Function at 0x18001cbec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
movzx ebx, word [0x18004d6b8]
lea r14, [rcx*8]
mov dword [rsp + 0x90], 0x9b
xor r15d, r15d
mov qword [r11 - 0x48], r15
mov eax, 0xed8b7622
mov qword [rsp + 0x90], rax
mov rsi, rcx
movzx eax, word [0x18004d6a8]
xor r9d, r9d
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor r8d, r8d
mov dword [rsp + 0xa0], 0x43ab9606
xor edx, edx
mov word [rsp + 0x90], ax
movzx eax, byte [0x18004d627]
mov qword [rsp + 0x90], rax
movzx eax, word [0x18004d6e0]
mov rbp, qword [0x18004d700]
mov word [rsp + 0x90], ax
movsx rax, word [0x18004d6d0]
mov qword [rsp + 0x90], rax
mov al, byte [0x18004d708]
mov byte [rsp + 0x90], al
mov eax, dword [0x18004d6e4]
mov dword [rsp + 0x90], eax
mov eax, 0x55aa
mov word [rsp + 0x98], ax
mov eax, 0x728e
mov dword [rsp + 0xa8], 0x5cce5852
mov byte [rsp + 0x90], 0x37
mov word [rsp + 0x98], ax
mov eax, dword [0x18004d720]
mov al, byte [0x18004d688]
mov byte [rsp + 0x98], al
movsx eax, word [0x18004d68c]
mov dword [rsp + 0x98], eax
movzx eax, word [0x18004d6d4]
mov rax, qword [0x18004d700]
mov dword [rsp + 0x98], 0xe6
mov qword [rsp + 0x98], rax
mov eax, 0xffffbce2
mov dword [rsp + 0x98], 0xb0157dce
mov word [rsp + 0x98], ax
mov byte [rsp + 0x98], 0xba
movsx eax, byte [str._AadPluginUninitial]
mov qword [r11 - 0x50], r15
mov dword [rsp + 0x98], eax
movsx rax, word [0x18004d6f8]
mov qword [r11 - 0x58], r15
mov qword [r11 - 0x60], r15
mov qword [rsp + 0x98], rax
mov qword [r11 - 0x68], r15
call fcn.180013250
mov rcx, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8d, [r15 + 8]
mov qword [rsp + 0x40], r15
mov rdx, rax
mov qword [rsp + 0x38], r15
mov r9, r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.180013250
mov rdi, rax
test rax, rax
jne 0x18001cdd4
movzx eax, word [0x18004d6b4]
mov word [rsp + 0x98], ax
mov al, byte [rsp + 0x90]
sub al, bpl
mov byte [rsp + 0x90], al
mov ecx, dword [rsp + 0xa0]
sub ecx, ebx
mov dword [rsp + 0xa0], ecx
xor eax, eax
jmp 0x18001ced3
mov qword [rsp + 0x40], r15
lea rcx, [fcn.18002c640]
mov qword [rsp + 0x38], r15
mov r9, r14
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, rdi
mov qword [rsp + 0x20], r15
call fcn.180013250
mov eax, dword [rsp + 0xa8]
mov rbx, r15
movzx eax, word [0x1809cbe90]
mov word [0x18004d738], ax
test rsi, rsi
je 0x18001ced0
mov ebp, 0x2110
mov al, byte [rsp + 0x90]
xor r9d, r9d
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor r8d, r8d
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.180013250
mov rcx, qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
mov qword [rsp + 0x40], r15
mov r9, rbp
mov qword [rsp + 0x38], r15
mov r8d, 8
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.180013250
mov qword [rdi + rbx*8], rax
test rax, rax
je 0x18001cee0
mov qword [rsp + 0x40], r15
lea rcx, [fcn.18002c640]
mov qword [rsp + 0x38], r15
mov r9, rbp
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov rdx, rax
mov qword [rsp + 0x20], r15
call fcn.180013250
inc rbx
cmp rbx, rsi
jb 0x18001ce28
mov rax, rdi
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movsx rcx, byte [str._AadPluginUninitial]
movabs rax, 0xab091231395ed
add rcx, rax
mov qword [rsp + 0x90], rcx
mov ecx, 0xfffff4a5
mov rax, qword [rsp + 0x90]
xor ax, cx
mov word [rsp + 0x98], ax
mov eax, dword [0x1809cbe90]
mov qword [0x18004d6c8], rax
mov eax, 0xffffbea0
mov word [0x18004d6f8], ax
jmp 0x18001cdcd