Function at 0x1d424
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x128
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x118], rax
lea rdx, [0x000202c0]
lea rcx, [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x98]
call fcn.00020100
lea rdx, [0x00020660]
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov dword [rsp + 0xc0], eax
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.00020100
lea rdx, [0x00020680]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x00023d68]
add rax, 0x3704
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], 0
jmp 0x1d4e7
mov eax, dword [rsp + 0x58]
add eax, 1
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x4f
jae 0x1d55a
mov rax, qword [0x00023c60]
movzx edx, byte [rax + 3]
mov rax, qword [0x00023c60]
movzx eax, byte [rax + 6]
shl eax, 8
or edx, eax
mov rax, qword [0x00023c60]
movzx ecx, word [rax + 8]
shl ecx, 0x10
mov eax, edx
or eax, ecx
mov dword [rsp + 0x68], eax
mov eax, 0xdd34e128
sub eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov rax, qword [rsp + 0x60]
mov dword [rax], ecx
mov rax, qword [rsp + 0x60]
add rax, 4
mov qword [rsp + 0x60], rax
mov rax, qword [0x00023c60]
add rax, 0xa
mov qword [0x00023c60], rax
jmp 0x1d4dc
mov rax, qword [0x00023d68]
add rax, 0x3840
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x58], 0
jmp 0x1d581
mov eax, dword [rsp + 0x58]
add eax, 1
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x2c
jae 0x1d658
mov rax, qword [0x00023c68]
movzx edx, word [rax]
mov rax, qword [0x00023c68]
movzx eax, byte [rax + 5]
shl eax, 0x10
or edx, eax
mov rax, qword [0x00023c68]
movzx ecx, byte [rax + 7]
shl ecx, 0x18
mov eax, edx
or eax, ecx
mov dword [rsp + 0x68], eax
mov eax, 0x132543f1
sub eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov rax, qword [rsp + 0x70]
mov dword [rax], ecx
mov rax, qword [rsp + 0x70]
add rax, 4
mov qword [rsp + 0x70], rax
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.00020100
mov r11, qword [0x00023c68]
movzx edx, word [r11 + 0xb]
mov rax, qword [0x00023c68]
movzx ecx, word [rax + 0xf]
shl ecx, 0x10
mov eax, edx
or eax, ecx
mov dword [rsp + 0x68], eax
mov eax, 0x132543f1
sub eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov rax, qword [rsp + 0x70]
mov dword [rax], ecx
mov rax, qword [rsp + 0x70]
add rax, 4
mov qword [rsp + 0x70], rax
mov rax, qword [0x00023c68]
add rax, 0x14
mov qword [0x00023c68], rax
jmp 0x1d576
lea rdx, [0x000206b0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r11, qword [0x00023c68]
movzx edx, word [r11]
mov rax, qword [0x00023c68]
movzx eax, byte [rax + 5]
shl eax, 0x10
or edx, eax
mov rax, qword [0x00023c68]
movzx ecx, byte [rax + 7]
shl ecx, 0x18
mov eax, edx
or eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0xc0]
xor eax, 0x932543ed
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov rax, qword [rsp + 0x70]
mov dword [rax], ecx
mov rax, qword [rsp + 0x70]
add rax, 4
mov qword [rsp + 0x70], rax
mov rax, qword [0x00023d68]
add rax, 0x39a4
mov qword [rsp + 0xb8], rax
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.00020100
mov dword [rsp + 0x58], 0
jmp 0x1d6fe
mov eax, dword [rsp + 0x58]
add eax, 1
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x22
jae 0x1d7e6
mov rax, qword [0x00023c70]
movzx edx, word [rax + 2]
mov rax, qword [0x00023c70]
movzx eax, byte [rax + 5]
shl eax, 0x10
or edx, eax
mov rax, qword [0x00023c70]
movzx ecx, byte [rax + 0xa]
shl ecx, 0x18
mov eax, edx
or eax, ecx
mov dword [rsp + 0x68], eax
mov eax, 0x24f141d
sub eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov rax, qword [rsp + 0xb8]
mov dword [rax], ecx
mov rax, qword [rsp + 0xb8]
add rax, 4
mov qword [rsp + 0xb8], rax
mov rax, qword [0x00023c70]
movzx edx, word [rax + 0xb]
mov rax, qword [0x00023c70]
movzx eax, byte [rax + 0xd]
shl eax, 0x10
or edx, eax
mov rax, qword [0x00023c70]
movzx ecx, byte [rax + 0xf]
shl ecx, 0x18
mov eax, edx
or eax, ecx
mov dword [rsp + 0x68], eax
mov ecx, 0x824f13d7
mov eax, dword [rsp + 0x68]
add rcx, rax
mov eax, dword [rsp + 0xc0]
lea ecx, [rcx + rax]
mov rax, qword [rsp + 0xb8]
mov dword [rax], ecx
mov rax, qword [rsp + 0xb8]
add rax, 4
mov qword [rsp + 0xb8], rax
mov rax, qword [0x00023c70]
add rax, 0x14
mov qword [0x00023c70], rax
jmp 0x1d6f3
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.000200a0
add rsp, 0x128
ret