Function at 0x140143d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402ba030]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], 0xc0001
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea rdx, [0x1401fe219]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.1400ef7b0
test eax, eax
jne 0x140143742
cmp rbx, rdi
jae 0x140143742
movzx r8d, byte [rbx]
lea rdx, str._02x:
lea rcx, [rsp + 0x20]
inc rbx
call fcn.1400ef9a0
test eax, eax
je 0x140143721
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401526c0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
push rbx
push rbp
push rdi
sub rsp, 0x70
cmp byte [rcx + 0x1a], 0
jne case.0x140143d81.7
movzx r10d, byte [rcx + 0x19]
lea eax, [r10 - 1]
cmp eax, 0x1d
ja case.0x140143d81.7
lea r8, [0x140000000]
cdqe
movzx eax, byte [r8 + rax + 0x14411c]
mov edx, dword [r8 + rax*4 + 0x1440f4]
add rdx, r8
jmp rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
sub rax, rdx
cmp rax, 1
jne case.default.0x140143db4
cmp byte [rdx], 0
lea rax, str.TRUE
lea rcx, str.FALSE
cmovne rcx, rax
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp qword [case.0x1400fa348.0]
mov rdx, qword [rcx + 0x10]
mov r9, qword [rcx + 8]
mov rax, rdx
sub rax, r9
je case.default.0x140143db4
cmp rax, 4
jbe 0x140143de4
mov rcx, r9
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp 0x1401436d0
movsx r8d, byte [r9]
sar r8d, 0x1f
nop dword [rax]
movzx eax, byte [r9]
inc r9
shl r8d, 8
or r8d, eax
cmp r9, rdx
jb 0x140143df0
cmp r8d, 0xa
lea rax, [0x1401ffecc]
lea rdx, [0x1401fe219]
cmovae rdx, rax
lea rcx, str._s_x
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp sym.CheraxLoader.exe_curl_maprintf
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
inc rcx
cmp rcx, rdx
ja case.default.0x140143db4
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp 0x1401436d0
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp 0x1401436d0
lea rcx, [0x1401fe219]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp qword [case.0x1400fa348.0]
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp fcn.140143be0
mov rbx, qword [rcx + 8]
mov r10, qword [rcx + 0x10]
mov r8, rbx
cmp rbx, r10
jae 0x140143ea7
movzx eax, byte [r8]
sub al, 0x30
cmp al, 9
ja 0x140143ea7
inc r8
cmp r8, r10
jb 0x140143e95
lea rdi, [rbx + 0xa]
mov rax, r8
sub rax, rdi
je 0x140143ec7
cmp rax, 2
je 0x140143ece
xor r11d, r11d
mov eax, r11d
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
lea rdi, [0x14029592c]
cmp r8, r10
jae case.default.0x140143db4
cmp byte [r8], 0x5a
jne 0x140143ee9
lea r8, [0x1402958d0]
lea r10, [0x1402958d3]
jmp 0x140143eec
inc r8
mov qword [rsp + 0x48], r8
lea rdx, [rbx + 4]
sub r10d, r8d
lea rax, [rbx + 8]
mov dword [rsp + 0x40], r10d
lea rcx, [rbx + 6]
xor r11d, r11d
mov qword [rsp + 0x38], rdi
cmp byte [rbx], 0x35
lea r9, [rbx + 2]
mov qword [rsp + 0x30], rax
mov r8, rbx
mov qword [rsp + 0x28], rcx
setl r11b
mov qword [rsp + 0x20], rdx
lea rcx, str._u_.2s__.2s__.2s__.2s:_.2s:_.2s__.s
lea edx, [r11 + 0x13]
call sym.CheraxLoader.exe_curl_maprintf
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x98], rsi
lea rbp, [0x1401fe219]
mov rsi, qword [rcx + 0x10]
mov qword [rsp + 0xa0], r14
mov r14, qword [rcx + 8]
mov qword [rsp + 0xa8], r15
mov r15, rbp
mov rbx, r14
cmp r14, rsi
jae 0x140143f85
movzx eax, byte [rbx]
sub al, 0x30
cmp al, 9
ja 0x140143f85
inc rbx
cmp rbx, rsi
jb 0x140143f74
mov rax, rbx
mov dl, 0x30
sub rax, r14
sub rax, 0xc
je 0x140143fb1
sub rax, 1
je 0x140143fab
cmp rax, 1
je 0x140143fa7
xor r11d, r11d
jmp 0x14014408f
movzx edx, byte [rbx - 2]
movzx ecx, byte [rbx - 1]
jmp 0x140143fb4
movzx ecx, dl
xor r11d, r11d
mov rdi, rbx
cmp rbx, rsi
jae 0x140144004
movzx eax, byte [rbx]
sub al, 0x2c
test al, 0xfd
jne 0x140144004
inc rbx
nop dword [rax + rax]
inc rdi
cmp rdi, rsi
jae 0x140143fe3
movzx eax, byte [rdi]
cmp al, 0x30
jl 0x140143fe3
cmp al, 0x39
jle 0x140143fd0
mov r11, rdi
sub r11, rbx
sub r11, 1
je 0x140144004
lea rax, [rbx - 1]
add rax, r11
cmp byte [rax], 0x30
jne 0x140144004
dec rax
sub r11, 1
jne 0x140143ff6
cmp rdi, rsi
jae 0x140144028
cmp byte [rdi], 0x5a
jne 0x14014401e
lea rdi, str._GMT
lea rsi, [0x1402958bc]
jmp 0x140144028
lea r15, [0x1401fe784]
inc rdi
mov qword [rsp + 0x68], rdi
lea rax, [0x14028d6cc]
sub esi, edi
lea r10, [r14 + 8]
mov dword [rsp + 0x60], esi
lea r9, [r14 + 6]
mov qword [rsp + 0x58], r15
lea r8, [r14 + 4]
mov qword [rsp + 0x50], rbx
test r11, r11
mov dword [rsp + 0x48], r11d
cmovne rbp, rax
movsx eax, cl
movsx ecx, dl
lea rdx, [r14 + 0xa]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, str._.4s__.2s__.2s__.2s:_.2s:_c_c_s_.s_s_.s
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x20], r10
call sym.CheraxLoader.exe_curl_maprintf
mov r11, rax
mov r15, qword [rsp + 0xa8]
mov rax, r11
mov r14, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
mov r9, qword [rcx + 0x10]
mov edx, r10d
mov r8, qword [rcx + 8]
lea rcx, [rsp + 0x90]
call fcn.140143760
mov rcx, qword [rsp + 0x90]
xor r11d, r11d
test rax, rax
cmovs rcx, r11
mov rax, rcx
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret