Function at 0x140075da0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x290
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140518628]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r13, rcx
lea rsi, [0x140519368]
xor r14d, r14d
movabs r15, 0x7ffffffffeced2ff
mov ebx, 0x3c
movabs rdi, 0x7fffffffffffffff
mov rax, qword [0x140519368]
test rax, rax
je 0x1400765e1
movzx eax, byte [0x140519351]
test al, al
je 0x140075eb1
call fcn.14035fc5c
mov rbx, rax
call fcn.14035fc40
cmp rbx, 0x989680
jne 0x140075e3c
imul rax, rax, 0x64
jmp 0x140075e57
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
setl cl
test cl, cl
je 0x140075e6e
add rax, 0x1312d00
mov qword [rsp + 0x48], rax
jmp 0x140075e73
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x48]
call fcn.14007cf80
movzx eax, byte [0x140519351]
test al, al
je 0x140075e94
mov rax, qword [0x140519368]
test rax, rax
jne 0x140075e20
mov rax, qword [0x140519368]
test rax, rax
je 0x1400765e1
mov rcx, r13
call fcn.1400768e0
mov ebx, 0x3c
mov rcx, qword [0x1407b7548]
test rcx, rcx
jne 0x140075edd
mov ecx, 0x110
call fcn.140361120
mov qword [rbp - 0x58], rax
mov rcx, rax
call fcn.14007d300
mov rcx, rax
mov qword [0x1407b7548], rax
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, rax
xorps xmm6, xmm6
test rax, rax
js 0x140075ef8
cvtsi2sd xmm6, rax
jmp 0x140075f0a
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm6, rax
addsd xmm6, xmm6
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x28]
mov rcx, rax
imul rcx, qword [r13 + 0xa8]
xorps xmm0, xmm0
test rcx, rcx
js 0x140075f2e
cvtsi2sd xmm0, rcx
jmp 0x140075f43
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
divsd xmm6, xmm0
mov eax, dword [r13 + 0x98]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
cvttsd2si r12d, xmm0
mov dword [rsp + 0x68], r12d
dec eax
cmp eax, 0x62
ja 0x140075f76
cmp r12d, 0x64
mov byte [rsp + 0x40], 1
jl 0x140075f7b
mov byte [rsp + 0x40], 0
mov r15b, 1
mov byte [rsp + 0x58], r15b
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
mov rcx, qword [r13 + 0xf48]
mov rax, qword [0x140519368]
cmp rax, rcx
jne 0x1400765d4
lea rdi, [r13 + 0xd0]
movzx eax, byte [rdi + 0xe80]
imul rcx, rax, 0x268
lea rsi, [rdi + 0x990]
add rsi, rcx
movzx ecx, byte [r13 + 0x8a]
mov edx, 1
shl rdx, cl
movzx ecx, byte [rsi + 2]
mov eax, 1
shl rax, cl
cmp rax, rdx
jne 0x1400765cd
movzx r8d, byte [rdi + 0xe80]
imul r10, r8, 0x268
mov edx, dword [r10 + rdi + 0x990]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
mov r11d, 0xffff0000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x140076040
mov eax, 0x20
jmp 0x14007606d
cmp ecx, 0x6c000000
jne 0x14007604f
mov eax, 0x4c
jmp 0x14007606d
cmp edx, 0x72151279
jne 0x14007605e
mov eax, 0x93
jmp 0x14007606d
mov eax, 0x27
cmp edx, 0x72151278
cmove rax, rbx
imul r9, r8, 0x4c8
add rax, r9
mov ecx, dword [rax + rdi]
mov dword [rbp + 0xe0], ecx
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x1400760a6
mov ecx, 0x20
jmp 0x1400760d3
cmp ecx, 0x6c000000
jne 0x1400760b5
mov ecx, 0x4c
jmp 0x1400760d3
cmp edx, 0x72151279
jne 0x1400760c4
mov ecx, 0x93
jmp 0x1400760d3
mov ecx, 0x27
cmp edx, 0x72151278
cmove rcx, rbx
mov r8, qword [r10 + rdi + 0x9b0]
lea rax, [r9 + r8]
add rax, rcx
mov eax, dword [rax + rdi]
mov dword [rbp + 0xe4], eax
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x140076111
mov ecx, 0x20
jmp 0x14007613e
cmp ecx, 0x6c000000
jne 0x140076120
mov ecx, 0x4c
jmp 0x14007613e
cmp edx, 0x72151279
jne 0x14007612f
mov ecx, 0x93
jmp 0x14007613e
mov ecx, 0x27
cmp edx, 0x72151278
cmove rcx, rbx
lea rax, [r9 + r8*2]
add rax, rcx
mov eax, dword [rax + rdi]
mov dword [rbp + 0xe8], eax
mov byte [rsp + 0x42], 1
movzx eax, byte [rdi + 0xe80]
imul rcx, rax, 0x268
mov edx, dword [rcx + rdi + 0x990]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007618f
mov r9d, 0x20
jmp 0x1400761bf
cmp ecx, 0x6c000000
jne 0x14007619f
mov r9d, 0x4c
jmp 0x1400761bf
cmp edx, 0x72151279
jne 0x1400761af
mov r9d, 0x93
jmp 0x1400761bf
mov r9d, 0x27
cmp edx, 0x72151278
cmove r9, rbx
movzx eax, byte [rdi + 0xe80]
imul rcx, rax, 0x268
mov edx, dword [rcx + rdi + 0x990]
mov eax, edx
and eax, 0xff000000
mov r8d, 0xff000000
cmp eax, 0x63000000
cmove r8d, r11d
and r8d, edx
mov ecx, 4
cmp r8d, 0x6b000000
mov eax, 8
cmove ecx, eax
movzx eax, byte [rdi + 0xe80]
imul r14, rax, 0x4c8
lea rax, [rdi + rcx]
add r14, rax
add r14, r9
mov edx, dword [rsi]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x72000000
jne 0x1400763db
test r15b, r15b
je 0x1400762af
mov byte [rsp + 0x58], 0
cmp byte [rsi + 0x261], 0
je 0x140076271
movzx eax, byte [rdi + 0xe80]
imul rdx, rax, 0x4c8
add rdx, rdi
mov r9, r14
mov r8, qword [rsi + 0x20]
mov rcx, rsi
call fcn.14003b510
movzx eax, byte [rdi + 0xe80]
imul r8, rax, 0x4c8
add r8, rdi
mov rbx, qword [r13 + 0xf58]
mov r9, qword [rsi + 0x20]
mov edx, 0x40
lea rcx, [rbp + 0xf0]
call qword [case.0x14017977d.0]
mov rax, qword [rbx]
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, rdi
call fcn.14007c450
test al, al
je 0x1400765ac
cmp byte [rsi + 0x261], 0
je 0x140076317
movups xmm0, xmmword [r14]
movaps xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [r14 + 0x30]
movaps xmmword [rbp + 0x160], xmm1
movzx eax, byte [rdi + 0xe80]
imul rdx, rax, 0x4c8
add rdx, rdi
mov r9, r14
mov r8, qword [rsi + 0x20]
mov rcx, rsi
call fcn.14003b510
mov r12, qword [rsi + 0x20]
movzx eax, byte [rdi + 0xe80]
imul r15, rax, 0x4c8
add r15, rdi
mov rbx, qword [r13 + 0xf58]
mov dword [rsp + 0x60], 0x9fc0
ldmxcsr dword [rsp + 0x60]
xor edi, edi
cmp dword [0x1407b69ec], 1
je 0x14007638d
nop dword [rax + rax]
mov rax, qword [rbx]
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [rax + gethostname]
mov r9d, 0x100
lea r8, [rbx + 0x980]
mov edx, 0x40
lea rcx, [rbp + 0xf0]
call qword [case.0x14017977d.0]
inc edi
mov eax, dword [0x1407b69ec]
dec eax
cmp edi, eax
jb 0x140076350
mov rax, qword [rbx]
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [rax + gethostname]
mov r9, r12
mov r8, r15
mov edx, 0x40
lea rcx, [rbp + 0xf0]
call qword [case.0x14017977d.0]
mov rax, qword [rbx]
lea rdx, [r13 + 0x28]
lea r8, [rbp + 0xf0]
mov rcx, rbx
call qword [rax + 0x18]
movzx ebx, byte [rsp + 0x42]
movzx r15d, byte [rsp + 0x58]
mov r12d, dword [rsp + 0x68]
jmp 0x140076457
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x6c000000
je 0x140076445
movzx eax, byte [rdi + 0xe80]
imul rbx, rax, 0x4c8
add rbx, rdi
mov r8d, dword [r13 + 0x8c]
mov edx, dword [r13 + 0x94]
mov rcx, rsi
call fcn.1400cb060
lea r9, [r13 + 0xb0]
lea r8, [r13 + 0x28]
mov rdx, qword [rsi + 0x78]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsi + 0x20]
mov rcx, rbx
call rax
movzx ebx, byte [rsp + 0x42]
jmp 0x140076447
xor bl, bl
mov rcx, rdi
call fcn.14007c450
test al, al
je 0x1400765ac
xor r14d, r14d
test bl, bl
je 0x1400764e3
mov edi, r14d
lea rbx, [r13 + 0x28]
nop dword [rax]
mov rax, qword [rbx + 0x18]
cmp rax, qword [rsi + 0x80]
jae 0x1400764d1
lea rax, [rbp + 0x130]
cmp byte [rsi + 0x261], 0
cmove rax, r14
mov r8d, dword [rbp + rdi*4 + 0xe0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9, rbx
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.1400b5a40
nop
mov rcx, rax
call fcn.1400b69a0
nop
mov rcx, qword [rbp + 8]
call fcn.14036115c
mov rcx, qword [rbp - 8]
call fcn.14036115c
inc rdi
add rbx, 0x20
cmp rdi, 3
jb 0x140076470
add qword [r13 + 8], 3
test byte [r13 + 8], 7
jne 0x140076581
cmp byte [rsp + 0x40], 0
je 0x140076581
movzx ecx, r12b
call fcn.1400c0320
mov rbx, rax
call fcn.14035fc5c
mov rdi, rax
call fcn.14035fc40
cmp rdi, 0x989680
jne 0x140076521
imul rcx, rax, 0x64
jmp 0x14007653c
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rcx, rax
mov qword [rsp + 0x50], rcx
test rbx, rbx
jle 0x140076577
movabs r9, 0x7fffffffffffffff
imul rdx, rbx, 0x3e8
mov rax, r9
sub rax, rdx
cmp rcx, rax
setl al
test al, al
je 0x140076572
lea rax, [rdx + rcx]
mov qword [rsp + 0x50], rax
jmp 0x140076577
mov qword [rsp + 0x50], r9
lea rcx, [rsp + 0x50]
call fcn.14007cf80
cmp byte [r13 + 0x91], 0
mov ebx, 0x3c
lea rsi, [0x140519368]
je 0x140075fa2
call sub.KERNEL32.dll_SwitchToThread
lea rsi, [0x140519368]
jmp 0x140075fa2
movzx eax, byte [r13 + 0xf50]
imul rcx, rax, 0x268
add rcx, 0xa60
add rcx, r13
call fcn.1400b6890
xor r14d, r14d
lea rsi, [0x140519368]
mov rcx, r13
call fcn.1400768e0
jmp 0x140075de8
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140361100
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret