Function at 0x140053a18
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x858]
sub rsp, 0x958
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x840], rax
xor ebx, ebx
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x58], r8d
mov esi, edx
mov dword [rsp + 0x50], edx
lea rcx, [rbp + 0x440]
xor edx, edx
mov r8d, 0x400
mov r14, r9
mov dword [rbp + 0x438], 0xbe010000
mov word [rbp + 0x43c], bx
mov byte [rbp + 0x43e], 0xff
mov byte [rsp + 0x31], bl
mov byte [rsp + 0x32], bl
mov r13b, bl
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x44], ebx
call fcn.1400ea1b0
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x4b0
call fcn.1400ea1b0
lea ecx, [rbx + 0x40]
mov edx, 0x4000
mov r15d, ebx
mov edi, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x54], esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14005408e
cmp byte [0x1401707a1], bl
lea r12d, [rbx + 8]
lea r8, [0x140000000]
jne 0x140053b0f
mov ecx, ebx
lea rdx, [0x14010e200]
movzx eax, byte [rdx]
inc rdx
mov byte [rax + r8 + 0x1707a0], cl
inc ecx
cmp ecx, 0x100
jl 0x140053af2
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov edx, dword [rsp + 0x58]
lea eax, [rsi + r12]
cmp eax, edx
jbe 0x140053b2f
mov r12d, edx
sub r12d, esi
inc r12d
je 0x140053f8e
test edi, edi
jne 0x140053b49
test r15d, r15d
jne 0x140053b49
mov eax, esi
sub eax, dword [rsp + 0x54]
cmp eax, 0x10000
ja 0x140053f8e
mov r9, rcx
mov rcx, qword [rsp + 0x78]
mov r8d, r12d
mov edx, esi
call fcn.140055e40
test eax, eax
je 0x14005408e
mov dword [rsp + 0x4c], ebx
test r12d, r12d
je 0x140053f7a
mov eax, ebx
mov dword [rsp + 0x48], ebx
test r13b, r13b
jne 0x140053f8a
mov esi, eax
add rsi, qword [rsp + 0x60]
movzx eax, byte [rsi + 0xd]
and eax, 7
mov cl, byte [rax + rsi + 0x14]
and cl, 0x30
cmp cl, 0x10
jne 0x140053f4c
movzx ecx, byte [rsi + 0x12]
movzx edx, byte [rsi + 0x13]
mov dword [rsp + 0x34], 1
shl ecx, 8
add edx, 0x14
mov r15d, 1
add edx, ecx
lea eax, [rdx - 0x80]
cmp eax, 0x779
ja 0x140053c9f
mov ecx, 0x7fa
lea r9, [rsp + 0x3c]
lea r8, [rbp + 0x438]
sub ecx, edx
add edx, 0xffffff80
mov dword [rsp + 0x34], 2
mov eax, ecx
mov byte [rbp + 0x43d], cl
lea rcx, [rsi + 0x80]
shr eax, 8
mov byte [rbp + 0x43c], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.1400536f4
cmp eax, r15d
jne 0x140053c9f
movzx eax, byte [rsi + 0x54]
lea r8, [0x140000000]
lea edi, [r15 + 2]
movzx ecx, byte [rax + r8 + 0x10dd00]
movzx eax, byte [rsi + 0x55]
mov dword [rsp + 0x34], edi
movzx eax, byte [rax + r8 + 0x10dd00]
shl ecx, 9
mov byte [rsp + 0x31], r15b
or ecx, eax
movzx eax, byte [rsi + 0x56]
mov r13b, r15b
xor dword [rsp + 0x3c], ecx
movzx ecx, byte [rax + r8 + 0x10dd00]
movzx eax, byte [rsi + 0x57]
movzx eax, byte [rax + r8 + 0x10dd00]
mov edx, ecx
and ecx, 0x1f
and edx, 0xe0
mov byte [rsp + 0x30], r15b
add edx, edx
or edx, ecx
shl edx, 8
or edx, eax
movzx eax, byte [rsi + 0x58]
movzx eax, byte [rax + r8 + 0x10dd00]
shl edx, 8
or edx, eax
xor dword [rsp + 0x40], edx
jmp 0x140053f50
mov r8, rbx
lea rdx, [rbp + 0x440]
mov r10d, pe_nt_image_headers64
movzx r9d, byte [r8 + rsi]
mov ecx, ebx
mov eax, r10d
sar eax, cl
test r9d, eax
setne al
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, 8
jl 0x140053cb6
inc r8
cmp r8, r10
jl 0x140053caf
mov r9d, 2
mov r13d, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x70], rbx
lea rdi, [rbp + 0x83d]
mov r11d, r9d
mov r8d, r9d
cmp r9d, 0x400
jge 0x140053d2a
mov r10, rdi
mov eax, r8d
lea rcx, [rbp + 0x83f]
cdq
idiv r9d
movsxd rax, edx
sub rcx, rax
mov al, byte [r10]
cmp byte [rcx], al
jne 0x140053d2a
inc r8d
dec r10
cmp r8d, 0x400
jl 0x140053d00
cmp r8d, r13d
jle 0x140053d58
cmp r8d, r9d
jle 0x140053d58
cmp r8d, 0x70
jle 0x140053d58
mov eax, r8d
cdq
idiv r9d
cmp eax, 2
jl 0x140053d58
mov r13d, r8d
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x70], r11
mov r8d, r9d
jmp 0x140053d5d
mov r8d, dword [rsp + 0x38]
inc r9d
inc r11
dec rdi
cmp r9d, 0x180
jl 0x140053cf1
test r13d, r13d
jle 0x140053f47
mov rdi, qword [rsp + 0x70]
mov r15d, 2
mov r10d, ebx
mov r11, rbx
mov eax, r10d
mov ecx, r10d
cdq
idiv r8d
and ecx, 7
jne 0x140053db8
movsxd rax, edx
sub rax, rdi
mov cl, byte [rbp + rax + 0x840]
mov rax, r11
shl cl, 7
sar rax, 3
mov byte [rbp + rax + 0x440], cl
jmp 0x140053de5
movsxd r8, edx
mov eax, 7
mov r9, r11
sub eax, ecx
sub r8, rdi
sar r9, 3
mov cl, al
mov al, byte [rbp + r8 + 0x840]
mov r8d, dword [rsp + 0x38]
shl al, cl
or byte [rbp + r9 + 0x440], al
inc r10d
inc r11
cmp r10d, 0x50
jl 0x140053d89
lea rax, [rbp + 0x440]
mov r8, rsi
mov rdx, rbx
sub r8, rax
lea r9, [0x140000000]
lea rcx, [rbp + 0x440]
add rcx, rdx
inc rdx
movzx eax, byte [rcx + r8 + 0x80]
mov al, byte [rax + r9 + 0x10de00]
xor byte [rcx], al
cmp rdx, 0xa
jl 0x140053e08
mov r13, qword [rsp + 0x68]
lea rdi, [rbp - 0x7b]
mov r11d, ebx
lea rax, [r13*2]
add rax, r13
lea rdi, [rdi + rax*4]
mov al, byte [rsp + 0x30]
test al, al
jne 0x140053f42
lea r8, [rbp + 0x430]
lea rdx, [rbp + 0x440]
mov ecx, r11d
call fcn.1400534c8
mov r11d, eax
test eax, eax
js 0x140053f42
lea rax, [rbp + 0x430]
mov r8, rsi
mov r15d, 3
sub r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x430]
add rcx, rdx
inc rdx
mov al, byte [rcx + r8 + 0x54]
xor byte [rcx], al
cmp rdx, 5
jl 0x140053e8c
mov r9b, byte [rbp + 0x434]
mov r10d, dword [rbp + 0x430]
mov edx, ebx
mov rcx, rbx
test r13, r13
jle 0x140053edd
movsxd rax, edx
lea r8, [rax + rax*2]
cmp dword [rbp + r8*4 - 0x7c], r10d
jne 0x140053ed3
cmp byte [rbp + r8*4 - 0x78], r9b
je 0x140053f20
inc rcx
inc edx
cmp rcx, r13
jl 0x140053ebe
mov al, byte [rbp + 0x431]
inc dword [rsp + 0x44]
mov byte [rdi - 1], r10b
mov byte [rdi], al
mov al, byte [rbp + 0x432]
mov byte [rdi + 3], r9b
mov byte [rdi + 1], al
mov al, byte [rbp + 0x433]
inc r13
mov byte [rdi + 2], al
mov al, 1
mov dword [rdi - 5], 1
mov byte [rsp + 0x30], al
mov byte [rsp + 0x32], al
add rdi, 0xc
jmp 0x140053e4d
lea rax, [rcx + rcx*2]
inc dword [rbp + rax*4 - 0x80]
cmp dword [rbp + rax*4 - 0x80], 1
mov al, byte [rsp + 0x30]
jl 0x140053e4d
mov al, 1
mov byte [rsp + 0x30], al
jmp 0x140053e4d
mov qword [rsp + 0x68], r13
mov r13b, byte [rsp + 0x30]
mov edi, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x4c]
mov esi, dword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
inc ecx
inc esi
add eax, 0x800
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x48], eax
cmp ecx, r12d
jb 0x140053b76
mov rcx, qword [rsp + 0x60]
test r13b, r13b
je 0x140053b14
jmp 0x140053f8e
mov edi, dword [rsp + 0x34]
mov al, byte [rsp + 0x31]
test al, al
je 0x14005401a
movsxd rdx, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x3c]
lea r8, [0x140000000]
mov rax, rcx
sar rax, 9
mov al, byte [rax + r8 + 0x10dd00]
mov byte [r14], al
movzx eax, cl
mov rcx, rdx
mov al, byte [rax + r8 + 0x10dd00]
sar rcx, 1
mov byte [r14 + 1], al
and ecx, 0xe00000
mov rax, rdx
and eax, 0x1f0000
or rcx, rax
sar rcx, 0x10
mov al, byte [rcx + r8 + 0x10dd00]
mov byte [r14 + 2], al
mov rax, rdx
sar rax, 8
movzx ecx, al
mov al, byte [rcx + r8 + 0x10dd00]
mov byte [r14 + 3], al
movzx eax, dl
mov al, byte [rax + r8 + 0x10dd00]
mov byte [r14 + 4], al
jmp 0x140054082
cmp byte [rsp + 0x32], bl
je 0x140054082
movsxd rax, dword [rsp + 0x44]
mov edx, 1
cmp rax, rdx
jle 0x140054054
mov r8, rbx
lea ecx, [rdx + 0xb]
lea r9, [rax - 1]
mov eax, dword [rbp + r8 - 0x80]
cmp dword [rbp + rcx - 0x80], eax
jle 0x140054049
mov ebx, edx
mov r8, rcx
inc edx
add rcx, 0xc
dec r9
jne 0x140054039
movsxd rax, ebx
lea rdx, [rax + rax*2]
mov cl, byte [rbp + rdx*4 - 0x7b]
mov al, byte [rbp + rdx*4 - 0x7c]
mov byte [r14 + 1], cl
mov cl, byte [rbp + rdx*4 - 0x7a]
mov byte [r14], al
mov byte [r14 + 2], cl
mov cl, byte [rbp + rdx*4 - 0x79]
mov byte [r14 + 3], cl
mov cl, byte [rbp + rdx*4 - 0x78]
mov byte [r14 + 4], cl
cmp edi, r15d
cmovg r15d, edi
mov eax, r15d
jmp 0x140054091
or eax, 0xffffffff
mov rcx, qword [rbp + 0x840]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x958
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret