Function at 0x18006cce4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2d8
movaps xmmword [rax - 0x58], xmm6
xor r12d, r12d
mov rdi, rdx
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
movaps xmmword [rax - 0xa8], xmm11
mov eax, 2
cmp dword [rdx + 0x494], r12d
jge 0x18006cd68
mov rcx, rdx
test byte [rdx], al
jne 0x18006cd58
mov edx, 0xf5
lea r8d, [rax + 0x19]
jmp 0x18006cd5d
mov r8d, eax
mov edx, eax
call fcn.18005627c
mov dword [rdi + 0x494], eax
cmp dword [rdi + 0x498], r12d
jge 0x18006cd8d
test byte [rdi], 4
jne 0x18006cd8d
mov edx, 0x41
mov rcx, rdi
lea r8d, [rdx - 1]
call fcn.18005627c
mov dword [rdi + 0x498], eax
mov rcx, rdi
mov qword [rdi + 8], r12
mov qword [rdi + 0x40], r12
mov qword [rdi + 0x48], r12
mov qword [rdi + 0x50], r12
call fcn.180055954
mov r15d, dword [rdi + 0x78]
mov edx, 8
mov byte [rbp + 0x238], r12b
mov rbx, r12
mov qword [rbp - 0x70], rbx
mov r14, r12
mov qword [rbp - 0x68], r12
mov dword [rbp - 0x78], r15d
lea esi, [rdx - 7]
test r15d, r15d
jle 0x18006ce06
cmp r15d, edx
mov eax, r15d
cmovl eax, edx
test eax, eax
jle 0x18006ce06
mov rcx, qword [0x1801b5b38]
test rcx, rcx
je 0x18006cdee
add dword [rcx + 0xf4], esi
cdqe
imul rcx, rax, 0x70
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov qword [rbp - 0x70], rax
mov edx, 8
mov r13d, dword [rdi + 0x58]
mov dword [rsp + 0x70], r13d
test r13d, r13d
jle 0x18006ce47
cmp r13d, edx
mov ecx, r13d
cmovl ecx, edx
test ecx, ecx
jle 0x18006ce47
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006ce33
add dword [rax + 0xf4], esi
movsxd rcx, ecx
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
mov qword [rbp - 0x68], rax
imul ecx, r15d, 0x70
xor edx, edx
movsxd r8, ecx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov ecx, r13d
xor edx, edx
shl ecx, 5
movsxd r8, ecx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x6c], r12d
cmp dword [rdi + 0x78], r12d
jle 0x18006d133
mov r15, r12
lea r14, [rbx + 0x24]
mov r12, qword [rdi + 0x80]
xor r9d, r9d
or dword [r14 + 0x1c], 0xffffffff
mov edx, r9d
cmp dword [rdi + 0x58], r9d
jle 0x18006d127
or eax, 0xffffffff
mov r8d, r9d
cmp eax, 0xffffffff
jne 0x18006ceda
mov rax, qword [rdi + 0x60]
mov rcx, qword [r8 + rax]
cmp qword [r15 + r12 + 0x80], rcx
jne 0x18006cec2
mov dword [r14 + 0x1c], edx
mov eax, edx
jmp 0x18006cec6
mov eax, dword [r14 + 0x1c]
add edx, esi
add r8, 8
cmp edx, dword [rdi + 0x58]
jl 0x18006cea3
cmp eax, 0xffffffff
je 0x18006d127
mov r9d, dword [r15 + r12 + 0x10]
lea rbx, [r14 - 0xc]
mov r8d, dword [r15 + r12 + 8]
mov rdx, qword [r15 + r12]
mov rcx, qword [rbp + 0x220]
mov qword [rsp + 0x20], rbx
call fcn.180074030
xor r9d, r9d
test eax, eax
jne 0x18006d127
mov rcx, qword [rbx]
mov edx, 0x756e6963
call fcn.1800760d0
xor r9d, r9d
test eax, eax
jne 0x18006d127
mov ecx, dword [rbp + 0x230]
lea edx, [r9 + 8]
or ecx, dword [r15 + r12 + 0x4c]
mov eax, r9d
bt ecx, 9
mov dword [r14 - 4], ecx
cmovae eax, edx
test sil, cl
je 0x18006cf45
or eax, 2
test cl, 2
je 0x18006cf4e
bts eax, 0xf
test cl, 4
je 0x18006cf56
or eax, 0x20
test dl, cl
je 0x18006cf60
bts eax, 0x10
jmp 0x18006cf69
test cl, 0x10
je 0x18006cf69
bts eax, 0x11
mov dword [r14], eax
mov eax, ecx
shr eax, 6
and eax, 2
mov dword [r14 + 4], eax
bt ecx, 8
jae 0x18006cf83
bts dword [r14], 0x14
xor eax, eax
mov dword [rbp - 0x24], r9d
xorps xmm0, xmm0
mov qword [rbp - 0x1c], r9
movups xmmword [r14 - 0x24], xmm0
mov qword [r14 - 0x14], rax
lea rdx, [rbp - 0x28]
cvttss2si rbx, dword [r15 + r12 + 0x14]
mov eax, ecx
mov rcx, qword [r14 - 0xc]
shr eax, 9
not eax
and eax, esi
mov dword [rbp - 0x28], eax
mov eax, ebx
shl eax, 6
mov dword [rbp - 0x20], eax
call fcn.180075df0
mov rax, qword [r14 - 0xc]
mov rcx, qword [rax + 0x80]
movsd xmm0, qword [rcx + 0x28]
movups xmm1, xmmword [rcx + 0x18]
mov r10d, dword [rcx + 0x30]
movsd qword [rbp + 0x50], xmm0
mov r8d, dword [rbp + 0x50]
mov rcx, qword [rbp + 0x50]
shr rcx, 0x20
psrldq xmm1, 8
movq r9, xmm1
mov dword [r14 - 0x24], ebx
shr r9, 0x20
lea eax, [r9 + 0x3f]
and eax, 0xffffffc0
cdq
and edx, 0x3f
add eax, edx
sar eax, 6
movd xmm0, eax
lea eax, [r8 + 0x3f]
and eax, 0xffffffc0
cdq
cvtdq2ps xmm0, xmm0
and edx, 0x3f
add eax, edx
sar eax, 6
movss dword [r14 - 0x20], xmm0
movd xmm0, eax
lea eax, [rcx + 0x3f]
and eax, 0xffffffc0
sub ecx, r9d
cdq
cvtdq2ps xmm0, xmm0
and edx, 0x3f
add eax, edx
sar eax, 6
movss dword [r14 - 0x1c], xmm0
movd xmm0, eax
lea eax, [r8 + 0x3f]
add eax, ecx
and eax, 0xffffffc0
cdq
cvtdq2ps xmm0, xmm0
and edx, 0x3f
add eax, edx
sar eax, 6
movss dword [r14 - 0x18], xmm0
movd xmm0, eax
lea eax, [r10 + 0x3f]
and eax, 0xffffffc0
cdq
cvtdq2ps xmm0, xmm0
and edx, 0x3f
add eax, edx
sar eax, 6
movss dword [r14 - 0x14], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [r14 - 0x10], xmm0
mov eax, dword [r15 + r12 + 0x4c]
shr eax, 8
and al, sil
or byte [rbp + 0x238], al
lea rcx, [0x180161e4c]
mov rax, qword [r15 + r12 + 0x38]
xor r12d, r12d
movsxd rdx, dword [r14 + 0x1c]
mov r8, qword [rbp - 0x68]
shl rdx, 5
add rdx, r8
test rax, rax
cmovne rcx, rax
mov qword [r14 + 0x14], rcx
jmp 0x18006d0e9
cmp word [rcx + 2], r12w
je 0x18006d0ef
movzx eax, word [rcx + 2]
cmp dword [r14 + 0x20], eax
cmovge eax, dword [r14 + 0x20]
add rcx, 4
mov dword [r14 + 0x20], eax
cmp word [rcx], r12w
jne 0x18006d0cd
add dword [rdx], esi
mov eax, dword [r14 + 0x20]
cmp dword [rdx + 4], eax
cmovge eax, dword [rdx + 4]
add r14, 0x70
mov dword [rdx + 4], eax
add r15, 0x88
mov eax, dword [rsp + 0x6c]
add eax, esi
mov dword [rsp + 0x6c], eax
cmp eax, dword [rdi + 0x78]
jl 0x18006ce81
mov rbx, qword [rbp - 0x70]
mov r15d, dword [rbp - 0x78]
jmp 0x18006d137
mov rbx, qword [rbp - 0x70]
mov sil, r9b
jmp 0x18006e05a
mov r8, qword [rbp - 0x68]
mov dword [rsp + 0x60], r12d
mov r14d, r12d
test r15d, r15d
jle 0x18006d3bd
mov edi, dword [rsp + 0x60]
lea r14, [rbx + 0x48]
mov eax, r15d
mov r12d, r15d
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x38], r12
mov edx, dword [r14 - 4]
lea rcx, [r14 + 8]
movsxd r15, dword [r14 - 8]
add edx, 0x20
shl r15, 5
sar edx, 5
add r15, r8
call fcn.18004fb78
movsxd r8, dword [r14 + 8]
xor edx, edx
mov rcx, qword [r14 + 0x10]
shl r8, 2
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rbx, [r15 + 0x10]
cmp dword [rbx], edx
jne 0x18006d1bf
mov edx, dword [r15 + 4]
mov rcx, rbx
add edx, 0x20
sar edx, 5
call fcn.18004fb78
movsxd r8, dword [rbx]
xor edx, edx
mov rcx, qword [rbx + 8]
shl r8, 2
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r13, qword [r14 - 0x10]
movzx eax, word [r13]
test ax, ax
je 0x18006d268
cmp word [r13 + 2], dx
je 0x18006d264
movzx ebx, ax
movzx eax, word [r13 + 2]
cmp ebx, eax
ja 0x18006d252
mov rax, qword [r15 + 0x18]
mov ecx, ebx
and ecx, 0x1f
movsxd r12, ebx
sar r12, 5
mov dword [rsp + 0x68], ecx
mov eax, dword [rax + r12*4]
bt eax, ecx
jb 0x18006d241
mov rcx, qword [r14 - 0x30]
mov edx, ebx
call fcn.180071df0
xor edx, edx
test eax, eax
je 0x18006d243
add dword [r14], esi
add dword [r15 + 8], esi
mov rcx, qword [r14 + 0x10]
mov edx, dword [rsp + 0x68]
mov eax, dword [rcx + r12*4]
bts eax, edx
mov dword [rcx + r12*4], eax
mov rcx, qword [r15 + 0x18]
mov eax, dword [rcx + r12*4]
bts eax, edx
mov dword [rcx + r12*4], eax
add edi, esi
xor edx, edx
movzx eax, word [r13 + 2]
add ebx, esi
cmp ebx, eax
jle 0x18006d1e8
mov dword [rsp + 0x60], edi
add r13, 4
movzx eax, word [r13]
test ax, ax
jne 0x18006d1d1
mov r12, qword [rbp - 0x38]
mov r8, qword [rbp - 0x68]
add r14, 0x70
sub r12, rsi
mov qword [rbp - 0x38], r12
jne 0x18006d15e
mov rbx, qword [rbp - 0x70]
mov rdi, qword [rbp + 0x228]
add rbx, 0x60
mov edx, dword [rbx - 0x18]
mov rcx, rbx
call fcn.18006e1c8
mov r12, qword [rbx - 8]
movsxd rax, dword [rbx - 0x10]
mov r15, r12
lea rax, [r12 + rax*4]
mov qword [rbp - 0x60], rax
cmp r12, rax
jae 0x18006d379
xor edx, edx
lea edi, [rdx + 8]
mov r13d, dword [r15]
test r13d, r13d
je 0x18006d365
mov r14d, edx
bt r13d, r14d
jae 0x18006d354
xor eax, eax
lea rcx, [r15*8]
mov qword [rbp + 0x60], rax
xorps xmm6, xmm6
lea rax, [r12*8]
sub ecx, eax
and ecx, 0xffffffe0
add ecx, r14d
movzx eax, cx
mov ecx, dword [rbx + 4]
movups xmmword [rbp + 0x50], xmm6
mov dword [rbp + 0x58], eax
mov eax, dword [rbx]
cmp eax, ecx
jne 0x18006d330
lea r8d, [rax + 1]
test ecx, ecx
je 0x18006d318
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18006d31a
mov eax, edi
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.18006e1c8
mov eax, dword [rbx]
xor edx, edx
movups xmm0, xmmword [rbp + 0x50]
cdqe
movsd xmm1, qword [rbp + 0x60]
lea rcx, [rax + rax*4]
mov rax, qword [rbx + 8]
movups xmmword [rax + rcx*8], xmm6
movups xmmword [rax + rcx*8 + 0x10], xmm0
movsd qword [rax + rcx*8 + 0x20], xmm1
add dword [rbx], esi
add r14d, esi
cmp r14d, 0x20
jb 0x18006d2c7
mov rax, qword [rbp - 0x60]
add r15, 4
cmp r15, rax
jb 0x18006d2b8
mov rdi, qword [rbp + 0x228]
mov rcx, qword [rbx - 8]
xor r12d, r12d
test rcx, rcx
je 0x18006d3a5
mov rax, qword [0x1801b5b38]
mov qword [rbx - 0x10], r12
test rax, rax
je 0x18006d39b
dec dword [rax + 0xf4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx - 8], r12
add rbx, 0x70
sub qword [rbp - 0x80], rsi
jne 0x18006d28c
mov r14d, dword [rsp + 0x60]
mov r13d, dword [rsp + 0x70]
test r13d, r13d
jle 0x18006d402
mov rbx, qword [rbp - 0x68]
add rbx, 0x18
mov r15d, r13d
xor r13d, r13d
mov rcx, qword [rbx]
test rcx, rcx
je 0x18006d3f7
mov rax, qword [0x1801b5b38]
mov qword [rbx - 8], r13
test rax, rax
je 0x18006d3ee
dec dword [rax + 0xf4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx], r13
add rbx, 0x20
sub r15, rsi
jne 0x18006d3d0
jmp 0x18006d405
xor r13d, r13d
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18006d42a
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006d420
dec dword [rax + 0xf4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x38], r13
mov r15, r13
mov r12d, 8
test r14d, r14d
jle 0x18006d473
cmp r14d, r12d
mov eax, r14d
cmovl eax, r12d
test eax, eax
jle 0x18006d473
mov rcx, qword [0x1801b5b38]
test rcx, rcx
je 0x18006d45c
add dword [rcx + 0xf4], esi
cdqe
lea rcx, [rax + rax*2]
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
mov qword [rbp - 0x38], rax
lea ecx, [r14 + r14*2]
xor edx, edx
shl ecx, 3
movsxd r8, ecx
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x1801b5b38]
mov dword [rsp + 0x60], r13d
test rcx, rcx
je 0x18006d49e
add dword [rcx + 0xf4], esi
mov ecx, 0x40000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [0x1801b5b38]
mov rbx, rax
test rcx, rcx
je 0x18006d4be
add dword [rcx + 0xf4], esi
mov ecx, 0x40
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [rbp - 0x78]
mov r10d, r13d
movss xmm11, dword [0x180162ce4]
mov r9d, r13d
mov qword [rbp - 0x40], rax
mov qword [rax], rbx
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x78], r13d
test ecx, ecx
jle 0x18006d89a
mov rbx, qword [rbp - 0x70]
mov r8, r13
add rbx, 0x60
mov qword [rbp - 0x80], r13
mov r11d, ecx
mov qword [rbp - 0x48], rcx
mov r14d, 0xff
mov rdx, qword [rdi + 0x80]
cmp dword [rbx - 0x18], r13d
je 0x18006d87e
movsxd rax, r9d
add r9d, dword [rbx - 0x18]
mov dword [rbp - 0x54], r9d
lea rcx, [rax + rax*2]
lea rax, [r15 + rcx*8]
mov qword [rbx - 0x30], rax
movss xmm1, dword [r8 + rdx + 0x50]
ucomiss xmm1, xmm11
je 0x18006d588
mov byte [rsp + 0x64], sil
lea r8, [rbp + 0x70]
mov edx, r13d
mov eax, edx
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mulss xmm0, xmm1
cvttss2si rax, xmm0
cmp eax, r14d
movzx ecx, al
cmova ecx, r14d
add edx, esi
mov byte [r8], cl
add r8, rsi
cmp edx, 0x100
jb 0x18006d555
mov r8, qword [rbp - 0x80]
jmp 0x18006d58d
mov byte [rsp + 0x64], r13b
mov eax, dword [rdi + 0x14]
mov dword [rbp - 0x58], eax
mov dword [rsp + 0x68], r13d
cmp dword [rbx], r13d
jle 0x18006d87e
mov rdi, qword [rbp - 0x40]
xor eax, eax
mov r14d, eax
mov qword [rbp - 0x50], r13
mov r15, qword [rbx + 8]
mov rcx, qword [rbx - 0x48]
mov edx, dword [r14 + r15 + 0x18]
call fcn.180071df0
test eax, eax
je 0x18006d837
mov r8d, dword [rbx - 0x3c]
mov edx, eax
mov rcx, qword [rbx - 0x48]
call fcn.180072df0
test eax, eax
jne 0x18006d837
mov rax, qword [rbx - 0x48]
mov r13, qword [rax + 0x78]
mov eax, dword [rbx - 0x40]
test al, 0x20
je 0x18006d5f9
mov rcx, r13
call fcn.18007b530
mov eax, dword [rbx - 0x40]
test al, 0x40
je 0x18006d605
mov rcx, r13
call fcn.18007b630
lea rax, [r13 + 0x30]
test rax, rax
je 0x18006d833
mov rax, qword [rbx - 0x48]
mov edx, dword [rbx - 0x38]
mov rax, qword [rax + 0x78]
mov rcx, rax
mov qword [rbp - 0x60], rax
call fcn.180075830
xor r10d, r10d
test eax, eax
jne 0x18006d833
mov rax, qword [rbx - 0x48]
mov r9, qword [rax + 0x78]
add r9, 0x68
mov qword [rbp - 0x40], r9
mov r8d, dword [r9 + 4]
mov dword [r14 + r15], r8d
mov r13d, dword [r9]
mov dword [r14 + r15 + 4], r13d
mov rax, qword [rbx - 0x48]
mov rcx, qword [rax + 0x78]
mov eax, dword [rcx + 0x90]
mov dword [r14 + r15 + 8], eax
mov rax, qword [rbx - 0x48]
mov rcx, qword [rax + 0x78]
mov eax, dword [rcx + 0x94]
neg eax
mov dword [r14 + r15 + 0xc], eax
mov rax, qword [rbp - 0x60]
mov eax, dword [rax + 0x58]
add eax, 0x3f
and eax, 0xffffffc0
cdq
and edx, 0x3f
add eax, edx
mov edx, dword [rsp + 0x60]
sar eax, 6
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [r14 + r15 + 0x10], xmm0
cmp byte [r9 + 0x1a], 7
sete al
imul r13d, r8d
mov byte [r14 + r15 + 0x14], al
mov r8d, 0x40000
shl r13d, 2
lea eax, [rdx + r13]
cmp eax, r8d
jle 0x18006d7af
mov rax, qword [0x1801b5b38]
mov dword [rsp + 0x60], r10d
test rax, rax
je 0x18006d6e3
add dword [rax + 0xf4], esi
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rsp + 0x70]
mov qword [rbp - 0x30], rax
cmp r8d, r12d
jne 0x18006d796
test r12d, r12d
je 0x18006d710
mov eax, r12d
cdq
sub eax, edx
sar eax, 1
add eax, r12d
jmp 0x18006d715
mov eax, 8
lea r12d, [r8 + 1]
cmp eax, r12d
cmovg r12d, eax
cmp r12d, dword [rsp + 0x6c]
jle 0x18006d791
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006d739
add dword [rax + 0xf4], esi
movsxd rcx, r12d
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x60], rax
test rdi, rdi
je 0x18006d782
movsxd r8, dword [rsp + 0x70]
mov rdx, rdi
shl r8, 3
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x1801b5b38]
test rdx, rdx
je 0x18006d775
dec dword [rdx + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rbp - 0x60]
mov r8d, dword [rsp + 0x70]
mov rdi, rax
mov dword [rsp + 0x6c], r12d
jmp 0x18006d796
mov r12d, dword [rsp + 0x6c]
mov rcx, qword [rbp - 0x30]
mov edx, dword [rsp + 0x60]
movsxd rax, r8d
add r8d, esi
mov dword [rsp + 0x70], r8d
mov qword [rdi + rax*8], rcx
jmp 0x18006d7b4
mov r8d, dword [rsp + 0x70]
mov r9d, dword [r14 + r15]
movsxd rax, r8d
movsxd rcx, edx
add edx, r13d
mov dword [rsp + 0x60], edx
mov rdx, qword [rbp - 0x40]
mov r8, qword [rdi + rax*8 - 8]
mov al, byte [rsp + 0x64]
add r8, rcx
neg al
mov qword [r14 + r15 + 0x20], r8
lea rax, [rbp + 0x70]
sbb rcx, rcx
and rcx, rax
mov qword [rsp + 0x20], rcx
call fcn.18006c79c
mov r13, qword [rbp - 0x50]
mov ecx, dword [r14 + r15]
add ecx, dword [rbp - 0x58]
mov rax, qword [rbx - 0x30]
mov r10d, dword [rsp + 0x78]
mov dword [rax + r13 + 4], ecx
mov ecx, dword [r14 + r15 + 4]
add ecx, dword [rbp - 0x58]
mov rax, qword [rbx - 0x30]
mov dword [rax + r13 + 8], ecx
mov rcx, qword [rbx - 0x30]
mov eax, dword [rcx + r13 + 8]
imul eax, dword [rcx + r13 + 4]
add r10d, eax
mov dword [rsp + 0x78], r10d
jmp 0x18006d83c
mov r13, qword [rbp - 0x50]
mov r10d, dword [rsp + 0x78]
mov eax, dword [rsp + 0x68]
add r13, 0x18
add eax, esi
mov qword [rbp - 0x50], r13
add r14, 0x28
mov dword [rsp + 0x68], eax
cmp eax, dword [rbx]
jl 0x18006d5ae
mov r8, qword [rbp - 0x80]
xor r13d, r13d
mov r9d, dword [rbp - 0x54]
mov r14d, 0xff
mov r11, qword [rbp - 0x48]
mov r15, qword [rbp - 0x38]
mov qword [rbp - 0x40], rdi
mov rdi, qword [rbp + 0x228]
add r8, 0x88
add rbx, 0x70
sub r11, rsi
mov qword [rbp - 0x80], r8
mov qword [rbp - 0x48], r11
jne 0x18006d514
mov ebx, dword [rdi + 0x10]
mov dword [rdi + 0x44], r13d
test ebx, ebx
jg 0x18006d8f3
movd xmm0, r10d
xorps xmm1, xmm1
cvtdq2ps xmm0, xmm0
mov ebx, 0x200
sqrtss xmm1, xmm0
cvttss2si eax, xmm1
add eax, esi
movd xmm0, eax
mov eax, 0x400
cvtdq2ps xmm0, xmm0
comiss xmm0, dword [0x1801631e8]
cmovae ebx, eax
mov eax, 0x800
comiss xmm0, dword [0x1801631f4]
cmovae ebx, eax
mov eax, 0x1000
comiss xmm0, dword [0x1801631fc]
cmovae ebx, eax
mov dword [rdi + 0x40], ebx
mov r15, r13
sub ebx, dword [rdi + 0x14]
mov r12d, 8
mov qword [rbp - 0x60], r13
test ebx, ebx
jle 0x18006d93d
cmp ebx, r12d
mov eax, ebx
cmovl eax, r12d
test eax, eax
jle 0x18006d93d
mov rcx, qword [0x1801b5b38]
test rcx, rcx
je 0x18006d929
add dword [rcx + 0xf4], esi
movsxd rcx, eax
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
mov qword [rbp - 0x60], rax
mov ecx, dword [rdi + 0x40]
lea eax, [rbx - 1]
sub ecx, dword [rdi + 0x14]
mov r11d, 0x8000
sub r11d, dword [rdi + 0x14]
mov r10d, r13d
movsxd r9, eax
test eax, eax
jle 0x18006d97b
mov edx, esi
lea r8, [r15 + 8]
mov r10d, eax
movsxd rax, edx
add edx, esi
shl rax, 4
add rax, r15
mov qword [r8], rax
lea r8, [r8 + 0x10]
sub r9, rsi
jne 0x18006d963
movsxd rax, r10d
mov r14, r13
add rax, rax
mov qword [r15 + rax*8 + 8], r13
lea rax, [rbp + 0x18]
and qword [rbp + 0x18], 0
mov qword [rbp + 8], rax
lea eax, [rbx - 1]
add eax, ecx
mov dword [rbp + 4], ebx
cdq
mov qword [rbp - 4], rsi
idiv ebx
mov ebx, dword [rdi + 0x68]
mov dword [rbp - 8], eax
lea rax, [rbp + 0x28]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x10], r15
mov dword [rbp - 0x10], ecx
mov dword [rbp - 0xc], r11d
mov dword [rbp + 0x28], ecx
mov dword [rbp + 0x2c], 0x40000000
mov qword [rbp + 0x30], r13
test ebx, ebx
jle 0x18006da02
cmp ebx, r12d
mov eax, ebx
cmovl eax, r12d
test eax, eax
jle 0x18006da02
mov rcx, qword [0x1801b5b38]
test rcx, rcx
je 0x18006d9ef
add dword [rcx + 0xf4], esi
cdqe
lea rcx, [rax + rax*2]
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
lea ecx, [rbx + rbx*2]
xor edx, edx
shl ecx, 3
movsxd r8, ecx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov r9d, r13d
cmp dword [rdi + 0x68], r13d
jle 0x18006da4e
mov rdx, r13
lea r8, [r14 + 8]
mov rax, qword [rdi + 0x70]
add r9d, esi
movzx ecx, word [rax + rdx]
lea rdx, [rdx + 0x20]
mov dword [r8 - 4], ecx
mov rax, qword [rdi + 0x70]
movzx ecx, word [rax + rdx - 0x1e]
mov dword [r8], ecx
lea r8, [r8 + 0x18]
cmp r9d, dword [rdi + 0x68]
jl 0x18006da25
mov r8d, ebx
lea rcx, [rbp - 0x10]
mov rdx, r14
call fcn.1800505dc
test ebx, ebx
jle 0x18006daa8
mov r8, r13
lea rdx, [r14 + 0x10]
mov r9, rbx
cmp dword [rdx + 4], r13d
je 0x18006da9b
movzx eax, word [rdx - 4]
mov rcx, qword [rdi + 0x70]
mov word [r8 + rcx + 4], ax
movzx eax, word [rdx]
mov rcx, qword [rdi + 0x70]
mov word [r8 + rcx + 6], ax
mov eax, dword [rdx - 8]
add eax, dword [rdx]
cmp dword [rdi + 0x44], eax
cmovge eax, dword [rdi + 0x44]
mov dword [rdi + 0x44], eax
add r8, 0x20
add rdx, 0x18
sub r9, rsi
jne 0x18006da6b
test r14, r14
je 0x18006dac8
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006dabf
dec dword [rax + 0xf4]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12d, dword [rbp - 0x78]
mov r13, qword [rbp - 0x70]
test r12d, r12d
jle 0x18006db31
lea rbx, [r13 + 0x48]
mov r14d, r12d
xor eax, eax
mov r8d, dword [rbx]
test r8d, r8d
je 0x18006db28
mov rdx, qword [rbx - 0x18]
lea rcx, [rbp - 0x10]
call fcn.18006cb14
xor eax, eax
mov r8d, eax
cmp dword [rbx], eax
jle 0x18006db28
mov ecx, eax
mov rdx, qword [rbx - 0x18]
cmp dword [rdx + rcx + 0x14], eax
je 0x18006db1c
mov eax, dword [rdx + rcx + 0x10]
add eax, dword [rdx + rcx + 8]
cmp dword [rdi + 0x44], eax
cmovge eax, dword [rdi + 0x44]
mov dword [rdi + 0x44], eax
xor eax, eax
add r8d, esi
add rcx, 0x18
cmp r8d, dword [rbx]
jl 0x18006dafe
add rbx, 0x70
sub r14, rsi
jne 0x18006dade
mov eax, dword [rdi + 0x44]
test byte [rdi], sil
jne 0x18006db5e
lea ecx, [rax - 1]
mov eax, ecx
sar eax, 1
or ecx, eax
mov eax, ecx
sar eax, 2
or ecx, eax
mov eax, ecx
sar eax, 4
or ecx, eax
mov eax, ecx
sar eax, 8
or ecx, eax
mov eax, ecx
sar eax, 0x10
or eax, ecx
movd xmm0, dword [rdi + 0x40]
inc eax
movsxd rbx, dword [rdi + 0x40]
movaps xmm2, xmm11
cvtdq2ps xmm0, xmm0
mov dword [rdi + 0x44], eax
xor ecx, ecx
movd xmm1, eax
divss xmm2, xmm0
cdqe
cvtdq2ps xmm1, xmm1
movaps xmm0, xmm11
movss dword [rdi + 0x48], xmm2
divss xmm0, xmm1
imul rbx, rax
movss dword [rdi + 0x4c], xmm0
mov rax, qword [0x1801b5b38]
cmp byte [rbp + 0x238], cl
je 0x18006dbc5
shl rbx, 2
test rax, rax
je 0x18006dbb6
add dword [rax + 0xf4], esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x38], rax
jmp 0x18006dbdd
test rax, rax
je 0x18006dbd0
add dword [rax + 0xf4], esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x30], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor r10d, r10d
mov al, r10b
mov byte [rbp + 0x238], al
test r12d, r12d
jle 0x18006df6e
mov ebx, r10d
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x50], rbx
lea r15, [r13 + 8]
mov r14, r12
cmp dword [r15 + 0x40], r10d
je 0x18006df44
mov r12, qword [rdi + 0x80]
movss xmm6, dword [r15 - 4]
add r12, rbx
movss xmm7, dword [r15]
mov r13, qword [r12 + 0x80]
cmp byte [r12 + 0x48], r10b
jne 0x18006dc6d
mov rcx, r13
call fcn.1800567e4
mov eax, dword [r12 + 0x14]
xor r10d, r10d
mov dword [r13 + 0x14], eax
movzx eax, r10w
movss dword [r13 + 0x68], xmm6
movss dword [r13 + 0x6c], xmm7
mov qword [r13 + 0x48], r12
mov qword [r13 + 0x40], rdi
jmp 0x18006dc78
movzx eax, word [r13 + 0x50]
movss xmm6, dword [r13 + 0x68]
addss xmm6, dword [0x180162b9c]
add ax, si
mov dword [rsp + 0x6c], r10d
mov word [r13 + 0x50], ax
mov r9d, dword [rdi + 0x14]
movss xmm10, dword [r12 + 0x2c]
cvttss2si eax, xmm6
mov dword [rsp + 0x60], r9d
movd xmm9, eax
cvtdq2ps xmm9, xmm9
addss xmm9, dword [r12 + 0x30]
cmp dword [r15 + 0x40], r10d
jle 0x18006df40
mov rcx, r10
mov rbx, r10
mov qword [rsp + 0x78], rcx
mov rdx, qword [r15 + 0x28]
mov r14, qword [r15 + 0x60]
cmp dword [rcx + rdx + 4], r10d
jne 0x18006dce0
cmp dword [rcx + rdx + 8], r10d
je 0x18006df17
mov r8d, dword [rcx + rdx + 0xc]
movaps xmm2, xmm11
movd xmm0, dword [rdi + 0x44]
add r8d, r9d
add r9d, dword [rcx + rdx + 0x10]
movaps xmm1, xmm11
mov edx, dword [rbx + r14 + 4]
mov ecx, dword [rbx + r14]
movd xmm8, dword [rbx + r14 + 0xc]
movd xmm3, dword [rbx + r14 + 8]
cvtdq2ps xmm0, xmm0
lea eax, [rdx + r9]
mov dword [rbp - 0x58], r8d
mov dword [rbp - 0x54], r9d
movd xmm4, r8d
divss xmm2, xmm0
movd xmm0, dword [rdi + 0x40]
cvtdq2ps xmm0, xmm0
movd xmm7, eax
lea eax, [rcx + r8]
movzx r8d, word [rbx + r14 + 0x18]
divss xmm1, xmm0
movss xmm0, dword [rbx + r14 + 0x10]
movss dword [rsp + 0x58], xmm0
movd xmm5, r9d
movd xmm6, eax
cvtdq2ps xmm5, xmm5
cvtdq2ps xmm4, xmm4
mulss xmm5, xmm2
mulss xmm4, xmm1
cvtdq2ps xmm3, xmm3
cvtdq2ps xmm7, xmm7
addss xmm3, xmm10
mulss xmm7, xmm2
movd xmm2, edx
mov rdx, r12
cvtdq2ps xmm2, xmm2
movss dword [rsp + 0x50], xmm7
cvtdq2ps xmm6, xmm6
cvtdq2ps xmm8, xmm8
mulss xmm6, xmm1
movd xmm1, ecx
addss xmm8, xmm9
cvtdq2ps xmm1, xmm1
mov rcx, r13
movss dword [rsp + 0x48], xmm6
addss xmm2, xmm8
movss dword [rsp + 0x40], xmm5
addss xmm1, xmm3
movss dword [rsp + 0x38], xmm4
movss dword [rsp + 0x30], xmm2
movss dword [rsp + 0x28], xmm1
movss dword [rsp + 0x20], xmm8
call fcn.180056d1c
cmp byte [rbx + r14 + 0x14], 0
movsxd rax, dword [r13 + 0x28]
lea rcx, [rax + rax*4]
mov rax, qword [r13 + 0x30]
je 0x18006ddf2
or dword [rax + rcx*8 - 0x28], esi
mov byte [rbp + 0x238], sil
movsxd r10, dword [rdi + 0x40]
movsxd rax, dword [rbp - 0x58]
movsxd rdx, dword [rbp - 0x54]
mov r9, qword [rdi + 0x30]
movsxd rcx, dword [rbx + r14]
mov r8, qword [rbx + r14 + 0x20]
imul rdx, r10
mov qword [rbp - 0x48], r10
add rdx, rax
xor eax, eax
test r9, r9
je 0x18006de96
xor r10d, r10d
mov dword [rsp + 0x68], eax
lea r11, [rdx + r9]
cmp dword [rbx + r14 + 4], r10d
jle 0x18006df0d
mov rdx, rcx
shl rdx, 2
mov qword [rbp - 0x80], rdx
xor edi, edi
mov r9, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x48]
mov r10d, edi
test ecx, ecx
jle 0x18006de7a
mov rdx, r11
lea r9, [r8 + 3]
mov al, byte [r9]
add r10d, esi
mov byte [rdx], al
lea r9, [r9 + 4]
mov ecx, dword [rbx + r14]
add rdx, rsi
cmp r10d, ecx
jl 0x18006de56
mov eax, dword [rsp + 0x68]
mov rdx, qword [rbp - 0x48]
mov r9, qword [rbp - 0x80]
add eax, esi
add r11, rdx
add r8, r9
mov dword [rsp + 0x68], eax
cmp eax, dword [rbx + r14 + 4]
jl 0x18006de48
mov rdi, qword [rbp + 0x228]
jmp 0x18006df0a
mov rax, qword [rdi + 0x38]
lea r9, [rax + rdx*4]
xor edx, edx
mov eax, edx
mov dword [rsp + 0x68], edx
cmp dword [rbx + r14 + 4], edx
jle 0x18006df0a
lea rdx, [r10*4]
lea r10, [rcx*4]
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x80], r10
xor r11d, r11d
test ecx, ecx
jle 0x18006def7
mov r10, r8
mov rdx, r9
sub r10, r9
mov eax, dword [r10 + rdx]
add r11d, esi
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov ecx, dword [rbx + r14]
cmp r11d, ecx
jl 0x18006ded5
mov eax, dword [rsp + 0x68]
mov rdx, qword [rbp - 0x48]
mov r10, qword [rbp - 0x80]
add eax, esi
add r9, rdx
add r8, r10
mov dword [rsp + 0x68], eax
cmp eax, dword [rbx + r14 + 4]
jl 0x18006dec5
xor r10d, r10d
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov edx, dword [rsp + 0x6c]
add rcx, 0x18
add edx, esi
mov qword [rsp + 0x78], rcx
add rbx, 0x28
mov dword [rsp + 0x6c], edx
cmp edx, dword [r15 + 0x40]
jl 0x18006dcc6
mov rbx, qword [rbp - 0x50]
mov r14, qword [rbp - 0x30]
mov qword [r15 + 0x28], r10
add rbx, 0x88
add r15, 0x70
sub r14, rsi
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x30], r14
jne 0x18006dc11
mov r15, qword [rbp - 0x60]
mov r12d, dword [rbp - 0x78]
mov al, byte [rbp + 0x238]
mov r13, qword [rbp - 0x40]
mov byte [rdi + 0x29], al
mov eax, dword [rsp + 0x70]
test eax, eax
jle 0x18006dfac
mov rbx, r13
mov r14d, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x18006df9d
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006df9d
dec dword [rax + 0xf4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rbx, 8
sub r14, rsi
jne 0x18006df83
test r12d, r12d
jle 0x18006dfc9
mov rbx, qword [rbp - 0x70]
mov r14d, r12d
mov rcx, rbx
call fcn.18006e25c
add rbx, 0x70
sub r14, rsi
jne 0x18006dfb8
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x18006dff1
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006dfe4
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov ebx, eax
mov rcx, rdi
call fcn.18005655c
test r15, r15
je 0x18006e019
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006e010
dec dword [rax + 0xf4]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r13, r13
je 0x18006e039
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006e030
dec dword [rax + 0xf4]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18006e05a
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006e054
dec dword [rax + 0xf4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18006e07b
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006e075
dec dword [rax + 0xf4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x18006e09b
mov rax, qword [0x1801b5b38]
test rax, rax
je 0x18006e092
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r11, [rsp + 0x2d8]
mov al, sil
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret