Function at 0x1400735d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140518628]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r15, rcx
lea r14, [0x140519368]
xor esi, esi
lea r12d, [rsi + 0x3c]
movabs r13, 0x7ffffffffeced2ff
movabs rdi, 0x7fffffffffffffff
mov rax, qword [0x140519368]
test rax, rax
je 0x140073d45
movzx eax, byte [0x140519351]
test al, al
je 0x1400736dc
nop
call fcn.14035fc5c
mov rbx, rax
call fcn.14035fc40
cmp rbx, 0x989680
jne 0x14007366c
imul rax, rax, 0x64
jmp 0x140073687
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r13
setl cl
test cl, cl
je 0x14007369e
add rax, 0x1312d00
mov qword [rsp + 0x70], rax
jmp 0x1400736a3
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x70]
call fcn.14007cf80
movzx eax, byte [0x140519351]
test al, al
je 0x1400736c4
mov rax, qword [0x140519368]
test rax, rax
jne 0x140073650
mov rax, qword [0x140519368]
test rax, rax
je 0x140073d45
mov rcx, r15
call fcn.140073fb0
mov rcx, qword [0x1407b7548]
test rcx, rcx
jne 0x140073708
mov ecx, 0x110
call fcn.140361120
mov qword [rbp - 0x50], rax
mov rcx, rax
call fcn.14007d300
mov rcx, rax
mov qword [0x1407b7548], rax
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, rax
xorps xmm6, xmm6
test rax, rax
js 0x140073723
cvtsi2sd xmm6, rax
jmp 0x140073735
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm6, rax
addsd xmm6, xmm6
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x28]
mov rcx, rax
imul rcx, qword [r15 + 0x68]
xorps xmm0, xmm0
test rcx, rcx
js 0x140073755
cvtsi2sd xmm0, rcx
jmp 0x14007376a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
divsd xmm6, xmm0
mov eax, dword [r15 + 0x58]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
cvttsd2si ecx, xmm0
mov dword [rsp + 0x64], ecx
dec eax
cmp eax, 0x62
ja 0x140073797
cmp ecx, 0x64
mov byte [rsp + 0x40], 1
jl 0x14007379c
mov byte [rsp + 0x40], 0
mov r13b, 1
mov byte [rsp + 0x60], r13b
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r15 + 0x898]
mov rax, qword [0x140519368]
cmp rax, rcx
jne 0x140073d38
lea rsi, [r15 + 0x80]
movzx eax, byte [rsi + 0x820]
imul rcx, rax, 0x268
lea r14, [rsi + 0x330]
add r14, rcx
movzx ecx, byte [r15 + 0x4a]
mov edx, 1
shl rdx, cl
movzx ecx, byte [r14 + 2]
mov eax, 1
shl rax, cl
cmp rax, rdx
jne 0x140073d2f
movzx r8d, byte [rsi + 0x820]
imul rax, r8, 0x268
mov edx, dword [rax + rsi + 0x330]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
mov r10d, 0xffff0000
cmove ecx, r10d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007386b
mov ecx, 0x20
jmp 0x140073898
cmp ecx, 0x6c000000
jne 0x14007387a
mov ecx, 0x4c
jmp 0x140073898
cmp edx, 0x72151279
jne 0x140073889
mov ecx, 0x93
jmp 0x140073898
mov ecx, 0x27
cmp edx, 0x72151278
cmove rcx, r12
imul rax, r8, 0x198
add rax, rcx
mov ebx, dword [rax + rsi]
mov byte [rsp + 0x51], 1
movzx eax, byte [rsi + 0x820]
imul rcx, rax, 0x268
mov edx, dword [rcx + rsi + 0x330]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r10d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x1400738e6
mov r9d, 0x20
jmp 0x140073916
cmp ecx, 0x6c000000
jne 0x1400738f6
mov r9d, 0x4c
jmp 0x140073916
cmp edx, 0x72151279
jne 0x140073906
mov r9d, 0x93
jmp 0x140073916
mov r9d, 0x27
cmp edx, 0x72151278
cmove r9, r12
movzx eax, byte [rsi + 0x820]
imul rcx, rax, 0x268
mov edx, dword [rcx + rsi + 0x330]
mov eax, edx
and eax, 0xff000000
mov r8d, 0xff000000
cmp eax, 0x63000000
cmove r8d, r10d
and r8d, edx
mov ecx, 4
cmp r8d, 0x6b000000
mov eax, 8
cmove ecx, eax
movzx eax, byte [rsi + 0x820]
imul r12, rax, 0x198
lea rax, [r9 + rcx]
add r12, rax
add r12, rsi
mov edx, dword [r14]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r10d
and ecx, edx
cmp ecx, 0x72000000
jne 0x140073b48
test r13b, r13b
je 0x140073a08
mov byte [rsp + 0x60], 0
cmp byte [r14 + 0x261], 0
je 0x1400739ca
movzx eax, byte [rsi + 0x820]
imul rdx, rax, 0x198
add rdx, rsi
mov r9, r12
mov r8, qword [r14 + 0x20]
mov rcx, r14
call fcn.14003b510
movzx eax, byte [rsi + 0x820]
imul r8, rax, 0x198
add r8, rsi
mov rdi, qword [r15 + 0x8a8]
mov r9, qword [r14 + 0x20]
mov edx, 0x40
lea rcx, [rbp + 0xe0]
call qword [case.0x14017977d.0]
mov rax, qword [rdi]
lea rdx, [rbp + 0xe0]
mov rcx, rdi
call qword [rax + 0x30]
mov edx, 0x8000
mov r8d, 1
mov rcx, rsi
call fcn.140072b40
test al, al
je 0x140073d0b
cmp byte [r14 + 0x261], 0
je 0x140073a80
movups xmm0, xmmword [r12]
movaps xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [r12 + 0x10]
movaps xmmword [rbp + 0x130], xmm1
movups xmm0, xmmword [r12 + 0x20]
movaps xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [r12 + 0x30]
movaps xmmword [rbp + 0x150], xmm1
movzx eax, byte [rsi + 0x820]
imul rdx, rax, 0x198
add rdx, rsi
mov r9, r12
mov r8, qword [r14 + 0x20]
mov rcx, r14
call fcn.14003b510
mov rax, qword [r14 + 0x20]
mov qword [rsp + 0x48], rax
movzx eax, byte [rsi + 0x820]
imul r13, rax, 0x198
add r13, rsi
mov rdi, qword [r15 + 0x8a8]
mov dword [rsp + 0x58], 0x9fc0
ldmxcsr dword [rsp + 0x58]
xor esi, esi
cmp dword [0x1407b69ec], 1
je 0x140073afd
nop dword [rax]
mov rax, qword [rdi]
lea rdx, [rbp + 0xe0]
mov rcx, rdi
call qword [rax + gethostname]
mov r9d, 0x100
lea r8, [rdi + 0x980]
mov edx, 0x40
lea rcx, [rbp + 0xe0]
call qword [case.0x14017977d.0]
inc esi
mov eax, dword [0x1407b69ec]
dec eax
cmp esi, eax
jb 0x140073ac0
mov rax, qword [rdi]
lea rdx, [rbp + 0xe0]
mov rcx, rdi
call qword [rax + gethostname]
mov r9, qword [rsp + 0x48]
mov r8, r13
mov edx, 0x40
lea rcx, [rbp + 0xe0]
call qword [case.0x14017977d.0]
mov rax, qword [rdi]
lea rdx, [r15 + 0x28]
lea r8, [rbp + 0xe0]
mov rcx, rdi
call qword [rax + 0x18]
movzx edi, byte [rsp + 0x51]
movzx r13d, byte [rsp + 0x60]
jmp 0x140073bc7
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r10d
and ecx, edx
cmp ecx, 0x6c000000
je 0x140073ba9
movzx eax, byte [rsi + 0x820]
imul rdi, rax, 0x198
add rdi, rsi
mov r8d, dword [r15 + 0x4c]
mov edx, dword [r15 + 0x54]
mov rcx, r14
call fcn.1400cb060
lea r9, [r15 + 0x70]
lea r8, [r15 + 0x28]
mov rdx, qword [r14 + 0x78]
mov qword [rsp + 0x20], rdx
mov rdx, qword [r14 + 0x20]
mov rcx, rdi
call rax
movzx edi, byte [rsp + 0x51]
jmp 0x140073bac
xor dil, dil
mov edx, 0x8000
mov r8d, 1
mov rcx, rsi
call fcn.140072b40
test al, al
je 0x140073d0b
test dil, dil
je 0x140073c33
mov rax, qword [r15 + 0x40]
cmp rax, qword [r14 + 0x80]
jae 0x140073c2f
lea rax, [rbp + 0x120]
cmp byte [r14 + 0x261], 0
mov ecx, 0
cmove rax, rcx
lea r9, [r15 + 0x28]
mov r8, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.1400b5a40
nop
mov rcx, rax
call fcn.1400b69a0
nop
mov rcx, qword [rbp + 8]
call fcn.14036115c
mov rcx, qword [rbp - 8]
call fcn.14036115c
inc qword [r15 + 8]
test byte [r15 + 8], 7
jne 0x140073ce0
cmp byte [rsp + 0x40], 0
je 0x140073ce0
movzx ecx, byte [rsp + 0x64]
call fcn.1400c0320
mov rbx, rax
xor esi, esi
call fcn.14035fc5c
mov rdi, rax
call fcn.14035fc40
cmp rdi, 0x989680
jne 0x140073c74
imul rcx, rax, 0x64
jmp 0x140073c8f
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rcx, rax
mov qword [rsp + 0x68], rcx
test rbx, rbx
jle 0x140073cd4
movabs r9, 0x7fffffffffffffff
imul rdx, rbx, 0x3e8
mov rax, r9
sub rax, rdx
cmp rcx, rax
setl al
test al, al
je 0x140073ccf
lea rax, [rdx + rcx]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
call fcn.14007cf80
jmp 0x140073ce2
mov qword [rsp + 0x68], r9
lea rcx, [rsp + 0x68]
call fcn.14007cf80
jmp 0x140073ce2
xor esi, esi
cmp byte [r15 + 0x51], 0
mov r12d, 0x3c
lea r14, [0x140519368]
je 0x1400737d0
call sub.KERNEL32.dll_SwitchToThread
lea r14, [0x140519368]
jmp 0x1400737d0
movzx eax, byte [r15 + 0x8a0]
imul rcx, rax, 0x268
add rcx, 0x3b0
add rcx, r15
call fcn.1400b6890
mov r12d, 0x3c
xor esi, esi
lea r14, [0x140519368]
mov rcx, r15
call fcn.140073fb0
jmp 0x14007361b
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140361100
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret