Function at 0x14007ea80
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14049e608]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov r13d, 0xffff0000
mov r14d, 0x4c
mov r8d, 1
movabs r12, 0x112e0be826d694b3
movabs rsi, 0x311cdad160000
mov rax, qword [0x14049f330]
test rax, rax
je 0x14007f53a
movzx eax, byte [0x14049f688]
test al, al
setne al
test al, al
je 0x14007ed23
mov qword [rsp + 0x48], 0x1312d00
nop
call fcn.140317990
mov rbx, rax
call fcn.140317974
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rdx, [rax + rcx]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdx
lea rdi, [rdx + 0x1312d00]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x48], rdi
call fcn.140317990
mov rbx, rax
call fcn.140317974
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rdx, [rcx + rax]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdi
cmp rdx, rdi
jge 0x14007ece0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x58], rdi
movsd xmm0, qword [0x14045b4a0]
movsd qword [rsp + 0x58], xmm0
movsd xmm6, qword [0x14045b4c8]
movsd qword [rsp + 0x58], xmm6
movsd qword [rsp + 0x48], xmm6
movsd qword [rsp + 0x48], xmm6
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x48], rdi
nop word [rax + rax]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdx
mov rbx, rdi
sub rbx, rdx
call fcn.140317a80
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x48], rax
imul rcx, rax, 0x64
mov qword [rsp + 0x48], rcx
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
movsd qword [rsp + 0x48], xmm0
movsd qword [rsp + 0x48], xmm0
comisd xmm0, xmm6
seta al
test al, al
je 0x14007ec4c
add rcx, rsi
jmp 0x14007ec54
mov qword [rsp + 0x48], rbx
add rcx, rbx
mov rax, r12
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x48], rdx
mov qword [rbp + 0xd0], rdx
imul rax, rdx, 0x3b9aca00
mov qword [rsp + 0x48], rax
sub rcx, rax
mov qword [rsp + 0x48], rcx
mov dword [rbp + 0xd8], ecx
lea rcx, [rbp + 0xd0]
call fcn.140317dfc
call fcn.140317990
mov rbx, rax
call fcn.140317974
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rdx, [rcx + rax]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x48], rdx
cmp rdx, rdi
jl 0x14007ec00
mov qword [rsp + 0x48], rdx
movzx eax, byte [0x14049f688]
test al, al
setne al
test al, al
je 0x14007ed00
mov rax, qword [0x14049f330]
test rax, rax
jne 0x14007eb20
mov rax, qword [0x14049f330]
test rax, rax
je 0x14007f53a
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call fcn.14007faa0
mov r8d, 1
mov sil, 1
mov byte [rsp + 0x50], sil
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
nop word [rax + rax]
mov rcx, qword [rdi + 0x1ff8]
mov rax, qword [0x14049f330]
cmp rax, rcx
jne 0x14007f528
lea r15, [rdi + 0x190]
movzx eax, byte [r15 + 0x1e70]
imul rcx, rax, 0x268
lea r12, [r15 + 0x1980]
add r12, rcx
movzx ecx, byte [rdi + 0x12a]
mov rdx, r8
shl rdx, cl
movzx ecx, byte [r12 + 2]
mov rax, r8
shl rax, cl
cmp rax, rdx
jne 0x14007f528
movzx r9d, byte [r15 + 0x1e70]
imul r11, r9, 0x268
mov r8d, dword [r11 + r15 + 0x1980]
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007ede8
mov edx, 0x20
jmp 0x14007edf7
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, r14
imul rax, r9, 0xcc0
add rax, r15
mov ebx, dword [rax + rdx]
mov dword [rbp + 0xe0], ebx
mov r11, qword [r11 + r15 + 0x19a0]
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007ee3a
mov edx, 0x20
jmp 0x14007ee49
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, r14
imul rcx, r9, 0xcc0
add rcx, r11
add rcx, r15
mov eax, dword [rcx + rdx]
mov dword [rbp + 0xe4], eax
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007ee87
mov edx, 0x20
jmp 0x14007ee96
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, r14
imul rcx, r9, 0x660
add rcx, r11
lea rax, [r15 + rcx*2]
mov ecx, dword [rax + rdx]
mov dword [rbp + 0xe8], ecx
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007eed5
mov edx, 0x20
jmp 0x14007eee4
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, r14
imul rcx, r9, 0x440
add rcx, r11
lea rax, [r15 + rcx*2]
add rcx, rax
mov eax, dword [rcx + rdx]
mov dword [rbp + 0xec], eax
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007ef26
mov edx, 0x20
jmp 0x14007ef35
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, r14
imul rcx, r9, 0x330
add rcx, r11
lea rax, [r15 + rcx*4]
mov ecx, dword [rax + rdx]
mov dword [rbp + 0xf0], ecx
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007ef75
mov r10d, 0x20
jmp 0x14007ef85
mov r10d, 0x27
cmp ecx, 0x6c000000
cmove r10, r14
imul rax, r9, 0xcc0
lea rdx, [r11 + r11*4]
add rax, r15
add rdx, rax
mov eax, dword [rdx + r10]
mov dword [rbp + 0xf4], eax
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007efc8
mov edx, 0x20
jmp 0x14007efd7
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, r14
imul rcx, r9, 0x220
add rcx, r11
lea rax, [rcx + rcx*2]
lea rcx, [r15 + rax*2]
mov eax, dword [rcx + rdx]
mov dword [rbp + 0xf8], eax
imul rcx, r9, 0x268
mov r10, qword [rcx + r15 + 0x19a0]
imul rcx, r9, 0x268
mov edx, dword [rcx + r15 + 0x1980]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007f037
mov r8d, 0x20
jmp 0x14007f047
mov r8d, 0x27
cmp ecx, 0x6c000000
cmove r8, r14
imul rax, r9, 0xcc0
imul rdx, r10, 7
add rax, r15
add rdx, rax
mov eax, dword [rdx + r8]
mov dword [rbp + 0xfc], eax
mov r10d, 8
mov eax, dword [rdi + 0x2030]
test eax, eax
je 0x14007f09e
cmp ebx, eax
jae 0x14007f535
cmp qword [rdi + 0x140], 1
jne 0x14007f09e
movzx eax, byte [r15 + 0x1e70]
imul rcx, rax, 0xcc0
mov rax, qword [0x1407366e0]
xor qword [rcx + r15], rax
movzx eax, byte [r15 + 0x1e70]
imul rcx, rax, 0x268
mov edx, dword [rcx + r15 + 0x1980]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007f0dc
mov r9d, 0x20
jmp 0x14007f0ec
mov r9d, 0x27
cmp ecx, 0x6c000000
cmove r9, r14
movzx eax, byte [r15 + 0x1e70]
imul rcx, rax, 0x268
mov edx, dword [rcx + r15 + 0x1980]
mov eax, edx
and eax, 0xff000000
mov r8d, 0xff000000
cmp eax, 0x63000000
cmove r8d, r13d
and r8d, edx
mov ecx, 4
cmp r8d, 0x6b000000
cmove rcx, r10
movzx eax, byte [r15 + 0x1e70]
imul rbx, rax, 0xcc0
lea rax, [r15 + rcx]
add rbx, rax
add rbx, r9
mov edx, dword [r12]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, edx
cmp ecx, 0x72000000
jne 0x14007f30d
test sil, sil
je 0x14007f1cd
mov byte [rsp + 0x50], 0
cmp byte [r12 + 0x261], 0
je 0x14007f1a3
movzx eax, byte [r15 + 0x1e70]
imul rdx, rax, 0xcc0
add rdx, r15
mov r9, rbx
mov r8, qword [r12 + 0x20]
mov rcx, r12
call fcn.14003ac30
movzx eax, byte [r15 + 0x1e70]
imul r8, rax, 0xcc0
add r8, r15
mov r9, qword [r12 + 0x20]
lea rdx, [rbp + 0x100]
mov rcx, qword [rdi + 0x2008]
call fcn.14014dc00
mov edx, 0x8000
cmp dword [rdi + 0x2030], 0
mov eax, 1
cmovne edx, eax
mov rcx, r15
call fcn.140080360
test al, al
je 0x14007f4db
cmp byte [r12 + 0x261], 0
je 0x14007f249
movups xmm0, xmmword [rbx]
movaps xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rbp + 0x150], xmm1
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rbp + 0x160], xmm0
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rbp + 0x170], xmm1
movzx eax, byte [r15 + 0x1e70]
imul rdx, rax, 0xcc0
add rdx, r15
mov r9, rbx
mov r8, qword [r12 + 0x20]
mov rcx, r12
call fcn.14003ac30
mov r14, qword [r12 + 0x20]
movzx r13d, byte [r15 + 0x1e70]
mov rbx, qword [rdi + 0x2008]
mov dword [rsp + 0x48], 0x9fc0
ldmxcsr dword [rsp + 0x48]
xor eax, eax
mov edi, eax
cmp dword [0x140736d64], 1
je 0x14007f2bd
nop word [rax + rax]
mov rax, qword [rbx]
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [rax + gethostname]
mov r9d, 0x100
lea r8, [rbx + 0x980]
mov edx, 0x40
lea rcx, [rbp + 0x100]
call qword [case.0x14014f91d.0]
inc edi
mov eax, dword [0x140736d64]
dec eax
cmp edi, eax
jb 0x14007f280
mov rax, qword [rbx]
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [rax + gethostname]
imul r8, r13, 0xcc0
add r8, r15
mov r9, r14
mov edx, 0x40
lea rcx, [rbp + 0x100]
call qword [case.0x14014f91d.0]
mov rdi, qword [rsp + 0x60]
lea r13, [rdi + 0x28]
mov rax, qword [rbx]
lea r8, [rbp + 0x100]
mov rdx, r13
mov rcx, rbx
call qword [rax + 0x18]
jmp 0x14007f3e0
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, edx
lea r13, [rdi + 0x28]
movzx eax, byte [r15 + 0x1e70]
cmp ecx, 0x6c000000
je 0x14007f38d
mov rsi, qword [r12 + 0x78]
mov r14, qword [r12 + 0x20]
lea rbx, [rdi + 0x148]
imul rdi, rax, 0xcc0
add rdi, r15
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax + 0x12c]
mov edx, dword [rax + 0x134]
mov rcx, r12
call fcn.1400a2bf0
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov r8, r13
mov rdx, r14
mov rcx, rdi
call rax
mov rdi, qword [rsp + 0x60]
mov r14d, 0x4c
jmp 0x14007f3bc
lea r9, [rdi + 0x148]
imul rcx, rax, 0xcc0
add rcx, r15
mov byte [rsp + 0x28], 1
mov rax, qword [rdi + 0x2028]
mov qword [rsp + 0x20], rax
mov r8, r13
mov rdx, qword [r12 + 0x20]
call fcn.14016d7e0
mov edx, 0x8000
cmp dword [rdi + 0x2030], 0
mov eax, 1
cmovne edx, eax
mov rcx, r15
call fcn.140080360
test al, al
je 0x14007f505
xor ecx, ecx
mov ebx, ecx
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r13 + 0x18]
mov eax, dword [rdi + 0x2030]
test eax, eax
je 0x14007f433
cmp dword [rbp + rbx*4 + 0xe0], eax
jae 0x14007f495
prefetchw byte [0x1407366e0]
mov rax, qword [0x1407366e0]
nop dword [rax]
mov rcx, rax
xor rcx, rdx
lock cmpxchg qword [0x1407366e0], rcx
jne 0x14007f420
jmp 0x14007f493
cmp rdx, qword [r12 + 0x80]
jae 0x14007f495
lea rax, [rbp + 0x140]
cmp byte [r12 + 0x261], 0
cmove rax, rcx
mov r8d, dword [rbp + rbx*4 + 0xe0]
mov qword [rsp + 0x30], rax
mov r9, r13
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.14008c700
nop
cmp qword [0x140737758], 0
je 0x14007f481
mov rdx, rax
call fcn.14008c870
nop
mov rcx, qword [rbp - 8]
call fcn.140319610
mov rcx, qword [rbp - 0x18]
call fcn.140319610
xor ecx, ecx
inc rbx
add r13, 0x20
cmp rbx, 8
jb 0x14007f3f0
add qword [rdi + 8], 8
cmp byte [rdi + 0x131], 0
movzx esi, byte [rsp + 0x50]
mov r14d, 0x4c
mov r13d, 0xffff0000
lea r8d, [r14 - 0x4b]
je 0x14007ed50
call sub.KERNEL32.dll_SwitchToThread
lea r8d, [r14 - 0x4b]
jmp 0x14007ed50
movzx eax, byte [rdi + 0x2000]
imul rcx, rax, 0x268
add rcx, 0x1b10
add rcx, rdi
call fcn.14008cc90
mov rcx, rdi
call fcn.14007faa0
jmp 0x14007ead8
movzx eax, byte [rdi + 0x2000]
imul rcx, rax, 0x268
add rcx, 0x1b10
add rcx, rdi
call fcn.14008cc90
mov r13d, 0xffff0000
mov rcx, rdi
call fcn.14007faa0
jmp 0x14007ead8
call fcn.140070e30
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1403195b0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret