Function at 0x18000740c
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0x100
lea rax, [rbp - 1]
mov rbx, r8
mov r14d, 0x10
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x51]
lea r8, str.SecretsNL_KMCurrVal
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x71]
mov edi, 0x2800
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x77]
mov rsi, r9
mov r15, rcx
mov dword [rbp - 0x69], edi
mov dword [rbp - 0x49], r14d
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x45], r14d
call fcn.180007e4c
test eax, eax
je 0x1800079e6
mov r13, qword [rbp + 0x7f]
test r13, r13
je 0x1800074a1
mov rax, qword [r13]
neg rax
sbb ecx, ecx
and ecx, 0x20006
jmp 0x1800074a3
xor ecx, ecx
or ecx, 0x20019
lea rax, [rsp + 0x60]
lea r8, str.Cache
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov rcx, r15
mov rdx, rbx
call fcn.18000fc84
test eax, eax
je 0x1800079dc
test rsi, rsi
je 0x180007532
call fcn.180004a6c
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea r8, str.NL_IterationCount
mov rcx, r15
call fcn.1800101f8
test eax, eax
je 0x18000752d
mov ecx, dword [rsp + 0x50]
mov eax, ecx
mov edx, ecx
and edx, 0xfffffc00
shl eax, 0xa
cmp ecx, edi
cmova eax, edx
mov edx, eax
mov edi, eax
mov dword [rbp - 0x69], eax
call fcn.180004a6c
cmp dword [rsp + 0x50], 0
jne 0x180007532
call fcn.180004a6c
mov rdx, qword [rsp + 0x60]
lea rax, [rbp - 0x7d]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x79]
mov rcx, r15
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call fcn.18000ff10
test eax, eax
je 0x1800079cf
mov eax, dword [rsp + 0x58]
mov ebx, 0x40
inc eax
mov ecx, ebx
lea edx, [rax + 1]
mov dword [rsp + 0x58], eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
je 0x1800079cf
mov edx, dword [rbp - 0x7d]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1800079c6
xor edx, edx
mov dword [rsp + 0x50], edx
cmp dword [rbp - 0x79], edx
jbe 0x1800079bd
mov eax, dword [rbp - 0x7d]
mov ecx, dword [rsp + 0x58]
mov r8d, edx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x4d]
mov dword [rbp - 0x4d], ecx
mov r9, r12
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.180010560
test eax, eax
je 0x1800079a7
lea rdx, str.NL_Control
mov r8d, 0xa
mov rcx, r12
call fcn.1800294f0
test eax, eax
je 0x1800079a7
lea rdx, str.NL_IterationCount
mov r8d, 0x11
mov rcx, r12
call fcn.1800294f0
test eax, eax
je 0x1800079a7
test byte [rbx + 0x30], 1
je 0x1800079a7
mov rcx, r12
call fcn.180004a6c
lea rcx, [rbx + 0x20]
call fcn.18000e67c
mov edx, dword [rbx + 0x10]
mov ecx, edx
call fcn.180004a6c
mov r14d, dword [rsp + 0x54]
lea r9, [rbx + 0x40]
add r14d, 0xffffffa0
test rsi, rsi
je 0x18000782c
mov r8, qword [rbp - 0x71]
and dword [rsp + 0x20], 0
lea rcx, [rbx + 0x60]
mov edx, r14d
call fcn.1800112f8
test eax, eax
je 0x18000799f
mov dl, 0x32
mov rcx, rbx
call fcn.180007a08
movzx r11d, word [rbx]
mov r8, qword [r13 + 0x18]
lea rdx, [rbx + 0xa8]
mov word [rbp - 0x5f], r11w
mov word [rbp - 0x61], r11w
mov qword [rbp - 0x59], rdx
test r8, r8
je 0x1800076f8
cmp dword [rbx + 0x84], 0
je 0x1800076f8
mov edx, dword [rbx + 0x84]
mov r9d, dword [r13 + 0x20]
mov eax, r14d
sub eax, edx
lea rcx, [rax + rbx + 0x60]
call fcn.180007aa4
mov rdx, qword [rbp - 0x59]
movzx r11d, word [rbp - 0x61]
mov rcx, qword [r13]
test rcx, rcx
je 0x18000799f
movzx r8d, r11w
shr r8, 1
call fcn.1800294f0
test eax, eax
jne 0x18000799f
call fcn.180004a6c
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x21]
mov r8b, 1
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeString]
test eax, eax
js 0x18000799f
lea rcx, [rbp - 0x21]
lea rdx, [r13 + 8]
mov r9d, eax
mov qword [rsp + 0x20], rcx
lea rcx, [rbx + 0x60]
mov r8d, edi
call fcn.1800113e0
test eax, eax
js 0x18000799f
call fcn.180004a6c
xor r8d, r8d
lea rcx, [rbx + 0x60]
lea edx, [r8 + 0x10]
call fcn.18000e590
call fcn.180004a6c
mov rdx, qword [rbp - 0x71]
mov eax, 0x10
lea rdi, [rbx + 0x50]
lea r9, [rbx + 0x60]
mov dword [rsp + 0x30], eax
mov r8d, eax
mov ecx, 0x8004
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r14d
call fcn.180010bc4
test eax, eax
je 0x18000799f
call fcn.180004a6c
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x10]
call fcn.18000e590
call fcn.180004a6c
mov r8, qword [rbp - 0x71]
lea r9, [rbx + 0x40]
lea rcx, [rbx + 0x60]
mov edx, r14d
mov dword [rsp + 0x20], 1
call fcn.1800112f8
mov r15, qword [rbp + 0x57]
test eax, eax
je 0x1800079a3
mov eax, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov r8, r12
mov rcx, r15
mov qword [rsp + 0x20], rbx
call fcn.1800102e8
test eax, eax
je 0x18000781a
call fcn.180004a6c
jmp 0x1800079a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180004a6c
jmp 0x1800079a3
mov rax, qword [rbp - 0x41]
mov r8d, dword [rbp - 0x51]
mov rdx, qword [rbp - 0x71]
mov ecx, 0x10
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov ecx, 0x8003
call fcn.180010bc4
test eax, eax
je 0x180007990
lea rdi, [rbx + 0x60]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
mov dword [rbp - 0x35], r14d
mov dword [rbp - 0x39], r14d
mov qword [rbp - 0x31], rdi
call qword [sym.imp.ADVAPI32.dll_SystemFunction032]
test eax, eax
js 0x180007996
mov dl, 0x31
mov rcx, rbx
call fcn.180007a08
movzx r11d, word [rbx]
lea rdx, [rbx + 0xa8]
mov word [rbp - 0x5f], r11w
mov word [rbp - 0x61], r11w
mov qword [rbp - 0x59], rdx
test r13, r13
je 0x1800079a7
mov rcx, qword [r13]
test rcx, rcx
je 0x1800079a7
movzx r8d, r11w
shr r8, 1
call fcn.1800294f0
test eax, eax
jne 0x1800079a7
call fcn.180004a6c
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x11]
mov r8b, 1
call qword [sym.imp.ntdll.dll_RtlDowncaseUnicodeString]
test eax, eax
js 0x1800079a7
lea rcx, [rbp - 0x11]
lea rdx, [r13 + 8]
mov r9d, eax
mov qword [rsp + 0x20], rcx
mov rcx, rdi
xor r8d, r8d
call fcn.1800113e0
test eax, eax
js 0x1800079a7
call fcn.180004a6c
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x10]
call fcn.18000e590
call fcn.180004a6c
mov rdx, qword [rbp - 0x41]
mov dword [rsp + 0x30], 0x10
lea rsi, [rbx + 0x50]
mov r9, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r14d
mov r14d, 0x10
mov r8d, r14d
mov ecx, 0x8003
call fcn.180010bc4
test eax, eax
je 0x1800079a3
call fcn.180004a6c
xor r8d, r8d
mov edx, r14d
mov rcx, rsi
call fcn.18000e590
call fcn.180004a6c
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_SystemFunction032]
test eax, eax
js 0x180007820
jmp 0x1800077ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180004a6c
jmp 0x1800079a7
mov r15, qword [rbp + 0x57]
mov rsi, qword [rbp + 0x6f]
mov edx, dword [rsp + 0x50]
mov edi, dword [rbp - 0x69]
inc edx
mov dword [rsp + 0x50], edx
cmp edx, dword [rbp - 0x79]
jb 0x1800075c4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x60]
mov rcx, r15
call fcn.1800107a4
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret