Function at 0x180029f10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x120
mov rdi, rcx
mov rcx, qword [rcx]
mov r12d, r8d
cmp word [rcx], 1
mov rbx, rdx
je 0x18002a06d
mov esi, dword [rcx + 4]
add rsi, qword [rdi + 0x40]
movzx eax, byte [rsi]
cmp eax, r8d
jne 0x180029f6f
movzx r9d, word [rcx + 2]
movzx r8d, byte [rsi + 1]
xor edx, edx
mov rcx, rbx
call fcn.180029cc0
mov rcx, rdi
mov qword [rdi + 0x10], rsi
call fcn.1800294c0
jmp 0x18002a4e6
mov dword [rdi + 0x20], 0
movzx edx, byte [rsi + 1]
mov r8, rcx
movzx ecx, word [rcx]
dec ecx
movzx eax, byte [rsi + 6]
add rsi, 6
cmp eax, r12d
je 0x18002a04a
movzx eax, byte [rsi + 1]
add edx, eax
add ecx, 0xffffffff
jne 0x180029f82
mov rax, qword [rdi + 0x10]
movzx ecx, byte [rax]
movzx eax, byte [rcx + rdi + 0x3ac]
mov ecx, 4
mov dword [rdi + 0x28], eax
lea rax, [rsp + 0x28]
nop word [rax + rax]
mov qword [rax - 8], 0xffffffffffffffff
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov qword [rax + 0x28], 0xffffffffffffffff
mov qword [rax + 0x30], 0xffffffffffffffff
add rax, 0x40
sub rcx, 1
jne 0x180029fc0
movzx eax, byte [rsi]
mov byte [rsp + rax + 0x20], cl
movzx ecx, word [r8]
dec ecx
nop word [rax + rax]
movzx eax, byte [rsi - 6]
sub rsi, 6
add ecx, 0xffffffff
mov byte [rsp + rax + 0x20], 0
jne 0x18002a020
movzx r9d, word [r8 + 2]
mov rcx, rbx
mov r8d, r9d
sub r8d, edx
call fcn.180029cc0
jmp 0x18002a204
movzx r9d, word [r8 + 2]
movzx r8d, byte [rsi + 1]
mov rcx, rbx
call fcn.180029cc0
mov rcx, rdi
mov qword [rdi + 0x10], rsi
call fcn.180029410
jmp 0x18002a4e6
mov r9, qword [rdi]
mov rax, qword [rdi + 0x10]
mov esi, dword [rdi + 0x2c]
movzx ecx, byte [rax]
mov rax, qword [rdi + 0x40]
sar esi, 0x1a
movzx r8d, byte [rcx + rdi + 0x3ac]
and esi, 0x20
lea rbp, [r9 + 2]
mov dword [rdi + 0x28], r8d
mov ecx, dword [r9 + 8]
movzx ecx, word [rcx + rax]
movzx eax, byte [rbp]
movzx edx, byte [rcx + rdi + 0x2ab]
movzx ecx, byte [rax + rdi + 0x3ac]
add edx, r8d
lea eax, [rdx + rcx*2]
add esi, eax
movzx eax, byte [r9 + 3]
add esi, dword [rdi + 0x20]
dec eax
movsxd rcx, eax
movzx eax, byte [rbp]
shl rcx, 6
add rsi, rcx
cmp eax, r12d
jne 0x18002a164
movzx edx, word [rdi + rsi*2 + 0xaf0]
mov rcx, rbx
call fcn.180029d60
movzx r11d, word [rdi + rsi*2 + 0xaf0]
lea eax, [r11 + 0x20]
sar eax, 7
sub r11w, ax
mov eax, 0x80
add r11w, ax
mov word [rdi + rsi*2 + 0xaf0], r11w
mov qword [rdi + 0x10], rbp
movzx eax, byte [rbp + 1]
cmp al, 0x80
adc al, 0
mov byte [rbp + 1], al
inc dword [rdi + 0x2c]
mov rcx, qword [rdi + 0x10]
mov dword [rdi + 0x20], 1
movzx edx, word [rcx + 4]
movzx eax, word [rcx + 2]
shl edx, 0x10
or rdx, rax
add rdx, qword [rdi + 0x40]
cmp dword [rdi + 0x18], 0
jne 0x18002a157
cmp rdx, qword [rdi + 0x58]
jbe 0x18002a157
mov qword [rdi + 8], rdx
mov qword [rdi], rdx
jmp 0x18002a4e6
mov rcx, rdi
call fcn.180028d50
jmp 0x18002a4e6
movzx edx, word [rdi + rsi*2 + 0xaf0]
mov rcx, rbx
call fcn.180029df0
movzx r11d, word [rdi + rsi*2 + 0xaf0]
lea rcx, [0x18007db50]
lea eax, [r11 + 0x20]
sar eax, 7
sub r11w, ax
movzx eax, r11w
mov word [rdi + rsi*2 + 0xaf0], ax
shr rax, 0xa
movzx eax, byte [rax + rcx]
mov ecx, 4
mov dword [rdi + 0x1c], eax
lea rax, [rsp + 0x28]
mov qword [rax - 8], 0xffffffffffffffff
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov qword [rax + 0x28], 0xffffffffffffffff
mov qword [rax + 0x30], 0xffffffffffffffff
add rax, 0x40
sub rcx, 1
jne 0x18002a1b0
movzx eax, byte [rbp]
mov dword [rdi + 0x20], ecx
mov byte [rsp + rax + 0x20], cl
mov qword [rsp + 0x148], r14
mov r14d, pe_nt_image_headers64
mov qword [rsp + 0x140], r13
nop word [rax + rax]
mov rax, qword [rdi]
movzx r10d, word [rax]
nop word [rax + rax]
inc dword [rdi + 0x18]
mov rax, qword [rdi]
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x18002a4d6
mov rdx, rcx
add rdx, qword [rdi + 0x40]
mov qword [rdi], rdx
movzx eax, word [rdx]
cmp eax, r10d
je 0x18002a230
movzx eax, word [rdx]
mov r11d, eax
sub r11d, r10d
cmp ax, r14w
je 0x18002a2e8
mov ecx, dword [rdx + 8]
mov rax, qword [rdi + 0x40]
movzx r8d, word [rcx + rax]
movzx eax, word [rdx]
movzx ecx, word [rdx + 2]
sub r8d, eax
movzx eax, word [rdx]
xor edx, edx
imul eax, eax, 0xb
cmp ecx, eax
lea eax, [r11 - 1]
movzx eax, byte [rax + rdi + 0x1ac]
setl dl
add edx, edx
cmp r11d, r8d
movsxd r9, edx
adc r9, 0
shl rax, 4
add r9, rax
xor eax, eax
cmp r10d, r11d
seta al
xor ebp, ebp
shl eax, 2
cdqe
add r9, rax
mov eax, dword [rdi + 0x28]
add r9, rax
lea r13, [rdi + r9*4 + 0x4b0]
movzx eax, word [r13]
movzx ecx, byte [r13 + 2]
mov edx, eax
shr edx, cl
sub ax, dx
test edx, edx
sete bpl
mov word [r13], ax
add ebp, edx
jmp 0x18002a2f4
lea r13, [rdi + 0x4ac]
mov ebp, 1
mov rax, qword [rdi]
mov r8d, dword [rax + 4]
movzx r9d, word [rax]
add r8, qword [rdi + 0x40]
xor esi, esi
nop word [rax + rax]
movzx eax, byte [r8]
cmp eax, r12d
je 0x18002a3c8
movzx ecx, byte [r8 + 1]
mov rdx, rax
movsx eax, byte [rsp + rax + 0x20]
and ecx, eax
add r8, 6
mov byte [rsp + rdx + 0x20], 0
add esi, ecx
add r9d, 0xffffffff
jne 0x18002a310
mov eax, dword [rbx + 8]
lea ecx, [rsi + rbp]
xor edx, edx
div ecx
mov ecx, eax
imul eax, ebp
imul ecx, esi
mov dword [rbx + 8], eax
add qword [rbx], rcx
cmp eax, 0x1000000
jae 0x18002a3bb
nop dword [rax]
mov ecx, dword [rbx]
shl dword [rbx + 8], 8
cmp ecx, 0xff000000
jb 0x18002a379
mov rax, qword [rbx]
shr rax, 0x20
test eax, eax
je 0x18002a3a6
movzx ecx, byte [rbx + 0xc]
nop dword [rax]
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x18]
shr rdx, 0x20
add dl, cl
mov rcx, r8
call qword [r8]
add qword [rbx + 0x10], 0xffffffffffffffff
mov cl, 0xff
jne 0x18002a380
mov ecx, dword [rbx]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0xc], al
inc qword [rbx + 0x10]
shl ecx, 8
mov eax, ecx
mov qword [rbx], rax
cmp dword [rbx + 8], 0x1000000
jb 0x18002a360
add bp, si
add word [r13], bp
jmp 0x18002a220
mov r10d, esi
mov r12, r8
nop
movzx eax, byte [r8]
add r8, 6
movsx ecx, byte [rsp + rax + 0x20]
movzx eax, byte [r8 - 5]
and ecx, eax
add esi, ecx
add r9d, 0xffffffff
jne 0x18002a3d0
mov eax, dword [rbx + 8]
movzx r8d, byte [r12 + 1]
lea ecx, [rsi + rbp]
xor edx, edx
div ecx
mov ecx, eax
imul eax, r8d
imul ecx, r10d
mov dword [rbx + 8], eax
add qword [rbx], rcx
cmp eax, 0x1000000
jae 0x18002a47b
nop word [rax + rax]
mov ecx, dword [rbx]
shl dword [rbx + 8], 8
cmp ecx, 0xff000000
jb 0x18002a439
mov rax, qword [rbx]
shr rax, 0x20
test eax, eax
je 0x18002a466
movzx ecx, byte [rbx + 0xc]
nop dword [rax]
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x18]
shr rdx, 0x20
add dl, cl
mov rcx, r8
call qword [r8]
add qword [rbx + 0x10], 0xffffffffffffffff
mov cl, 0xff
jne 0x18002a440
mov ecx, dword [rbx]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0xc], al
inc qword [rbx + 0x10]
shl ecx, 8
mov eax, ecx
mov qword [rbx], rax
cmp dword [rbx + 8], 0x1000000
jb 0x18002a420
movzx ecx, byte [r13 + 2]
cmp cl, 7
jae 0x18002a4a2
add byte [r13 + 3], 0xff
jne 0x18002a4a2
shl word [r13], 1
mov eax, 3
shl al, cl
inc cl
mov byte [r13 + 2], cl
mov byte [r13 + 3], al
mov rax, qword [rdi]
mov qword [rdi + 0x10], r12
add word [rax + 2], 4
mov rax, qword [rdi + 0x10]
add byte [rax + 1], 4
mov rax, qword [rdi + 0x10]
cmp byte [rax + 1], 0x7c
jbe 0x18002a4c8
mov rcx, rdi
call fcn.1800291d0
mov eax, dword [rdi + 0x30]
mov rcx, rdi
mov dword [rdi + 0x2c], eax
call fcn.180028d50
mov r13, qword [rsp + 0x140]
mov r14, qword [rsp + 0x148]
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret