Function at 0x1400e3a71
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x100
lea rbp, [rsp + 0x80]
mov eax, ecx
mov word [rbp + 0x90], ax
mov byte [rbp - 0x2a], 0xf7
movabs rax, 0x60c0165d30c4ece0
mov qword [rbp + 0x68], rax
mov byte [rbp - 0x29], 0x9e
movzx eax, byte [rbp - 0x29]
test al, al
je 0x1400e3b0f
movzx eax, byte [rbp - 0x29]
movzx eax, al
cmp eax, 0x9e
je 0x1400e3af5
cmp eax, 0xd6
jne 0x1400e3b0f
movzx eax, byte [rbp - 0x29]
movzx eax, al
cmp eax, 0xb9
je 0x1400e3ae8
cmp eax, 0xde
jne 0x1400e3b0e
mov rax, qword [rbp + 0x60]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ILCreateFromPathA]
call rax
mov qword [rbp - 8], rax
jmp 0x1400e3af3
movzx eax, byte [rbp - 0x29]
and eax, 0x14
mov byte [rbp - 0x29], al
nop
jmp 0x1400e3b0e
movzx eax, byte [rbp - 0x29]
shr al, 1
mov byte [rbp - 0x2a], al
movabs rax, 0x16384afd2a7d4ef
mov qword [rbp], rax
jmp 0x1400e3b0f
nop
movzx eax, byte [rbp - 0x29]
movzx eax, al
cmp eax, 0x65
je 0x1400e3b47
cmp eax, 0x92
jne 0x1400e3b9c
movzx eax, byte [rbp - 0x2a]
movzx ecx, al
movzx edx, word [rbp + 0x90]
mov rax, qword [rbp]
mov r9d, ecx
mov r8d, 8
mov rcx, rax
call fcn.1400e28b4
jmp 0x1400e3b9c
movzx eax, byte [rbp - 0x2a]
movzx eax, al
cmp eax, 0x22
je 0x1400e3b66
cmp eax, 0x58
jne 0x1400e3b9b
mov rax, qword [rbp]
shl rax, 6
mov qword [rbp], rax
jmp 0x1400e3b9b
lea rdx, [rbp - 8]
lea rax, [rbp - 0x50]
mov r8, rdx
mov rdx, rax
mov ecx, 0x99
mov rax, qword [sym.imp.SHELL32.dll_SHGetImageList]
call rax
mov dword [rbp + 0x5c], eax
mov rax, qword [rbp]
movabs rdx, 0x1e51d86917a593dd
or rax, rdx
mov qword [rbp], rax
nop
nop
mov rax, rbp
mov qword [rbp - 0x28], rax
mov eax, dword [section..data]
mov dword [rbp - 0x34], eax
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x30], eax
mov word [rbp + 0x76], 0x4337
movzx eax, word [rbp + 0x90]
mov word [rbp - 0x1a], ax
cmp word [rbp + 0x76], 0x920
jg 0x1400e3c6c
movzx eax, byte [rbp - 0x29]
movzx eax, al
lea edx, [rax + 0x35]
movzx eax, byte [rbp - 0x2a]
movzx eax, al
cmp edx, eax
jl 0x1400e3c06
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
mov rdx, qword [rbp]
mov rax, qword [rbp - 0x28]
sub rcx, rdx
mov qword [rax], rcx
movzx eax, word [rbp - 0x1a]
mov word [rbp + 0x90], ax
jmp 0x1400e3c6c
cmp word [rbp + 0x76], 0x92d
jg 0x1400e3c6c
mov r8, rbp
lea rcx, [rbp - 0x28]
lea rax, [rbp - 0x18]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov edx, 0x3a
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
call rax
mov dword [rbp + 0x58], eax
mov rdx, qword [rbp]
mov rax, qword [rbp - 0x28]
movabs rcx, 0x40eb643abdcd2f43
and rdx, rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x28]
mov rax, qword [rax]
movabs rdx, 0x31e256bd39dded55
add rax, rdx
mov qword [rbp], rax
movzx eax, word [rbp - 0x1a]
movzx eax, ax
lea edx, [rax - 0xfcd]
movzx eax, word [rbp + 0x90]
cmp edx, eax
jle 0x1400e3cb1
lea r8, [rbp - 0x1a]
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x50]
mov dword [rsp + 0x20], 7
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoA]
call rax
mov dword [rbp + 0x3c], eax
movzx eax, byte [rbp - 0x2a]
movzx eax, al
cmp eax, 0x87
je 0x1400e3cf2
cmp eax, 0xc6
jne 0x1400e3d80
movzx eax, byte [rbp - 0x2a]
movzx ecx, al
movzx eax, word [rbp - 0x1a]
movzx edx, ax
mov rax, qword [rbp]
mov r9d, ecx
mov r8d, 0x41
mov rcx, rax
call fcn.1400e28b4
jmp 0x1400e3d80
mov rax, qword [rbp - 0x28]
mov rax, qword [rax]
movabs rdx, 0x3e8638d31dd6a339
add rax, rdx
mov qword [rbp], rax
lea rdx, [rbp - 8]
lea rax, [rbp - 0x18]
mov r8d, 0xd8
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
call rax
mov dword [rbp + 0x38], eax
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
mov rdx, qword [rbp]
mov rax, qword [rbp - 0x28]
sub rcx, rdx
mov qword [rax], rcx
shl word [rbp + 0x76], 6
movzx eax, word [rbp - 0x1a]
movzx eax, ax
mov ecx, eax
call fcn.1400e3a71
lea r8, [rbp - 0x28]
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x29]
lea rax, [rbp - 8]
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
call rax
mov dword [rbp + 0x34], eax
movzx eax, word [rbp - 0x1a]
mov word [rbp + 0x90], ax
nop
movzx eax, word [rbp + 0x90]
mov word [rbp + 0x32], ax
movzx eax, word [rbp - 0x1a]
xor ax, word [rbp + 0x32]
cmp word [rbp + 0x90], ax
jb 0x1400e3e8d
mov rax, rbp
mov qword [rbp + 0x28], rax
lea rax, [rbp - 0x34]
mov qword [rbp + 0x20], rax
mov edx, dword [rbp - 0x34]
mov eax, dword [rbp - 0x30]
imul edx, eax
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax]
mov eax, dword [section..data]
and eax, ecx
cmp edx, eax
jl 0x1400e3e50
mov dword [rbp - 0xc], 0x4595e350
movzx eax, word [rbp + 0x76]
mov word [rbp + 0x1e], ax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax]
mov eax, dword [rbp - 0x34]
mov ecx, edx
sub ecx, eax
mov edx, dword [rbp - 0x30]
mov eax, dword [section..data]
add eax, edx
cmp ecx, eax
jne 0x1400e3e36
lea rdx, [rbp - 0x1a]
lea rax, [rbp - 0xc]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
call rax
mov dword [rbp + 0x18], eax
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
add rax, rdx
mov qword [rbp], rax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax]
mov eax, dword [rbp - 0x30]
sub edx, eax
mov rax, qword [rbp + 0x20]
mov dword [rax], edx
lea rax, [rbp - 0x2a]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
mov rax, qword [rbp]
and rax, rdx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x78]
movzx eax, byte [rax]
movzx edx, al
movzx eax, byte [rbp - 0x2a]
movzx eax, al
imul edx, eax
movzx eax, byte [rbp - 0x29]
movzx eax, al
cmp edx, eax
jle 0x1400e3e7d
mov eax, dword [rbp - 0xc]
mov dword [rbp + 0x14], eax
lea rax, [rbp - 0x34]
mov qword [rbp + 8], rax
movzx eax, word [rbp - 0x1a]
movzx eax, ax
mov ecx, eax
call fcn.1400e3972
jmp 0x1400e3ea4
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
mov rax, qword [rbp]
mov ecx, eax
mov rax, qword [rbp - 0x28]
sar rdx, cl
mov qword [rax], rdx
movzx eax, byte [rbp - 0x2a]
movzx ecx, al
movzx edx, word [rbp + 0x32]
mov rax, qword [rbp]
mov r9d, ecx
mov r8d, 0xfc
mov rcx, rax
call fcn.1400e28b4
mov eax, dword [section..data]
add rsp, 0x100
pop rbp
ret