Function at 0x18000ee40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x90
mov rax, qword [rcx + 0xc0]
mov rbx, rcx
cmp rax, qword [rcx + 0xc8]
jae 0x18000ee83
movzx r10d, byte [rax]
inc rax
mov qword [rcx + 0xc0], rax
jmp 0x18000eea8
cmp dword [rcx + 0x30], 0
je 0x18000eea5
call fcn.180003830
mov rax, qword [rbx + 0xc0]
movzx r10d, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000eea8
xor r10b, r10b
mov ecx, 0x30
mov rdx, rbx
mov qword [rsp + 0x88], r14
lea rsi, [rcx + rbx]
movzx ecx, r10b
mov dword [rsp + 0xf8], ecx
mov qword [rsp + 0x78], rsi
cmp rax, qword [rbx + 0xc8]
jae 0x18000eee5
movzx r14d, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000ef0c
cmp dword [rsi], 0
je 0x18000ef09
mov rcx, rbx
call fcn.180003830
mov rax, qword [rbx + 0xc0]
movzx r14d, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000ef0c
xor r14b, r14b
mov byte [rsp + 0xd0], r14b
cmp rax, qword [rbx + 0xc8]
jae 0x18000ef2c
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000ef51
cmp dword [rsi], 0
je 0x18000ef4f
mov rcx, rbx
call fcn.180003830
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000ef51
xor cl, cl
movzx eax, cl
mov rcx, rbx
mov dword [rsp + 0x3c], eax
call fcn.180003a40
mov rcx, rbx
movsxd r15, eax
call fcn.180003a40
mov rcx, qword [rbx + 0xc0]
mov dword [rsp + 0x50], eax
cmp rcx, qword [rbx + 0xc8]
jae 0x18000ef8e
movzx edx, byte [rcx]
inc rcx
mov qword [rbx + 0xc0], rcx
jmp 0x18000efb3
cmp dword [rsi], 0
je 0x18000efb1
mov rcx, rbx
call fcn.180003830
mov rax, qword [rbx + 0xc0]
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000efb3
xor dl, dl
mov rcx, rbx
movzx edi, dl
call fcn.180003a40
mov rcx, rbx
call fcn.180003a40
mov rcx, rbx
call fcn.180003a40
mov rcx, rbx
mov dword [rsp + 0x34], eax
call fcn.180003a40
mov dword [rsp + 0x40], eax
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x18000effd
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000f022
cmp dword [rsi], 0
je 0x18000f020
mov rcx, rbx
call fcn.180003830
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000f022
xor cl, cl
movzx r10d, cl
mov dword [rsp + 0x58], r10d
cmp rax, qword [rbx + 0xc8]
jae 0x18000f043
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000f06d
cmp dword [rsi], 0
je 0x18000f06b
mov rcx, rbx
call fcn.180003830
mov rax, qword [rbx + 0xc0]
mov r10d, dword [rsp + 0x58]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000f06d
xor cl, cl
mov r8d, dword [rsp + 0x40]
xor ebp, ebp
movzx eax, cl
mov r12d, ebp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x54], ebp
lea r13d, [rbp + 1]
cmp r8d, 0x1000000
jg 0x18000f85c
mov r9d, dword [rsp + 0x34]
cmp r9d, 0x1000000
jg 0x18000f85c
mov ecx, dword [rsp + 0x3c]
cmp ecx, 8
lea edx, [rcx - 8]
cmovb edx, ecx
shr eax, 5
and eax, r13d
mov ecx, r13d
sub ecx, eax
test r14b, r14b
mov dword [rsp + 0x5c], ecx
mov r14d, ebp
je 0x18000f0f0
mov ecx, edi
sub ecx, 8
je 0x18000f0eb
sub ecx, 7
je 0x18000f145
sub ecx, r13d
je 0x18000f145
sub ecx, 8
je 0x18000f10f
cmp ecx, 8
jne 0x18000f118
jmp 0x18000f10f
mov edi, r13d
jmp 0x18000f112
mov ecx, r10d
sub ecx, 8
je 0x18000f151
sub ecx, 7
je 0x18000f145
sub ecx, r13d
je 0x18000f137
sub ecx, 8
je 0x18000f10c
cmp ecx, 8
jne 0x18000f118
mov edi, r10d
shr edi, 3
mov esi, edi
test edi, edi
jne 0x18000f157
mov edx, dword [0x18018d84c]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, str.bad_format
jmp 0x18000f876
cmp edx, 3
jne 0x18000f145
mov edi, 2
mov esi, edi
jmp 0x18000f157
mov edi, 3
mov r14d, r13d
mov esi, edi
jmp 0x18000f157
mov edi, r13d
mov esi, r13d
mov rax, qword [rsp + 0xd8]
mov dword [rax], r9d
mov rax, qword [rsp + 0xe0]
mov dword [rax], r8d
mov rax, qword [rsp + 0xe8]
test rax, rax
je 0x18000f17c
mov dword [rax], edi
test r9d, r9d
js 0x18000f85c
test r8d, r8d
js 0x18000f85c
je 0x18000f1a2
mov eax, 0x7fffffff
cdq
idiv r8d
cmp r9d, eax
jg 0x18000f85c
mov ecx, r8d
imul ecx, r9d
test ecx, ecx
js 0x18000f85c
xor edx, edx
mov eax, 0x7fffffff
div edi
cmp ecx, eax
jg 0x18000f85c
test r8d, r8d
je 0x18000f1d9
mov eax, 0x7fffffff
cdq
idiv r8d
cmp r9d, eax
jg 0x18000f840
mov eax, r8d
imul eax, edi
imul eax, r9d
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x48], rax
mov r8, rax
test rax, rax
je 0x18000f840
movsxd rdx, dword [rsp + 0xf8]
test edx, edx
je 0x18000f244
cmp qword [rbx + 0x10], rbp
je 0x18000f23d
mov ecx, dword [rbx + 0xc8]
sub ecx, dword [rbx + 0xc0]
cmp ecx, edx
jge 0x18000f23d
mov rax, qword [rbx + 0xc8]
sub edx, ecx
mov rcx, qword [rbx + 0x28]
mov qword [rbx + 0xc0], rax
call qword [rbx + 0x18]
mov r8, qword [rsp + 0x48]
jmp 0x18000f244
add qword [rbx + 0xc0], rdx
cmp byte [rsp + 0xd0], bpl
jne 0x18000f30d
mov edx, dword [rsp + 0x3c]
mov r15d, edi
mov dword [rsp + 0xf8], r14d
cmp edx, 8
jae 0x18000f477
mov dword [rsp + 0xf8], r14d
test r14d, r14d
jne 0x18000f477
mov r13d, dword [rsp + 0x40]
mov dword [rsp + 0xf8], r14d
test r13d, r13d
jle 0x18000f2fa
imul r15d, dword [rsp + 0x34]
cmp dword [rsp + 0x5c], ebp
mov ebp, r13d
mov dword [rsp + 0xf8], r14d
je 0x18000f2d9
mov eax, r15d
neg eax
movsxd r12, eax
lea eax, [r13 - 1]
imul eax, edi
imul eax, dword [rsp + 0x34]
movsxd rsi, eax
add rsi, r8
nop
mov r8d, r15d
mov rdx, rsi
mov rcx, rbx
call fcn.1800038b0
add rsi, r12
sub rbp, 1
jne 0x18000f2c0
jmp 0x18000f2f7
movsxd r12, r15d
mov rsi, r8
nop
mov r8d, r15d
mov rdx, rsi
mov rcx, rbx
call fcn.1800038b0
add rsi, r12
sub rbp, 1
jne 0x18000f2e0
mov r15d, edi
mov edx, dword [rsp + 0x34]
mov r14d, r13d
imul r14d, edx
mov esi, r15d
jmp 0x18000f7cf
cmp dword [rsp + 0x50], ebp
jne 0x18000f33b
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, dword [0x18018d84c]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, str.bad_palette
jmp 0x18000f876
test r15d, r15d
je 0x18000f38d
jns 0x18000f352
mov rax, qword [rbx + 0xc8]
mov qword [rbx + 0xc0], rax
jmp 0x18000f38d
cmp qword [rbx + 0x10], rbp
je 0x18000f386
mov ecx, dword [rbx + 0xc8]
sub ecx, dword [rbx + 0xc0]
cmp ecx, r15d
jge 0x18000f386
mov rax, qword [rbx + 0xc8]
sub r15d, ecx
mov rcx, qword [rbx + 0x28]
mov edx, r15d
mov qword [rbx + 0xc0], rax
call qword [rbx + 0x18]
jmp 0x18000f38d
add qword [rbx + 0xc0], r15
mov r15d, dword [rsp + 0x50]
test r15d, r15d
js 0x18000f835
xor edx, edx
imul esi, r15d
mov eax, 0x7fffffff
div edi
cmp r15d, eax
jg 0x18000f835
movsxd rcx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x18000f835
mov dword [rsp + 0xf8], r14d
test r14d, r14d
je 0x18000f4ea
mov rsi, rax
test r15d, r15d
jle 0x18000f4e5
mov eax, edi
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x38], edi
mov rcx, rbx
call fcn.180003a40
movzx r8d, ax
mov eax, r8d
shr eax, 0xa
and eax, 0x1f
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
shr eax, 5
and r8d, 0x1f
and eax, 0x1f
mov byte [rsi], dl
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
add edx, ecx
imul ecx, r8d, 0xff
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x84210843
mov byte [rsi + 1], dl
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [rsi + 2], dl
add rsi, rdi
sub r15, r13
jne 0x18000f3f0
mov r15d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov r14d, dword [rsp + 0x40]
mov eax, dword [rsp + 0x34]
imul r14d, eax
mov esi, r15d
mov dword [rsp + 0x38], r14d
test r14d, r14d
je 0x18000f74c
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
sub rax, rcx
mov ecx, r14d
mov r14, qword [rsp + 0x78]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x70], rax
cmp edx, 8
jb 0x18000f562
test r12d, r12d
jne 0x18000f553
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x18000f518
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000f53d
mov r15d, edi
jmp 0x18000f473
mov r8d, esi
mov rdx, rax
mov rcx, rbx
mov r15d, edi
call fcn.1800038b0
test eax, eax
jne 0x18000f473
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x68]
jmp 0x18000f316
cmp dword [r14], ebp
je 0x18000f53b
mov rcx, rbx
call fcn.180003830
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000f53d
xor cl, cl
movzx eax, cl
mov r12d, eax
and r12d, 0x7f
inc r12d
shr eax, 7
mov dword [rsp + 0x54], eax
jmp 0x18000f562
cmp dword [rsp + 0x54], ebp
je 0x18000f562
test r13d, r13d
je 0x18000f6ed
cmp byte [rsp + 0xd0], bpl
je 0x18000f5fe
cmp dword [rsp + 0x58], 8
jne 0x18000f5c6
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x18000f599
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
movzx eax, cl
jmp 0x18000f5ce
cmp dword [r14], ebp
je 0x18000f5bf
mov rcx, rbx
call fcn.180003830
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
movzx eax, cl
jmp 0x18000f5ce
xor cl, cl
movzx eax, cl
jmp 0x18000f5ce
mov rcx, rbx
call fcn.180003a40
test r15d, r15d
je 0x18000f6e0
cmp eax, dword [rsp + 0x50]
mov ecx, ebp
mov r8, rsi
cmovl ecx, eax
imul ecx, r15d
movsxd rdx, ecx
lea rcx, [rsp + 0x30]
add rdx, qword [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18000f6e0
cmp dword [rsp + 0xf8], ebp
je 0x18000f683
mov rcx, rbx
call fcn.180003a40
movzx r8d, ax
mov eax, r8d
shr eax, 0xa
and eax, 0x1f
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
shr eax, 5
and r8d, 0x1f
and eax, 0x1f
mov byte [rsp + 0x30], dl
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
add edx, ecx
imul ecx, r8d, 0xff
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x84210843
mov byte [rsp + 0x31], dl
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [rsp + 0x32], dl
jmp 0x18000f6e0
mov rdi, rbp
test r15d, r15d
je 0x18000f6e0
nop dword [rax + rax]
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x18000f6af
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000f6d4
cmp dword [r14], ebp
je 0x18000f6d2
mov rcx, rbx
call fcn.180003830
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x18000f6d4
xor cl, cl
mov byte [rsp + rdi + 0x30], cl
inc rdi
cmp rdi, rsi
jl 0x18000f690
mov rax, qword [rsp + 0x70]
mov r13d, ebp
mov rcx, qword [rsp + 0x60]
mov rdi, rbp
test r15d, r15d
je 0x18000f722
lea rcx, [rsp + 0x30]
mov r8, rsi
add rcx, rax
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
nop word [rax + rax]
inc rdi
cmp rdi, rsi
jl 0x18000f710
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
movsxd rdx, r15d
dec r12d
add rax, rdx
mov edx, dword [rsp + 0x3c]
sub rcx, 1
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rcx
jne 0x18000f4b4
mov r14d, dword [rsp + 0x38]
mov eax, dword [rsp + 0x34]
mov r13d, dword [rsp + 0x40]
cmp dword [rsp + 0x5c], ebp
je 0x18000f7b8
test r13d, r13d
jle 0x18000f7b8
mov rdi, qword [rsp + 0x48]
lea r10d, [r13 - 1]
imul r10d, r15d
mov r11d, r15d
imul r11d, eax
mov ebx, ebp
imul r10d, eax
mov r8d, r11d
test r11d, r11d
jle 0x18000f7aa
movsxd rax, ebx
movsxd r9, r10d
sub r9, rax
lea rdx, [rax + rdi]
nop dword [rax + rax]
movzx eax, byte [r9 + rdx]
dec r8d
movzx ecx, byte [rdx]
mov byte [rdx], al
mov byte [r9 + rdx], cl
lea rdx, [rdx + 1]
test r8d, r8d
jg 0x18000f790
add ebx, r11d
sub r10d, r11d
add ebp, 2
cmp ebp, r13d
jl 0x18000f776
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18000f7cb
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x48]
cmp r15d, 3
jb 0x18000f80e
cmp dword [rsp + 0xf8], 0
jne 0x18000f80e
mov r8, rax
test r14d, r14d
je 0x18000f80e
mov r10d, r14d
nop
movzx ecx, byte [r8]
movzx eax, byte [r8 + 2]
mov byte [r8], al
mov byte [r8 + 2], cl
add r8, rsi
sub r10, 1
jne 0x18000f7f0
mov rax, qword [rsp + 0x48]
mov r8d, dword [rsp + 0xf0]
test r8d, r8d
je 0x18000f881
cmp r8d, r15d
je 0x18000f881
mov r9d, edx
mov dword [rsp + 0x20], r13d
mov edx, r15d
mov rcx, rax
call fcn.180003b00
jmp 0x18000f881
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, dword [0x18018d84c]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, str.outofmem
jmp 0x18000f876
mov edx, dword [0x18018d84c]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, str.too_large
mov ecx, 0x28
mov qword [rcx + rax], rdx
xor eax, eax
mov r14, qword [rsp + 0x88]
add rsp, 0x90
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret