Function at 0x180004d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rsi, r9
movzx eax, r8b
mov r13, rdx
mov r14, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
mov rbx, qword [rcx + 8]
mov r12, rcx
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x180004ed5
mov r14, qword [r9 + 0x10]
mov r12, rbx
test al, al
je 0x180004e45
lea rcx, [rbx + 0x20]
cmp qword [rsi + 0x18], 0x10
jb 0x180004dec
mov rdx, qword [rsi]
jmp 0x180004def
mov rdx, rsi
lea r15, [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x180004dfd
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r14
mov r15, qword [r15]
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x38]
cmp r14, r15
cmovae r8, rax
mov r8, qword [r8]
call sub.VCRUNTIME140.dll_memcmp
mov edi, eax
test eax, eax
jne 0x180004e3c
cmp r15, r14
jae 0x180004e33
or edi, 0xffffffff
jmp 0x180004e3c
xor edi, edi
cmp r15, r14
seta dil
shr edi, 0x1f
xor dil, 1
jmp 0x180004ea8
lea rdx, [rbx + 0x20]
lea rdi, [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180004e57
mov rdx, qword [rdx]
cmp qword [rsi + 0x18], 0x10
jb 0x180004e63
mov rcx, qword [rsi]
jmp 0x180004e66
mov rcx, rsi
mov rdi, qword [rdi]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x38]
lea rax, [rsp + 0x30]
cmp rdi, r14
cmovae r8, rax
mov r8, qword [r8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180004ea2
cmp r14, rdi
jae 0x180004e9a
or eax, 0xffffffff
jmp 0x180004ea2
xor eax, eax
cmp r14, rdi
seta al
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x180004eb2
mov rbx, qword [rbx]
jmp 0x180004eb6
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
movzx eax, byte [rsp + 0x90]
je 0x180004dd5
mov rcx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x80]
mov rbx, r12
test dil, dil
je 0x180004f8a
cmp r12, qword [rcx]
jne 0x180004f21
movzx eax, byte [rsp + 0xa0]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rsi
mov r9, r12
mov r8b, 1
lea rdx, [rsp + 0x80]
mov rcx, r14
call sym.malware_module.dll_____Insert_at_AEBV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__U_Nil_2_____Tree_V___Tset_tr
mov rax, qword [rax]
mov qword [r13], rax
mov byte [r13 + 8], 1
mov rax, r13
jmp 0x180004fe2
cmp byte [r12 + 0x19], 0
je 0x180004f30
mov rbx, qword [r12 + 0x10]
jmp 0x180004f8a
mov rax, qword [r12]
cmp byte [rax + 0x19], 0
jne 0x180004f5f
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
jne 0x180004f8a
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x180004f50
jmp 0x180004f8a
mov rax, qword [r12 + 8]
cmp byte [rax + 0x19], 0
jne 0x180004f82
nop word [rax + rax]
cmp rbx, qword [rax]
jne 0x180004f82
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x180004f70
cmp byte [rbx + 0x19], 0
cmove rbx, rax
lea rdx, [rbx + 0x20]
mov r8, rsi
mov rcx, r14
call sym.malware_module.dll_public:_bool___cdecl_std::less_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___::operator___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64_const___ptr64
test al, al
je 0x180004fd6
movzx eax, byte [rsp + 0xa0]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rsi
mov r9, r12
movzx r8d, dil
lea rdx, [rsp + 0x80]
mov rcx, r14
call sym.malware_module.dll_____Insert_at_AEBV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__U_Nil_2_____Tree_V___Tset_tr
mov rax, qword [rax]
mov qword [r13], rax
mov byte [r13 + 8], 1
mov rax, r13
jmp 0x180004fe2
mov qword [r13], rbx
mov byte [r13 + 8], 0
mov rax, r13
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret