Function at 0x140001550
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140025018]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [0x140021530]
lea rsi, [0x140026d18]
movdqa xmm0, xmmword [0x140022260]
mov rdi, rcx
movdqa xmm1, xmmword [str.:h_8J_4_FXayMqW_bV_H_Na_2qEi_RNbQ_:SJ__k_WuKr_]
mov dword [rbp - 0x39], eax
movzx eax, word [0x140021534]
mov word [rbp - 0x35], ax
movzx eax, byte [0x140021536]
mov byte [rbp - 0x33], al
mov eax, dword [0x140021540]
mov dword [rbp - 0x2a], eax
xor eax, eax
mov word [rbp - 0x26], ax
mov byte [rbp - 0x24], al
mov eax, dword [0x140021550]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x140022250]
mov dword [rbp - 0x1b], eax
movzx eax, word [0x140021554]
movdqa xmmword [rbp + 0x27], xmm0
movsd xmm0, qword [str.192.168.100.52]
mov word [rbp - 0x17], ax
movzx eax, byte [0x140021556]
movsd qword [rbp - 0x41], xmm0
movsd xmm0, qword [str.10.10.10.12]
mov byte [rbp - 0x15], al
mov eax, dword [0x140021560]
mov dword [rbp - 0xc], eax
movzx eax, word [0x140021564]
movsd qword [rbp - 0x32], xmm0
movsd xmm0, qword [str.172.16.132.123]
mov word [rbp - 8], ax
xor eax, eax
movdqa xmmword [rbp + 0x17], xmm1
xor ebx, ebx
movdqa xmm1, xmmword [str.aJ4_:E52__iT]
movsd qword [rbp - 0x23], xmm0
movsd xmm0, qword [str.152.77.83.151]
mov byte [rbp - 6], al
mov byte [0x140026d18], al
movdqa xmmword [rbp + 0x37], xmm1
movsd qword [rbp - 0x14], xmm0
nop dword [rax + rax]
movsxd rax, ebx
lea rdx, [0x1400214b0]
imul rcx, rax, 0xf
lea rax, [rbp - 0x41]
add rcx, rax
call fcn.140006ad8
test rax, rax
je 0x1400016d3
nop
mov rcx, rax
call fcn.140009cf4
mov r8d, eax
lea rdx, str._02X
lea rcx, [rbp - 0x59]
call fcn.140001070
lea rax, [rsi - 1]
nop
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1400016a0
lea r8, [rbp - 0x59]
xor edx, edx
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400016b0
lea rdx, [0x1400214b0]
xor ecx, ecx
call fcn.140006ad8
test rax, rax
jne 0x140001680
inc ebx
cmp ebx, 4
jb 0x140001660
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rsi + r9], 0
jne 0x1400016e1
mov r8, rsi
lea rcx, [rbp + 7]
call fcn.1400010d0
mov ebx, dword [rdi + 8]
lea rcx, str.___Crypt_processing_PE_with_size:__d._n
mov rdi, qword [rdi]
mov edx, ebx
call fcn.140001010
lea rax, [rbp + 7]
mov dword [rbp - 0x79], 0x40
lea rcx, [rbp - 0x51]
mov qword [rbp - 0x71], rax
mov dword [rbp - 0x75], 0x40
mov dword [rbp - 0x69], ebx
mov dword [rbp - 0x65], ebx
mov qword [rbp - 0x61], rdi
mov dword [rbp - 0x51], 0x50595243
mov dword [rbp - 0x4d], 0x2e505354
mov dword [rbp - 0x49], 0x4c4c44
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x69]
call rax
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x140001794
mov edx, edi
lea rcx, str.____Operation_failed_with_status:__d_n
call fcn.140001010
lea rcx, str.____Crypt_operation_failed._n
call fcn.140001010
xor eax, eax
jmp 0x140001799
mov eax, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140002c00
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret