Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Encrypt data using rc4 ksa
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x138], rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rbp, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov r8, rax
cmp rbx, 0x989680
jne 0x1400010cb
imul rcx, r8, 0x64
jmp 0x1400010f1
cqo
idiv rbx
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rcx, rax
mov rax, r8
cqo
idiv rbx
imul rdx, rax, 0x3b9aca00
add rcx, rdx
movabs rax, 0x7ffffffed5fa0dff
cmp rcx, rax
jge 0x14000110f
movabs rdi, 0x12a05f200
add rdi, rcx
jmp 0x140001119
movabs rdi, 0x7fffffffffffffff
movsd xmm6, qword [0x1400032c0]
movabs r14, 0x311cdad160000
movabs r15, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rsi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rsi, 0x989680
jne 0x140001156
imul rbx, rcx, 0x64
jmp 0x14000117c
cqo
idiv rsi
imul rax, rdx, 0x3b9aca00
cqo
idiv rsi
mov rbx, rax
mov rax, rcx
cqo
idiv rsi
imul rcx, rax, 0x3b9aca00
add rbx, rcx
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
cmp rbx, rdi
jge 0x1400011fc
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea r8, [rcx + r14]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r9b
test r9b, r9b
jne 0x1400011ae
lea r8, [rax + rcx]
add rax, rcx
lea rdx, [rcx + r14]
test r9b, r9b
lea rcx, [rsp + 0x128]
cmove rdx, rax
mov rax, r15
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x128], rdx
sub r8d, eax
mov dword [rsp + 0x130], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140001135
movsd xmm0, qword [0x1400032b0]
sub rax, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm1, qword [0x1400032b8]
comisd xmm0, xmm1
jbe 0x140001226
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ebx, ebx
lea rsi, [fcn.1400013c0]
lea r9, [rsp + 0x120]
mov dword [rsp + 0x120], ebx
mov edx, 0x1cc
mov rcx, rsi
lea r8d, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001268
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:__d
call fcn.140001010
mov eax, ebx
lea rcx, [rsp + 0x20]
nop
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jl 0x140001270
xor r8b, r8b
lea r10, [rsp + 0x20]
mov r9d, ebx
lea rdi, str.advapi32.dll
nop dword [rax]
nop word [rax + rax]
movzx r11d, byte [r10]
mov eax, 0xaaaaaaab
mul r9d
movzx r8d, r8b
mov eax, r9d
shr edx, 3
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movsx edx, byte [rcx + rdi]
add r8d, edx
add r8d, r11d
and r8d, 0x800000ff
jge 0x1400012e1
dec r8d
or r8d, 0xffffff00
inc r8d
movzx ecx, r8b
inc r9d
movzx eax, byte [rsp + rcx + 0x20]
mov byte [r10], al
inc r10
mov byte [rsp + rcx + 0x20], r11b
cmp r9d, 0x100
jl 0x1400012a0
xor dil, dil
mov r11, rbx
nop word [rax + rax]
lea eax, [rbx + 1]
and eax, 0x800000ff
jge 0x140001323
dec eax
or eax, 0xffffff00
inc eax
movsxd rbx, eax
movzx r10d, byte [rsp + rbx + 0x20]
add dil, r10b
movzx ecx, dil
movzx eax, byte [rsp + rcx + 0x20]
mov byte [rsp + rbx + 0x20], al
mov byte [rsp + rcx + 0x20], r10b
movzx r8d, byte [rsp + rbx + 0x20]
add r8, r10
movzx eax, r8b
movzx r8d, byte [rsp + rax + 0x20]
xor byte [r11 + rsi], r8b
inc r11
cmp r11, 0x1cc
jl 0x140001310
mov r8d, dword [rsp + 0x120]
lea r9, [rsp + 0x120]
mov edx, 0x1cc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.1400013c0
xor eax, eax
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1400015a0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rdi
ret