Function at 0x180138380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movdqa xmmword [rsp + 0xa0], xmm8
movdqa xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x40], r8
mov rdi, rdx
mov rsi, rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 0x50], rax
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rsi + 0x28]
mov r8, rdi
call fcn.180137db0
mov r12, rax
mov rax, qword [rsi]
mov qword [rsp + 0x38], rsi
mov rsi, qword [rsi + 8]
mov rcx, r12
shr rcx, 0x39
mov qword [rsp + 0x60], rcx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
mov r13, qword [rdi + 0x10]
mov rbp, qword [rdi]
mov rcx, qword [rdi + 8]
test rbp, rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x70], rcx
cmove rbp, rcx
mov qword [rsp + 0x68], rdi
movzx ecx, byte [rdi + 0x18]
mov byte [rsp + 0x2f], cl
lea rdi, [rax - 0x28]
xor ecx, ecx
mov qword [rsp + 0x48], rcx
pcmpeqd xmm7, xmm7
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x30], rax
nop word cs:[rax + rax]
and r12, rsi
movdqu xmm8, xmmword [rax + r12]
movdqa xmm0, xmm6
pcmpeqb xmm0, xmm8
pmovmskb eax, xmm0
test eax, eax
jne 0x1801384bb
pcmpeqb xmm8, xmm7
pmovmskb eax, xmm8
test eax, eax
jne 0x180138562
mov rax, qword [rsp + 0x48]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
jmp 0x180138450
mov rcx, rbp
mov r8, r13
call fcn.1801813c0
test eax, eax
je 0x1801384e9
lea eax, [r15 - 1]
and eax, r15d
test ax, ax
je 0x18013846a
mov r15d, eax
tzcnt eax, r15d
add rax, r12
and rax, rsi
neg rax
lea rbx, [rax + rax*4]
cmp r13, qword [rdi + rbx*8 + 0x10]
jne 0x1801384af
lea r14, [rdi + rbx*8]
mov rdx, qword [r14]
test rdx, rdx
jne 0x1801384a0
mov rdx, qword [r14 + 8]
jmp 0x1801384a0
cmp byte [rsp + 0x2f], 0
sete al
cmp byte [r14 + 0x18], 0
setne cl
xor cl, al
je 0x1801384af
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + rbx*8 - 8], rax
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x180138637
cmp qword [rsp + 0x70], 0
je 0x180138637
mov rcx, qword [0x18021e9c0]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
mov rbx, qword [rsp + 0x58]
and rcx, rbx
mov r8, qword [rsp + 0x30]
movdqu xmm0, xmmword [r8 + rcx]
pmovmskb eax, xmm0
test eax, eax
je 0x180138587
mov rdi, qword [rsp + 0x38]
jmp 0x1801385b8
mov edx, 0x10
mov rdi, qword [rsp + 0x38]
nop word cs:[rax + rax]
add rcx, rdx
and rcx, rsi
movdqu xmm0, xmmword [r8 + rcx]
pmovmskb eax, xmm0
add rdx, 0x10
test eax, eax
je 0x1801385a0
tzcnt eax, eax
add rax, rcx
and rax, rsi
movzx ebp, byte [r8 + rax]
test bpl, bpl
js 0x1801385de
movdqa xmm0, xmmword [r8]
pmovmskb eax, xmm0
tzcnt eax, eax
movzx ebp, byte [r8 + rax]
and bpl, 1
je 0x1801385eb
cmp qword [rdi + 0x10], 0
je 0x180138664
movzx ecx, bpl
sub qword [rdi + 0x10], rcx
lea rcx, [rax - 0x10]
and rcx, rsi
mov rdx, qword [rsp + 0x60]
mov byte [r8 + rax], dl
mov byte [rcx + r8 + 0x10], dl
inc qword [rdi + 0x18]
neg rax
lea rax, [rax + rax*4]
mov rcx, qword [rsp + 0x68]
movdqu xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [r8 + rax*8 - 0x18], xmm1
movdqu xmmword [r8 + rax*8 - 0x28], xmm0
mov rcx, qword [rsp + 0x40]
mov qword [r8 + rax*8 - 8], rcx
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
mov rdx, qword [rsp + 0x50]
call fcn.18018e230
mov r8, qword [rdi]
mov rsi, qword [rdi + 8]
and rbx, rsi
movdqu xmm0, xmmword [r8 + rbx]
pmovmskb eax, xmm0
test eax, eax
jne 0x1801386a6
mov ecx, 0x10
add rbx, rcx
and rbx, rsi
movdqu xmm0, xmmword [r8 + rbx]
pmovmskb eax, xmm0
add rcx, 0x10
test eax, eax
je 0x18013868e
tzcnt eax, eax
add rax, rbx
and rax, rsi
cmp byte [r8 + rax], 0
js 0x1801385eb
movdqa xmm0, xmmword [r8]
pmovmskb eax, xmm0
tzcnt eax, eax
jmp 0x1801385eb