Function at 0x1400010e0
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2140]
mov eax, 0x2240
call fcn.140004ff0
sub rsp, rax
mov rax, qword [0x14002b018]
xor rax, rsp
mov qword [rbp + 0x2130], rax
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x4d0
call fcn.140006350
xor edx, edx
lea rcx, [rbp + 0x440]
mov r8d, 0x4d0
call fcn.140006350
xor edx, edx
lea rcx, [rbp + 0xde0]
mov r8d, 0x4d0
call fcn.140006350
xor edx, edx
lea rcx, [rbp + 0x12b0]
mov r8d, 0x4d0
call fcn.140006350
xor edx, edx
lea rcx, [rbp + 0x1780]
mov r8d, 0x4d0
call fcn.140006350
xor edx, edx
lea rcx, [rbp + 0x910]
mov r8d, 0x4d0
call fcn.140006350
xor edx, edx
lea rcx, [rbp + 0x1c50]
mov r8d, 0x4d0
call fcn.140006350
movdqa xmm0, xmmword [0x1400282b0]
lea r9, str.LEA0LBY34JJFA4K
xor r13d, r13d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], r13
xor ecx, ecx
mov dword [rsp + 0x48], r13d
movdqu xmmword [rbp + 0x2120], xmm0
call qword [sym.imp.KERNEL32.DLL_CreateEventW]
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_CreateTimerQueue]
lea rcx, str.Ntdll
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtContinue
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rcx, str.Advapi32
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov r8, qword [sym.imp.KERNEL32.DLL_RtlCaptureContext]
lea r9, [rsp + 0x70]
mov r14, rax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], r13d
mov rdx, rbx
movsxd rcx, dword [rax + 0x3c]
mov dword [rsp + 0x20], r13d
mov r15d, dword [rax + rcx*4 + 0x50]
lea rax, [rbp + 0x2120]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x64], 0x10
mov dword [rsp + 0x60], 0x10
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x50], r15d
call qword [sym.imp.KERNEL32.DLL_CreateTimerQueueTimer]
test eax, eax
je 0x140001845
lea edx, [r13 + 0x32]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edx, 9
lea rax, [rbp + 0x440]
mov r8d, edx
lea rcx, [rsp + 0x70]
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub r8, 1
jne 0x1400012c0
movups xmm0, xmmword [rcx]
mov r8, rdx
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
lea rcx, [rsp + 0x70]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm0
lea rax, [rbp + 0xde0]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub r8, 1
jne 0x140001350
movups xmm0, xmmword [rcx]
mov r8, rdx
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
lea rcx, [rsp + 0x70]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm0
lea rax, [rbp + 0x12b0]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub r8, 1
jne 0x1400013e0
movups xmm0, xmmword [rcx]
mov r8, rdx
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
lea rcx, [rsp + 0x70]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm0
lea rax, [rbp + 0x1780]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub r8, 1
jne 0x140001470
movups xmm0, xmmword [rcx]
mov r8, rdx
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
lea rcx, [rsp + 0x70]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm0
lea rax, [rbp + 0x910]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub r8, 1
jne 0x140001500
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
lea rcx, [rbp + 0x1c50]
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm0
lea rax, [rsp + 0x70]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001590
movups xmm0, xmmword [rax]
mov rdx, r15
mov qword [rbp + 0x4c0], r14
movups xmm1, xmmword [rax + 0x10]
mov qword [rbp + 0x4c8], rdx
movups xmmword [rcx], xmm0
mov qword [rbp + 0x4f8], 4
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
movups xmmword [rcx + 0x30], xmm1
mov qword [rbp + 0x538], rax
lea rax, [rsp + 0x48]
movups xmmword [rcx + 0x40], xmm0
mov rcx, qword [rbp + 8]
add rcx, 0xfffffffffffffff8
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x4d8], rcx
cmp dword [rsp + 0x50], r13d
je 0x14000165c
xor eax, eax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0xe78], rcx
mov qword [rbp + 0xe60], rax
lea r9, [rbp + 0x440]
lea rax, [rsp + 0x60]
mov qword [rbp + 0x1348], rcx
mov qword [rbp + 0xe68], rax
mov r8, rdi
mov rax, qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov qword [rbp + 0x13a8], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0x1800], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x1808], rax
mov rax, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov qword [rbp + 0xa08], rax
lea rax, [rsp + 0x48]
mov qword [rbp + 0x9d0], rax
mov rax, qword [sym.imp.KERNEL32.DLL_SetEvent]
mov qword [rbp + 0x1818], rcx
mov qword [rbp + 0x9a8], rcx
mov qword [rbp + 0x998], rdx
mov rdx, rbx
mov qword [rbp + 0x1ce8], rcx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], r13d
mov qword [rbp + 0x1d48], rax
mov qword [rbp + 0xed8], r12
mov qword [rbp + 0x1330], 0xffffffffffffffff
mov qword [rbp + 0x1338], 0x36ee80
mov qword [rbp + 0x1878], r12
mov qword [rbp + 0x990], r14
mov qword [rbp + 0x9c8], 0x40
mov qword [rbp + 0x1cd0], rsi
mov dword [rsp + 0x20], 0x64
call qword [sym.imp.KERNEL32.DLL_CreateTimerQueueTimer]
mov dword [rsp + 0x30], 0x20
lea r9, [rbp + 0xde0]
mov dword [rsp + 0x28], r13d
lea rcx, [rsp + 0x40]
mov r8, rdi
mov dword [rsp + 0x20], 0xc8
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateTimerQueueTimer]
mov dword [rsp + 0x30], 0x20
lea r9, [rbp + 0x12b0]
mov dword [rsp + 0x28], r13d
lea rcx, [rsp + 0x40]
mov r8, rdi
mov dword [rsp + 0x20], 0x12c
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateTimerQueueTimer]
mov dword [rsp + 0x30], 0x20
lea r9, [rbp + 0x1780]
mov dword [rsp + 0x28], r13d
lea rcx, [rsp + 0x40]
mov r8, rdi
mov dword [rsp + 0x20], 0x190
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateTimerQueueTimer]
mov dword [rsp + 0x30], 0x20
lea r9, [rbp + 0x910]
mov dword [rsp + 0x28], r13d
lea rcx, [rsp + 0x40]
mov r8, rdi
mov dword [rsp + 0x20], 0x1f4
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateTimerQueueTimer]
mov dword [rsp + 0x30], 0x20
lea r9, [rbp + 0x1c50]
mov dword [rsp + 0x28], r13d
lea rcx, [rsp + 0x40]
mov r8, rdi
mov dword [rsp + 0x20], 0x258
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateTimerQueueTimer]
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_DeleteTimerQueue]
mov rcx, qword [rbp + 0x2130]
xor rcx, rsp
call fcn.1400049b0
lea r11, [rsp + 0x2240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret