Function at 0x140079e30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140518628]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r13, rcx
mov r12d, 0xffff0000
movabs r14, 0x7ffffffffeced2ff
mov ebx, 0x3c
movabs rdi, 0x7fffffffffffffff
mov rax, qword [0x140519368]
test rax, rax
je 0x14007a877
movzx eax, byte [0x140519351]
test al, al
je 0x140079f41
nop dword [rax]
call fcn.14035fc5c
mov rbx, rax
call fcn.14035fc40
cmp rbx, 0x989680
jne 0x140079ecc
imul rax, rax, 0x64
jmp 0x140079ee7
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
setl cl
test cl, cl
je 0x140079efe
add rax, 0x1312d00
mov qword [rsp + 0x48], rax
jmp 0x140079f03
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x48]
call fcn.14007cf80
movzx eax, byte [0x140519351]
test al, al
je 0x140079f24
mov rax, qword [0x140519368]
test rax, rax
jne 0x140079eb0
mov rax, qword [0x140519368]
test rax, rax
je 0x14007a877
mov rcx, r13
call fcn.14007ab60
mov ebx, 0x3c
mov rcx, qword [0x1407b7548]
test rcx, rcx
jne 0x140079f6d
mov ecx, 0x110
call fcn.140361120
mov qword [rbp - 0x50], rax
mov rcx, rax
call fcn.14007d300
mov rcx, rax
mov qword [0x1407b7548], rax
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, rax
xorps xmm6, xmm6
test rax, rax
js 0x140079f88
cvtsi2sd xmm6, rax
jmp 0x140079f9a
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm6, rax
addsd xmm6, xmm6
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x28]
mov rcx, rax
imul rcx, qword [r13 + 0x148]
xorps xmm0, xmm0
test rcx, rcx
js 0x140079fbe
cvtsi2sd xmm0, rcx
jmp 0x140079fd3
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
divsd xmm6, xmm0
mov eax, dword [r13 + 0x138]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
cvttsd2si ecx, xmm0
mov dword [rsp + 0x70], ecx
dec eax
cmp eax, 0x62
ja 0x14007a003
cmp ecx, 0x64
mov byte [rsp + 0x60], 1
jl 0x14007a008
mov byte [rsp + 0x60], 0
mov r14b, 1
mov byte [rsp + 0x50], r14b
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
nop
mov rcx, qword [r13 + 0x2000]
mov rax, qword [0x140519368]
cmp rax, rcx
jne 0x14007a86a
lea rsi, [r13 + 0x198]
movzx eax, byte [rsi + 0x1e70]
imul rcx, rax, 0x268
lea r15, [rsi + 0x1980]
add r15, rcx
movzx ecx, byte [r13 + 0x12a]
mov edx, 1
shl rdx, cl
movzx ecx, byte [r15 + 2]
mov eax, 1
shl rax, cl
cmp rax, rdx
jne 0x14007a86a
movzx r8d, byte [rsi + 0x1e70]
imul r9, r8, 0x268
mov edx, dword [r9 + rsi + 0x1980]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a0c9
mov eax, 0x20
jmp 0x14007a0f6
cmp ecx, 0x6c000000
jne 0x14007a0d8
mov eax, 0x4c
jmp 0x14007a0f6
cmp edx, 0x72151279
jne 0x14007a0e7
mov eax, 0x93
jmp 0x14007a0f6
mov eax, 0x27
cmp edx, 0x72151278
cmove rax, rbx
imul r10, r8, 0xcc0
add rax, r10
mov ecx, dword [rax + rsi]
mov dword [rbp + 0xe0], ecx
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a12f
mov eax, 0x20
jmp 0x14007a15c
cmp ecx, 0x6c000000
jne 0x14007a13e
mov eax, 0x4c
jmp 0x14007a15c
cmp edx, 0x72151279
jne 0x14007a14d
mov eax, 0x93
jmp 0x14007a15c
mov eax, 0x27
cmp edx, 0x72151278
cmove rax, rbx
mov r8, qword [r9 + rsi + 0x19a0]
add rax, r10
add rax, r8
mov eax, dword [rax + rsi]
mov dword [rbp + 0xe4], eax
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a199
mov eax, 0x20
jmp 0x14007a1c6
cmp ecx, 0x6c000000
jne 0x14007a1a8
mov eax, 0x4c
jmp 0x14007a1c6
cmp edx, 0x72151279
jne 0x14007a1b7
mov eax, 0x93
jmp 0x14007a1c6
mov eax, 0x27
cmp edx, 0x72151278
cmove rax, rbx
lea rax, [rax + r8*2]
add rax, r10
mov eax, dword [rax + rsi]
mov dword [rbp + 0xe8], eax
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a1fc
mov eax, 0x20
jmp 0x14007a229
cmp ecx, 0x6c000000
jne 0x14007a20b
mov eax, 0x4c
jmp 0x14007a229
cmp edx, 0x72151279
jne 0x14007a21a
mov eax, 0x93
jmp 0x14007a229
mov eax, 0x27
cmp edx, 0x72151278
cmove rax, rbx
lea rcx, [rax + r8*2]
add rcx, r8
add rcx, r10
mov eax, dword [rcx + rsi]
mov dword [rbp + 0xec], eax
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a262
mov eax, 0x20
jmp 0x14007a28f
cmp ecx, 0x6c000000
jne 0x14007a271
mov eax, 0x4c
jmp 0x14007a28f
cmp edx, 0x72151279
jne 0x14007a280
mov eax, 0x93
jmp 0x14007a28f
mov eax, 0x27
cmp edx, 0x72151278
cmove rax, rbx
lea rax, [rax + r8*4]
add rax, r10
mov eax, dword [rax + rsi]
mov dword [rbp + 0xf0], eax
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a2c5
mov eax, 0x20
jmp 0x14007a2f2
cmp ecx, 0x6c000000
jne 0x14007a2d4
mov eax, 0x4c
jmp 0x14007a2f2
cmp edx, 0x72151279
jne 0x14007a2e3
mov eax, 0x93
jmp 0x14007a2f2
mov eax, 0x27
cmp edx, 0x72151278
cmove rax, rbx
lea rcx, [rax + r8*4]
add rcx, r8
add rcx, r10
mov eax, dword [rcx + rsi]
mov dword [rbp + 0xf4], eax
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a32b
mov ecx, 0x20
jmp 0x14007a358
cmp ecx, 0x6c000000
jne 0x14007a33a
mov ecx, 0x4c
jmp 0x14007a358
cmp edx, 0x72151279
jne 0x14007a349
mov ecx, 0x93
jmp 0x14007a358
mov ecx, 0x27
cmp edx, 0x72151278
cmove rcx, rbx
lea rax, [r8 + r8*2]
lea rcx, [rcx + rax*2]
add rcx, r10
mov eax, dword [rcx + rsi]
mov dword [rbp + 0xf8], eax
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a392
mov ecx, 0x20
jmp 0x14007a3bf
cmp ecx, 0x6c000000
jne 0x14007a3a1
mov ecx, 0x4c
jmp 0x14007a3bf
cmp edx, 0x72151279
jne 0x14007a3b0
mov ecx, 0x93
jmp 0x14007a3bf
mov ecx, 0x27
cmp edx, 0x72151278
cmove rcx, rbx
imul rax, r8, 7
add rax, rcx
add rax, r10
mov eax, dword [rax + rsi]
mov dword [rbp + 0xfc], eax
mov r10d, 8
movzx eax, byte [rsi + 0x1e70]
imul rcx, rax, 0x268
mov edx, dword [rcx + rsi + 0x1980]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007a412
lea r9d, [r10 + 0x18]
jmp 0x14007a442
cmp ecx, 0x6c000000
jne 0x14007a422
mov r9d, 0x4c
jmp 0x14007a442
cmp edx, 0x72151279
jne 0x14007a432
mov r9d, 0x93
jmp 0x14007a442
mov r9d, 0x27
cmp edx, 0x72151278
cmove r9, rbx
movzx eax, byte [rsi + 0x1e70]
imul rcx, rax, 0x268
mov edx, dword [rcx + rsi + 0x1980]
mov eax, edx
and eax, 0xff000000
mov r8d, 0xff000000
cmp eax, 0x63000000
cmove r8d, r12d
and r8d, edx
mov ecx, 4
cmp r8d, 0x6b000000
cmove rcx, r10
movzx eax, byte [rsi + 0x1e70]
imul rdi, rax, 0xcc0
lea rax, [r9 + rcx]
add rdi, rax
add rdi, rsi
mov edx, dword [r15]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
cmp ecx, 0x72000000
jne 0x14007a651
test r14b, r14b
je 0x14007a530
mov byte [rsp + 0x50], 0
cmp byte [r15 + 0x261], 0
je 0x14007a4f2
movzx eax, byte [rsi + 0x1e70]
imul rdx, rax, 0xcc0
add rdx, rsi
mov r9, rdi
mov r8, qword [r15 + 0x20]
mov rcx, r15
call fcn.14003b510
movzx eax, byte [rsi + 0x1e70]
imul r8, rax, 0xcc0
add r8, rsi
mov rbx, qword [r13 + 0x2010]
mov r9, qword [r15 + 0x20]
mov edx, 0x40
lea rcx, [rbp + 0x100]
call qword [case.0x14017977d.0]
mov rax, qword [rbx]
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, rsi
call fcn.14007b4d0
test al, al
je 0x14007a84c
cmp byte [r15 + 0x261], 0
je 0x14007a595
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rdi + 0x10]
movaps xmmword [rbp + 0x150], xmm1
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rbp + 0x160], xmm0
movups xmm1, xmmword [rdi + 0x30]
movaps xmmword [rbp + 0x170], xmm1
movzx eax, byte [rsi + 0x1e70]
imul rdx, rax, 0xcc0
add rdx, rsi
mov r9, rdi
mov r8, qword [r15 + 0x20]
mov rcx, r15
call fcn.14003b510
mov r12, qword [r15 + 0x20]
movzx eax, byte [rsi + 0x1e70]
imul r14, rax, 0xcc0
add r14, rsi
mov rbx, qword [r13 + 0x2010]
mov dword [rsp + 0x68], 0x9fc0
ldmxcsr dword [rsp + 0x68]
xor esi, esi
mov edi, esi
cmp dword [0x1407b69ec], 1
je 0x14007a60d
nop dword [rax + rax]
mov rax, qword [rbx]
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [rax + gethostname]
mov r9d, 0x100
lea r8, [rbx + 0x980]
mov edx, 0x40
lea rcx, [rbp + 0x100]
call qword [case.0x14017977d.0]
inc edi
mov eax, dword [0x1407b69ec]
dec eax
cmp edi, eax
jb 0x14007a5d0
mov rax, qword [rbx]
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [rax + gethostname]
mov r9, r12
mov r8, r14
mov edx, 0x40
lea rcx, [rbp + 0x100]
call qword [case.0x14017977d.0]
lea rdi, [r13 + 0x28]
mov rax, qword [rbx]
lea r8, [rbp + 0x100]
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x18]
jmp 0x14007a70c
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r12d
and ecx, edx
movzx eax, byte [rsi + 0x1e70]
cmp ecx, 0x6c000000
je 0x14007a6b9
imul rbx, rax, 0xcc0
add rbx, rsi
mov r8d, dword [r13 + 0x12c]
mov edx, dword [r13 + 0x134]
mov rcx, r15
call fcn.1400cb060
lea rdi, [r13 + 0x28]
lea r9, [r13 + 0x150]
mov rdx, qword [r15 + 0x78]
mov qword [rsp + 0x20], rdx
mov r8, rdi
mov rdx, qword [r15 + 0x20]
mov rcx, rbx
call rax
jmp 0x14007a6fa
lea rdi, [r13 + 0x28]
lea r9, [r13 + 0x150]
mov byte [rsp + 0x28], 1
mov r8, rdi
imul rcx, rax, 0xcc0
add rcx, rsi
mov rax, qword [r13 + 0x2018]
mov qword [rsp + 0x20], rax
cmp edx, 0x6c15006d
mov rdx, qword [r15 + 0x20]
je 0x14007a6f5
call fcn.1401b4050
jmp 0x14007a6fa
call fcn.1401b3060
mov rcx, rsi
call fcn.14007b4d0
test al, al
je 0x14007a84c
xor esi, esi
mov rbx, rsi
nop
mov rax, qword [rdi + 0x18]
cmp rax, qword [r15 + 0x80]
jae 0x14007a772
lea rax, [rbp + 0x140]
cmp byte [r15 + 0x261], 0
cmove rax, rsi
mov r8d, dword [rbp + rbx*4 + 0xe0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov rdx, r15
lea rcx, [rbp - 0x10]
call fcn.1400b5a40
nop
mov rcx, rax
call fcn.1400b69a0
nop
mov rcx, qword [rbp + 8]
call fcn.14036115c
mov rcx, qword [rbp - 8]
call fcn.14036115c
inc rbx
add rdi, 0x20
cmp rbx, 8
jb 0x14007a710
add qword [r13 + 8], 8
test byte [r13 + 8], 7
jne 0x14007a823
cmp byte [rsp + 0x60], 0
je 0x14007a823
movzx ecx, byte [rsp + 0x70]
call fcn.1400c0320
mov rbx, rax
call fcn.14035fc5c
mov rdi, rax
call fcn.14035fc40
cmp rdi, 0x989680
jne 0x14007a7c3
imul rcx, rax, 0x64
jmp 0x14007a7de
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rcx, rax
mov qword [rsp + 0x58], rcx
test rbx, rbx
jle 0x14007a819
movabs r9, 0x7fffffffffffffff
imul rdx, rbx, 0x3e8
mov rax, r9
sub rax, rdx
cmp rcx, rax
setl al
test al, al
je 0x14007a814
lea rax, [rcx + rdx]
mov qword [rsp + 0x58], rax
jmp 0x14007a819
mov qword [rsp + 0x58], r9
lea rcx, [rsp + 0x58]
call fcn.14007cf80
cmp byte [r13 + 0x131], 0
movzx r14d, byte [rsp + 0x50]
mov ebx, 0x3c
mov r12d, 0xffff0000
je 0x14007a030
call sub.KERNEL32.dll_SwitchToThread
jmp 0x14007a030
movzx eax, byte [r13 + 0x2008]
imul rcx, rax, 0x268
add rcx, 0x1b18
add rcx, r13
call fcn.1400b6890
mov rcx, r13
call fcn.14007ab60
jmp 0x140079e74
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140361100
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret