Function at 0x1400a0750
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x118
mov rax, qword [0x14031a320]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rax, qword [rcx]
xor r10d, r10d
mov rbx, qword [rcx + 0x18]
mov r15, r8
mov word [rsp + 0x32], r9w
mov r8, rdx
mov qword [rsp + 0x48], rdx
mov r14, rcx
mov rax, qword [rax]
mov esi, r10d
mov qword [rsp + 0x68], rax
mov r13d, r10d
mov qword [rsp + 0x40], rcx
mov r12d, r10d
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
cmp byte [rax + 0x63], r10b
je 0x1400a07bf
lea eax, [r10 + 7]
jmp 0x1400a11ef
mov eax, dword [rbx + 0x28]
mov edx, Ordinal_26
movzx r9d, word [rbx + 0x2c]
test al, 0x20
mov dword [rsp + 0x58], eax
mov eax, 0x1bf
cmove edx, eax
mov qword [rsp + 0x110], rbp
movzx eax, word [rbx + 0x1a]
movzx ebp, word [rbx + 0x18]
mov word [rsp + 0x38], ax
movzx eax, word [rbx + 0x1c]
mov word [rsp + 0x3a], ax
movzx eax, word [rbx + 0x2e]
mov word [rsp + 0x3e], ax
mov rax, qword [rbx]
mov qword [rsp + 0x70], rax
movzx eax, word [rbx + 0x16]
mov word [rsp + 0x34], ax
mov rax, qword [rcx + 8]
mov ecx, edx
mov qword [rsp + 0x80], rax
and ecx, 0xffffffc3
mov qword [rsp + 0x88], rax
mov eax, dword [r15 + 0x64]
and al, 4
mov qword [rsp + 0x108], rdi
mov eax, dword [r8 + 0x44]
cmove ecx, edx
mov dword [rsp + 0xac], eax
mov rax, qword [r15 + 8]
mov word [rsp + 0x30], bp
mov word [rsp + 0x3c], r9w
mov dword [rsp + 0x54], ebp
movsx rdx, word [rax + rbp*2]
mov qword [rsp + 0x98], r10
mov word [rsp + 0xa0], pe_nt_image_headers64
mov qword [rsp + 0x90], r10
mov dword [rsp + 0xa4], ecx
mov dword [rsp + 0xa8], r10d
mov byte [rsp + 0xa2], 1
cmp edx, 0xfffffffe
jne 0x1400a08d5
mov rax, qword [r15 + 0x50]
mov ecx, ebp
shl rcx, 5
mov rcx, qword [rcx + rax + 8]
mov rax, qword [r15 + 0x40]
mov qword [rsp + 0x98], rcx
mov rcx, qword [rax + rbp*8]
mov eax, edx
mov qword [rsp + 0x90], rcx
lea rcx, [rsp + 0x80]
mov word [rsp + 0xd8], ax
call fcn.14009e4b0
jmp 0x1400a0929
mov r9, qword [r15 + 0x18]
movsx eax, word [r9 + 0x44]
cmp edx, eax
jne 0x1400a08e9
mov edx, 0xffffffff
jmp 0x1400a0914
test edx, edx
js 0x1400a0914
mov rax, qword [r9 + 8]
mov rcx, rdx
shl rcx, 5
movzx ecx, byte [rcx + rax + 0x19]
mov rax, qword [r15 + 0x40]
mov byte [rsp + 0xa0], cl
mov rcx, qword [rax + rbp*8]
mov qword [rsp + 0x90], rcx
lea rcx, [rsp + 0x80]
mov word [rsp + 0xd8], dx
call fcn.14009e190
mov rdi, rax
xor r8d, r8d
mov word [rbx + 0x12], r8w
mov rax, qword [r15 + 0x10]
movzx eax, word [rax]
movzx ecx, ax
mov word [rsp + 0x50], ax
call fcn.14009e8e0
mov word [rsp + 0x36], ax
mov ecx, pe_nt_image_headers64
test rdi, rdi
je 0x1400a10ba
movzx r14d, word [rdi + 0x14]
mov ebp, r8d
cmp r14w, cx
je 0x1400a0973
test byte [rdi + 0x12], 0x80
je 0x1400a0a1f
movzx r8d, word [rsp + 0x30]
mov rax, qword [r15 + 8]
movsx rdx, word [rax + r8*2]
test edx, edx
js 0x1400a09ed
mov rax, qword [r15 + 0x18]
mov rcx, rdx
shl rcx, 5
mov rax, qword [rax + 8]
cmp byte [rax + rcx + 0x18], 0
jne 0x1400a09f2
mov ecx, pe_nt_image_headers64
mov rax, qword [rbx + 8]
test qword [rdi + 0x28], rax
jne 0x1400a09f2
test word [rdi + 0x12], cx
je 0x1400a09b8
cmp r14w, 0x10
je 0x1400a09f2
mov rax, qword [rsp + 0x48]
test byte [rax + 0x3c], 8
je 0x1400a09cc
mov rax, qword [rdi]
test byte [rax + 4], 1
je 0x1400a09f2
cmp byte [r15 + 0x62], 0
je 0x1400a0a2a
movzx eax, word [r15 + 0x5e]
dec eax
movzx ecx, r8w
cmp ecx, eax
jne 0x1400a0a2a
mov rax, qword [rsp + 0x40]
or byte [rax + 0x28], 2
jmp 0x1400a0a33
cmp edx, 0xffffffff
jne 0x1400a099c
mov r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.14009e190
mov rdi, rax
mov ecx, pe_nt_image_headers64
mov r8d, 0
test esi, esi
je 0x1400a0952
jmp 0x1400a10ba
movzx r8d, word [rsp + 0x30]
jmp 0x1400a09a1
mov rax, qword [rsp + 0x40]
or byte [rax + 0x28], 1
mov eax, dword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
mov dword [rbx + 0x28], eax
movzx eax, word [rsp + 0x38]
mov word [rbx + 0x1a], ax
movzx eax, word [rsp + 0x3a]
mov word [rbx + 0x1c], ax
movzx eax, word [rsp + 0x3c]
mov word [rbx + 0x18], r8w
mov word [rbx + 0x2c], ax
lea r8d, [rax + 1]
call fcn.14009fbb0
test eax, eax
jne 0x1400a10b5
movzx ecx, word [rbx + 0x2c]
mov rax, qword [rbx + 0x38]
mov qword [rax + rcx*8], rdi
movzx edx, word [rbx + 0x2c]
mov rax, qword [rbx + 8]
inc dx
mov word [rbx + 0x2c], dx
not rax
mov rcx, qword [rdi + 0x28]
or rcx, qword [rsp + 0x70]
and rcx, rax
mov qword [rbx], rcx
test r14b, 1
je 0x1400a0c9b
mov r8, qword [rdi]
test dword [r8 + 4], 0x800
je 0x1400a0af0
movzx ecx, dx
xor r9d, r9d
dec ecx
mov ebp, reloc.WLDAP32.dll_Ordinal_46
test ecx, ecx
jle 0x1400a0bb7
mov rax, qword [rbx + 0x38]
mov edx, ecx
mov rcx, qword [rax]
test rcx, rcx
je 0x1400a0ae1
cmp qword [rcx], r8
cmove ebp, r9d
add rax, 8
sub rdx, 1
jne 0x1400a0ad2
jmp 0x1400a0bb7
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x1400a0bb4
movsxd rcx, dword [rax]
mov r11d, Ordinal_41
test ecx, ecx
je 0x1400a0baf
mov rax, rcx
movzx ecx, r11w
cmp rax, 8
jae 0x1400a0b4f
cmp rax, 2
jae 0x1400a0b40
xor r9d, r9d
lea r10, [0x140000000]
movzx eax, r9w
movsx ebp, ax
jmp 0x1400a0bc4
add cx, 0xfff6
add rax, rax
cmp rax, 8
jb 0x1400a0b40
jmp 0x1400a0b8d
cmp rax, 0xff
jbe 0x1400a0b70
nop word [rax + rax]
add cx, r11w
shr rax, 4
cmp rax, 0xff
ja 0x1400a0b60
cmp rax, 0xf
jbe 0x1400a0b8d
nop word [rax + rax]
add cx, 0xa
shr rax, 1
cmp rax, 0xf
ja 0x1400a0b80
and eax, 7
lea r10, [0x140000000]
movzx eax, word [r10 + rax*2 + 0x2e83e0]
sub ax, 0xa
add ax, cx
xor r9d, r9d
movsx ebp, ax
jmp 0x1400a0bc4
xor r9d, r9d
jmp 0x1400a0bbd
xor r9d, r9d
mov r11d, Ordinal_41
lea r10, [0x140000000]
test byte [r15 + 0x64], 0x80
je 0x1400a0c87
movsx r8d, word [rsp + 0x36]
cmp r8d, 0xa
jl 0x1400a0c87
movzx ecx, word [rsp + 0x30]
mov rax, qword [r15 + 0x10]
movsx edx, word [rax + rcx*2]
cmp bp, 0xa
jg 0x1400a0bf8
movzx eax, r9w
jmp 0x1400a0c70
movsx rax, bp
movzx ecx, r11w
cmp rax, 8
jae 0x1400a0c22
cmp rax, 2
jae 0x1400a0c13
mov eax, 0xffffffdf
jmp 0x1400a0c70
add cx, 0xfff6
add rax, rax
cmp rax, 8
jb 0x1400a0c13
jmp 0x1400a0c5d
cmp rax, 0xff
jbe 0x1400a0c40
nop word [rax + rax]
add cx, 0x28
shr rax, 4
cmp rax, 0xff
ja 0x1400a0c30
cmp rax, 0xf
jbe 0x1400a0c5d
nop word [rax + rax]
add cx, 0xa
shr rax, 1
cmp rax, 0xf
ja 0x1400a0c50
and eax, 7
movzx eax, word [r10 + rax*2 + 0x2e83e0]
sub ax, 0x2b
add ax, cx
movsx ecx, ax
add edx, 0xa
add edx, ecx
lea eax, [r8 + rbp]
cmp edx, eax
jge 0x1400a0c87
or dword [rbx + 0x28], 0x100000
or dword [rbx + 0x28], 4
mov edx, dword [rbx + 0x28]
xor r8d, r8d
mov rsi, qword [rsp + 0x48]
jmp 0x1400a0e23
test r14b, 0x82
je 0x1400a0d25
mov rax, qword [r15 + 8]
mov ecx, dword [rbx + 0x28]
movzx r9d, word [rsp + 0x30]
or ecx, 1
movsx r8d, word [rax + r9*2]
mov dword [rbx + 0x28], ecx
cmp r8d, 0xffffffff
je 0x1400a0d0f
mov edx, ecx
test r8d, r8d
js 0x1400a0d18
cmp word [rsp + 0x32], 0
jne 0x1400a0d18
movzx r8d, word [r15 + 0x5e]
lea eax, [r8 - 1]
cmp r9d, eax
jne 0x1400a0d18
test byte [r15 + 0x64], 8
jne 0x1400a0d0f
cmp r8d, 1
jne 0x1400a0cfb
cmp byte [r15 + 0x62], 0
je 0x1400a0cfb
cmp r14w, 2
je 0x1400a0d0f
mov rsi, qword [rsp + 0x48]
bts edx, 0x10
mov dword [rbx + 0x28], edx
xor r8d, r8d
jmp 0x1400a0e29
mov edx, ecx
bts edx, 0xc
mov dword [rbx + 0x28], edx
mov rsi, qword [rsp + 0x48]
xor r8d, r8d
jmp 0x1400a0e29
mov edx, dword [rbx + 0x28]
mov r10d, pe_nt_image_headers64
test r10w, r14w
je 0x1400a0d4d
movzx r9d, word [rsp + 0x30]
or edx, 8
mov rsi, qword [rsp + 0x48]
xor r8d, r8d
mov dword [rbx + 0x28], edx
jmp 0x1400a0e2f
mov r9d, dword [rsp + 0x54]
mov r8, r15
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdi
test r14b, 0x24
je 0x1400a0dec
mov rax, qword [rsp + 0x48]
or edx, 0x22
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x44]
call fcn.1400a04c0
mov word [rbx + 0x1a], ax
mov r10d, pe_nt_image_headers64
xor eax, eax
mov r12, rdi
mov r13d, eax
test word [rdi + 0x12], r10w
je 0x1400a0dd9
movzx r8d, word [rbx + 0x2c]
lea r13, [rdi + 0x38]
mov rcx, qword [rsp + 0x60]
inc r8d
mov rdx, rbx
call fcn.14009fbb0
test eax, eax
jne 0x1400a10b5
movzx ecx, word [rbx + 0x2c]
mov r10d, pe_nt_image_headers64
mov rax, qword [rbx + 0x38]
mov qword [rax + rcx*8], r13
mov eax, 1
inc word [rbx + 0x2c]
or dword [rbx + 0x28], 0x10
mov word [rbx + 0x1c], ax
mov edx, dword [rbx + 0x28]
xor r8d, r8d
movzx r9d, word [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
jmp 0x1400a0e2f
mov rsi, qword [rsp + 0x48]
or edx, 0x12
mov dword [rbx + 0x28], edx
mov edx, dword [rsi + 0x44]
call fcn.1400a04c0
mov edx, dword [rbx + 0x28]
xor r8d, r8d
mov word [rbx + 0x1c], ax
mov r13, rdi
test dl, 0x20
je 0x1400a0e20
movzx ecx, word [rbx + 0x2c]
mov rax, qword [rbx + 0x38]
mov r12, qword [rax + rcx*8 - 0x10]
jmp 0x1400a0e23
mov r12, r8
movzx r9d, word [rsp + 0x30]
mov r10d, pe_nt_image_headers64
test dl, 2
je 0x1400a0ecd
movsx ecx, word [rbx + 0x16]
mov edx, ecx
test r12, r12
je 0x1400a0e5f
movzx eax, word [r12 + 0x10]
test ax, ax
jg 0x1400a0e53
add cx, ax
jmp 0x1400a0e5f
test byte [r12 + 0x12], 0x80
jne 0x1400a0e5f
add cx, 0xffec
test r13, r13
je 0x1400a0e7e
movzx eax, word [r13 + 0x10]
test ax, ax
jg 0x1400a0e73
add cx, ax
jmp 0x1400a0e7e
test byte [r13 + 0x12], 0x80
jne 0x1400a0e7e
sub cx, 0x14
test r12, r12
je 0x1400a0e9d
cmp word [r12 + 0x10], 0
jle 0x1400a0e9d
test r13, r13
je 0x1400a0e9d
cmp word [r13 + 0x10], 0
jle 0x1400a0e9d
sub cx, 0x14
test r12, r12
mov eax, r8d
setne al
sub edx, eax
mov eax, r8d
test r13, r13
setne al
sub edx, eax
cmp cx, 0xa
jge 0x1400a0ebe
mov ecx, 0xa
movzx edi, cx
cmp edi, edx
cmovge di, dx
mov word [rbx + 0x16], di
jmp 0x1400a0f30
movzx r8d, word [rbx + 0x18]
inc r8w
mov word [rbx + 0x18], r8w
movzx edx, word [rdi + 0x10]
test dx, dx
jg 0x1400a0f00
mov rax, qword [r15 + 8]
movzx ecx, r9w
cmp word [rax + rcx*2], 0
jl 0x1400a0f00
sub dx, bp
add word [rbx + 0x16], dx
movzx edi, word [rbx + 0x16]
jmp 0x1400a0f30
mov rax, qword [r15 + 0x10]
movzx ecx, r8w
movzx edx, word [rax + rcx*2]
sub dx, word [rax + rcx*2 - 2]
add dx, word [rbx + 0x16]
mov word [rbx + 0x16], dx
movzx eax, dx
movzx edi, dx
test r10w, r14w
je 0x1400a0f30
add ax, 0xa
mov word [rbx + 0x16], ax
movzx edi, ax
mov rcx, qword [rsi + 0x20]
lea r10, [0x140000000]
movsx eax, word [r15 + 0x5c]
movsx r14d, word [rsp + 0x36]
imul eax, eax, 0xf
movsx r8d, word [rcx + 0x4c]
cdq
idiv r8d
add ax, di
movsx edx, ax
inc edx
lea ecx, [rax + 1]
cmp r14w, cx
jl 0x1400a0f8f
lea eax, [rdx + 0x31]
mov ecx, r14d
cmp r14d, eax
jg 0x1400a0fb6
lea eax, [rdx + 0x1f]
cmp ecx, eax
jle 0x1400a0f7b
lea ecx, [r14 + 1]
jmp 0x1400a0fb6
sub ecx, edx
movsxd rax, ecx
movzx ecx, byte [rax + r10 + 0x2eb048]
add cx, r14w
jmp 0x1400a0fb6
lea eax, [r14 + 0x31]
cmp edx, eax
jg 0x1400a0fb6
lea eax, [r14 + 0x1f]
cmp edx, eax
jle 0x1400a0fa4
inc cx
jmp 0x1400a0fb6
sub edx, r14d
movsxd rax, edx
movzx eax, byte [rax + r10 + 0x2eb048]
add cx, ax
test dword [rbx + 0x28], 0x140
jne 0x1400a102c
movsx r8d, di
lea r9d, [rdi + 0x10]
add r8d, 0x10
movsx edx, cx
cmp cx, r9w
jl 0x1400a0ffd
lea eax, [r8 + 0x31]
cmp edx, eax
jg 0x1400a102c
lea eax, [r8 + 0x1f]
cmp edx, eax
jle 0x1400a0fe9
inc cx
jmp 0x1400a102c
sub edx, r8d
movsxd rax, edx
movzx eax, byte [rax + r10 + 0x2eb048]
add cx, ax
jmp 0x1400a102c
lea eax, [rdx + 0x31]
cmp r8d, eax
jle 0x1400a100b
movzx ecx, r9w
jmp 0x1400a102c
lea eax, [rdx + 0x1f]
cmp r8d, eax
jle 0x1400a1019
lea ecx, [r9 + 1]
jmp 0x1400a102c
sub r8d, edx
movsxd rax, r8d
movzx ecx, byte [rax + r10 + 0x2eb048]
add cx, r9w
mov r14, qword [rsp + 0x40]
lea eax, [rcx + rbp]
add ax, word [rsp + 0x32]
mov rdx, rbx
movzx r8d, word [rsp + 0x50]
mov word [rbx + 0x14], ax
lea eax, [rdi + rbp]
add ax, word [rsp + 0x32]
mov word [rbx + 0x16], ax
mov rcx, qword [r14 + 8]
call fcn.1400a02e0
mov rdx, rbx
mov rcx, r14
call fcn.1400a00a0
mov edx, dword [rbx + 0x28]
mov esi, eax
movzx eax, word [rsp + 0x34]
test dl, 2
movzx ecx, ax
cmove cx, di
mov word [rbx + 0x16], cx
test dl, 0x10
jne 0x1400a10ac
movzx ecx, word [r15 + 0x60]
cmp word [rbx + 0x18], cx
jae 0x1400a10ac
add bp, word [rsp + 0x32]
mov r8, r15
mov rdx, qword [rsp + 0x48]
movzx r9d, bp
mov rcx, r14
call fcn.1400a0750
movzx eax, word [rsp + 0x34]
mov word [rbx + 0x16], ax
jmp 0x1400a09f7
mov r14, qword [rsp + 0x40]
mov rax, qword [rsp + 0x70]
movzx ebp, word [rsp + 0x30]
movzx r12d, word [rsp + 0x34]
movzx r9d, word [rsp + 0x3c]
mov r13d, dword [rsp + 0x58]
mov qword [rbx], rax
movzx eax, word [rsp + 0x38]
mov word [rbx + 0x1a], ax
movzx eax, word [rsp + 0x3a]
mov word [rbx + 0x1c], ax
movzx eax, word [rsp + 0x3e]
mov word [rbx + 0x18], bp
mov word [rbx + 0x2e], ax
mov dword [rbx + 0x28], r13d
mov word [rbx + 0x16], r12w
mov word [rbx + 0x2c], r9w
cmp bp, ax
jne 0x1400a11dd
movzx ecx, word [r15 + 0x5e]
lea eax, [rbp + 1]
cmp eax, ecx
jae 0x1400a11dd
cmp bp, r9w
jne 0x1400a11dd
mov eax, dword [r15 + 0x64]
test al, 0x40
jne 0x1400a11dd
test al, al
jns 0x1400a11dd
mov rcx, qword [rsp + 0x60]
test dword [rcx + 0x5c], 0x4000
jne 0x1400a11dd
mov rax, qword [r15 + 0x10]
lea rdi, [rbp*2 + 2]
cmp word [rdi + rax], 0x2a
jl 0x1400a11dd
lea r8d, [r9 + 1]
mov rdx, rbx
call fcn.14009fbb0
mov esi, eax
test eax, eax
jne 0x1400a11dd
inc word [rbx + 0x18]
xor r9d, r9d
inc word [rbx + 0x2e]
mov r8, r15
movzx ecx, word [rbx + 0x2c]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rsp + 0x48]
mov qword [rax + rcx*8], r9
mov rcx, r14
inc word [rbx + 0x2c]
or dword [rbx + 0x28], 0x8000
mov r9, qword [r15 + 0x10]
movzx r10d, word [r9 + rbp*2]
sub r10w, word [r9 + rdi]
movzx r9d, word [rsp + 0x32]
sub word [rbx + 0x16], r10w
add r9w, 5
add r9w, r10w
call fcn.1400a0750
movzx eax, word [rsp + 0x3e]
mov word [rbx + 0x2e], ax
mov word [rbx + 0x16], r12w
mov word [rbx + 0x18], bp
mov dword [rbx + 0x28], r13d
mov rdi, qword [rsp + 0x108]
mov eax, esi
mov rbp, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140252d20
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret