Function at 0x140130800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14025d030]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], 0xc0001
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea rdx, [0x1401e8131]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.1400dab60
test eax, eax
jne 0x140130202
cmp rbx, rdi
jae 0x140130202
movzx r8d, byte [rbx]
lea rdx, str._02x:
lea rcx, [rsp + 0x20]
inc rbx
call fcn.1400dad50
test eax, eax
je 0x1401301e1
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14013ea20
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
push rbx
push rbp
push rdi
sub rsp, 0x70
cmp byte [rcx + 0x1a], 0
jne case.0x140130841.7
movzx r10d, byte [rcx + 0x19]
lea eax, [r10 - 1]
cmp eax, 0x1d
ja case.0x140130841.7
lea r8, [0x140000000]
cdqe
movzx eax, byte [r8 + rax + 0x130bdc]
mov edx, dword [r8 + rax*4 + 0x130bb4]
add rdx, r8
jmp rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
sub rax, rdx
cmp rax, 1
jne case.default.0x140130874
cmp byte [rdx], 0
lea rax, str.TRUE
lea rcx, str.FALSE
cmovne rcx, rax
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp qword [case.0x1400e58f8.0]
mov rdx, qword [rcx + 0x10]
mov r9, qword [rcx + 8]
mov rax, rdx
sub rax, r9
je case.default.0x140130874
cmp rax, 4
jbe 0x1401308a4
mov rcx, r9
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp 0x140130190
movsx r8d, byte [r9]
sar r8d, 0x1f
nop dword [rax]
movzx eax, byte [r9]
inc r9
shl r8d, 8
or r8d, eax
cmp r9, rdx
jb 0x1401308b0
cmp r8d, 0xa
lea rax, [0x1401e9d30]
lea rdx, [0x1401e8131]
cmovae rdx, rax
lea rcx, str._s_x
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp sym.CheraxLoader.exe_curl_maprintf
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
inc rcx
cmp rcx, rdx
ja case.default.0x140130874
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp 0x140130190
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp 0x140130190
lea rcx, [0x1401e8131]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp qword [case.0x1400e58f8.0]
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
jmp fcn.1401306a0
mov rbx, qword [rcx + 8]
mov r10, qword [rcx + 0x10]
mov r8, rbx
cmp rbx, r10
jae 0x140130967
movzx eax, byte [r8]
sub al, 0x30
cmp al, 9
ja 0x140130967
inc r8
cmp r8, r10
jb 0x140130955
lea rdi, [rbx + 0xa]
mov rax, r8
sub rax, rdi
je 0x140130987
cmp rax, 2
je 0x14013098e
xor r11d, r11d
mov eax, r11d
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
lea rdi, [0x14023b630]
cmp r8, r10
jae case.default.0x140130874
cmp byte [r8], 0x5a
jne 0x1401309a9
lea r8, [0x14023b62c]
lea r10, [0x14023b62f]
jmp 0x1401309ac
inc r8
mov qword [rsp + 0x48], r8
lea rdx, [rbx + 4]
sub r10d, r8d
lea rax, [rbx + 8]
mov dword [rsp + 0x40], r10d
lea rcx, [rbx + 6]
xor r11d, r11d
mov qword [rsp + 0x38], rdi
cmp byte [rbx], 0x35
lea r9, [rbx + 2]
mov qword [rsp + 0x30], rax
mov r8, rbx
mov qword [rsp + 0x28], rcx
setl r11b
mov qword [rsp + 0x20], rdx
lea rcx, str._u_.2s__.2s__.2s__.2s:_.2s:_.2s__.s
lea edx, [r11 + 0x13]
call sym.CheraxLoader.exe_curl_maprintf
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x98], rsi
lea rbp, [0x1401e8131]
mov rsi, qword [rcx + 0x10]
mov qword [rsp + 0xa0], r14
mov r14, qword [rcx + 8]
mov qword [rsp + 0xa8], r15
mov r15, rbp
mov rbx, r14
cmp r14, rsi
jae 0x140130a45
movzx eax, byte [rbx]
sub al, 0x30
cmp al, 9
ja 0x140130a45
inc rbx
cmp rbx, rsi
jb 0x140130a34
mov rax, rbx
mov dl, 0x30
sub rax, r14
sub rax, 0xc
je 0x140130a71
sub rax, 1
je 0x140130a6b
cmp rax, 1
je 0x140130a67
xor r11d, r11d
jmp 0x140130b4f
movzx edx, byte [rbx - 2]
movzx ecx, byte [rbx - 1]
jmp 0x140130a74
movzx ecx, dl
xor r11d, r11d
mov rdi, rbx
cmp rbx, rsi
jae 0x140130ac4
movzx eax, byte [rbx]
sub al, 0x2c
test al, 0xfd
jne 0x140130ac4
inc rbx
nop dword [rax + rax]
inc rdi
cmp rdi, rsi
jae 0x140130aa3
movzx eax, byte [rdi]
cmp al, 0x30
jl 0x140130aa3
cmp al, 0x39
jle 0x140130a90
mov r11, rdi
sub r11, rbx
sub r11, 1
je 0x140130ac4
lea rax, [rbx - 1]
add rax, r11
cmp byte [rax], 0x30
jne 0x140130ac4
dec rax
sub r11, 1
jne 0x140130ab6
cmp rdi, rsi
jae 0x140130ae8
cmp byte [rdi], 0x5a
jne 0x140130ade
lea rdi, str._GMT
lea rsi, [0x14023b628]
jmp 0x140130ae8
lea r15, [0x140230c2c]
inc rdi
mov qword [rsp + 0x68], rdi
lea rax, [0x1402313ac]
sub esi, edi
lea r10, [r14 + 8]
mov dword [rsp + 0x60], esi
lea r9, [r14 + 6]
mov qword [rsp + 0x58], r15
lea r8, [r14 + 4]
mov qword [rsp + 0x50], rbx
test r11, r11
mov dword [rsp + 0x48], r11d
cmovne rbp, rax
movsx eax, cl
movsx ecx, dl
lea rdx, [r14 + 0xa]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, str._.4s__.2s__.2s__.2s:_.2s:_c_c_s_.s_s_.s
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x20], r10
call sym.CheraxLoader.exe_curl_maprintf
mov r11, rax
mov r15, qword [rsp + 0xa8]
mov rax, r11
mov r14, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
mov r9, qword [rcx + 0x10]
mov edx, r10d
mov r8, qword [rcx + 8]
lea rcx, [rsp + 0x90]
call fcn.140130220
mov rcx, qword [rsp + 0x90]
xor r11d, r11d
test rax, rax
cmovs rcx, r11
mov rax, rcx
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret