Function at 0x1402854e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rdi
push r12
push r15
sub rsp, 0x70
mov r10d, dword [rcx + 0x13c]
mov r15d, r8d
mov eax, dword [rcx + 0x10c]
mov edi, r10d
sar edi, 8
mov ebp, r8d
sar r15d, 8
mov r12d, edx
mov rbx, rcx
cmp edi, eax
jl 0x140285520
cmp r15d, eax
jge 0x14028552f
mov eax, dword [rcx + 0x108]
cmp edi, eax
jge 0x14028554a
cmp r15d, eax
jge 0x14028554a
mov eax, pe_nt_image_headers64
mov dword [rcx + 0x13c], ebp
mov dword [rcx + rax], r12d
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rcx + 0x138]
mov r9d, r12d
mov qword [rsp + 0x68], rsi
mov ecx, ebp
mov qword [rsp + 0x60], r13
sub r9d, eax
mov qword [rsp + 0x58], r14
sub ecx, r10d
sar edx, 8
mov r14d, eax
sar r14d, 8
mov dword [rsp + 0xa0], edx
movzx r13d, al
movzx esi, r10b
cmp r14d, edx
jne 0x140285591
cmp edi, r15d
je 0x140285887
test ecx, ecx
jne 0x1402855a5
mov r8d, r15d
mov rcx, rbx
call fcn.1402858e0
jmp 0x1402858af
test r9d, r9d
jne 0x14028564d
test ecx, ecx
jle 0x140285610
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x118]
mov eax, 0x100
sub eax, esi
inc edi
mov r8d, edi
mov edx, r14d
add dword [rcx + 4], eax
mov eax, 0x100
mov rcx, qword [rbx + 0x118]
sub eax, esi
imul eax, r13d
xor esi, esi
add eax, eax
add dword [rcx + 8], eax
mov rcx, rbx
call fcn.1402858e0
cmp edi, r15d
jne 0x1402855c0
jmp 0x140285887
mov rax, qword [rbx + 0x118]
dec edi
mov r8d, edi
mov edx, r14d
sub dword [rax + 4], esi
mov eax, r13d
mov rcx, qword [rbx + 0x118]
imul eax, esi
mov esi, 0x100
neg eax
add eax, eax
add dword [rcx + 8], eax
mov rcx, rbx
call fcn.1402858e0
cmp edi, r15d
jne 0x140285610
jmp 0x140285887
movsxd r8, r9d
mov rax, r13
movsxd r10, ecx
mov rbp, rsi
imul rax, r10
imul rbp, r8
mov r12d, 0xffffffff
sub rbp, rax
cmp r14d, edx
je 0x14028567c
mov eax, r12d
cqo
idiv r8
mov r11, rax
jmp 0x14028567f
xor r11d, r11d
cmp edi, r15d
je 0x14028568e
mov rax, r12
cqo
idiv r10
jmp 0x140285690
xor eax, eax
mov r8, rax
shl ecx, 8
movsxd r10, ecx
mov r12, r11
shl r9d, 8
mov rcx, r10
imul rcx, rax
imul r8, rbp
imul r12, rbp
movsxd r9, r9d
mov rdx, r9
mov qword [rsp + 0x40], r9
imul rdx, rax
mov rax, r9
mov qword [rsp + 0x48], r10
imul rax, r11
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
mov rax, r10
imul rax, r11
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov rcx, rbp
sub rcx, r9
test rcx, rcx
jle 0x140285737
test rbp, rbp
jg 0x140285737
mov rcx, qword [rbx + 0x118]
mov rdx, r12
sub r8, qword [rsp + 0x28]
sub r12, rax
shr rdx, 0x20
sub rbp, r10
mov eax, edx
sub eax, esi
add dword [rcx + 4], eax
mov eax, edx
mov rcx, qword [rbx + 0x118]
sub eax, esi
imul eax, r13d
mov esi, edx
mov r13d, 0x100
add dword [rcx + 8], eax
dec r14d
jmp 0x140285834
mov rdx, r10
sub rdx, r9
add rdx, rbp
test rdx, rdx
jle 0x14028579b
test rcx, rcx
jg 0x14028579b
sub r8, qword [rsp + 0x38]
mov rbp, rcx
mov rcx, qword [rbx + 0x118]
mov eax, 0x100
sub r12, qword [rsp + 0x30]
sub eax, esi
mov qword [rsp + 0xb8], r8
neg r8
shr r8, 0x20
add dword [rcx + 4], eax
mov eax, 0x100
mov rdx, qword [rbx + 0x118]
sub eax, esi
xor esi, esi
lea ecx, [r8 + r13]
mov r13d, r8d
imul ecx, eax
add dword [rdx + 8], ecx
inc edi
jmp 0x14028583c
lea rax, [r10 + rbp]
test rax, rax
js 0x1402857f8
test rdx, rdx
jg 0x1402857f8
add r8, qword [rsp + 0x28]
mov rbp, rax
mov rcx, qword [rbx + 0x118]
add r12, qword [rsp + 0x20]
mov qword [rsp + 0xb8], r8
mov r8, r12
shr r8, 0x20
mov eax, r8d
sub eax, esi
add dword [rcx + 4], eax
lea eax, [r13 + 0x100]
mov rdx, qword [rbx + 0x118]
mov ecx, r8d
sub ecx, esi
xor r13d, r13d
imul ecx, eax
mov esi, r8d
add dword [rdx + 8], ecx
inc r14d
jmp 0x14028583c
mov rax, qword [rbx + 0x118]
mov rdx, r8
add r12, qword [rsp + 0x30]
neg rdx
add r8, qword [rsp + 0x38]
add rbp, r9
shr rdx, 0x20
sub dword [rax + 4], esi
mov rcx, qword [rbx + 0x118]
lea eax, [rdx + r13]
mov r13d, edx
imul eax, esi
mov esi, 0x100
sub dword [rcx + 8], eax
dec edi
mov qword [rsp + 0xb8], r8
mov r8d, edi
mov edx, r14d
mov rcx, rbx
call fcn.1402858e0
mov r8, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x48]
mov rax, qword [rsp + 0x20]
cmp r14d, dword [rsp + 0xa0]
jne 0x1402856e5
cmp edi, r15d
jne 0x1402856e5
mov ebp, dword [rsp + 0xb0]
mov r12d, dword [rsp + 0xa8]
mov rcx, qword [rbx + 0x118]
movzx edx, bpl
mov eax, edx
sub edx, esi
sub eax, esi
add dword [rcx + 4], eax
mov rcx, qword [rbx + 0x118]
movzx eax, r12b
add eax, r13d
imul eax, edx
add dword [rcx + 8], eax
mov r13, qword [rsp + 0x60]
mov eax, pe_nt_image_headers64
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x58]
mov dword [rbx + 0x13c], ebp
mov dword [rbx + rax], r12d
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rbp
pop rbx
ret