Function at 0x4db140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db353
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
movups xmmword [rsp + 0x38], xmm15
cmp qword [rsp + 0x70], 0
je 0x4db16c
jmp 0x4db18c
lea rax, str.._0___M__L1y_w_c__i_____:_01.__PMAMpmamx0s25_a_b_f_n_r_t_vuU__LlLtLuMn__n_ePnil0x0_NUL:_EOFMayUTC_mStdDltEET0001CATWATEATGMTHSTHDT_03_04_05ESTCSTCDTMSTMDT_02EDTASTADTPSTPDTNSTNDT06030407IST0908IDT12PKT11KST05JST10_01_11_12_08_0913CETBSTMSK_0614125625NaNintmapptr...finobj.__adxaesshaavxfmanet___n_NoPopenreadtruemap_pipefileStat.com.exe.bat.cmdpathquitbindJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT3125_InfInfboolint8uintchanfunccallkind_on_allgallprootitabsbrk_is_LEAFbaseGOGCcas1cas2cas3cas4cas5cas6ermssse3avx2bmi1bmi2false_nil__nil_ErrorchdirwritecloseLstatntohsMarchAprilLocal053004300545063003300845103012451345_09301562578125int16int32int64uint8arrayslicedefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleepgcingusagefault_..._Greeksse41sse42ssse3HiDdEnByPaSsStringFormat__bytestringremoveexec:_hangupkilledlistensocketSundayMondayFridayAugustUTC_11UTC_02UTC_08UTC_09UTC12UTC13390625uint16uint32uint64structchan____chan_Valuesysmontimersefenceselect__not_objectGetACPCommonrdtscppopcntcmd_gonetdns_PANICfloat32float64consolePATHEXTabortedCopySidWSARecvWSASendconnectsignal_TuesdayJanuaryOctober__time.MUI_StdMUI_Dlt19531259765625invaliduintptri___lenChanDiri___cap_Value_forcegcallocmWcpuprofallocmRunknowngctraceIO_waitUNKNOWN:events.UNCos_execruntimeGoStringFullPathno_anodeCancelIoReadFileAcceptExWSAIoctlshutdownThursdaySaturdayFebruaryNovemberDecembertime.UTC__Month_48828125scavengepollDesctraceBufdeadlockraceFinipanicnilcgocheck_is_not__pointerBAD_RANKwsaioctlnet_httpgo_buildx509sha1_method:__MISSING____EXTRA_fork_execexecwaitinterruptbus_errorFindCloseLocalFreeMoveFileWWriteFileWSASendTontdll.dllrwxrwxrwxWednesdaySeptember244140625complex64interfaceinvalid_ni___s.Lenfuncargs_bad_indirreflect:_InterfaceprofBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan_sendpreemptedbad_prunectxt___0atomicor8tracebackpsapi.dllInheritedpclmulqdqmath_randPoWeRsHeLl_BADINDEX____NOVERB_CreateFilecreatetemp_dev_stdinexecerrdotSYSTEMROOTterminatedowner_diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dlltime.Date_time.Local__Weekday_12207031256103515625complex128t.Kind__notifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop_tracedisablethpinvalidptrschedtracesemacquiredebug_callGOMEMLIMITexitThreadBad_varintatomicand8float64nanfloat32nanunknown_pcLockFileExWSASocketWhttp2debugcrypto_tls___BADPREC_CloseHandleOpenProcessunreachableGetFileType_dev_stdout_dev_stderrSYSTEMROOTbroken_pipealarm_clockbad_messagefile_existsbad_addressRegCloseKeyCreateFileWDeleteFileWExitProcessFreeLibrarySetFileTimeVirtualLockWSARecvFromclosesocketgetpeernamegetsocknamecrypt32.dllmswsock.dllsecur32.dllshell32.dlluserenv.dllshort_write30517578125bad_argSizemethodargs_assistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart_traceclobberfreegccheckmarkscheddetailcgocall_nilbad_m_valuebad_timedivfloat64nan1float64nan2float64nan3float32nan2i_o_timeoutProcessPrngMoveFileExWNetShareAddNetShareDelgocachehashgocachetesthttp2clienthttp2serverarchive_tarcrypto_x509archive_zip___BADWIDTH_exit_status_invalid_slothost_is_downillegal_seekGetLengthSidGetLastErrorGetStdHandleGetTempPathWLoadLibraryWReadConsoleWSetEndOfFileTransmitFileGetAddrInfoWadvapi32.dlliphlpapi.dllkernel32.dllnetapi32.dll152587890625762939453125outCount___0t.xcount___0sweepWaiterstraceStringsspanSetSpinemspanSpecialgcBitsArenasmheapSpecialgcpacertracemadvdontneedharddecommitdumping_heapchan_receivelfstack.pushbad_flushGenbad_g0_stackself_preemptbad_recoverybad_g_statusentersyscallcas64_failedabi_mismatchnot_pollableRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerymultipathtcprandautoseedFindFirstFilelevel_3_resetsrmount_errortimer_expiredexchange_fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamedalTLDpSugct_3814697265625t.inCount___0profMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC_sweep_waitout_of_memory_is_nil__not_v
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 1
mov ebx, 1
add rsp, 0x58
pop rbp
ret
jmp 0x4db18e
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rcx
test rcx, rcx
setne byte [rsp + 0x16]
jne 0x4db1a4
jmp 0x4db1eb
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x68]
lea rcx, [rcx + rdx]
lea rcx, [rcx - 1]
movzx ecx, byte [rcx]
mov byte [rsp + 0x15], cl
cmp cl, 0x5c
sete byte [rsp + 0x17]
je 0x4db1ce
jmp 0x4db1d0
jmp 0x4db1da
cmp cl, 0x2f
sete byte [rsp + 0x17]
jmp 0x4db1da
movzx ecx, byte [rsp + 0x17]
mov byte [rsp + 0x13], cl
jmp 0x4db1e5
mov byte [rsp + 0x16], cl
jmp 0x4db1ed
jmp 0x4db1ed
cmp byte [rsp + 0x16], 0
jne 0x4db1f6
jmp 0x4db214
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
dec rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x70], rcx
jmp 0x4db20f
jmp 0x4db18e
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
nop
call fcn.004db380
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x70]
sub rcx, rbx
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rbx, rcx
add rbx, qword [rsp + 0x68]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x28], rdx
lea rcx, [rdx - 1]
mov qword [rsp + 0x18], rcx
jmp 0x4db268
cmp qword [rsp + 0x18], 0
setge byte [rsp + 0x16]
jge 0x4db277
jmp 0x4db2b6
mov rcx, qword [rsp + 0x68]
add rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx]
mov byte [rsp + 0x14], cl
cmp cl, 0x5c
sete byte [rsp + 0x17]
je 0x4db294
jmp 0x4db296
jmp 0x4db2a2
cmp cl, 0x2f
sete byte [rsp + 0x17]
nop
jmp 0x4db2a2
movzx ecx, byte [rsp + 0x17]
mov byte [rsp + 0x12], cl
jmp 0x4db2ad
xor ecx, 1
mov byte [rsp + 0x16], cl
jmp 0x4db2b8
jmp 0x4db2b8
cmp byte [rsp + 0x16], 0
jne 0x4db2c2
nop
jmp 0x4db2cb
dec qword [rsp + 0x18]
jmp 0x4db2c9
jmp 0x4db268
cmp qword [rsp + 0x18], 0
jge 0x4db2d5
jmp 0x4db30d
mov rcx, qword [rsp + 0x18]
lea rdx, [rcx + 1]
mov qword [rsp + 0x28], rdx
mov rsi, qword [rsp + 0x70]
sub rsi, rcx
lea rcx, [rsi - 1]
mov rsi, rcx
neg rcx
sar rcx, 0x3f
and rdx, rcx
add rdx, qword [rsp + 0x68]
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rsi
jmp 0x4db30f
jmp 0x4db30f
cmp qword [rsp + 0x70], 0
je 0x4db319
jmp 0x4db339
lea rax, [0x0050c75c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 1
mov ebx, 1
add rsp, 0x58
pop rbp
ret
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00451b40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004db140