Function at 0x140055154
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x858]
sub rsp, 0x958
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x840], rax
xor ebx, ebx
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x58], r8d
mov esi, edx
mov dword [rsp + 0x50], edx
lea rcx, [rbp + 0x440]
xor edx, edx
mov r8d, 0x400
mov r14, r9
mov dword [rbp + 0x438], 0xbe010000
mov word [rbp + 0x43c], bx
mov byte [rbp + 0x43e], 0xff
mov byte [rsp + 0x31], bl
mov byte [rsp + 0x32], bl
mov r13b, bl
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x44], ebx
call fcn.1400ebf40
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x4b0
call fcn.1400ebf40
lea ecx, [rbx + 0x40]
mov edx, 0x4000
mov r15d, ebx
mov edi, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x54], esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400557ca
cmp byte [0x140171c61], bl
lea r12d, [rbx + 8]
lea r8, [0x140000000]
jne 0x14005524b
mov ecx, ebx
lea rdx, [0x14010f200]
movzx eax, byte [rdx]
inc rdx
mov byte [rax + r8 + 0x171c60], cl
inc ecx
cmp ecx, 0x100
jl 0x14005522e
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov edx, dword [rsp + 0x58]
lea eax, [rsi + r12]
cmp eax, edx
jbe 0x14005526b
mov r12d, edx
sub r12d, esi
inc r12d
je 0x1400556ca
test edi, edi
jne 0x140055285
test r15d, r15d
jne 0x140055285
mov eax, esi
sub eax, dword [rsp + 0x54]
cmp eax, 0x10000
ja 0x1400556ca
mov r9, rcx
mov rcx, qword [rsp + 0x78]
mov r8d, r12d
mov edx, esi
call fcn.140056eb4
test eax, eax
je 0x1400557ca
mov dword [rsp + 0x4c], ebx
test r12d, r12d
je 0x1400556b6
mov eax, ebx
mov dword [rsp + 0x48], ebx
test r13b, r13b
jne 0x1400556c6
mov esi, eax
add rsi, qword [rsp + 0x60]
movzx eax, byte [rsi + 0xd]
and eax, 7
mov cl, byte [rax + rsi + 0x14]
and cl, 0x30
cmp cl, 0x10
jne 0x140055688
movzx ecx, byte [rsi + 0x12]
movzx edx, byte [rsi + 0x13]
mov dword [rsp + 0x34], 1
shl ecx, 8
add edx, 0x14
mov r15d, 1
add edx, ecx
lea eax, [rdx - 0x80]
cmp eax, 0x779
ja 0x1400553db
mov ecx, 0x7fa
lea r9, [rsp + 0x3c]
lea r8, [rbp + 0x438]
sub ecx, edx
add edx, 0xffffff80
mov dword [rsp + 0x34], 2
mov eax, ecx
mov byte [rbp + 0x43d], cl
lea rcx, [rsi + 0x80]
shr eax, 8
mov byte [rbp + 0x43c], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140054e30
cmp eax, r15d
jne 0x1400553db
movzx eax, byte [rsi + 0x54]
lea r8, [0x140000000]
lea edi, [r15 + 2]
movzx ecx, byte [rax + r8 + 0x10ed00]
movzx eax, byte [rsi + 0x55]
mov dword [rsp + 0x34], edi
movzx eax, byte [rax + r8 + 0x10ed00]
shl ecx, 9
mov byte [rsp + 0x31], r15b
or ecx, eax
movzx eax, byte [rsi + 0x56]
mov r13b, r15b
xor dword [rsp + 0x3c], ecx
movzx ecx, byte [rax + r8 + 0x10ed00]
movzx eax, byte [rsi + 0x57]
movzx eax, byte [rax + r8 + 0x10ed00]
mov edx, ecx
and ecx, 0x1f
and edx, 0xe0
mov byte [rsp + 0x30], r15b
add edx, edx
or edx, ecx
shl edx, 8
or edx, eax
movzx eax, byte [rsi + 0x58]
movzx eax, byte [rax + r8 + 0x10ed00]
shl edx, 8
or edx, eax
xor dword [rsp + 0x40], edx
jmp 0x14005568c
mov r8, rbx
lea rdx, [rbp + 0x440]
mov r10d, pe_nt_image_headers64
movzx r9d, byte [r8 + rsi]
mov ecx, ebx
mov eax, r10d
sar eax, cl
test r9d, eax
setne al
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, 8
jl 0x1400553f2
inc r8
cmp r8, r10
jl 0x1400553eb
mov r9d, 2
mov r13d, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x70], rbx
lea rdi, [rbp + 0x83d]
mov r11d, r9d
mov r8d, r9d
cmp r9d, 0x400
jge 0x140055466
mov r10, rdi
mov eax, r8d
lea rcx, [rbp + 0x83f]
cdq
idiv r9d
movsxd rax, edx
sub rcx, rax
mov al, byte [r10]
cmp byte [rcx], al
jne 0x140055466
inc r8d
dec r10
cmp r8d, 0x400
jl 0x14005543c
cmp r8d, r13d
jle 0x140055494
cmp r8d, r9d
jle 0x140055494
cmp r8d, 0x70
jle 0x140055494
mov eax, r8d
cdq
idiv r9d
cmp eax, 2
jl 0x140055494
mov r13d, r8d
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x70], r11
mov r8d, r9d
jmp 0x140055499
mov r8d, dword [rsp + 0x38]
inc r9d
inc r11
dec rdi
cmp r9d, 0x180
jl 0x14005542d
test r13d, r13d
jle 0x140055683
mov rdi, qword [rsp + 0x70]
mov r15d, 2
mov r10d, ebx
mov r11, rbx
mov eax, r10d
mov ecx, r10d
cdq
idiv r8d
and ecx, 7
jne 0x1400554f4
movsxd rax, edx
sub rax, rdi
mov cl, byte [rbp + rax + 0x840]
mov rax, r11
shl cl, 7
sar rax, 3
mov byte [rbp + rax + 0x440], cl
jmp 0x140055521
movsxd r8, edx
mov eax, 7
mov r9, r11
sub eax, ecx
sub r8, rdi
sar r9, 3
mov cl, al
mov al, byte [rbp + r8 + 0x840]
mov r8d, dword [rsp + 0x38]
shl al, cl
or byte [rbp + r9 + 0x440], al
inc r10d
inc r11
cmp r10d, 0x50
jl 0x1400554c5
lea rax, [rbp + 0x440]
mov r8, rsi
mov rdx, rbx
sub r8, rax
lea r9, [0x140000000]
lea rcx, [rbp + 0x440]
add rcx, rdx
inc rdx
movzx eax, byte [rcx + r8 + 0x80]
mov al, byte [rax + r9 + 0x10ee00]
xor byte [rcx], al
cmp rdx, 0xa
jl 0x140055544
mov r13, qword [rsp + 0x68]
lea rdi, [rbp - 0x7b]
mov r11d, ebx
lea rax, [r13*2]
add rax, r13
lea rdi, [rdi + rax*4]
mov al, byte [rsp + 0x30]
test al, al
jne 0x14005567e
lea r8, [rbp + 0x430]
lea rdx, [rbp + 0x440]
mov ecx, r11d
call fcn.140054c04
mov r11d, eax
test eax, eax
js 0x14005567e
lea rax, [rbp + 0x430]
mov r8, rsi
mov r15d, 3
sub r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x430]
add rcx, rdx
inc rdx
mov al, byte [rcx + r8 + 0x54]
xor byte [rcx], al
cmp rdx, 5
jl 0x1400555c8
mov r9b, byte [rbp + 0x434]
mov r10d, dword [rbp + 0x430]
mov edx, ebx
mov rcx, rbx
test r13, r13
jle 0x140055619
movsxd rax, edx
lea r8, [rax + rax*2]
cmp dword [rbp + r8*4 - 0x7c], r10d
jne 0x14005560f
cmp byte [rbp + r8*4 - 0x78], r9b
je 0x14005565c
inc rcx
inc edx
cmp rcx, r13
jl 0x1400555fa
mov al, byte [rbp + 0x431]
inc dword [rsp + 0x44]
mov byte [rdi - 1], r10b
mov byte [rdi], al
mov al, byte [rbp + 0x432]
mov byte [rdi + 3], r9b
mov byte [rdi + 1], al
mov al, byte [rbp + 0x433]
inc r13
mov byte [rdi + 2], al
mov al, 1
mov dword [rdi - 5], 1
mov byte [rsp + 0x30], al
mov byte [rsp + 0x32], al
add rdi, 0xc
jmp 0x140055589
lea rax, [rcx + rcx*2]
inc dword [rbp + rax*4 - 0x80]
cmp dword [rbp + rax*4 - 0x80], 1
mov al, byte [rsp + 0x30]
jl 0x140055589
mov al, 1
mov byte [rsp + 0x30], al
jmp 0x140055589
mov qword [rsp + 0x68], r13
mov r13b, byte [rsp + 0x30]
mov edi, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x4c]
mov esi, dword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
inc ecx
inc esi
add eax, 0x800
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x48], eax
cmp ecx, r12d
jb 0x1400552b2
mov rcx, qword [rsp + 0x60]
test r13b, r13b
je 0x140055250
jmp 0x1400556ca
mov edi, dword [rsp + 0x34]
mov al, byte [rsp + 0x31]
test al, al
je 0x140055756
movsxd rdx, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x3c]
lea r8, [0x140000000]
mov rax, rcx
sar rax, 9
mov al, byte [rax + r8 + 0x10ed00]
mov byte [r14], al
movzx eax, cl
mov rcx, rdx
mov al, byte [rax + r8 + 0x10ed00]
sar rcx, 1
mov byte [r14 + 1], al
and ecx, 0xe00000
mov rax, rdx
and eax, 0x1f0000
or rcx, rax
sar rcx, 0x10
mov al, byte [rcx + r8 + 0x10ed00]
mov byte [r14 + 2], al
mov rax, rdx
sar rax, 8
movzx ecx, al
mov al, byte [rcx + r8 + 0x10ed00]
mov byte [r14 + 3], al
movzx eax, dl
mov al, byte [rax + r8 + 0x10ed00]
mov byte [r14 + 4], al
jmp 0x1400557be
cmp byte [rsp + 0x32], bl
je 0x1400557be
movsxd rax, dword [rsp + 0x44]
mov edx, 1
cmp rax, rdx
jle 0x140055790
mov r8, rbx
lea ecx, [rdx + 0xb]
lea r9, [rax - 1]
mov eax, dword [rbp + r8 - 0x80]
cmp dword [rbp + rcx - 0x80], eax
jle 0x140055785
mov ebx, edx
mov r8, rcx
inc edx
add rcx, 0xc
dec r9
jne 0x140055775
movsxd rax, ebx
lea rdx, [rax + rax*2]
mov cl, byte [rbp + rdx*4 - 0x7b]
mov al, byte [rbp + rdx*4 - 0x7c]
mov byte [r14 + 1], cl
mov cl, byte [rbp + rdx*4 - 0x7a]
mov byte [r14], al
mov byte [r14 + 2], cl
mov cl, byte [rbp + rdx*4 - 0x79]
mov byte [r14 + 3], cl
mov cl, byte [rbp + rdx*4 - 0x78]
mov byte [r14 + 4], cl
cmp edi, r15d
cmovg r15d, edi
mov eax, r15d
jmp 0x1400557cd
or eax, 0xffffffff
mov rcx, qword [rbp + 0x840]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x958
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret