Function at 0x140111b40
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov qword [rsp + 0x110], rcx
call fcn.140112939
mov qword [rsp + 0x118], rax
call fcn.140112939
xor eax, eax
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x108], rax
cmp rax, 0x100
je 0x140111bc4
mov rax, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x110]
mov byte [rcx + rax], 0
movabs rcx, 0x687be77a3bddbb83
movabs rdx, 0x687be77a3bddbb82
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x120], rax
jmp 0x140111b6d
mov ecx, 0x50d
call fcn.140066656
mov rcx, rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x100], rcx
mov al, byte [rax]
mov cl, 0xd6
xor cl, 0xd6
cmp al, cl
jne 0x140112902
mov ecx, 0x1e8
call fcn.140066656
mov rcx, qword [rsp + 0x118]
cmp byte [rcx], 0
mov qword [rsp + 0xf8], rax
jne 0x140112902
mov rcx, qword [rsp + 0x100]
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xf0], rax
cmp rax, rcx
jge 0x140112902
mov rax, qword [rsp + 0xf0]
cmp rax, 0xff
jbe 0x140111c64
mov rcx, qword [rsp + 0xf0]
xor eax, eax
mov edx, eax
mov r8d, 0xff
call fcn.14001f7c4
jmp 0x140112902
mov rax, qword [rsp + 0xf0]
mov dword [rsp + 0xe8], eax
mov cx, 0xd129
xor cx, 0x9e1e
mov dx, 0x1559
xor dx, 0xf77f
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0xee], cx
mov al, byte [rax]
mov cl, 0x64
xor cl, 0x64
cmp al, cl
jne 0x140112902
mov edx, dword [rsp + 0xe8]
mov ax, word [rsp + 0xee]
mov cx, ax
add cx, 1
xor ax, 0xffff
or ax, 0xff
add ax, cx
movzx ecx, ax
mov eax, 0xff
cmp ecx, edx
mov qword [rsp + 0xe0], rax
ja 0x140112014
mov ecx, 0xba22
mov edx, 0x1728
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0xde], cx
cmp byte [rax], 0
jne 0x140112902
mov ecx, dword [rsp + 0xe8]
mov ax, word [rsp + 0xde]
mov dx, ax
add dx, 1
xor ax, 0xffff
or ax, 0xff
add ax, dx
movzx edx, ax
mov eax, 0xff
cmp ecx, edx
mov qword [rsp + 0xe0], rax
ja 0x140112014
mov eax, dword [0x140207998]
mov r8d, dword [0x14020799c]
mov ecx, 0xd6ef8f3a
xor ecx, 0x291070c5
mov edx, r8d
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
xor eax, 0xd838aee3
mov ecx, eax
xor ecx, 0x2da5bbf2
xor ecx, 0xffffffff
and ecx, 0x2da5bbf2
shl ecx, 1
sub ecx, 0x2da5bbf2
sub eax, ecx
mov ecx, 0xf3c7b46
xor ecx, 0xc65a475a
sub eax, ecx
cmp eax, 0xf46c7ce8
jae 0x14011290c
mov ecx, dword [0x1402079a0]
mov edx, dword [0x1402079a4]
xor edx, 0x7d95b7fa
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
mov edx, 0x2488f4e1
xor edx, 0xdb770b1e
mov ecx, eax
xor ecx, edx
mov edx, 0xf12b4d1f
xor edx, 0x47a3a31f
and ecx, edx
mov edx, 0x3c643729
xor edx, 0x8aecd929
mov r8d, 0x6aaa90c7
xor r8d, 0x95556f38
xor edx, r8d
and eax, edx
sub eax, ecx
imul eax, eax, 0x8f1b82c3
sub eax, 0x6d7a1e3
mov dword [rsp + 0xcc], eax
mov ecx, 0x49c
call fcn.140066656
mov rcx, qword [rsp + 0x118]
mov rdx, rax
mov eax, dword [rsp + 0xcc]
mov qword [rsp + 0xd0], rdx
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0xdd], cl
cmp eax, 0x6431a42
je 0x140111dac
mov al, byte [rsp + 0xdd]
test al, 1
jne 0x140111e64
jmp 0x140112902
mov ecx, dword [0x1402079a8]
mov edx, dword [0x1402079ac]
mov r8d, ecx
and r8d, edx
mov eax, 0xe095bd2b
xor eax, 0xe095bd29
imul eax, r8d
add ecx, edx
sub ecx, eax
mov edx, 0xcd40663a
xor edx, 0xa5aedfae
mov eax, ecx
and eax, edx
xor ecx, 0x68eeb994
or eax, ecx
imul eax, eax, 0xeaa907df
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x438203da
mov edx, 0xffffffff
xor edx, 0x438203da
and eax, edx
sub eax, ecx
cmp eax, 0x7338ef4b
ja 0x140112915
mov r8, qword [rsp + 0xd0]
mov r10, qword [rsp + 0xf0]
mov ecx, dword [0x1402079b0]
mov edx, dword [0x1402079b4]
xor edx, 0x6382ce39
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, 0x85f8fb4e
xor eax, 0x3a985d0e
or ecx, eax
xor ecx, 0x9a2f7882
mov eax, ecx
and eax, 0x6938da06
xor ecx, 0x6938da06
or eax, ecx
mov rdx, r10
sub rdx, r8
mov qword [rsp + 0xc0], rdx
mov rcx, rdx
xor rcx, 0xffffffffffffffff
movabs r9, 0x69b7c6595a1ea027
and rcx, r9
movabs rsi, 0x51e3135b93e9c0e5
movabs r9, 0x3854d502c9f760c2
xor rsi, r9
movabs r9, 0x632bb4ae85e61be3
movabs r11, 0x9cd44b517a19e41c
xor r9, r11
xor rsi, r9
mov r11, rdx
and r11, rsi
mov r9, r10
xor r9, 0xffffffffffffffff
movabs rdi, 0x69b7c6595a1ea027
and r9, rdi
and r10, rsi
or rcx, r11
or r9, r10
xor rcx, r9
movabs r9, 0xecf2db00d5dcf670
movabs r10, 0xecf2db00d5dcf670
xor r9, r10
cmp rcx, r9
setl cl
xor rdx, r8
movabs r8, 0xd42461f21b791bd9
movabs r9, 0x2bdb9e0de486e426
xor r8, r9
cmp rdx, r8
setg dl
and cl, dl
mov byte [rsp + 0xcb], cl
cmp eax, 0x60142adc
jb 0x140111eca
mov rax, qword [rsp + 0xc0]
mov cl, byte [rsp + 0xcb]
test cl, 1
mov qword [rsp + 0xe0], rax
jne 0x14011200a
jmp 0x140112014
call fcn.140007f57
jmp 0x140112902
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xb0], rax
mov ecx, 0xab1
mov edx, 0xa780
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0xbe], cx
cmp byte [rax], 0
jne 0x140112902
mov eax, dword [0x1402079b8]
xor eax, 0x311373bb
xor eax, dword [0x1402079bc]
xor ecx, ecx
sub ecx, 0xe330a6f9
sub eax, ecx
mov ecx, 0x2aa3be67
xor edx, edx
div ecx
mov ecx, 0x7dac7cbd
xor edx, edx
div ecx
cmp eax, 0xe5801bcf
jae 0x14011291e
mov edx, dword [rsp + 0xe8]
mov cx, word [rsp + 0xbe]
mov eax, dword [0x1402079c0]
mov r9d, dword [0x1402079c4]
mov r8d, eax
add r8d, 1
xor eax, 0xffffffff
or eax, r9d
add eax, r8d
sub eax, 0x938ff92a
add eax, 0xc71ddee7
and eax, 0x338dd3fd
mov r8w, 0xac99
xor r8w, 0xac66
and cx, r8w
movzx ecx, cx
cmp ecx, edx
seta cl
mov byte [rsp + 0xaf], cl
cmp eax, 0xeefd5a0
je 0x140112087
mov rax, qword [rsp + 0xb0]
mov cl, byte [rsp + 0xaf]
test cl, 1
mov qword [rsp + 0xa0], rax
jne 0x140112333
jmp 0x140112110
mov ecx, dword [0x1402079c8]
mov edx, dword [0x1402079cc]
xor edx, 0xfe4c14c0
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, 0xa57f4753
xor edx, edx
div ecx
and eax, 0x6bf642d4
and eax, 0xd317a21e
mov ecx, 0xa20d239
xor ecx, 0xe0d8480a
cmp eax, ecx
je 0x140112927
mov r11d, dword [0x1402079d0]
mov r10d, dword [0x1402079d4]
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, r10d
xor edx, 0xffffffff
mov r8d, 0x5618ed04
xor r8d, 0x69abbc13
mov eax, 0xef745059
xor eax, 0x108bafa6
xor r8d, eax
mov eax, ecx
and eax, 0x3fb35117
and r11d, r8d
mov r9d, edx
and r9d, 0x3fb35117
and r10d, r8d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0xf2f3f212
xor edx, 0xcd40a305
or edx, r8d
and ecx, edx
or eax, ecx
or eax, 0x6911d356
mov ecx, 0xc21b04dd
xor edx, edx
div ecx
mov ecx, 0xec18491d
xor edx, edx
div ecx
mov dword [rsp + 0x98], eax
mov ecx, 0x8f70
mov edx, 0x225a
call fcn.140069186
mov rcx, qword [rsp + 0x118]
mov dx, ax
mov eax, dword [rsp + 0x98]
mov word [rsp + 0x9c], dx
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x9f], cl
cmp eax, 0x5e6ffa06
ja 0x140112150
mov al, byte [rsp + 0x9f]
test al, 1
jne 0x14011222e
jmp 0x140112902
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0xe8]
mov dx, word [rsp + 0x9c]
mov r8w, 0x39f8
xor r8w, 0x3907
and dx, r8w
movzx edx, dx
cmp ecx, edx
mov qword [rsp + 0xa0], rax
ja 0x140112333
mov ecx, 0x374
call fcn.140066656
mov rcx, rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x90], rcx
cmp byte [rax], 0
jne 0x140112902
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0xf0]
mov rax, r8
sub rax, r9
movabs rcx, 0x10b5485a251b82cd
movabs rdx, 0xef4ab7a5dae47d32
xor rcx, rdx
mov rdx, rax
xor rdx, rcx
mov rcx, r8
and rcx, rdx
xor r8, 0xffffffffffffffff
mov rdx, rax
and rdx, r8
or rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0xe7d74d2aeae8c801
movabs r8, 0x1828b2d5151737fe
xor rdx, r8
mov r8, rax
xor r8, rdx
mov rdx, r9
and rdx, r8
xor r9, 0xffffffffffffffff
mov r8, rax
and r8, r9
or rdx, r8
cmp rdx, 0xffffffffffffffff
setg dl
and cl, dl
test cl, 1
mov qword [rsp + 0xa0], rax
jne 0x140112329
jmp 0x140112333
call fcn.140007f57
jmp 0x140112902
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x80], rax
mov ecx, 0x7d35
mov edx, 0xd055
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0x8e], cx
mov al, byte [rax]
mov cl, 0x67
xor cl, 0x67
cmp al, cl
jne 0x140112902
mov rax, qword [rsp + 0x80]
mov edx, dword [rsp + 0xe8]
mov cx, word [rsp + 0x8e]
mov r8w, 0xb7fb
xor r8w, 0xb704
and cx, r8w
movzx ecx, cx
cmp ecx, edx
mov qword [rsp + 0x78], rax
ja 0x140112564
mov ecx, 0x73ce
mov edx, 0xdea7
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0x76], cx
cmp byte [rax], 0
jne 0x140112902
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0xe8]
mov r8w, word [rsp + 0x76]
mov r9w, 0xffff
xor r9w, 0xff
mov dx, r8w
xor dx, r9w
and dx, r8w
movzx edx, dx
cmp ecx, edx
mov qword [rsp + 0x78], rax
ja 0x140112564
mov cx, 0x87e2
xor cx, 0x8593
call fcn.140066656
mov rcx, rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x68], rcx
mov al, byte [rax]
mov cl, 0x8c
xor cl, 0x8c
cmp al, cl
jne 0x140112902
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0xf0]
mov rcx, r9
xor rcx, 0xffffffffffffffff
movabs rax, 0x71b223c6478749e7
movabs r8, 0x71b223c6478749e7
xor rax, r8
movabs r8, 0xb8cad6131d50831
movabs r10, 0xb8cad6131d50830
xor r8, r10
sub rax, r8
sub rcx, rax
mov rax, rdx
sub rax, rcx
mov rcx, rax
xor rcx, 0xffffffffffffffff
movabs r8, 0xf051b66770422a79
and rcx, r8
mov r11, 0xffffffffffffffff
movabs r8, 0xf051b66770422a79
xor r11, r8
mov r10, rax
and r10, r11
movabs rsi, 0xb1e6e8945f6f21cb
movabs r8, 0x4e19176ba090de34
xor rsi, r8
mov r8, r9
xor r8, rsi
movabs rsi, 0xf051b66770422a79
and r8, rsi
and r9, r11
or rcx, r10
or r8, r9
xor rcx, r8
mov r8, rax
and r8, r8
movabs r9, 0xf6e14a27fb1b223b
movabs r10, 0x91eb5d804e4ddc4
xor r9, r10
xor r8, r9
xor r8, 0xffffffffffffffff
mov r9, rdx
xor r9, 0xffffffffffffffff
or r8, r9
mov r9, rdx
xor r9, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or r9, rdx
mov rdx, rax
and rdx, r9
xor rdx, 0xffffffffffffffff
and r8, rdx
xor r8, 0xffffffffffffffff
mov rdx, rcx
add rdx, 1
xor rcx, 0xffffffffffffffff
or rcx, r8
add rcx, rdx
cmp rcx, 0
mov qword [rsp + 0x78], rax
jge 0x140112564
call fcn.140007f57
jmp 0x140112902
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov ecx, 0x4c2b
mov edx, 0xe150
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0x66], cx
mov al, byte [rax]
mov cl, 0xd6
xor cl, 0xd6
cmp al, cl
jne 0x140112902
mov eax, dword [rsp + 0xe8]
mov dx, word [rsp + 0x66]
mov cx, dx
xor cx, 0xffff
mov r8w, 0xf794
xor r8w, 0x86b
xor dx, r8w
and cx, dx
mov dx, 0xff
or dx, 0xff
mov r8w, 0x2337
xor r8w, 0xdcc8
xor dx, r8w
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
movzx ecx, cx
cmp eax, ecx
je 0x14011277e
mov cx, 0x9d41
xor cx, 0x235f
mov dx, 0x8964
xor dx, 0x9a07
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0x56], cx
cmp byte [rax], 0
jne 0x140112902
mov eax, dword [0x1402079d8]
mov ecx, dword [0x1402079dc]
xor ecx, 0x8b4d464a
xor edx, edx
div ecx
mov r11d, eax
and r11d, 0x7d7971e7
mov eax, 0xe518168e
xor eax, 0x51382d75
xor r11d, eax
mov eax, 0xb0e22509
xor eax, 0x4f1ddaf6
mov ecx, r11d
xor ecx, eax
mov r8d, 0xffffffff
xor r8d, 0x79bbd34f
mov edx, 0xffffffff
xor edx, 0xc1848c07
mov r9d, 0xe095d41f
xor r9d, 0x21115818
mov eax, ecx
and eax, r9d
and r11d, edx
mov r9d, r8d
and r9d, 0xc1848c07
mov r10d, edx
and r10d, 0x79bbd34f
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x68ad12b8
xor r8d, 0x9752ed47
xor ecx, r8d
or edx, 0xc1848c07
and ecx, edx
or eax, ecx
mov ecx, 0xdbe4a38e
xor ecx, 0x1913ff7b
cmp eax, ecx
jbe 0x140112930
mov ecx, dword [rsp + 0xe8]
mov eax, dword [0x1402079e0]
mov r8d, dword [0x1402079e4]
mov r9d, eax
and r9d, r8d
mov edx, 0x121c6292
xor edx, 0x121c6290
imul edx, r9d
add eax, r8d
sub eax, edx
mov r8d, 0x1f1d238b
xor edx, edx
div r8d
mov dx, word [rsp + 0x56]
mov r8d, 0xc1660b43
xor r8d, 0xd593f50a
add eax, r8d
imul eax, eax, 0xb7e51006
mov r8w, dx
xor r8w, 0xff
mov r9w, 0xdd72
xor r9w, 0x228d
xor r8w, r9w
or dx, 0xff
and dx, r8w
movzx edx, dx
cmp ecx, edx
sete cl
mov byte [rsp + 0x55], cl
cmp eax, 0xfdfb5b81
ja 0x1401126d5
mov rax, qword [rsp + 0x58]
mov cl, byte [rsp + 0x55]
test cl, 1
mov qword [rsp + 0x48], rax
jne 0x14011277e
jmp 0x1401127a2
mov cx, 0xe600
xor cx, 0xe3e1
call fcn.140066656
mov rcx, qword [rsp + 0x118]
cmp byte [rcx], 0
mov qword [rsp + 0x48], rax
jne 0x140112902
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov ecx, 0x7130
mov edx, 0xdc4f
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0x46], cx
cmp byte [rax], 0
jne 0x140112902
mov eax, dword [rsp + 0xe8]
mov cx, word [rsp + 0x46]
or cx, cx
xor cx, 0xffff
mov dx, 0xffff
xor dx, 0xff
mov r8w, 0xffff
xor r8w, 0xff
and dx, r8w
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
movzx ecx, cx
cmp eax, ecx
je 0x140112863
mov ecx, 0x699e
mov edx, 0xc491
call fcn.140069186
mov cx, ax
mov rax, qword [rsp + 0x118]
mov word [rsp + 0x36], cx
cmp byte [rax], 0
jne 0x140112902
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0xe8]
mov dx, word [rsp + 0x36]
and dx, 0xff
movzx edx, dx
cmp ecx, edx
mov qword [rsp + 0x28], rax
jne 0x140112883
mov ecx, 0x1e3
call fcn.140066656
mov rcx, qword [rsp + 0x118]
cmp byte [rcx], 0
mov qword [rsp + 0x28], rax
jne 0x140112902
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, 0xff
jbe 0x1401128b2
mov rcx, qword [rsp + 0x20]
xor eax, eax
mov edx, eax
mov r8d, 0xff
call fcn.14001f7c4
jmp 0x140112902
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x20]
mov byte [rcx + rax], dl
movabs rcx, 0x3e357c0ba99875f3
add rax, rcx
add rax, 1
movabs rcx, 0x52941da9bfa216d8
movabs rdx, 0x6ca161a2163a632b
xor rcx, rdx
sub rax, rcx
mov qword [rsp + 0xf8], rax
jmp 0x140111c13
add rsp, 0x128
pop rdi
pop rsi
ret
call 0x129fc325b
xchg edi, eax
hlt
rcl ebp, 1
mov bl, 0xac
jmp 0x140111eca
lahf
fld xword [rbx]
mov esi, 0xfff760e9
call rsp
xchg ebp, eax
hlt
invalid
add byte [rcx - 0x6316c056], bl
std
invalid