Function at 0x140036930
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r15
sub rsp, 0xa8
mov rax, qword [0x1400ef528]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [rcx + 0xc0]
mov rbx, rcx
mov rcx, qword [rcx + 0xc8]
xor ebp, ebp
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jb 0x140036995
cmp dword [rbx + 0x30], ebp
je 0x1400369b7
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
movzx edx, byte [rax]
inc rax
movzx r8d, dl
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x2c], r8d
mov qword [rbx + 0xc0], rax
cmp rax, rcx
jae 0x1400369bf
jmp 0x1400369da
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x2c], ebp
cmp dword [rbx + 0x30], ebp
je 0x140036a03
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
movzx esi, byte [rax]
inc rax
movzx edx, sil
mov dword [rsp + 0x50], edx
mov qword [rbx + 0xc0], rax
cmp rax, rcx
jae 0x140036a0a
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x140036a2f
xor sil, sil
mov dword [rsp + 0x50], ebp
cmp dword [rbx + 0x30], ebp
je 0x140036a2d
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x140036a2f
xor cl, cl
movzx eax, cl
mov rcx, rbx
mov dword [rsp + 0x30], eax
call fcn.14002bed0
mov rcx, rbx
movsxd r13, eax
call fcn.14002bed0
mov rcx, qword [rbx + 0xc0]
mov dword [rsp + 0x40], eax
cmp rcx, qword [rbx + 0xc8]
jae 0x140036a6c
movzx edx, byte [rcx]
inc rcx
mov qword [rbx + 0xc0], rcx
jmp 0x140036a91
cmp dword [rbx + 0x30], ebp
je 0x140036a8f
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x140036a91
xor dl, dl
movzx ecx, dl
mov dword [rsp + 0x24], ecx
mov rcx, rbx
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], r14
call fcn.14002bed0
mov rcx, rbx
call fcn.14002bed0
mov rcx, rbx
call fcn.14002bed0
mov rcx, rbx
mov dword [rsp + 0x5c], eax
call fcn.14002bed0
mov rcx, qword [rbx + 0xc8]
mov dword [rsp + 0x58], eax
mov rax, qword [rbx + 0xc0]
cmp rax, rcx
jb 0x140036afe
cmp dword [rbx + 0x30], ebp
je 0x140036b26
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
movzx edx, byte [rax]
inc rax
movzx r14d, dl
mov qword [rbx + 0xc0], rax
mov edi, r14d
cmp rax, rcx
jae 0x140036b2b
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x140036b50
mov r14d, ebp
mov edi, ebp
cmp dword [rbx + 0x30], ebp
je 0x140036b4e
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x140036b50
xor cl, cl
mov r8d, dword [rsp + 0x58]
mov r15d, ebp
movzx eax, cl
mov r12d, 1
mov qword [rsp + 0x70], rbp
mov dword [rsp + 0x78], ebp
cmp r8d, 0x1000000
jg 0x1400372e5
mov r9d, dword [rsp + 0x5c]
cmp r9d, 0x1000000
jg 0x1400372e5
mov edx, dword [rsp + 0x30]
cmp edx, 8
mov dword [rsp + 0x28], ebp
lea ecx, [rdx - 8]
cmovb ecx, edx
shr eax, 5
and eax, r12d
mov edx, r12d
sub edx, eax
mov dword [rsp + 0x64], edx
cmp dword [rsp + 0x50], ebp
je 0x140036bd0
mov edi, dword [rsp + 0x24]
mov ecx, edi
sub ecx, 8
je 0x140036c33
sub ecx, 7
je 0x140036c23
sub ecx, r12d
je 0x140036c23
sub ecx, 8
je 0x140036bec
cmp ecx, 8
jne 0x140036bfb
jmp 0x140036bec
sub edi, 8
je 0x140036c33
sub edi, 7
je 0x140036c23
sub edi, r12d
je 0x140036c13
sub edi, 8
je 0x140036be9
cmp edi, 8
jne 0x140036bfb
mov edi, r14d
shr edi, 3
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x28], ebp
test edi, edi
jne 0x140036c3b
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
lea rax, str.bad_format
jmp 0x1400372f8
cmp ecx, 3
jne 0x140036c23
mov edi, 2
mov dword [rsp + 0x24], edi
jmp 0x140036c3b
mov edi, 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x24], edi
jmp 0x140036c3b
mov dword [rsp + 0x24], r12d
mov edi, r12d
mov rax, qword [rsp + 0x38]
mov dword [rax], r9d
mov rax, qword [rsp + 0x48]
mov dword [rax], r8d
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140036c57
mov dword [rax], edi
test r9d, r9d
js 0x1400372e5
test r8d, r8d
js 0x1400372e5
je 0x140036c84
mov eax, 0x7fffffff
mov ecx, ebp
cdq
idiv r8d
cmp r9d, eax
setle cl
test ecx, ecx
je 0x1400372e5
mov ecx, r8d
imul ecx, r9d
mov dword [rsp + 0x68], ecx
test ecx, ecx
js 0x1400372e5
xor edx, edx
mov eax, 0x7fffffff
div edi
mov dword [rsp + 0x48], eax
cmp ecx, eax
jg 0x1400372e5
test r8d, r8d
je 0x140036cc3
mov eax, 0x7fffffff
cdq
idiv r8d
cmp r9d, eax
jg 0x1400372d0
mov eax, edi
imul eax, r8d
imul eax, r9d
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x38], rax
mov rdx, rax
test rax, rax
je 0x1400372d0
cmp dword [rsp + 0x60], ebp
je 0x140036d2f
mov edx, dword [rsp + 0x2c]
cmp qword [rbx + 0x10], rbp
je 0x140036d20
mov ecx, dword [rbx + 0xc8]
sub ecx, dword [rbx + 0xc0]
cmp ecx, edx
jge 0x140036d20
mov rax, qword [rbx + 0xc8]
sub edx, ecx
mov rcx, qword [rbx + 0x28]
mov qword [rbx + 0xc0], rax
call qword [rbx + 0x18]
jmp 0x140036d2a
movsxd rax, edx
add qword [rbx + 0xc0], rax
mov rdx, qword [rsp + 0x38]
cmp dword [rsp + 0x50], ebp
jne 0x140036e28
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x2c], r14d
mov byte [rsp + 0x20], sil
cmp ecx, 8
jae 0x140036f97
mov ecx, dword [rsp + 0x28]
mov dword [rsp + 0x2c], r14d
mov byte [rsp + 0x20], sil
test ecx, ecx
jne 0x140036f93
mov r15d, dword [rsp + 0x58]
test r15d, r15d
jle 0x1400372bb
mov r8d, dword [rsp + 0x5c]
mov ebp, r8d
imul ebp, edi
mov edi, r15d
cmp dword [rsp + 0x64], ecx
je 0x140036dff
mov eax, ebp
neg eax
movsxd r14, eax
lea eax, [r15 - 1]
imul eax, dword [rsp + 0x24]
imul eax, r8d
movsxd rsi, eax
add rsi, rdx
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call fcn.14002bd40
add rsi, r14
sub rdi, r12
jne 0x140036da2
mov rdi, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x24]
cmp eax, 3
jb 0x140036df5
test ecx, ecx
jne 0x140036df5
mov ecx, dword [rsp + 0x68]
mov rdx, rdi
test ecx, ecx
jle 0x140036df5
mov r9d, eax
mov r8d, ecx
nop
movzx ecx, byte [rdx]
movzx eax, byte [rdx + 2]
mov byte [rdx], al
mov byte [rdx + 2], cl
add rdx, r9
sub r8, 1
jne 0x140036de0
mov rax, qword [rsp + 0x38]
jmp 0x140037303
movsxd r14, ebp
mov rsi, rdx
nop word [rax + rax]
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call fcn.14002bd40
add rsi, r14
sub rdi, r12
jne 0x140036e10
jmp 0x140036db8
cmp dword [rsp + 0x40], ebp
jne 0x140036e4f
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
lea rax, str.bad_palette
jmp 0x1400372f8
test r13d, r13d
je 0x140036ea1
jns 0x140036e66
mov rax, qword [rbx + 0xc8]
mov qword [rbx + 0xc0], rax
jmp 0x140036ea1
cmp qword [rbx + 0x10], rbp
je 0x140036e9a
mov ecx, dword [rbx + 0xc8]
sub ecx, dword [rbx + 0xc0]
cmp ecx, r13d
jge 0x140036e9a
mov rax, qword [rbx + 0xc8]
sub r13d, ecx
mov rcx, qword [rbx + 0x28]
mov edx, r13d
mov qword [rbx + 0xc0], rax
call qword [rbx + 0x18]
jmp 0x140036ea1
add qword [rbx + 0xc0], r13
mov ecx, dword [rsp + 0x40]
test ecx, ecx
js 0x1400372c5
cmp ecx, dword [rsp + 0x48]
mov eax, ebp
setle al
test eax, eax
je 0x1400372c5
imul edi, ecx
movsxd rcx, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x70], rax
mov r13, rax
test rax, rax
je 0x1400372c5
mov dword [rsp + 0x2c], r14d
mov byte [rsp + 0x20], sil
cmp dword [rsp + 0x28], ebp
je 0x140036fed
mov edx, dword [rsp + 0x40]
mov rdi, rax
test edx, edx
jle 0x140036f8f
mov ecx, dword [rsp + 0x24]
mov r13d, edx
mov byte [rsp + 0x20], sil
mov esi, ecx
mov dword [rsp + 0x2c], r14d
mov rcx, rbx
call fcn.14002bed0
movzx r8d, ax
mov eax, r8d
shr eax, 0xa
and eax, 0x1f
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
shr eax, 5
and r8d, 0x1f
and eax, 0x1f
mov byte [rdi], dl
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
add edx, ecx
imul ecx, r8d, 0xff
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x84210843
mov byte [rdi + 1], dl
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [rdi + 2], dl
add rdi, rsi
sub r13, r12
jne 0x140036f11
mov edi, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x68]
mov esi, edi
test eax, eax
jle 0x140037220
mov r14, qword [rsp + 0x38]
lea rdx, [rsp + 0x78]
sub r14, rdx
mov r9d, edi
mov r8d, eax
mov qword [rsp + 0x48], rax
mov r13d, ebp
cmp ecx, 8
jb 0x14003705a
test r15d, r15d
jne 0x14003704c
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x140037012
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x140037037
mov r8d, edi
mov rdx, r13
mov rcx, rbx
call fcn.14002bd40
test eax, eax
jne 0x140036f8f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r13
jmp 0x140036e31
cmp dword [rbx + 0x30], ebp
je 0x140037035
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x140037037
xor cl, cl
movzx eax, cl
mov r15d, eax
and r15d, 0x7f
inc r15d
shr eax, 7
mov r13d, eax
jmp 0x14003705a
test r13d, r13d
je 0x14003705a
test r12d, r12d
je 0x1400371df
cmp byte [rsp + 0x20], bpl
je 0x1400370f0
cmp dword [rsp + 0x2c], 8
jne 0x1400370bb
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x14003708e
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
movzx eax, cl
jmp 0x1400370c3
cmp dword [rbx + 0x30], ebp
je 0x1400370b4
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
movzx eax, cl
jmp 0x1400370c3
xor cl, cl
movzx eax, cl
jmp 0x1400370c3
mov rcx, rbx
call fcn.14002bed0
cmp eax, dword [rsp + 0x40]
cmovge eax, ebp
test rsi, rsi
je 0x1400371d4
imul eax, edi
lea rcx, [rsp + 0x78]
mov r8, rsi
movsxd rdx, eax
add rdx, qword [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400371d4
cmp dword [rsp + 0x28], ebp
je 0x140037172
mov rcx, rbx
call fcn.14002bed0
movzx r8d, ax
mov eax, r8d
shr eax, 0xa
and eax, 0x1f
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
shr eax, 5
and r8d, 0x1f
and eax, 0x1f
mov byte [rsp + 0x78], dl
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
add edx, ecx
imul ecx, r8d, 0xff
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x84210843
mov byte [rsp + 0x79], dl
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov byte [rsp + 0x7a], dl
jmp 0x1400371d4
mov rdi, rbp
test rsi, rsi
je 0x1400371d0
nop word [rax + rax]
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x14003719f
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x1400371c4
cmp dword [rbx + 0x30], ebp
je 0x1400371c2
mov rcx, rbx
call fcn.14002bcc0
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x1400371c4
xor cl, cl
mov byte [rsp + rdi + 0x78], cl
inc rdi
cmp rdi, rsi
jl 0x140037180
mov edi, dword [rsp + 0x24]
mov r8, qword [rsp + 0x48]
mov r12d, ebp
mov r9d, edi
mov rdx, rbp
test rsi, rsi
je 0x140037207
nop word [rax + rax]
lea rcx, [rsp + 0x78]
add rcx, rdx
inc rdx
movzx eax, byte [rcx]
mov byte [r14 + rcx], al
cmp rdx, rsi
jl 0x1400371f0
mov ecx, dword [rsp + 0x30]
dec r15d
add r14, r9
sub r8, 1
mov qword [rsp + 0x48], r8
jne 0x140036fc0
cmp dword [rsp + 0x64], ebp
je 0x14003729a
mov r15d, dword [rsp + 0x58]
test r15d, r15d
jle 0x14003729a
mov r11d, edi
lea r10d, [r15 - 1]
imul r11d, dword [rsp + 0x5c]
mov ebx, ebp
imul r10d, edi
mov rdi, qword [rsp + 0x38]
imul r10d, dword [rsp + 0x5c]
nop
mov r8d, r11d
test r11d, r11d
jle 0x14003728a
movsxd rax, ebx
movsxd r9, r10d
sub r9, rax
lea rdx, [rax + rdi]
nop word [rax + rax]
movzx eax, byte [rdx + r9]
dec r8d
movzx ecx, byte [rdx]
mov byte [rdx], al
mov byte [rdx + r9], cl
lea rdx, [rdx + 1]
test r8d, r8d
jg 0x140037270
add ebx, r11d
sub r10d, r11d
add ebp, 2
cmp ebp, r15d
jl 0x140037250
jmp 0x14003729f
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140036dbd
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140036dbd
mov rdi, qword [rsp + 0x38]
jmp 0x140036dc1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
lea rax, str.outofmem
jmp 0x1400372f8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
lea rax, str.too_large
mov edx, 0x18
mov qword [rdx + rcx], rax
xor eax, eax
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400ad2b0
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret