Function at 0x1400335d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1370]
mov eax, 0x1470
call fcn.1400c9b10
sub rsp, rax
mov rax, qword [0x1400fe700]
xor rax, rsp
mov qword [rbp + 0x1360], rax
mov rbx, qword [rcx]
xor eax, eax
xor r15b, r15b
mov qword [rcx + 0x10], rax
mov qword [rcx + 8], rax
mov r14, rcx
mov qword [rcx + 0x18], rax
mov r13d, eax
mov qword [rsp + 0x48], rcx
mov r12d, eax
mov rcx, rbx
mov byte [rsp + 0x31], r15b
mov byte [rsp + 0x30], 0
mov r15d, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
call fcn.140032600
test eax, eax
je 0x1400341ec
mov rcx, rbx
call fcn.14002e130
mov rcx, rbx
mov esi, eax
call fcn.14002e130
shl esi, 0x10
mov rcx, rbx
add esi, eax
call fcn.14002e130
mov rcx, rbx
mov edi, eax
call fcn.14002e130
shl edi, 0x10
lea ecx, [rdi + rax]
cmp ecx, 0x49484452
ja 0x140033ae0
je 0x14003378f
cmp ecx, 0x43674249
je 0x140033780
cmp ecx, 0x49444154
je 0x1400336fa
cmp ecx, 0x49454e44
jne 0x140033af4
cmp dword [rsp + 0x34], 0
jne 0x1400341ec
mov rdi, qword [r14 + 8]
test rdi, rdi
je 0x1400341ec
mov ecx, 0x4000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x140033eab
mov qword [r14 + 0x10], rax
jmp 0x1400341ec
cmp dword [rsp + 0x34], 0
jne 0x1400341ec
cmp byte [rsp + 0x30], 0
je 0x140033715
test r13d, r13d
je 0x1400341ec
mov eax, dword [rsp + 0x38]
lea edi, [rsi + rax]
cmp edi, r15d
jbe 0x14003375e
test r15d, r15d
jne 0x140033738
mov r15d, 0x1000
cmp esi, r15d
cmova r15d, esi
cmp edi, r15d
jbe 0x140033740
add r15d, r15d
cmp edi, r15d
ja 0x140033738
mov rcx, qword [r14 + 8]
mov edx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x1400341ec
mov qword [r14 + 8], rax
mov eax, dword [rsp + 0x38]
mov edx, eax
mov r8d, esi
add rdx, qword [r14 + 8]
mov rcx, rbx
call fcn.14002e060
test eax, eax
je 0x1400341ec
mov dword [rsp + 0x38], edi
jmp 0x140033e96
mov eax, dword [0x140105460]
mov dword [rsp + 0x40], eax
jmp 0x140033b09
cmp dword [rsp + 0x34], 0
je 0x1400341ec
xor r12d, r12d
mov dword [rsp + 0x34], r12d
cmp esi, 0xd
jne 0x1400341ec
mov rcx, rbx
call fcn.14002e130
mov rcx, rbx
mov edi, eax
call fcn.14002e130
shl edi, 0x10
add eax, edi
mov dword [rbx], eax
cmp eax, 0x1000000
ja 0x1400341ec
mov rcx, rbx
call fcn.14002e130
mov rcx, rbx
mov edi, eax
call fcn.14002e130
shl edi, 0x10
lea ecx, [rax + rdi]
mov dword [rbx + 4], ecx
cmp ecx, 0x1000000
ja 0x1400341ec
mov rcx, qword [rbx + 0xb8]
cmp rcx, qword [rbx + 0xc0]
jae 0x14003380e
movzx edx, byte [rcx]
inc rcx
jmp 0x140033867
cmp dword [rbx + 0x30], r12d
je 0x1400341ec
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x140033849
lea rax, [rbx + 0x39]
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0xc0], rax
mov byte [rdi], r12b
jmp 0x140033859
cdqe
lea rcx, [rbx + 0x38]
add rcx, rax
mov qword [rbx + 0xc0], rcx
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
lea rcx, [rax + 1]
mov qword [rbx + 0xb8], rcx
cmp dl, 8
jne 0x1400341ec
cmp rcx, qword [rbx + 0xc0]
jae 0x140033888
movzx edx, byte [rcx]
inc rcx
jmp 0x1400338dd
cmp dword [rbx + 0x30], r12d
je 0x140033908
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x1400338bf
lea rax, [rbx + 0x39]
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0xc0], rax
mov byte [rdi], r12b
jmp 0x1400338cf
cdqe
lea rcx, [rbx + 0x38]
add rcx, rax
mov qword [rbx + 0xc0], rcx
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
lea rcx, [rax + 1]
movzx esi, dl
mov qword [rbx + 0xb8], rcx
cmp esi, 6
ja 0x1400341ec
cmp esi, 3
jne 0x1400338fc
mov byte [rsp + 0x30], sil
jmp 0x14003390b
test sil, 1
jne 0x1400341ec
jmp 0x14003390b
mov esi, r12d
cmp rcx, qword [rbx + 0xc0]
jae 0x14003391c
movzx edx, byte [rcx]
inc rcx
jmp 0x140033971
cmp dword [rbx + 0x30], r12d
je 0x140033980
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x140033953
lea rax, [rbx + 0x39]
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0xc0], rax
mov byte [rdi], r12b
jmp 0x140033963
cdqe
lea rcx, [rbx + 0x38]
add rcx, rax
mov qword [rbx + 0xc0], rcx
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
lea rcx, [rax + 1]
mov qword [rbx + 0xb8], rcx
test dl, dl
jne 0x1400341ec
cmp rcx, qword [rbx + 0xc0]
jae 0x140033991
movzx edx, byte [rcx]
inc rcx
jmp 0x1400339e6
cmp dword [rbx + 0x30], r12d
je 0x1400339f5
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x1400339c8
lea rax, [rbx + 0x39]
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0xc0], rax
mov byte [rdi], r12b
jmp 0x1400339d8
cdqe
lea rcx, [rbx + 0x38]
add rcx, rax
mov qword [rbx + 0xc0], rcx
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
lea rcx, [rax + 1]
mov qword [rbx + 0xb8], rcx
test dl, dl
jne 0x1400341ec
cmp rcx, qword [rbx + 0xc0]
jae 0x140033a07
movzx edx, byte [rcx]
lea rax, [rcx + 1]
jmp 0x140033a5b
cmp dword [rbx + 0x30], r12d
je 0x140033a77
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x140033a3e
lea rax, [rbx + 0x39]
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0xc0], rax
mov byte [rdi], r12b
jmp 0x140033a4e
cdqe
lea rcx, [rbx + 0x38]
add rcx, rax
mov qword [rbx + 0xc0], rcx
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
inc rax
movzx r12d, dl
mov qword [rbx + 0xb8], rax
mov dword [rsp + 0x3c], r12d
cmp r12d, 1
ja 0x1400341ec
jmp 0x140033a7c
mov dword [rsp + 0x3c], r12d
mov ecx, dword [rbx]
test ecx, ecx
je 0x1400341ec
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x1400341ec
xor edx, edx
mov eax, 0x40000000
div ecx
cmp byte [rsp + 0x30], 0
jne 0x140033ac8
mov ecx, esi
xor edx, edx
shr ecx, 2
and esi, 2
and ecx, 1
or esi, 1
add ecx, esi
div ecx
mov dword [rbx + 8], ecx
cmp eax, r8d
jb 0x1400341ec
jmp 0x140033e96
shr eax, 2
mov dword [rbx + 8], 1
cmp eax, r8d
jb 0x1400341ec
jmp 0x140033e96
cmp ecx, 0x504c5445
je 0x140033c7a
cmp ecx, 0x74524e53
je 0x140033b4d
cmp dword [rsp + 0x34], 0
jne 0x1400341ec
bt ecx, 0x1d
jae 0x1400341c5
cmp qword [rbx + 0x10], 0
je 0x140033b3e
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xb8]
cmp ecx, esi
jge 0x140033b3e
mov rax, qword [rbx + 0xc0]
sub esi, ecx
mov rcx, qword [rbx + 0x28]
mov edx, esi
mov qword [rbx + 0xb8], rax
call qword [rbx + 0x18]
jmp 0x140033e96
movsxd rax, esi
add qword [rbx + 0xb8], rax
jmp 0x140033e96
cmp dword [rsp + 0x34], 0
jne 0x1400341ec
cmp qword [r14 + 8], 0
jne 0x1400341ec
cmp byte [rsp + 0x30], 0
je 0x140033c2d
test r13d, r13d
je 0x1400341ec
cmp esi, r13d
ja 0x1400341ec
xor r14d, r14d
mov byte [rsp + 0x30], 4
test esi, esi
je 0x140033e91
mov rax, qword [rbx + 0xb8]
cmp rax, qword [rbx + 0xc0]
jae 0x140033baf
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140033c0d
cmp dword [rbx + 0x30], 0
je 0x140033c0b
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x140033be5
mov dword [rbx + 0x30], eax
lea rax, [rbx + 0x39]
mov qword [rbx + 0xc0], rax
mov byte [rdi], 0
jmp 0x140033bf5
cdqe
lea rcx, [rbx + 0x38]
add rcx, rax
mov qword [rbx + 0xc0], rcx
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xb8], rax
jmp 0x140033c0d
xor dl, dl
lea eax, [r14*4 + 3]
inc r14d
mov byte [rbp + rax + 0xf60], dl
cmp r14d, esi
jb 0x140033b90
jmp 0x140033e91
mov ecx, dword [rbx + 8]
test cl, 1
je 0x1400341ec
lea eax, [rcx + rcx]
cmp esi, eax
jne 0x1400341ec
xor esi, esi
mov byte [rsp + 0x31], 1
test ecx, ecx
jle 0x140033e96
lea rdi, [rbp + 0xf50]
nop word [rax + rax]
mov rcx, rbx
call fcn.14002e130
inc esi
mov byte [rdi], al
lea rdi, [rdi + 1]
cmp esi, dword [rbx + 8]
jl 0x140033c60
jmp 0x140033e96
cmp dword [rsp + 0x34], 0
jne 0x1400341ec
cmp esi, 0x300
ja 0x1400341ec
mov eax, 0xaaaaaaab
mul esi
mov r13d, edx
shr r13d, 1
lea eax, [r13*2]
add eax, r13d
cmp eax, esi
jne 0x1400341ec
xor r14d, r14d
test r13d, r13d
je 0x140033e91
mov r8, qword [rbx + 0xb8]
xor r12d, r12d
nop word [rax + rax]
mov rdx, qword [rbx + 0xc0]
cmp r8, rdx
jae 0x140033ce5
movzx ecx, byte [r8]
inc r8
jmp 0x140033d41
cmp dword [rbx + 0x30], r12d
je 0x140033d68
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x140033d23
lea rax, [rbx + 0x39]
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0xc0], rax
mov byte [rdi], r12b
mov rdx, qword [rbx + 0xc0]
jmp 0x140033d33
cdqe
lea rdx, [rbx + 0x38]
add rdx, rax
mov qword [rbx + 0xc0], rdx
mov rax, qword [rbx + 0xb8]
movzx ecx, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xb8], r8
lea esi, [r14*4]
mov byte [rbp + rsi + 0xf60], cl
mov r9d, esi
cmp r8, rdx
jae 0x140033d7b
movzx r9d, byte [r8]
inc r8
jmp 0x140033dd8
lea esi, [r14*4]
mov byte [rbp + rsi + 0xf60], r12b
mov r9d, esi
cmp dword [rbx + 0x30], r12d
je 0x140033dff
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x140033db9
lea rax, [rbx + 0x39]
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0xc0], rax
mov byte [rdi], r12b
mov rdx, qword [rbx + 0xc0]
jmp 0x140033dc9
cdqe
lea rdx, [rbx + 0x38]
add rdx, rax
mov qword [rbx + 0xc0], rdx
mov rax, qword [rbx + 0xb8]
movzx r9d, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xb8], r8
lea eax, [rsi + 1]
mov byte [rbp + rax + 0xf60], r9b
cmp r8, rdx
jae 0x140033e0b
movzx edx, byte [r8]
inc r8
mov qword [rbx + 0xb8], r8
jmp 0x140033e6b
lea eax, [r9 + 1]
mov byte [rbp + rax + 0xf60], r12b
cmp dword [rbx + 0x30], r12d
je 0x140033e69
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [rbx + reloc.WS2_32.dll_recv]
mov qword [rbx + 0xb8], rdi
test eax, eax
jne 0x140033e42
lea rax, [rbx + 0x39]
mov dword [rbx + 0x30], r12d
mov qword [rbx + 0xc0], rax
mov byte [rdi], r12b
jmp 0x140033e52
cdqe
lea rcx, [rbx + 0x38]
add rcx, rax
mov qword [rbx + 0xc0], rcx
mov rax, qword [rbx + 0xb8]
movzx edx, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xb8], r8
jmp 0x140033e6b
xor dl, dl
lea eax, [rsi + 2]
inc r14d
mov byte [rbp + rax + 0xf60], dl
lea eax, [rsi + 3]
mov byte [rbp + rax + 0xf60], 0xff
cmp r14d, r13d
jb 0x140033cd0
mov r12d, dword [rsp + 0x3c]
mov r14, qword [rsp + 0x48]
mov rcx, rbx
call fcn.14002e130
mov rcx, rbx
call fcn.14002e130
jmp 0x140033661
movsxd rax, dword [rsp + 0x38]
xor esi, esi
mov r13d, dword [rsp + 0x40]
add rax, rdi
mov qword [rsp + 0x58], rax
mov edx, esi
lea rax, [rcx + 0x4000]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rcx
test r13d, r13d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
sete dl
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], 1
call fcn.140032350
test eax, eax
je 0x1400341b4
mov rax, qword [rsp + 0x70]
mov edi, dword [rsp + 0x68]
sub edi, dword [rsp + 0x70]
mov qword [r14 + 0x10], rax
test rax, rax
je 0x1400341ec
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + 8], rsi
mov eax, dword [rbx + 8]
movzx esi, byte [rsp + 0x30]
lea r9d, [rax + 1]
cmp r9d, 4
jne 0x140033f3e
test sil, sil
je 0x140033fbb
movzx r15d, byte [rsp + 0x31]
test r15b, r15b
jne 0x140033f4c
mov r9d, eax
mov dword [rbx + 0xc], r9d
mov r8d, edi
mov rdx, qword [r14 + 0x10]
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.1400332a0
test eax, eax
je 0x1400341ec
test r15b, r15b
je 0x140033ffe
mov rax, qword [r14]
mov rcx, qword [r14 + 0x18]
mov edx, dword [rax + 4]
imul edx, dword [rax]
test edx, edx
je 0x140033ffe
cmp dword [rbx + 0xc], 2
jne 0x140033fc3
movzx r8d, byte [rbp + 0xf50]
xor r15d, r15d
nop word [rax + rax]
cmp byte [rcx], r8b
lea rcx, [rcx + 2]
mov eax, 0xff
cmove eax, r15d
mov byte [rcx - 1], al
sub rdx, 1
jne 0x140033fa0
jmp 0x140034001
movzx r15d, byte [rsp + 0x31]
jmp 0x140033f4c
movzx r8d, byte [rbp + 0xf51]
movzx r9d, byte [rbp + 0xf50]
mov eax, edx
movzx edx, byte [rbp + 0xf52]
nop dword [rax]
cmp byte [rcx], r9b
jne 0x140033ff4
cmp byte [rcx + 1], r8b
jne 0x140033ff4
cmp byte [rcx + 2], dl
jne 0x140033ff4
mov byte [rcx + 3], 0
add rcx, 4
sub rax, 1
jne 0x140033fe0
xor r15d, r15d
test r13d, r13d
je 0x1400340fa
cmp dword [rbx + 0xc], 2
jle 0x1400340fa
mov rax, qword [r14]
mov r9, qword [r14 + 0x18]
mov ecx, dword [rax + 4]
imul ecx, dword [rax]
test ecx, ecx
je 0x1400340fa
cmp dword [rax + 0xc], 3
jne 0x14003405f
mov edx, ecx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9]
movzx eax, byte [r9 + 2]
mov byte [r9], al
mov byte [r9 + 2], cl
lea r9, [r9 + 3]
sub rdx, 1
jne 0x140034040
jmp 0x1400340fa
cmp dword [0x140105464], 0
je 0x1400340d0
mov edi, ecx
nop word [rax + rax]
movzx eax, byte [r9 + 3]
movzx ecx, byte [r9]
movzx r11d, byte [r9 + 2]
test al, al
je 0x1400340b5
mov r8d, eax
xor edx, edx
movzx eax, byte [r9 + 1]
imul eax, eax, 0xff
div r8d
xor edx, edx
mov byte [r9 + 1], al
imul eax, ecx, 0xff
div r8d
xor edx, edx
mov r10d, eax
imul eax, r11d, 0xff
div r8d
jmp 0x1400340bd
movzx r10d, cl
movzx eax, r11b
mov byte [r9], al
mov byte [r9 + 2], r10b
add r9, 4
sub rdi, 1
jne 0x140034070
jmp 0x1400340fa
mov edx, ecx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9]
movzx eax, byte [r9 + 2]
mov byte [r9], al
mov byte [r9 + 2], cl
lea r9, [r9 + 4]
sub rdx, 1
jne 0x1400340e0
test sil, sil
je 0x14003419f
mov dword [rbx + 0xc], 4
movzx eax, sil
mov dword [rbx + 8], eax
mov eax, 4
mov rcx, qword [r14]
mov rbx, qword [r14 + 0x18]
mov edi, dword [rcx + 4]
imul edi, dword [rcx]
mul edi
mov ecx, eax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400341ec
test edi, edi
je 0x140034191
lea r8, [rax + 2]
mov r9d, edi
nop
movzx edx, byte [rbx]
lea r8, [r8 + 4]
lea rbx, [rbx + 1]
movzx eax, byte [rbp + rdx*4 + 0xf60]
mov byte [r8 - 6], al
movzx eax, byte [rbp + rdx*4 + 0xf61]
mov byte [r8 - 5], al
movzx eax, byte [rbp + rdx*4 + 0xf62]
mov byte [r8 - 4], al
movzx eax, byte [rbp + rdx*4 + 0xf63]
mov byte [r8 - 3], al
sub r9, 1
jne 0x140034150
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + 0x18], rsi
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
mov qword [r14 + 0x10], r15
jmp 0x1400341ee
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + 0x10], rsi
jmp 0x1400341ec
mov eax, ecx
mov byte [0x1401037fb], cl
shr eax, 0x18
mov byte [str.XXXX_chunk_not_known], al
mov eax, ecx
shr eax, 0x10
mov byte [0x1401037f9], al
mov eax, ecx
shr eax, 8
mov byte [0x1401037fa], al
xor eax, eax
mov rcx, qword [rbp + 0x1360]
xor rcx, rsp
call fcn.1400c8ee0
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret