Function at 0x1400542e0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x858]
sub rsp, 0x958
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x840], rax
xor ebx, ebx
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x58], r8d
mov esi, edx
mov dword [rsp + 0x50], edx
lea rcx, [rbp + 0x440]
xor edx, edx
mov r8d, 0x400
mov r14, r9
mov dword [rbp + 0x438], 0xbe010000
mov word [rbp + 0x43c], bx
mov byte [rbp + 0x43e], 0xff
mov byte [rsp + 0x31], bl
mov byte [rsp + 0x32], bl
mov r13b, bl
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x44], ebx
call fcn.1400ea570
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x4b0
call fcn.1400ea570
lea ecx, [rbx + 0x40]
mov edx, 0x4000
mov r15d, ebx
mov edi, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x54], esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140054956
cmp byte [0x140170841], bl
lea r12d, [rbx + 8]
lea r8, [0x140000000]
jne 0x1400543d7
mov ecx, ebx
lea rdx, [0x14010e200]
movzx eax, byte [rdx]
inc rdx
mov byte [rax + r8 + 0x170840], cl
inc ecx
cmp ecx, 0x100
jl 0x1400543ba
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov edx, dword [rsp + 0x58]
lea eax, [rsi + r12]
cmp eax, edx
jbe 0x1400543f7
mov r12d, edx
sub r12d, esi
inc r12d
je 0x140054856
test edi, edi
jne 0x140054411
test r15d, r15d
jne 0x140054411
mov eax, esi
sub eax, dword [rsp + 0x54]
cmp eax, 0x10000
ja 0x140054856
mov r9, rcx
mov rcx, qword [rsp + 0x78]
mov r8d, r12d
mov edx, esi
call fcn.140056708
test eax, eax
je 0x140054956
mov dword [rsp + 0x4c], ebx
test r12d, r12d
je 0x140054842
mov eax, ebx
mov dword [rsp + 0x48], ebx
test r13b, r13b
jne 0x140054852
mov esi, eax
add rsi, qword [rsp + 0x60]
movzx eax, byte [rsi + 0xd]
and eax, 7
mov cl, byte [rax + rsi + 0x14]
and cl, 0x30
cmp cl, 0x10
jne 0x140054814
movzx ecx, byte [rsi + 0x12]
movzx edx, byte [rsi + 0x13]
mov dword [rsp + 0x34], 1
shl ecx, 8
add edx, 0x14
mov r15d, 1
add edx, ecx
lea eax, [rdx - 0x80]
cmp eax, 0x779
ja 0x140054567
mov ecx, 0x7fa
lea r9, [rsp + 0x3c]
lea r8, [rbp + 0x438]
sub ecx, edx
add edx, 0xffffff80
mov dword [rsp + 0x34], 2
mov eax, ecx
mov byte [rbp + 0x43d], cl
lea rcx, [rsi + 0x80]
shr eax, 8
mov byte [rbp + 0x43c], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140053fbc
cmp eax, r15d
jne 0x140054567
movzx eax, byte [rsi + 0x54]
lea r8, [0x140000000]
lea edi, [r15 + 2]
movzx ecx, byte [rax + r8 + 0x10dd00]
movzx eax, byte [rsi + 0x55]
mov dword [rsp + 0x34], edi
movzx eax, byte [rax + r8 + 0x10dd00]
shl ecx, 9
mov byte [rsp + 0x31], r15b
or ecx, eax
movzx eax, byte [rsi + 0x56]
mov r13b, r15b
xor dword [rsp + 0x3c], ecx
movzx ecx, byte [rax + r8 + 0x10dd00]
movzx eax, byte [rsi + 0x57]
movzx eax, byte [rax + r8 + 0x10dd00]
mov edx, ecx
and ecx, 0x1f
and edx, 0xe0
mov byte [rsp + 0x30], r15b
add edx, edx
or edx, ecx
shl edx, 8
or edx, eax
movzx eax, byte [rsi + 0x58]
movzx eax, byte [rax + r8 + 0x10dd00]
shl edx, 8
or edx, eax
xor dword [rsp + 0x40], edx
jmp 0x140054818
mov r8, rbx
lea rdx, [rbp + 0x440]
mov r10d, pe_nt_image_headers64
movzx r9d, byte [r8 + rsi]
mov ecx, ebx
mov eax, r10d
sar eax, cl
test r9d, eax
setne al
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, 8
jl 0x14005457e
inc r8
cmp r8, r10
jl 0x140054577
mov r9d, 2
mov r13d, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x70], rbx
lea rdi, [rbp + 0x83d]
mov r11d, r9d
mov r8d, r9d
cmp r9d, 0x400
jge 0x1400545f2
mov r10, rdi
mov eax, r8d
lea rcx, [rbp + 0x83f]
cdq
idiv r9d
movsxd rax, edx
sub rcx, rax
mov al, byte [r10]
cmp byte [rcx], al
jne 0x1400545f2
inc r8d
dec r10
cmp r8d, 0x400
jl 0x1400545c8
cmp r8d, r13d
jle 0x140054620
cmp r8d, r9d
jle 0x140054620
cmp r8d, 0x70
jle 0x140054620
mov eax, r8d
cdq
idiv r9d
cmp eax, 2
jl 0x140054620
mov r13d, r8d
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x70], r11
mov r8d, r9d
jmp 0x140054625
mov r8d, dword [rsp + 0x38]
inc r9d
inc r11
dec rdi
cmp r9d, 0x180
jl 0x1400545b9
test r13d, r13d
jle 0x14005480f
mov rdi, qword [rsp + 0x70]
mov r15d, 2
mov r10d, ebx
mov r11, rbx
mov eax, r10d
mov ecx, r10d
cdq
idiv r8d
and ecx, 7
jne 0x140054680
movsxd rax, edx
sub rax, rdi
mov cl, byte [rbp + rax + 0x840]
mov rax, r11
shl cl, 7
sar rax, 3
mov byte [rbp + rax + 0x440], cl
jmp 0x1400546ad
movsxd r8, edx
mov eax, 7
mov r9, r11
sub eax, ecx
sub r8, rdi
sar r9, 3
mov cl, al
mov al, byte [rbp + r8 + 0x840]
mov r8d, dword [rsp + 0x38]
shl al, cl
or byte [rbp + r9 + 0x440], al
inc r10d
inc r11
cmp r10d, 0x50
jl 0x140054651
lea rax, [rbp + 0x440]
mov r8, rsi
mov rdx, rbx
sub r8, rax
lea r9, [0x140000000]
lea rcx, [rbp + 0x440]
add rcx, rdx
inc rdx
movzx eax, byte [rcx + r8 + 0x80]
mov al, byte [rax + r9 + 0x10de00]
xor byte [rcx], al
cmp rdx, 0xa
jl 0x1400546d0
mov r13, qword [rsp + 0x68]
lea rdi, [rbp - 0x7b]
mov r11d, ebx
lea rax, [r13*2]
add rax, r13
lea rdi, [rdi + rax*4]
mov al, byte [rsp + 0x30]
test al, al
jne 0x14005480a
lea r8, [rbp + 0x430]
lea rdx, [rbp + 0x440]
mov ecx, r11d
call fcn.140053d90
mov r11d, eax
test eax, eax
js 0x14005480a
lea rax, [rbp + 0x430]
mov r8, rsi
mov r15d, 3
sub r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x430]
add rcx, rdx
inc rdx
mov al, byte [rcx + r8 + 0x54]
xor byte [rcx], al
cmp rdx, 5
jl 0x140054754
mov r9b, byte [rbp + 0x434]
mov r10d, dword [rbp + 0x430]
mov edx, ebx
mov rcx, rbx
test r13, r13
jle 0x1400547a5
movsxd rax, edx
lea r8, [rax + rax*2]
cmp dword [rbp + r8*4 - 0x7c], r10d
jne 0x14005479b
cmp byte [rbp + r8*4 - 0x78], r9b
je 0x1400547e8
inc rcx
inc edx
cmp rcx, r13
jl 0x140054786
mov al, byte [rbp + 0x431]
inc dword [rsp + 0x44]
mov byte [rdi - 1], r10b
mov byte [rdi], al
mov al, byte [rbp + 0x432]
mov byte [rdi + 3], r9b
mov byte [rdi + 1], al
mov al, byte [rbp + 0x433]
inc r13
mov byte [rdi + 2], al
mov al, 1
mov dword [rdi - 5], 1
mov byte [rsp + 0x30], al
mov byte [rsp + 0x32], al
add rdi, 0xc
jmp 0x140054715
lea rax, [rcx + rcx*2]
inc dword [rbp + rax*4 - 0x80]
cmp dword [rbp + rax*4 - 0x80], 1
mov al, byte [rsp + 0x30]
jl 0x140054715
mov al, 1
mov byte [rsp + 0x30], al
jmp 0x140054715
mov qword [rsp + 0x68], r13
mov r13b, byte [rsp + 0x30]
mov edi, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x4c]
mov esi, dword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
inc ecx
inc esi
add eax, 0x800
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x48], eax
cmp ecx, r12d
jb 0x14005443e
mov rcx, qword [rsp + 0x60]
test r13b, r13b
je 0x1400543dc
jmp 0x140054856
mov edi, dword [rsp + 0x34]
mov al, byte [rsp + 0x31]
test al, al
je 0x1400548e2
movsxd rdx, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x3c]
lea r8, [0x140000000]
mov rax, rcx
sar rax, 9
mov al, byte [rax + r8 + 0x10dd00]
mov byte [r14], al
movzx eax, cl
mov rcx, rdx
mov al, byte [rax + r8 + 0x10dd00]
sar rcx, 1
mov byte [r14 + 1], al
and ecx, 0xe00000
mov rax, rdx
and eax, 0x1f0000
or rcx, rax
sar rcx, 0x10
mov al, byte [rcx + r8 + 0x10dd00]
mov byte [r14 + 2], al
mov rax, rdx
sar rax, 8
movzx ecx, al
mov al, byte [rcx + r8 + 0x10dd00]
mov byte [r14 + 3], al
movzx eax, dl
mov al, byte [rax + r8 + 0x10dd00]
mov byte [r14 + 4], al
jmp 0x14005494a
cmp byte [rsp + 0x32], bl
je 0x14005494a
movsxd rax, dword [rsp + 0x44]
mov edx, 1
cmp rax, rdx
jle 0x14005491c
mov r8, rbx
lea ecx, [rdx + 0xb]
lea r9, [rax - 1]
mov eax, dword [rbp + r8 - 0x80]
cmp dword [rbp + rcx - 0x80], eax
jle 0x140054911
mov ebx, edx
mov r8, rcx
inc edx
add rcx, 0xc
dec r9
jne 0x140054901
movsxd rax, ebx
lea rdx, [rax + rax*2]
mov cl, byte [rbp + rdx*4 - 0x7b]
mov al, byte [rbp + rdx*4 - 0x7c]
mov byte [r14 + 1], cl
mov cl, byte [rbp + rdx*4 - 0x7a]
mov byte [r14], al
mov byte [r14 + 2], cl
mov cl, byte [rbp + rdx*4 - 0x79]
mov byte [r14 + 3], cl
mov cl, byte [rbp + rdx*4 - 0x78]
mov byte [r14 + 4], cl
cmp edi, r15d
cmovg r15d, edi
mov eax, r15d
jmp 0x140054959
or eax, 0xffffffff
mov rcx, qword [rbp + 0x840]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x958
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret