Function at 0x1801198a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14, rdx
mov rsi, rcx
cmp byte [rdx + 8], 0
mov rbp, qword [rdx]
je 0x180119b26
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x180119b9e
mov rdi, rax
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x18011990c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180119ff1
mov rcx, rax
mov qword [0x180219958], rax
mov r8d, 0x18
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180119ff1
mov rbx, rax
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], rdi
lock inc qword [rax]
jle 0x180119fdc
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x180119968
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180119fc6
mov rcx, rax
mov qword [0x180219958], rax
mov r8d, 0x80
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180119fc6
mov rdi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], 0
mov byte [rax + 0x28], 0
mov qword [rax + 0x30], 8
xorps xmm0, xmm0
movups xmmword [rax + 0x38], xmm0
movups xmmword [rax + 0x41], xmm0
mov qword [rax + 0x58], 8
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x69], xmm0
lock inc qword [rbx]
jle 0x180119fdc
mov r13, qword [rdi + 0x10]
lock inc qword [rdi]
jle 0x180119fdc
test rbp, rbp
je 0x180119bbb
xor r15d, r15d
mov rax, rbp
shr rax, 0x3a
sete al
jne 0x180119fdc
mov r12, rbp
shl r12, 5
mov r15b, al
shl r15, 3
test r12, r12
je 0x180119fb5
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x180119a38
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180119fc1
mov rcx, rax
mov qword [0x180219958], rax
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rbx, rbx
je 0x180119fc1
cmp rbp, 2
jb 0x180119bc7
lea rdx, [rbp - 1]
lea r8, [rbp - 2]
mov eax, edx
and eax, 7
mov rcx, rbx
cmp r8, 7
jb 0x180119ae4
and rdx, 0xfffffffffffffff8
xorps xmm0, xmm0
mov rcx, rbx
nop dword [rax]
movups xmmword [rcx + 0xc], xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x2c], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x4c], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x6c], xmm0
movups xmmword [rcx + 0x80], xmm0
movups xmmword [rcx + 0x8c], xmm0
movups xmmword [rcx + 0xa0], xmm0
movups xmmword [rcx + 0xac], xmm0
movups xmmword [rcx + 0xc0], xmm0
movups xmmword [rcx + 0xcc], xmm0
movups xmmword [rcx + 0xec], xmm0
movups xmmword [rcx + 0xe0], xmm0
add rcx, 0x100
add rdx, 0xfffffffffffffff8
jne 0x180119a80
test rax, rax
je 0x180119b00
xorps xmm0, xmm0
nop dword [rax]
movups xmmword [rcx + 0xc], xmm0
movups xmmword [rcx], xmm0
add rcx, 0x20
dec rax
jne 0x180119af0
xorps xmm0, xmm0
movups xmmword [rcx + 0xc], xmm0
movups xmmword [rcx], xmm0
mov r12, rbp
shl r12, 4
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x180119bfc
jmp 0x180119be3
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x180119b4b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18011a002
mov rcx, rax
mov qword [0x180219958], rax
mov r8d, 0x30
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18011a002
mov rbx, rax
mov qword [rax], 1
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
mov byte [rax + 0x18], 0
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
lock inc qword [rax]
jle 0x180119fdc
xor edi, edi
mov r8b, 2
mov r13, rbx
jmp 0x180119c71
call fcn.18016fe79
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 2
jmp 0x180119fa1
mov ebx, 8
mov eax, 8
jmp 0x180119c10
xorps xmm0, xmm0
movups xmmword [rbx + 0xc], xmm0
movups xmmword [rbx], xmm0
mov r12d, 0x10
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x180119bfc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18011a013
mov rcx, rax
mov qword [0x180219958], rax
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18011a013
mov qword [rsp + 0x80], rax
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x180119c3d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180119fc6
mov rcx, rax
mov qword [0x180219958], rax
mov r8d, 0x80
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180119fc6
mov rdx, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x70], 0
movaps xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 0
xor r8d, r8d
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0xa0], al
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0xb0], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xc0], rax
cmp byte [r14 + 9], 0
mov qword [rsp + 0x88], r13
je 0x180119d38
mov dword [rsp + 0x2c], r8d
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x180119fd7
mov r14, qword [rsp + 0x30]
mov r8, qword [0x180219970]
test r8, r8
jne 0x180119d1f
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x180119fd7
mov r8, qword [rsp + 0x30]
mov qword [0x180219970], r8
test r8, r8
je 0x180119fdc
mov rax, r14
or rax, r8
shr rax, 0x20
je 0x180119d49
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
jmp 0x180119d53
mov r15d, 1
mov r12d, 0x3b9aca00
jmp 0x180119ea4
mov eax, r14d
xor edx, edx
div r8d
mov ecx, eax
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, r8
shr rdx, 0x20
je 0x180119d6d
xor edx, edx
div r8
jmp 0x180119d72
xor edx, edx
div r8d
imul r12, rcx, 0x3b9aca00
add r12, rax
mov rax, r12
shr rax, 9
movabs rcx, 0x44b82fa09b5a53
mul rcx
mov r14, rdx
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x180119db8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180119fe0
mov rcx, rax
mov qword [0x180219958], rax
mov r8d, 0x1860
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180119fe0
mov r13, rax
shr r14, 0xb
imul eax, r14d, 0x3b9aca00
sub r12d, eax
xor r15d, r15d
mov r8d, 0x810
mov rcx, r13
xor edx, edx
call fcn.180171550
mov qword [r13 + 0x810], 1
lea rcx, [r13 + 0x818]
mov r8d, 0x408
xor edx, edx
call fcn.180171550
mov qword [r13 + 0xc20], 2
lea rcx, [r13 + 0xc28]
mov r8d, 0x408
xor edx, edx
call fcn.180171550
mov qword [r13 + 0x1030], 3
lea rcx, [r13 + 0x1038]
mov r8d, 0x408
xor edx, edx
call fcn.180171550
mov qword [r13 + 0x1440], 4
mov rcx, r13
add rcx, 0x1448
mov r8d, 0x408
xor edx, edx
call fcn.180171550
mov qword [r13 + 0x1850], 5
mov qword [r13 + 0x1858], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x2c]
mov qword [rsi + 0x10], rbp
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], rbp
mov qword [rsi + 0x28], 0
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x63]
mov dword [rsi + 0x3c], ecx
mov dword [rsi + 0x39], eax
movzx eax, byte [rsp + 0x50]
mov byte [rsi + 0xe8], al
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rsi + 0xd8], xmm1
movups xmmword [rsi + 0xc8], xmm0
movzx eax, byte [rsp + 0xa0]
mov byte [rsi + 0x68], al
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [rsi + 0x58], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsi + 0x98], rax
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rsi + 0x88], xmm0
mov qword [rsi], r15
mov qword [rsi + 8], rbx
mov qword [rsi + 0x30], rdi
mov byte [rsi + 0x38], r8b
mov qword [rsi + 0x40], rdi
mov rax, qword [rsp + 0x88]
mov qword [rsi + 0x48], rax
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x70], rdx
mov qword [rsi + 0x78], 0x10
mov qword [rsi + 0x80], 0
mov qword [rsi + 0xa0], 0
mov byte [rsi + 0xa8], 0
mov qword [rsi + 0xb0], r13
mov qword [rsi + 0xb8], 6
mov qword [rsi + 0xc0], 6
mov qword [rsi + 0xf0], r14
mov dword [rsi + 0xf8], r12d
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, r15
test rbx, rbx
jne 0x180119a4f
mov rcx, r15
jmp 0x18011a018
mov ecx, 8
mov edx, 0x80
call fcn.18017ea70
ud2
call fcn.18016fe79
ud2
mov ecx, 8
mov edx, 0x1860
call fcn.18017ea70
ud2
mov ecx, 8
mov edx, 0x18
call fcn.18017ea70
ud2
mov ecx, 8
mov edx, 0x30
call fcn.18017ea70
ud2
mov ecx, 8
mov rdx, r12
call fcn.18017ea70
ud2