Function at 0x140009fd0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
xorps xmm0, xmm0
movups xmmword [rcx + 0x1b0], xmm0
movups xmmword [rcx + 0x1a0], xmm0
movups xmmword [rcx + 0x190], xmm0
movups xmmword [rcx + 0x180], xmm0
movups xmmword [rcx + 0x170], xmm0
movups xmmword [rcx + 0x160], xmm0
movups xmmword [rcx + 0x150], xmm0
movups xmmword [rcx + 0x140], xmm0
movups xmmword [rcx + 0x130], xmm0
mov qword [rcx + 0x1c0], 0
mov edx, dword [rcx + 0x3c]
add rdx, qword [rcx + 0x40]
mov qword [rcx + 0x58], rdx
mov r9d, dword [rcx + 0x24]
mov r8d, dword [rcx + 0x34]
lea rax, [rdx + r8]
mov r10d, 0xaaaaaaab
imul r10, r8
shr r10, 0x26
imul r10d, r10d, 0x54
sub rax, r10
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x38], 0
mov dword [rcx + 0x18], r9d
cmp r9d, 0xc
mov r10d, recvfrom
cmovb r10d, r9d
not r10d
mov dword [rcx + 0x30], r10d
mov dword [rcx + 0x2c], r10d
mov dword [rcx + 0x20], 0
lea r9, [r8 + rdx - 0xc]
mov qword [rcx + 0x50], r9
lea r10, [rax + 0x600]
mov qword [rcx + 0x48], r10
mov qword [rcx], r9
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], rax
mov dword [r8 + rdx - 0xc], 0x1010100
mov r9d, dword [rcx + 0x40]
mov r10d, eax
sub r10d, r9d
mov dword [r8 + rdx - 8], r10d
mov dword [r8 + rdx - 4], 0
xor edx, edx
nop word [rax + rax]
mov byte [rax], dl
mov byte [rax + 1], 1
mov dword [rax + 2], 0
lea r8d, [rdx + 1]
mov byte [rax + 6], r8b
mov byte [rax + 7], 1
mov dword [rax + 8], 0
lea r8d, [rdx + 2]
mov byte [rax + 0xc], r8b
mov byte [rax + 0xd], 1
mov dword [rax + 0xe], 0
lea r8d, [rdx + 3]
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], 1
mov dword [rax + 0x14], 0
add edx, 4
add rax, 0x18
cmp edx, 0x100
jne 0x140009c30
lea r8, [rcx + 0xa9a]
mov r9d, 2
xor r10d, r10d
nop word cs:[rax + rax]
mov eax, 0x3cdd
xor edx, edx
div r9d
mov edx, 0x4000
sub edx, eax
mov word [r8 + r10 - 0x7e], dx
mov word [r8 + r10 - 0x6e], dx
mov word [r8 + r10 - 0x5e], dx
mov word [r8 + r10 - 0x4e], dx
mov word [r8 + r10 - 0x3e], dx
mov word [r8 + r10 - 0x2e], dx
mov word [r8 + r10 - 0x1e], dx
mov word [r8 + r10 - 0xe], dx
mov eax, 0x1f3f
xor edx, edx
div r9d
mov edx, 0x4000
sub edx, eax
mov word [r8 + r10 - 0x7c], dx
mov word [r8 + r10 - 0x6c], dx
mov word [r8 + r10 - 0x5c], dx
mov word [r8 + r10 - 0x4c], dx
mov word [r8 + r10 - 0x3c], dx
mov word [r8 + r10 - 0x2c], dx
mov word [r8 + r10 - 0x1c], dx
mov word [r8 + r10 - 0xc], dx
mov eax, 0x59bf
xor edx, edx
div r9d
mov edx, 0x4000
sub edx, eax
mov word [r8 + r10 - 0x7a], dx
mov word [r8 + r10 - 0x6a], dx
mov word [r8 + r10 - 0x5a], dx
mov word [r8 + r10 - 0x4a], dx
mov word [r8 + r10 - 0x3a], dx
mov word [r8 + r10 - 0x2a], dx
mov word [r8 + r10 - 0x1a], dx
mov word [r8 + r10 - 0xa], dx
mov eax, 0x48f3
xor edx, edx
div r9d
mov edx, 0x4000
sub edx, eax
mov word [r8 + r10 - 0x78], dx
mov word [r8 + r10 - 0x68], dx
mov word [r8 + r10 - 0x58], dx
mov word [r8 + r10 - 0x48], dx
mov word [r8 + r10 - 0x38], dx
mov word [r8 + r10 - 0x28], dx
mov word [r8 + r10 - 0x18], dx
mov word [r8 + r10 - 8], dx
mov eax, 0x64a1
xor edx, edx
div r9d
mov edx, 0x4000
sub edx, eax
mov word [r8 + r10 - 0x76], dx
mov word [r8 + r10 - 0x66], dx
mov word [r8 + r10 - 0x56], dx
mov word [r8 + r10 - 0x46], dx
mov word [r8 + r10 - 0x36], dx
mov word [r8 + r10 - 0x26], dx
mov word [r8 + r10 - 0x16], dx
mov word [r8 + r10 - 6], dx
mov eax, 0x5abc
xor edx, edx
div r9d
mov edx, 0x4000
sub edx, eax
mov word [r8 + r10 - 0x74], dx
mov word [r8 + r10 - 0x64], dx
mov word [r8 + r10 - 0x54], dx
mov word [r8 + r10 - 0x44], dx
mov word [r8 + r10 - 0x34], dx
mov word [r8 + r10 - 0x24], dx
mov word [r8 + r10 - 0x14], dx
mov word [r8 + r10 - 4], dx
mov eax, 0x6632
xor edx, edx
div r9d
mov edx, 0x4000
sub edx, eax
mov word [r8 + r10 - 0x72], dx
mov word [r8 + r10 - 0x62], dx
mov word [r8 + r10 - 0x52], dx
mov word [r8 + r10 - 0x42], dx
mov word [r8 + r10 - 0x32], dx
mov word [r8 + r10 - 0x22], dx
mov word [r8 + r10 - 0x12], dx
mov word [r8 + r10 - 2], dx
mov eax, 0x6051
xor edx, edx
div r9d
mov edx, 0x4000
sub edx, eax
mov word [r8 + r10 - 0x70], dx
mov word [r8 + r10 - 0x60], dx
mov word [r8 + r10 - 0x50], dx
mov word [r8 + r10 - 0x40], dx
mov word [r8 + r10 - 0x30], dx
mov word [r8 + r10 - 0x20], dx
mov word [r8 + r10 - 0x10], dx
mov word [r8 + r10], dx
inc r9d
sub r10, 0xffffffffffffff80
cmp r10, 0x4000
jne 0x140009ca0
lea rax, [rcx + 0x41b]
mov dx, 0x50
xor r8d, r8d
nop dword [rax]
mov word [rax + r8 - 0x3f], dx
mov word [rax + r8 - 0x3d], 0x403
mov word [rax + r8 - 0x3b], dx
mov word [rax + r8 - 0x39], 0x403
mov word [rax + r8 - 0x37], dx
mov word [rax + r8 - 0x35], 0x403
mov word [rax + r8 - 0x33], dx
mov word [rax + r8 - 0x31], 0x403
mov word [rax + r8 - 0x2f], dx
mov word [rax + r8 - 0x2d], 0x403
mov word [rax + r8 - 0x2b], dx
mov word [rax + r8 - 0x29], 0x403
mov word [rax + r8 - 0x27], dx
mov word [rax + r8 - 0x25], 0x403
mov word [rax + r8 - 0x23], dx
mov word [rax + r8 - 0x21], 0x403
mov word [rax + r8 - 0x1f], dx
mov word [rax + r8 - 0x1d], 0x403
mov word [rax + r8 - 0x1b], dx
mov word [rax + r8 - 0x19], 0x403
mov word [rax + r8 - 0x17], dx
mov word [rax + r8 - 0x15], 0x403
mov word [rax + r8 - 0x13], dx
mov word [rax + r8 - 0x11], 0x403
mov word [rax + r8 - 0xf], dx
mov word [rax + r8 - 0xd], 0x403
mov word [rax + r8 - 0xb], dx
mov word [rax + r8 - 9], 0x403
mov word [rax + r8 - 7], dx
mov word [rax + r8 - 5], 0x403
mov word [rax + r8 - 3], dx
mov word [rax + r8 - 1], 0x403
add edx, 0x28
add r8, 0x40
cmp r8, 0x640
jne 0x140009ed0
mov dword [rcx + 0x3d8], 0x40070000
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140516758]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r8, qword [rcx + 0x10]
cmp byte [r8 + 1], 0x1e
ja 0x14000a0bc
mov rax, qword [rsi]
mov eax, dword [rax + 8]
test rax, rax
je 0x14000a0bc
mov rcx, qword [rsi + 0x40]
cmp word [rcx + rax], 1
jne 0x14000a034
movzx edx, byte [rcx + rax + 3]
cmp dl, 0x1f
ja 0x14000a0bc
inc dl
mov byte [rcx + rax + 3], dl
jmp 0x14000a0bc
mov r9d, dword [rcx + rax + 4]
lea rdx, [rcx + r9]
movzx r8d, byte [r8]
cmp byte [rcx + r9], r8b
je 0x14000a0a3
nop word [rax + rax]
mov r9, rdx
add rdx, 6
cmp byte [r9 + 6], r8b
jne 0x14000a050
movzx r8d, byte [rdx + 1]
cmp r8b, byte [rdx - 5]
jb 0x14000a0a3
lea r8, [rdx - 6]
movzx r9d, word [rdx + 4]
mov word [rsp + 0x3c], r9w
mov r9d, dword [rdx]
mov dword [rsp + 0x38], r9d
movzx r9d, word [r8 + 4]
mov word [rdx + 4], r9w
mov r9d, dword [r8]
mov dword [rdx], r9d
movzx edx, word [rsp + 0x3c]
mov word [r8 + 4], dx
mov edx, dword [rsp + 0x38]
mov dword [r8], edx
mov rdx, r8
movzx r8d, byte [rdx + 1]
cmp r8b, 0x72
ja 0x14000a0bc
add r8b, 2
mov byte [rdx + 1], r8b
add word [rcx + rax + 2], 2
cmp dword [rsi + 0x18], 0
je 0x14000a117
mov rax, qword [rsi + 0x10]
mov rdi, qword [rsi + 0x58]
movzx eax, byte [rax]
mov byte [rdi], al
inc rdi
mov qword [rsi + 0x58], rdi
cmp rdi, qword [rsi + 0x60]
jae 0x14000a49d
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x40]
sub rdi, rcx
mov eax, dword [rdx + 2]
test eax, eax
je 0x14000a13e
cmp eax, edi
ja 0x14000a10d
mov rcx, rsi
call fcn.14000a4f0
test rax, rax
je 0x14000a49d
mov rcx, qword [rsi + 0x40]
sub eax, ecx
dec dword [rsi + 0x18]
je 0x14000a14e
mov rbp, qword [rsi]
jmp 0x14000a160
mov rcx, rsi
call fcn.14000a4f0
mov qword [rsi], rax
mov qword [rsi + 8], rax
test rax, rax
je 0x14000a49d
sub eax, dword [rsi + 0x40]
mov rcx, qword [rsi + 0x10]
mov dword [rcx + 2], eax
jmp 0x14000a4c2
mov dword [rdx + 2], edi
mov rbp, qword [rsi]
mov rcx, qword [rsi + 0x40]
mov eax, ebp
sub eax, ecx
jmp 0x14000a160
mov rbp, qword [rsi]
xor edx, edx
cmp qword [rsi + 8], rbp
setne dl
sub qword [rsi + 0x58], rdx
mov edi, eax
mov r14, qword [rsi + 8]
mov eax, eax
add rax, rcx
mov qword [rsi], rax
mov qword [rsi + 8], rax
cmp r14, rbp
je 0x14000a4c2
movzx r15d, word [rbp + 2]
movzx edx, word [rbp]
xor eax, eax
cmp edx, 4
setae al
mov dword [rsp + 0x28], eax
mov rax, qword [rsi + 0x10]
movzx eax, byte [rax + 1]
mov dword [rsp + 0x2c], edx
add eax, edx
sub r15d, eax
inc r15d
mov r13d, edi
shr r13d, 0x10
mov qword [rsp + 0x30], rdi
jmp 0x14000a208
lea r10d, [r9 + r9*8]
mov r11d, r9d
shl r11d, 2
lea r11d, [r11 + r11*2]
xor ebx, ebx
cmp r8d, r11d
setae bl
cmp r8d, r10d
sbb ebx, 0
lea r9d, [r9 + r9*4]
lea r9d, [r9 + r9*2]
cmp r8d, r9d
sbb ebx, 0xffffffff
add ecx, ebx
add ecx, 5
mov r10d, ebx
add r10d, 5
lea rax, [rax + rdx*2]
mov word [r14 + 2], cx
mov byte [rax + 1], r10b
mov rcx, qword [rsi + 0x40]
mov r14d, dword [r14 + 8]
add r14, rcx
cmp r14, rbp
je 0x14000a4c2
movzx r12d, word [r14]
cmp r12d, 1
jne 0x14000a230
mov edx, dword [rsi + 0x130]
test rdx, rdx
je 0x14000a282
lea rax, [rcx + rdx]
mov ecx, dword [rcx + rdx]
mov dword [rsi + 0x130], ecx
jmp 0x14000a2ba
mov rdi, r15
mov r15d, r13d
mov r13, rbp
test r12b, 1
jne 0x14000a3e6
mov rbx, r12
shr rbx, 1
movzx ebp, byte [rsi + rbx + 0xaf]
cmp bpl, byte [rsi + rbx + 0xb0]
je 0x14000a3e6
mov edx, dword [rsi + rbp*4 + 0x134]
test rdx, rdx
je 0x14000a302
lea rax, [rcx + rdx]
mov edx, dword [rcx + rdx]
mov dword [rsi + rbp*4 + 0x134], edx
jmp 0x14000a344
movzx eax, byte [rsi + 0x88]
shl rax, 2
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x48]
mov edx, dword [rsi + 0x50]
sub edx, eax
cmp ecx, edx
jbe 0x14000a2aa
mov rcx, rsi
xor edx, edx
call fcn.14000acb0
jmp 0x14000a2b1
add rcx, rax
mov qword [rsi + 0x48], rcx
test rax, rax
je 0x14000a49d
movzx edx, byte [r14 + 3]
movzx ecx, byte [r14 + 2]
mov byte [rax], cl
movzx ecx, word [r14 + 4]
mov word [rax + 2], cx
movzx ecx, word [r14 + 6]
mov word [rax + 4], cx
mov ecx, dword [rsi + 0x40]
mov r8d, eax
sub r8d, ecx
lea ecx, [rdx + rdx]
cmp edx, 0x1e
mov dword [r14 + 4], r8d
mov edx, pe_nt_image_headers64
cmovae ecx, edx
mov byte [rax + 1], cl
add ecx, dword [rsp + 0x28]
add ecx, dword [rsi + 0x1c]
jmp 0x14000a42d
lea rdx, [rbp + 1]
movzx eax, byte [rsi + rdx + 0x88]
shl rax, 2
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x48]
mov r8d, dword [rsi + 0x50]
sub r8d, eax
cmp ecx, r8d
jbe 0x14000a330
mov rcx, rsi
call fcn.14000acb0
jmp 0x14000a337
add rcx, rax
mov qword [rsi + 0x48], rcx
test rax, rax
je 0x14000a49d
mov rcx, qword [rsi + 0x40]
mov edx, dword [r14 + 4]
add rdx, rcx
mov rcx, rax
mov r8, rdx
mov r9d, ebx
test r12b, 2
je 0x14000a376
mov ecx, dword [rdx]
mov dword [rax], ecx
mov ecx, dword [rdx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdx + 8]
mov dword [rax + 8], ecx
lea r8, [rdx + 0xc]
lea rcx, [rax + 0xc]
lea r9d, [rbx - 1]
cmp ebx, 1
je 0x14000a3c4
xor r10d, r10d
nop
mov r11d, dword [r8 + r10]
mov dword [rcx + r10], r11d
mov r11d, dword [r8 + r10 + 4]
mov dword [rcx + r10 + 4], r11d
mov r11d, dword [r8 + r10 + 8]
mov dword [rcx + r10 + 8], r11d
mov r11d, dword [r8 + r10 + 0xc]
mov dword [rcx + r10 + 0xc], r11d
mov r11d, dword [r8 + r10 + 0x10]
mov dword [rcx + r10 + 0x10], r11d
mov r11d, dword [r8 + r10 + 0x14]
mov dword [rcx + r10 + 0x14], r11d
add r10, 0x18
add r9d, 0xfffffffe
jne 0x14000a380
mov ecx, ebp
mov r8d, dword [rsi + rcx*4 + 0x130]
mov dword [rdx], r8d
mov r8d, dword [rsi + 0x40]
sub edx, r8d
mov dword [rsi + rcx*4 + 0x130], edx
sub eax, r8d
mov dword [r14 + 4], eax
movzx eax, word [r14 + 2]
lea edx, [r12 + r12]
lea ecx, [r12*4]
mov r9d, dword [rsp + 0x2c]
cmp ecx, r9d
setbe cl
lea r8d, [r12*8]
cmp r8d, eax
setae r8b
and r8b, cl
movzx ecx, r8b
add ecx, ecx
cmp edx, r9d
adc ecx, eax
mov rbp, r13
mov r13d, r15d
mov r15, rdi
mov rdi, qword [rsp + 0x30]
mov eax, dword [r14 + 4]
add rax, qword [rsi + 0x40]
lea rdx, [r12 + r12*2]
lea r9d, [rcx + rcx]
add r9d, 0xc
mov r10, qword [rsi + 0x10]
movzx r8d, byte [r10 + 1]
imul r8d, r9d
lea r9d, [r15 + rcx]
movzx r10d, byte [r10]
mov byte [rax + rdx*2], r10b
inc r12d
mov word [r14], r12w
mov word [rax + rdx*2 + 2], di
mov word [rax + rdx*2 + 4], r13w
lea r10d, [r9 + r9]
lea r10d, [r10 + r10*2]
cmp r8d, r10d
jae 0x14000a1b0
xor r10d, r10d
cmp r8d, r9d
seta r10b
shl r9d, 2
cmp r8d, r9d
sbb r10d, 0xffffffff
inc r10d
add ecx, 3
jmp 0x14000a1e7
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14049f400
mov rcx, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x140009b40
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14049f400
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret