rbp, rax
cmp r14d, edx
je 0x18018b96c
mov eax, r12d
cqo
idiv r8
mov r11, rax
jmp 0x18018b96f
xor r11d, r11d
cmp edi, r15d
je 0x18018b97e
mov rax, r12
cqo
idiv r10
jmp 0x18018b980
xor eax, eax
mov r8, rax
shl ecx, 8
movsxd r10, ecx
mov r12, r11
shl r9d, 8
mov rcx, r10
imul rcx, rax
imul r8, rbp
imul r12, rbp
movsxd r9, r9d
mov rdx, r9
mov qword [rsp + 0x40], r9
imul rdx, rax
mov rax, r9
mov qword [rsp + 0x48], r10
imul rax, r11
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
mov rax, r10
imul rax, r11
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov rcx, rbp
sub rcx, r9
test rcx, rcx
jle 0x18018ba27
test rbp, rbp
jg 0x18018ba27
mov rcx, qword [rbx + 0x118]
mov rdx, r12
sub r8, qword [rsp + 0x28]
sub r12, rax
shr rdx, 0x20
sub rbp, r10
mov eax, edx
sub eax, esi
add dword [rcx + 4], eax
mov eax, edx
mov rcx, qword [rbx + 0x118]
sub eax, esi
imul eax, r13d
mov esi, edx
mov r13d, pe_nt_image_headers64
add dword [rcx + 8], eax
dec r14d
jmp 0x18018bb24
mov rdx, r10
sub rdx, r9
add rdx, rbp
test rdx, rdx
jle 0x18018ba8b
test rcx, rcx
jg 0x18018ba8b
sub r8, qword [rsp + 0x38]
mov rbp, rcx
mov rcx, qword [rbx + 0x118]
mov eax, pe_nt_image_headers64
sub r12, qword [rsp + 0x30]
sub eax, esi
mov qword [rsp + 0xb8], r8
neg r8
shr r8, 0x20
add dword [rcx + 4], eax
mov eax, pe_nt_image_headers64
mov rdx, qword [rbx + 0x118]
sub eax, esi
xor esi, esi
lea ecx, [r8 + r13]
mov r13d, r8d
imul ecx, eax
add dword [rdx + 8], ecx
inc edi
jmp 0x18018bb2c
lea rax, [r10 + rbp]
test rax, rax
js 0x18018bae8
test rdx, rdx
jg 0x18018bae8
add r8, qword [rsp + 0x28]
mov rbp, rax
mov rcx, qword [rbx + 0x118]
add r12, qword [rsp + 0x20]
mov qword [rsp + 0xb8], r8
mov r8, r12
shr r8, 0x20
mov eax, r8d
sub eax, esi
add dword [rcx + 4], eax
lea eax, [r13 + 0x100]
mov rdx, qword [rbx + 0x118]
mov ecx, r8d
sub ecx, esi
xor r13d, r13d
imul ecx, eax
mov esi, r8d
add dword [rdx + 8], ecx
inc r14d
jmp 0x18018bb2c
mov rax, qword [rbx + 0x118]
mov rdx, r8
add r12, qword [rsp + 0x30]
neg rdx
add r8, qword [rsp + 0x38]
add rbp, r9
shr rdx, 0x20
sub dword [rax + 4], esi
mov rcx, qword [rbx + 0x118]
lea eax, [rdx + r13]
mov r13d, edx
imul eax, esi
mov esi, pe_nt_image_headers64
sub dword [rcx + 8], eax
dec edi
mov qword [rsp + 0xb8], r8
mov r8d, edi
mov edx, r14d
mov rcx, rbx
call fcn.18018bbd0
mov r8, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x48]
mov rax, qword [rsp + 0x20]
cmp r14d, dword [rsp + 0xa0]
jne 0x18018b9d5
cmp edi, r15d
jne 0x18018b9d5
mov ebp, dword [rsp + 0xb0]
mov r12d, dword [rsp + 0xa8]
mov rcx, qword [rbx + 0x118]
movzx edx, bpl
mov eax, edx
sub edx, esi
sub eax, esi
add dword [rcx + 4], eax
mov rcx, qword [rbx + 0x118]
movzx eax, r12b
add eax, r13d
imul eax, edx
add dword [rcx + 8], eax
mov r13, qword [rsp + 0x60]
mov eax, 0x138
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x58]
mov dword [rbx + 0x13c], ebp
mov dword [rbx + rax], r12d
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rbp
pop rbx
ret