Function at 0x180001730
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push r14
sub rsp, 0x130
mov r14, rcx
mov ecx, 0x9139c
call fcn.180001ed0
xor edx, edx
mov r8d, 0x91394
mov rcx, rax
mov rsi, rax
call fcn.180002da0
xor ebx, ebx
lea r9, str.TRwNndnjY2wngBcORiqY0fTonIFWJF4qL8QaQ7TG2VDVUKjtUUQC_TKFQlEAhl_1j06f4VNkS0w_r_ntfrmeULmoJ0ULzFarJ3L6bN7S3gLpLBrDji9N2yj19RYDXS1lc4yPqrtKPHhlPAIjDKftW_r_n4882WbbeKWApUHj7kz5gZ8tpsHcNTt7uigNGZkXhEOPc9QuHc4THs_pqvF66bTGCYSFyXvmsLbx_r_nxgiV_yqB0lojmhJIK75mefc2p29iR6cmIloOO3qW68zU9pXd5PzA4yk01uqZOLnH16HelQ6gu_r_nLQRUWisPdSqQLFAE6EaJWKvW6QLwuljn1UK7EGCv1Udr_hNdqLqw7EiD8KNyurDv8sHVIE7dBBQm_r_nMQSp2nIflActlmcrBAzxDCjQ9pXu21ozKwaXimObXNAd29UdlG5WsjqNvs8eNWXx3dlMeLdTYD_r_nbo96_tyO0goLSrahVyep1xHE3GnGmMZKGjTKTX7Kp4kfVM2GGJzczZtFeQ07xU8CDu4bByEmioX_r_nclvVQU1oE6rHAFSyrjNDzfDqysbyGL3PNnAuVVSwzuGl3sYxw8TbmAAtOeWXLC1VK7vWpxsuw3_r_nMY5zYknwa_p8x1gdSBhXoGEM9UlEAaDwaPUfyhGalDMCIiDaCiZAqBKQktWDOQYjL1BF1Rv9rLa4_r_nl8D0dPqCPI8AXNwZxxEADWUQrGA4EGFEMpGyXicwRddnIBfHZlQs611T0CsNNqjT5xBNgcshSvyE_r_nQdQun3RZdFB2ki57l0hLrYgbS4YY3kKsV3Kox92LyDohqD34eA3EO9G2hhS517L5eqHRqlJhmns_r_nxbFvDvgXcvjyTYnNUVRpvZY4zuxs4_HWMzt01vZRXVy4JNpjKjeQNs5yPQOcBpCybRt1t_pWxGDl_r_n3ddEElWq3RYAZsXp07nIrGwFHi5Fwteu19NG48FxOGAxe0xmvYBbbV0yctUGDIwWwymWDsEt5LC_r_nnN8YpcMLvy2g4dx92_BxermoaBDAfsfYv_Ny3hIXwPez5n4Tj_1EygbDMb2eEhXgdl8Tqf8qOTM_r_nxH_6vArCxZFcvOKKKAiB_TAfZ5CYeWpBqeeKWJPXmb1kbtXGtKbz_D55fQB1qZRjDWfD62c5aEzK_r_njs6jFUp8Oyf3lLzZbS6LJ62REvZtXKNyHhsOqvmeGtgQJrIyAkNyK4im3GiDNQPpqh206IfKB4J_r_nRncmrBYvrtczlC6rxtlAmzY2AmqGxGtf1RCW_ApUlL3ESzDqBerQ0lhnw524_yj_p1NSFrtEV__r_n3dpLaVnR4OoGZLGvC1o29KzSIajist33WEXIZfMhyz0exetk1Ap_mj2SmblikP4fnump_Ptxzb_r_nUjarCv0xQpYqyD2DeeoHkP3i2i3Apwyrh_GHkIUc3j3DgEGEHanRu5BbVJFhN4FVrLGa13wc9fQt_r_nEu9Oyr0Wt6BMbOrckPedLedQOhtrenOcZdtTVcFHSx8az8eXaNUp0qo0nLvZ4tvq7pTWWanr8Vb_r_n8FXizBtUDJKwKb3gzNQ6LRJG0f7qihM7mzoKQvpczCThVpYuv82YSkg2C1SsfmaXcWQ4jZTU7bAN_r_n3it3blEdvvnptJwUfBottOcKnDMjQhIszFSUoMUmEi0NFLyDfpQppBmDT7cRY5Cn8Kq53zh2ruuy_r_n6Q4rUaUnimdRoGDUSYoXsHTkaqYJGn2ONwmAWGbZ1RiSvcZ18Fo93u4IiZmsTJ6mQanOtEP2uk_L_r_nOdl3jY8DCI0h192YCViPrc2YVPPe0Jp_OU_hzlSUnPT5DnkWMd6DpcrWyHnGOY_ui9tw8qYRwDr9_r_nCIGk_f_9bwxqBJBh5LEimXcs0fcOu4wwvO8g4rDJOQ5udVKxWkJWSiexuQn2zMs9DLtHsSEUI2_r_nIxTj5sBw9STbRr6hJMsCC1zHHzI21njPXWTjkc0ZQxsJ_BR7fq94Ig7Zy0NMcl3hPF3_f5I6q8D_r_nbQ0lV8grjrqmqRuBcxDgzbtopFW8_MCFtcMSoc0kHD39hovLhnHwq6owtAsKnWCudDXKzvSUnQ_r_nD6IavRlt95azKR9xazSxuJwS32ImTwZOYnKeWpqF13WpX2AZQzuIQbzysL7pIyUibgjUNBVJq_r_n4OsSmtrtpuVMwqpwFQmoJ_NASKQWPTQboYZMYGMwhsUA_wmlip8nvmp630dieZnN06N0c6kqZEY_r_nzPcWcXsQKGDrie2tvPQ28zlcnixBIu3ufuUICj3RcZFtmiqOq62BdMSKwOtZ7KhHi6Ojkvor_Ffd_r_nNfG7n6a9t7WJ9WmD_PRk_5FC61PKAoW3gHr9fzpiomeTbakYr0FHWBL8b_5qNzCbOL0eOl8qJ6F_r_nDFT1lScQm7ly1D9yLlo3RSMnpc9fYiqcF24LcQHN3qDhcst6qw9_znj6Ng_JfkTu42d_NtRXbp_r_nv0Yoc9Bt6E5BaPBjQ1_nTKcNempFYVhqHIxxCrJ9pg1jJLSPvcQ4vaXTbXDez_Vmec1zfSdj5r1_r_nasIYWfiR6mOzm6WwJt9VpubbpNL9KgMueVixW1DJmpDQD2Di9vMZIZWtbCkC5A_RPwZVoK_lAJKo_r_nM84GGVbnZeThxu_6r_C4DEFPzw7wrIau6UM719Dz2FcBH921jNPFzSPaOKd9hK0dLDZkHlxqJJrW_r_noe_7gu3UfUbAiUGdKm4uYJAIpYkWWe4BIhCr2N2Fvq8YlfUGdQR34F1dgobT4w7FqdFdVuR88b9_r_nb6M38scW6eSz5M59hXVvLehhLcHdMenFIVjfxfgbCaJGtnZIp_YoJ4cHE_DXf3G5CLIS86QjvUx_r_nEmehKeueM_5GZ0w7q3nypL2JYocZc8qE4G8Wdd1Kh1CQ8DdNH6aGOGfELeuRmai3Lv1R8rSuP4__r_nt27IxLcFjDSXDFqsz18ThZUKNvBlmwH02t1lxvOClsEMZegfhq6Im0hc2tFgUzbNDMwSh7GpdqAX_r_n_caLbUbhUf5YEkx8si32P_CQluPaRSA9r7QE6JoxzzFQ3BTKAKU7y7U4YXmk9nnCrJ4NVGH3GZd2_r_nCcg8rYCnAIOYLJV16bVlHujPYGdHO36eABYaysvrke90m8aLVPyFkXLBOrMxCrWQyzufCMZbNU_r_nvWTzr5NsxKiHGVccN6lxt7bZZH9UhCGeVjT1hgQFU18YL5zBCB9cdMtBKanSvGwy6AJ9vAMY9z_r_nzeyj3vQ3jCqfNp4Z4lX8zEOyE_dWT83L9z81ZFYjdyX6E0NvjQaEA3m0NkOFb1D3dQfO2h0cmV__r_nskP9aziSiNXAQI8uboNHBq2qstJ4NiSXMmDowKkgX_lEfoS_pNlk9YImCpAQ5f5XZzSoSwIJ1tN_r_nIakk3MlkkNNV45UnqzLSy3oL9pEcB32reUbagZDX3Q4ufB0nbZxlKZuc2dbg2qUl9UnWGJ91ieAU_r_nsa13aZpe7BmZ9wDqkr33wE5Sb_V2yxEk6ySR4xgrBOuXkjfGtHJzJ6wlo490VLKGAC7VyBjIQdGr_r_nSEwHitZtNSMoDjKC3DKJBoTyCq58XGODRzxYT_hdRwxejHMcHldoxYnlWrgR0t3_K8k0NYxnbOCN_r_nxFMSPsF6RUPxLTAo5nVVfzEkgGvtpLhteXpdrSWyA0miO6LS0IoBrfQzWG_gHx6A0tcfA2tb0GoP_r_n_yYGg8bNSnxWFS436dk2s9sgW2CJEfdNLYRhmg3ediEj60NpR6isAzJ1XsP8ADjNPT5YJPPzhZ_r_n8scUqPxNThATeiEcDIYIKw2LPK4KHc0_iKcciBwcZTJY63s66qxM_Z_IPDYUQH7z62gqCcEuir_4_r_nmqfdGhdAaYITV_asMBPrSEmoxyDDP6sBFwldpDHDT2SvVa8GHCglot_3WFcxAHvmiMuXRp1oKas_r_nsQG4lRHhjnzEra59
mov r8d, ebx
mov r10d, 0x244
nop word [rax + rax]
mov eax, r8d
mov rcx, r9
add rax, rsi
mov edx, 8
nop
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x180001790
add r8d, 0x400
add r9, 0x400
sub r10, 1
jne 0x180001780
mov ecx, r8d
lea rax, str.gD9BU0V1y2bp5vxITXilorrK0_iJA3QjE9Ftast5PZPb2_CO_r_ntdW5e8TQBMQaJbbEqOPjlpiGnioAo0Ydc8od4TCP85evtseFs98KTiISFMWB7M4lMWkG2zTFQJq_r_n7t481YNdBva1QRmeAL0J4sUVxcOYf03ixCnhbBgu4pqFh73LGvVhc4HtbHa3UHTK7VndOX_w_r_nmTcZ_JFlcrzu2Nx4CUtgZwXwYC82kSQ6zHG1bciLqfb74_JkZiPtQ9xBN77KIzXDO9qHGss8GMsi_r_nFDwEJIyZfJ9wzVkrbpvczsJUBmGOplPjtImgX0m4JubgiV3sYm5qD3iXXa1C586GjWJUVer5vYv_r_nHIDzoVkKhPcNFe9bSoitNWLUy2a5pIwAWyHiC5T3lMXb54CaPn6UZeQq_JTELnWBPK9tKBQjMOxL_r_nHeHs_0GXFyVNhw1jcECMtM8Fu4H_bFm91sqmjYlfcHFPFoMkGnimXPuwfnVXv0w29svs5L0Z8S_r_nPblOHlOB5ZiJYylVCR_FoJHi3jYGQFoq3pQJ0VlL_TD4kCvKcvDjrg0Ms72KlS7cqPDSol1_wZQ5_r_nxuuRS7BPPVbfwdMhZPZVQNMF4MB8kYxEwGeYhvKnqcZW7iAa8RrkR2LzDvvCTdqeqPxh1oBf8U1k_r_nRDSAPhaDM__tY_I1EFOzjHWr_ECnOSMmyZSwLgc9pFw3S_tiftXrYSFW2AA6DStYahBDPDJeiK_r_nu61ZqQQwsv_cL_IpsF20c9VAyvYGDYW4ozGgKgmkzjmPyqCmlAQ7jdtvKSqW59eeSxtRyAM_k_r_ndLVWVHR9AZAxMPl4dBxVDzbDFWmrmjYssl9E8lK6xbEZ0alxPeeiGdBKZhMDjFU62VUTB1PYn_r_n6AKI6cNR
add rcx, rsi
lea edx, [r10 + 7]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180001810
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rcx + 0x10], eax
cmp r8d, 0x91000
je 0x18000187f
xor eax, eax
jmp 0x1800019bc
mov ecx, 0x91394
mov qword [rsp + 0x140], rdi
mov dword [r14], 0x91394
call fcn.180001ed0
movsxd r8, dword [r14]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.180002da0
mov r9, r14
mov r8, rdi
mov rcx, rsi
call fcn.180001030
lea rcx, [rsp + 0x20]
mov dword [r14], 0x91394
mov r9d, pe_nt_image_headers64
nop dword [rax + rax]
mov byte [rcx], bl
lea rcx, [rcx + 1]
inc bx
cmp bx, r9w
jl 0x1800018d0
xor r8b, r8b
mov word [rsp + 0x120], 0
xor r11b, r11b
lea r10, [rsp + 0x20]
lea rbx, str.FGsak__3A53n___297Y56
nop dword [rax + rax]
movzx edx, byte [r10]
movzx eax, r8b
movzx r8d, r8b
inc r8d
movzx ecx, byte [rax + rbx]
add cl, dl
add r11b, cl
lea rcx, [rsp + 0x20]
movzx eax, r11b
add rcx, rax
movzx eax, byte [rcx]
mov byte [r10], al
mov eax, 0xba2e8ba3
mov byte [rcx], dl
inc r10
mul r8d
shr edx, 4
imul eax, edx, 0x16
sub r8d, eax
sub r9, 1
jne 0x180001900
movsxd rbx, dword [r14]
movzx r10d, byte [rsp + 0x120]
movzx r11d, byte [rsp + 0x121]
test rbx, rbx
jle 0x1800019a9
mov r9, rdi
inc r10b
lea rdx, [rsp + 0x20]
movzx eax, r10b
lea rcx, [rsp + 0x20]
add rdx, rax
lea r9, [r9 + 1]
movzx r8d, byte [rdx]
add r11b, r8b
movzx eax, r11b
add rcx, rax
movzx eax, byte [rcx]
mov byte [rdx], al
mov byte [rcx], r8b
movzx eax, byte [rdx]
add al, r8b
movzx eax, al
movzx ecx, byte [rsp + rax + 0x20]
xor byte [r9 - 1], cl
sub rbx, 1
jne 0x180001963
mov rcx, rsi
call fcn.180001ec8
mov rax, rdi
mov rdi, qword [rsp + 0x140]
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret