Function at 0x180195680
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x148
mov rax, qword [0x180293780]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rax, qword [rcx]
mov r14, r8
mov rdi, qword [rcx + 0x10]
mov r10, rdx
mov word [rsp + 0x32], r9w
mov r13, rcx
mov qword [rsp + 0xa8], r8
mov rsi, qword [rax]
xor eax, eax
mov qword [rsp + 0x78], rdx
mov ebp, eax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x50], rsi
mov r15, qword [rsi]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rax
cmp dword [rsi + 0x30], eax
je 0x1801956f9
mov eax, dword [rsi + 0x18]
jmp 0x18019610c
mov eax, dword [rdi + 0x38]
mov edx, 0x18
mov r8d, dword [r8 + 0x64]
test al, 0x20
mov dword [rsp + 0x5c], eax
mov eax, 0x1bf
cmove edx, eax
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x138], r12
test r8d, 0x104
je 0x180195747
mov ecx, edx
and ecx, 0xffffffc3
test r8b, 4
cmove ecx, edx
bt r8d, 8
mov edx, ecx
jae 0x180195747
and edx, 0xffffff7c
movzx ecx, word [rdi + 0x1a]
movzx r8d, word [rdi + 0x3e]
movzx eax, word [rdi + 0x18]
mov word [rsp + 0x3e], cx
mov r9d, eax
movzx ecx, word [rdi + 0x1c]
mov word [rsp + 0x40], cx
mov rcx, qword [rdi]
mov qword [rsp + 0xa0], rcx
movzx ecx, word [rdi + 0x16]
mov word [rsp + 0x44], r8w
movzx r8d, word [rdi + 0x3c]
mov word [rsp + 0x34], cx
lea rcx, [rsp + 0xb0]
mov word [rsp + 0x42], r8w
mov r8d, dword [r10 + 0x44]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], edx
mov rdx, qword [r13 + 8]
mov word [rsp + 0x30], ax
mov dword [rsp + 0x68], eax
call fcn.18019b0d0
xor r11d, r11d
mov qword [rsp + 0x98], rax
mov word [rdi + 0x12], r11w
mov r12, rax
mov rcx, qword [r14 + 0x10]
movsx rax, word [rcx]
mov word [rsp + 0x5a], ax
cmp eax, 0xa
jg 0x1801957de
mov word [rsp + 0x3c], r11w
jmp 0x1801957f0
mov rcx, rax
call fcn.180140510
sub ax, 0x21
mov word [rsp + 0x3c], ax
nop
test r12, r12
je 0x180195fcf
movzx r15d, word [r12 + 0x14]
mov ecx, 0x100
mov eax, dword [r13 + 0x28]
mov ebx, r11d
mov word [rsp + 0x58], r15w
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x88], eax
cmp r15w, cx
je 0x18019582a
test byte [r12 + 0x12], 0x80
je 0x18019586b
movzx r9d, word [rsp + 0x30]
mov rax, qword [r14 + 8]
movsx r8, word [rax + r9*2]
test r8d, r8d
js 0x18019585f
mov rdx, qword [r14 + 0x18]
lea rcx, [r8 + r8*2]
mov rax, qword [rdx + 8]
test dword [rax + rcx*8 + 8], 0xf
jne 0x180195fa9
mov ecx, 0x100
jmp 0x180195871
cmp r8d, 0xffffffff
je 0x180195fa9
jmp 0x180195871
movzx r9d, word [rsp + 0x30]
mov rax, qword [r12 + 0x28]
test qword [rdi + 8], rax
jne 0x180195fa9
test word [r12 + 0x12], cx
je 0x180195893
cmp r15w, 0x10
je 0x180195fa9
mov r10, qword [rsp + 0x78]
movzx edx, byte [r10 + 0x3c]
test dl, 0x58
je 0x1801958d0
mov rcx, qword [r12]
mov r8d, dword [rcx + 4]
test r8b, 3
je 0x180195fa9
mov eax, dword [r10 + 0x44]
cmp dword [rcx + 0x34], eax
jne 0x180195fa9
test dl, 0x18
je 0x1801958d0
test r8b, 2
jne 0x180195fa9
cmp byte [r14 + 0x62], 0
je 0x1801958ed
movzx eax, word [r14 + 0x5e]
dec eax
movzx ecx, r9w
cmp ecx, eax
jne 0x1801958ed
or byte [r13 + 0x2c], 2
jmp 0x1801958f2
or byte [r13 + 0x2c], 1
mov eax, dword [rsp + 0x5c]
mov dword [rdi + 0x38], eax
movzx eax, word [rsp + 0x3e]
mov word [rdi + 0x1a], ax
movzx eax, word [rsp + 0x40]
mov word [rdi + 0x1c], ax
movzx eax, word [rsp + 0x42]
mov word [rdi + 0x18], r9w
mov word [rdi + 0x3c], ax
cmp ax, word [rdi + 0x40]
jb 0x180195946
mov rcx, qword [rsp + 0x70]
lea r8d, [rax + 1]
mov rdx, rdi
call fcn.1801981b0
test eax, eax
jne 0x180195fcf
movzx r9d, word [rsp + 0x30]
xor r11d, r11d
mov r10, qword [rsp + 0x78]
movzx ecx, word [rdi + 0x3c]
mov rax, qword [rdi + 0x48]
mov qword [rax + rcx*8], r12
movzx edx, word [rdi + 0x3c]
mov rcx, qword [rsp + 0xa0]
inc dx
mov rax, qword [rdi + 8]
mov word [rdi + 0x3c], dx
not rax
or rcx, qword [r12 + 0x28]
and rcx, rax
mov qword [rdi], rcx
test r15b, 1
je 0x180195a64
mov r8, qword [r12]
test dword [r8 + 4], 0x1000
je 0x1801959c2
movzx eax, dx
mov ebx, 0x2e
dec eax
mov dword [rsp + 0x38], ebx
test eax, eax
jle 0x1801959de
mov rcx, qword [rdi + 0x48]
mov edx, eax
mov rax, qword [rcx]
test rax, rax
je 0x1801959b6
cmp qword [rax], r8
cmove ebx, r11d
add rcx, 8
sub rdx, 1
jne 0x1801959a7
jmp 0x1801959da
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x1801959de
movsxd rcx, dword [rax]
test ecx, ecx
je 0x1801959de
call fcn.180140510
movsx ebx, ax
mov dword [rsp + 0x38], ebx
test byte [r14 + 0x64], 0x80
je 0x180195a4e
movzx r10d, word [rsp + 0x3c]
cmp r10w, 0xa
jl 0x180195a4e
mov rax, qword [r14 + 0x10]
movzx ecx, r9w
movzx r8d, word [rax + rcx*2]
cmp bx, 0xa
jg 0x180195a0b
movzx eax, r11w
jmp 0x180195a18
movsx rcx, bx
call fcn.180140510
sub ax, 0x21
sub ax, bx
sub ax, r10w
add ax, r8w
add ax, 0xa
jns 0x180195a4e
cmp word [rsp + 0x32], 2
jge 0x180195fa9
mov rax, qword [rsp + 0x70]
test dword [rax + 0x60], 0x20000
jne 0x180195fa9
or dword [rdi + 0x38], 0x100000
or dword [rdi + 0x38], 4
mov edx, dword [rdi + 0x38]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
jmp 0x180195be5
test r15b, 0x82
je 0x180195afb
mov rax, qword [r14 + 8]
movzx ecx, r9w
movsx r9d, word [rax + rcx*2]
mov ecx, dword [rdi + 0x38]
or ecx, 1
mov dword [rdi + 0x38], ecx
cmp r9d, 0xffffffff
je 0x180195acc
mov r8d, ecx
mov edx, ecx
test r9d, r9d
js 0x180195ad8
cmp word [rsp + 0x32], 0
jne 0x180195ad8
movzx r9d, word [r14 + 0x5e]
lea eax, [r9 - 1]
cmp dword [rsp + 0x68], eax
jne 0x180195ad8
test byte [r14 + 0x64], 8
jne 0x180195acc
cmp r9d, 1
jne 0x180195ac6
cmp byte [r14 + 0x62], 0
je 0x180195ac6
cmp r15w, 2
je 0x180195acc
bts edx, 0x10
jmp 0x180195ad2
mov edx, ecx
bts edx, 0xc
mov r8d, edx
mov dword [rdi + 0x38], edx
cmp byte [rsp + 0xd9], 1
jbe 0x180195aec
mov edx, r8d
bts edx, 0x15
mov dword [rdi + 0x38], edx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
jmp 0x180195be5
bt r15w, 8
jae 0x180195b1b
mov edx, dword [rdi + 0x38]
mov rax, qword [rsp + 0x48]
or edx, 8
mov rcx, qword [rsp + 0x60]
mov dword [rdi + 0x38], edx
jmp 0x180195be5
mov r9d, dword [rsp + 0x68]
mov r8, r14
mov edx, dword [r10 + 0x44]
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.18019ad30
mov edx, dword [rdi + 0x38]
test r15b, 0x24
je 0x180195bb1
mov word [rdi + 0x1a], ax
or edx, 0x22
xor eax, eax
mov dword [rdi + 0x38], edx
mov qword [rsp + 0x48], rax
mov eax, 0x100
mov qword [rsp + 0x60], r12
test word [r12 + 0x12], ax
je 0x180195ba4
movzx r8d, word [rdi + 0x3c]
lea rsi, [r12 + 0x38]
mov rcx, qword [rsp + 0x70]
inc r8d
mov rdx, rdi
mov qword [rsp + 0x48], rsi
call fcn.1801981b0
test eax, eax
jne 0x180195fcf
movzx ecx, word [rdi + 0x3c]
mov rax, qword [rdi + 0x48]
mov qword [rax + rcx*8], rsi
inc word [rdi + 0x3c]
or dword [rdi + 0x38], 0x10
mov edx, dword [rdi + 0x38]
mov word [rdi + 0x1c], 1
mov rax, qword [rsp + 0x48]
mov rcx, r12
xor r11d, r11d
jmp 0x180195be5
or edx, 0x12
mov word [rdi + 0x1c], ax
xor r11d, r11d
mov dword [rdi + 0x38], edx
mov rax, r12
mov qword [rsp + 0x48], rax
test dl, 0x20
je 0x180195bdd
mov rax, qword [rdi + 0x48]
movzx ecx, word [rdi + 0x3c]
mov rcx, qword [rax + rcx*8 - 0x10]
mov rax, r12
jmp 0x180195be0
mov rcx, r11
mov qword [rsp + 0x60], rcx
test dl, 2
je 0x180195c0a
mov r15, qword [rsp + 0x50]
mov r8, rcx
mov rcx, r15
mov qword [rsp + 0x20], rdi
mov r9, rax
mov rdx, r13
call fcn.18019a270
jmp 0x180195e98
movzx eax, word [rdi + 0x18]
inc ax
movzx esi, ax
mov word [rdi + 0x18], si
movzx edx, word [r12 + 0x10]
mov dword [rsp + 0x6c], esi
test dx, dx
jg 0x180195c43
movzx ecx, word [rsp + 0x30]
mov rax, qword [r14 + 8]
cmp word [rax + rcx*2], 0
jl 0x180195c43
sub dx, bx
add word [rdi + 0x16], dx
jmp 0x180195e93
cmp word [rsp + 0x32], 0
mov rbx, r11
mov qword [rsp + 0x80], rbx
jne 0x180195e68
cmp dword [r14 + 0x68], 0
je 0x180195e68
cmp esi, dword [r14 + 0x70]
jg 0x180195e68
test r15b, 1
je 0x180195c86
mov rax, qword [r12]
test dword [rax + 4], 0x1000
jne 0x180195e68
mov rax, qword [rsp + 0x70]
test dword [rax + 0x60], 0x800
jne 0x180195e68
mov rax, qword [r12]
mov ecx, 0x182
test cx, r15w
je 0x180195ccd
mov r8, qword [rax + 0x18]
lea r9, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov rdx, r13
call fcn.180194170
mov rbx, qword [rsp + 0x80]
jmp 0x180195d73
mov r13, qword [rax + 0x20]
mov r10, qword [rsp + 0x90]
mov rax, qword [r10 + 0x10]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 0x10]
movzx ecx, word [rcx]
call fcn.180140720
mov r12d, dword [r10 + 0x28]
lea r14, [r13 + 8]
mov r15, rax
mov rbp, r11
mov eax, r11d
mov esi, r11d
cmp esi, dword [r13]
jge 0x180195d47
mov r8, qword [r14]
lea r9, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov rdx, r10
mov qword [rsp + 0x80], r15
call fcn.180194170
mov r10, qword [rsp + 0x90]
inc esi
add rbp, qword [rsp + 0x80]
add r14, 0x20
mov dword [r10 + 0x28], r12d
test eax, eax
je 0x180195d01
jmp 0x180195d51
cmp rbp, r15
mov rbx, rbp
cmova rbx, r15
mov esi, dword [rsp + 0x6c]
mov r14, qword [rsp + 0xa8]
movzx r15d, word [rsp + 0x58]
mov r12, qword [rsp + 0x98]
mov r13, qword [rsp + 0x90]
xor r11d, r11d
cmp eax, 0xc
mov ebp, r11d
cmovne ebp, eax
test ebp, ebp
jne 0x180195fcf
test rbx, rbx
je 0x180195e68
lea eax, [rbp + 0x28]
cmp rbx, 8
jae 0x180195dbf
cmp rbx, 2
jae 0x180195db0
movzx eax, r11w
jmp 0x180195e0f
add ax, 0xfff6
add rbx, rbx
cmp rbx, 8
jb 0x180195db0
jmp 0x180195dfd
cmp rbx, 0xff
jbe 0x180195de1
nop dword [rax + rax]
add ax, 0x28
shr rbx, 4
cmp rbx, 0xff
ja 0x180195dd0
cmp rbx, 0xf
jbe 0x180195dfd
nop word [rax + rax]
add ax, 0xa
shr rbx, 1
cmp rbx, 0xf
ja 0x180195df0
and ebx, 7
lea rcx, [0x18028d458]
sub ax, 0xa
add ax, word [rcx + rbx*2]
mov word [rdi + 0x16], ax
cmp si, 1
jne 0x180195e47
movsx edx, ax
mov rax, qword [r14 + 0x10]
add edx, 0xa
movsx ecx, word [rax]
cmp edx, ecx
jle 0x180195e47
mov eax, 0x4000
or ax, word [r12 + 0x12]
bt ax, 0xd
mov word [r12 + 0x12], ax
jae 0x180195e47
or byte [r13 + 0x2d], 4
movzx eax, word [rdi + 0x16]
cmp ax, word [rsp + 0x34]
mov esi, dword [rsp + 0x38]
cmovg ax, word [rsp + 0x34]
mov r15, qword [rsp + 0x50]
sub ax, si
mov word [rdi + 0x16], ax
jmp 0x180195e9c
mov rax, qword [r14 + 0x10]
movzx ecx, si
movzx edx, word [rax + rcx*2]
sub dx, word [rax + rcx*2 - 2]
add dx, word [rdi + 0x16]
bt r15w, 8
mov word [rdi + 0x16], dx
movzx eax, dx
jae 0x180195e93
add ax, 0xa
mov word [rdi + 0x16], ax
mov r15, qword [rsp + 0x50]
mov esi, dword [rsp + 0x38]
mov eax, dword [r14 + 0x64]
movzx ebx, word [rdi + 0x16]
and eax, 3
cmp al, 3
jne 0x180195eb0
lea eax, [rbx + 0x10]
jmp 0x180195ed0
mov rcx, qword [rsp + 0x78]
movsx eax, word [r14 + 0x5c]
imul eax, eax, 0xf
mov rcx, qword [rcx + 0x20]
cdq
movsx r8d, word [rcx + 0x3c]
idiv r8d
inc ax
add ax, bx
movzx ecx, word [rsp + 0x3c]
movzx edx, ax
call fcn.1801405d0
test dword [rdi + 0x38], 0x4000140
jne 0x180195ef1
lea edx, [rbx + 0x10]
movzx ecx, ax
call fcn.1801405d0
movzx r12d, word [rsp + 0x32]
add ax, si
movzx r8d, word [rsp + 0x5a]
add ax, r12w
mov word [rdi + 0x14], ax
mov rdx, rdi
lea eax, [rsi + rbx]
add ax, r12w
mov word [rdi + 0x16], ax
mov rcx, qword [r13 + 8]
call fcn.180197ed0
mov rdx, rdi
mov rcx, r13
call fcn.180197a10
mov ecx, dword [rdi + 0x38]
mov ebp, eax
test cl, 2
cmovne bx, word [rsp + 0x34]
mov word [rdi + 0x16], bx
test cl, 0x10
jne 0x180195f90
movzx ecx, word [rdi + 0x18]
cmp cx, word [r14 + 0x60]
jae 0x180195f90
cmp cx, word [r14 + 0x5e]
jb 0x180195f5d
mov eax, dword [r14 + 0x64]
and al, 3
cmp al, 2
je 0x180195f90
cmp cx, 3
jbe 0x180195f7c
mov rax, qword [r15]
mov ecx, dword [rax + 0x188]
test ecx, ecx
je 0x180195f7c
inc dword [r15 + 0x30]
mov dword [r15 + 0x18], 9
mov rdx, qword [rsp + 0x78]
lea r9d, [rsi + r12]
mov r8, r14
mov rcx, r13
call fcn.180195680
movzx ecx, word [rsp + 0x34]
mov eax, dword [rsp + 0x88]
mov rsi, qword [rsp + 0x50]
mov word [rdi + 0x16], cx
mov dword [r13 + 0x28], eax
lea rcx, [rsp + 0xb0]
call fcn.18019b6d0
mov qword [rsp + 0x98], rax
mov r12, rax
mov r11d, 0
test ebp, ebp
je 0x1801957f0
mov rax, qword [rsp + 0xa0]
movzx esi, word [rsp + 0x30]
movzx ecx, word [rsp + 0x44]
movzx r12d, word [rsp + 0x34]
movzx r8d, word [rsp + 0x42]
mov qword [rdi], rax
movzx eax, word [rsp + 0x3e]
mov word [rdi + 0x1a], ax
movzx eax, word [rsp + 0x40]
mov word [rdi + 0x1c], ax
mov eax, dword [rsp + 0x5c]
mov dword [rdi + 0x38], eax
mov word [rdi + 0x18], si
mov word [rdi + 0x3e], cx
mov word [rdi + 0x16], r12w
mov word [rdi + 0x3c], r8w
cmp si, cx
jne 0x1801960fa
movzx ecx, word [r14 + 0x5e]
lea eax, [rsi + 1]
cmp eax, ecx
jae 0x1801960fa
cmp si, r8w
jne 0x1801960fa
mov eax, dword [r14 + 0x64]
test al, 0x40
jne 0x1801960fa
test al, al
jns 0x1801960fa
mov r15, qword [rsp + 0x70]
test dword [r15 + 0x60], 0x4000
jne 0x1801960fa
mov rax, qword [r14 + 0x10]
cmp word [rax + rsi*2 + 2], 0x2a
jl 0x1801960fa
inc r8d
mov rdx, rdi
mov rcx, r15
call fcn.1801981b0
mov ebp, eax
test eax, eax
jne 0x1801960fa
inc word [rdi + 0x18]
mov r8, r14
inc word [rdi + 0x3e]
movzx ecx, word [rdi + 0x3c]
mov rax, qword [rdi + 0x48]
movzx r15d, word [rsp + 0x32]
mov rdx, qword [rsp + 0x78]
add r15w, 5
mov qword [rax + rcx*8], 0
mov rcx, r13
inc word [rdi + 0x3c]
or dword [rdi + 0x38], 0x8000
mov rax, qword [r14 + 0x10]
movzx r9d, word [rax + rsi*2]
sub r9w, word [rax + rsi*2 + 2]
sub word [rdi + 0x16], r9w
add r9w, r15w
call fcn.180195680
movzx r8d, word [rsp + 0x44]
mov eax, dword [rsp + 0x5c]
mov word [rdi + 0x3e], r8w
mov word [rdi + 0x16], r12w
mov word [rdi + 0x18], si
mov dword [rdi + 0x38], eax
mov r12, qword [rsp + 0x138]
mov eax, ebp
mov rbx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180002c0c
add rsp, 0x148
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret