Function at 0x140055058
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x858]
sub rsp, 0x958
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x840], rax
xor ebx, ebx
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x58], r8d
mov esi, edx
mov dword [rsp + 0x50], edx
lea rcx, [rbp + 0x440]
xor edx, edx
mov r8d, 0x400
mov r14, r9
mov dword [rbp + 0x438], 0xbe010000
mov word [rbp + 0x43c], bx
mov byte [rbp + 0x43e], 0xff
mov byte [rsp + 0x31], bl
mov byte [rsp + 0x32], bl
mov r13b, bl
mov byte [rsp + 0x30], bl
mov dword [rsp + 0x44], ebx
call fcn.1400ebf40
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x4b0
call fcn.1400ebf40
lea ecx, [rbx + 0x40]
mov edx, 0x4000
mov r15d, ebx
mov edi, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x54], esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400556ce
cmp byte [0x140171c61], bl
lea r12d, [rbx + 8]
lea r8, [0x140000000]
jne 0x14005514f
mov ecx, ebx
lea rdx, [0x14010f200]
movzx eax, byte [rdx]
inc rdx
mov byte [rax + r8 + 0x171c60], cl
inc ecx
cmp ecx, 0x100
jl 0x140055132
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov edx, dword [rsp + 0x58]
lea eax, [rsi + r12]
cmp eax, edx
jbe 0x14005516f
mov r12d, edx
sub r12d, esi
inc r12d
je 0x1400555ce
test edi, edi
jne 0x140055189
test r15d, r15d
jne 0x140055189
mov eax, esi
sub eax, dword [rsp + 0x54]
cmp eax, 0x10000
ja 0x1400555ce
mov r9, rcx
mov rcx, qword [rsp + 0x78]
mov r8d, r12d
mov edx, esi
call fcn.140056db8
test eax, eax
je 0x1400556ce
mov dword [rsp + 0x4c], ebx
test r12d, r12d
je 0x1400555ba
mov eax, ebx
mov dword [rsp + 0x48], ebx
test r13b, r13b
jne 0x1400555ca
mov esi, eax
add rsi, qword [rsp + 0x60]
movzx eax, byte [rsi + 0xd]
and eax, 7
mov cl, byte [rax + rsi + 0x14]
and cl, 0x30
cmp cl, 0x10
jne 0x14005558c
movzx ecx, byte [rsi + 0x12]
movzx edx, byte [rsi + 0x13]
mov dword [rsp + 0x34], 1
shl ecx, 8
add edx, 0x14
mov r15d, 1
add edx, ecx
lea eax, [rdx - 0x80]
cmp eax, 0x779
ja 0x1400552df
mov ecx, 0x7fa
lea r9, [rsp + 0x3c]
lea r8, [rbp + 0x438]
sub ecx, edx
add edx, 0xffffff80
mov dword [rsp + 0x34], 2
mov eax, ecx
mov byte [rbp + 0x43d], cl
lea rcx, [rsi + 0x80]
shr eax, 8
mov byte [rbp + 0x43c], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140054d34
cmp eax, r15d
jne 0x1400552df
movzx eax, byte [rsi + 0x54]
lea r8, [0x140000000]
lea edi, [r15 + 2]
movzx ecx, byte [rax + r8 + 0x10ed00]
movzx eax, byte [rsi + 0x55]
mov dword [rsp + 0x34], edi
movzx eax, byte [rax + r8 + 0x10ed00]
shl ecx, 9
mov byte [rsp + 0x31], r15b
or ecx, eax
movzx eax, byte [rsi + 0x56]
mov r13b, r15b
xor dword [rsp + 0x3c], ecx
movzx ecx, byte [rax + r8 + 0x10ed00]
movzx eax, byte [rsi + 0x57]
movzx eax, byte [rax + r8 + 0x10ed00]
mov edx, ecx
and ecx, 0x1f
and edx, 0xe0
mov byte [rsp + 0x30], r15b
add edx, edx
or edx, ecx
shl edx, 8
or edx, eax
movzx eax, byte [rsi + 0x58]
movzx eax, byte [rax + r8 + 0x10ed00]
shl edx, 8
or edx, eax
xor dword [rsp + 0x40], edx
jmp 0x140055590
mov r8, rbx
lea rdx, [rbp + 0x440]
mov r10d, pe_nt_image_headers64
movzx r9d, byte [r8 + rsi]
mov ecx, ebx
mov eax, r10d
sar eax, cl
test r9d, eax
setne al
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, 8
jl 0x1400552f6
inc r8
cmp r8, r10
jl 0x1400552ef
mov r9d, 2
mov r13d, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x70], rbx
lea rdi, [rbp + 0x83d]
mov r11d, r9d
mov r8d, r9d
cmp r9d, 0x400
jge 0x14005536a
mov r10, rdi
mov eax, r8d
lea rcx, [rbp + 0x83f]
cdq
idiv r9d
movsxd rax, edx
sub rcx, rax
mov al, byte [r10]
cmp byte [rcx], al
jne 0x14005536a
inc r8d
dec r10
cmp r8d, 0x400
jl 0x140055340
cmp r8d, r13d
jle 0x140055398
cmp r8d, r9d
jle 0x140055398
cmp r8d, 0x70
jle 0x140055398
mov eax, r8d
cdq
idiv r9d
cmp eax, 2
jl 0x140055398
mov r13d, r8d
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x70], r11
mov r8d, r9d
jmp 0x14005539d
mov r8d, dword [rsp + 0x38]
inc r9d
inc r11
dec rdi
cmp r9d, 0x180
jl 0x140055331
test r13d, r13d
jle 0x140055587
mov rdi, qword [rsp + 0x70]
mov r15d, 2
mov r10d, ebx
mov r11, rbx
mov eax, r10d
mov ecx, r10d
cdq
idiv r8d
and ecx, 7
jne 0x1400553f8
movsxd rax, edx
sub rax, rdi
mov cl, byte [rbp + rax + 0x840]
mov rax, r11
shl cl, 7
sar rax, 3
mov byte [rbp + rax + 0x440], cl
jmp 0x140055425
movsxd r8, edx
mov eax, 7
mov r9, r11
sub eax, ecx
sub r8, rdi
sar r9, 3
mov cl, al
mov al, byte [rbp + r8 + 0x840]
mov r8d, dword [rsp + 0x38]
shl al, cl
or byte [rbp + r9 + 0x440], al
inc r10d
inc r11
cmp r10d, 0x50
jl 0x1400553c9
lea rax, [rbp + 0x440]
mov r8, rsi
mov rdx, rbx
sub r8, rax
lea r9, [0x140000000]
lea rcx, [rbp + 0x440]
add rcx, rdx
inc rdx
movzx eax, byte [rcx + r8 + 0x80]
mov al, byte [rax + r9 + 0x10ee00]
xor byte [rcx], al
cmp rdx, 0xa
jl 0x140055448
mov r13, qword [rsp + 0x68]
lea rdi, [rbp - 0x7b]
mov r11d, ebx
lea rax, [r13*2]
add rax, r13
lea rdi, [rdi + rax*4]
mov al, byte [rsp + 0x30]
test al, al
jne 0x140055582
lea r8, [rbp + 0x430]
lea rdx, [rbp + 0x440]
mov ecx, r11d
call fcn.140054b08
mov r11d, eax
test eax, eax
js 0x140055582
lea rax, [rbp + 0x430]
mov r8, rsi
mov r15d, 3
sub r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x430]
add rcx, rdx
inc rdx
mov al, byte [rcx + r8 + 0x54]
xor byte [rcx], al
cmp rdx, 5
jl 0x1400554cc
mov r9b, byte [rbp + 0x434]
mov r10d, dword [rbp + 0x430]
mov edx, ebx
mov rcx, rbx
test r13, r13
jle 0x14005551d
movsxd rax, edx
lea r8, [rax + rax*2]
cmp dword [rbp + r8*4 - 0x7c], r10d
jne 0x140055513
cmp byte [rbp + r8*4 - 0x78], r9b
je 0x140055560
inc rcx
inc edx
cmp rcx, r13
jl 0x1400554fe
mov al, byte [rbp + 0x431]
inc dword [rsp + 0x44]
mov byte [rdi - 1], r10b
mov byte [rdi], al
mov al, byte [rbp + 0x432]
mov byte [rdi + 3], r9b
mov byte [rdi + 1], al
mov al, byte [rbp + 0x433]
inc r13
mov byte [rdi + 2], al
mov al, 1
mov dword [rdi - 5], 1
mov byte [rsp + 0x30], al
mov byte [rsp + 0x32], al
add rdi, 0xc
jmp 0x14005548d
lea rax, [rcx + rcx*2]
inc dword [rbp + rax*4 - 0x80]
cmp dword [rbp + rax*4 - 0x80], 1
mov al, byte [rsp + 0x30]
jl 0x14005548d
mov al, 1
mov byte [rsp + 0x30], al
jmp 0x14005548d
mov qword [rsp + 0x68], r13
mov r13b, byte [rsp + 0x30]
mov edi, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x4c]
mov esi, dword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
inc ecx
inc esi
add eax, 0x800
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x48], eax
cmp ecx, r12d
jb 0x1400551b6
mov rcx, qword [rsp + 0x60]
test r13b, r13b
je 0x140055154
jmp 0x1400555ce
mov edi, dword [rsp + 0x34]
mov al, byte [rsp + 0x31]
test al, al
je 0x14005565a
movsxd rdx, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x3c]
lea r8, [0x140000000]
mov rax, rcx
sar rax, 9
mov al, byte [rax + r8 + 0x10ed00]
mov byte [r14], al
movzx eax, cl
mov rcx, rdx
mov al, byte [rax + r8 + 0x10ed00]
sar rcx, 1
mov byte [r14 + 1], al
and ecx, 0xe00000
mov rax, rdx
and eax, 0x1f0000
or rcx, rax
sar rcx, 0x10
mov al, byte [rcx + r8 + 0x10ed00]
mov byte [r14 + 2], al
mov rax, rdx
sar rax, 8
movzx ecx, al
mov al, byte [rcx + r8 + 0x10ed00]
mov byte [r14 + 3], al
movzx eax, dl
mov al, byte [rax + r8 + 0x10ed00]
mov byte [r14 + 4], al
jmp 0x1400556c2
cmp byte [rsp + 0x32], bl
je 0x1400556c2
movsxd rax, dword [rsp + 0x44]
mov edx, 1
cmp rax, rdx
jle 0x140055694
mov r8, rbx
lea ecx, [rdx + 0xb]
lea r9, [rax - 1]
mov eax, dword [rbp + r8 - 0x80]
cmp dword [rbp + rcx - 0x80], eax
jle 0x140055689
mov ebx, edx
mov r8, rcx
inc edx
add rcx, 0xc
dec r9
jne 0x140055679
movsxd rax, ebx
lea rdx, [rax + rax*2]
mov cl, byte [rbp + rdx*4 - 0x7b]
mov al, byte [rbp + rdx*4 - 0x7c]
mov byte [r14 + 1], cl
mov cl, byte [rbp + rdx*4 - 0x7a]
mov byte [r14], al
mov byte [r14 + 2], cl
mov cl, byte [rbp + rdx*4 - 0x79]
mov byte [r14 + 3], cl
mov cl, byte [rbp + rdx*4 - 0x78]
mov byte [r14 + 4], cl
cmp edi, r15d
cmovg r15d, edi
mov eax, r15d
jmp 0x1400556d1
or eax, 0xffffffff
mov rcx, qword [rbp + 0x840]
xor rcx, rsp
call fcn.1400e8bc0
add rsp, 0x958
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret