Function at 0x14035b1d0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1404d4020]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rax, qword [rcx]
movzx r13d, r9w
mov rdi, qword [rcx + 0x10]
mov r15, r8
mov word [rsp + 0x30], r9w
mov r10, rdx
mov qword [rsp + 0xa8], r8
mov r14, rcx
mov rsi, qword [rax]
xor eax, eax
mov qword [rsp + 0x78], rdx
mov ebp, eax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x88], rsi
mov rbx, qword [rsi]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rax
cmp dword [rsi + 0x30], eax
je 0x14035b24e
mov eax, dword [rsi + 0x18]
jmp 0x14035b4f2
movzx ecx, word [rdi + 0x1a]
mov edx, 0x18
mov eax, dword [rdi + 0x38]
test al, 0x20
movzx r8d, word [rdi + 0x3c]
mov word [rsp + 0x3e], cx
movzx ecx, word [rdi + 0x1c]
mov word [rsp + 0x40], cx
movzx ecx, word [rdi + 0x3e]
mov word [rsp + 0x44], cx
mov rcx, qword [rdi]
mov qword [rsp + 0xa0], rcx
movzx ecx, word [rdi + 0x16]
mov word [rsp + 0x34], cx
mov dword [rsp + 0x64], eax
mov eax, 0x1bf
cmove edx, eax
mov word [rsp + 0x42], r8w
movzx eax, word [rdi + 0x18]
mov ecx, edx
mov r8d, dword [r10 + 0x44]
and ecx, 0xffffffc3
test byte [r15 + 0x64], 4
mov r9d, eax
mov qword [rsp + 0x28], r15
cmove ecx, edx
mov qword [rsp + 0x138], r12
mov rdx, qword [r14 + 8]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0xb0]
mov word [rsp + 0x32], ax
mov dword [rsp + 0x70], eax
call fcn.14035f930
xor r11d, r11d
mov qword [rsp + 0x98], rax
mov word [rdi + 0x12], r11w
mov r12, rax
mov rcx, qword [r15 + 0x10]
movsx rax, word [rcx]
mov word [rsp + 0x62], ax
cmp eax, 0xa
jg 0x14035b30e
mov word [rsp + 0x3c], r11w
jmp 0x14035b31f
mov rcx, rax
call fcn.1403177c0
sub ax, 0x21
mov word [rsp + 0x3c], ax
mov ecx, pe_nt_image_headers64
test r12, r12
je 0x14035b3c0
movzx r13d, word [r12 + 0x14]
mov ebx, r11d
mov eax, dword [r14 + 0x28]
mov word [rsp + 0x60], r13w
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x90], eax
cmp r13w, cx
je 0x14035b35d
test byte [r12 + 0x12], 0x80
je 0x14035b525
movzx r9d, word [rsp + 0x32]
mov rax, qword [r15 + 8]
movsx r8, word [rax + r9*2]
test r8d, r8d
js 0x14035b514
mov rdx, qword [r15 + 0x18]
lea rcx, [r8 + r8*2]
mov rax, qword [rdx + 8]
test dword [rax + rcx*8 + 8], 0xf
je 0x14035b51e
movzx r13d, word [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.14035feb0
mov qword [rsp + 0x98], rax
mov r12, rax
mov ecx, pe_nt_image_headers64
mov r11d, 0
test ebp, ebp
je 0x14035b324
mov r14, qword [rsp + 0x58]
mov rax, qword [rsp + 0xa0]
movzx esi, word [rsp + 0x32]
movzx ecx, word [rsp + 0x44]
movzx r12d, word [rsp + 0x34]
movzx r8d, word [rsp + 0x42]
mov qword [rdi], rax
movzx eax, word [rsp + 0x3e]
mov word [rdi + 0x1a], ax
movzx eax, word [rsp + 0x40]
mov word [rdi + 0x1c], ax
mov eax, dword [rsp + 0x64]
mov dword [rdi + 0x38], eax
mov word [rdi + 0x18], si
mov word [rdi + 0x3e], cx
mov word [rdi + 0x16], r12w
mov word [rdi + 0x3c], r8w
cmp si, cx
jne 0x14035b4e8
movzx ecx, word [r15 + 0x5e]
lea eax, [rsi + 1]
cmp eax, ecx
jae 0x14035b4e8
cmp si, r8w
jne 0x14035b4e8
mov eax, dword [r15 + 0x64]
test al, 0x40
jne 0x14035b4e8
test al, al
jns 0x14035b4e8
mov eax, 0x4000
test dword [r14 + 0x60], eax
jne 0x14035b4e8
mov rax, qword [r15 + 0x10]
lea rbx, [rsi*2 + 2]
cmp word [rbx + rax], 0x2a
jl 0x14035b4e8
inc r8d
mov rdx, rdi
mov rcx, r14
call fcn.14035d4c0
mov ebp, eax
test eax, eax
jne 0x14035b4e8
inc word [rdi + 0x18]
mov r8, r15
inc word [rdi + 0x3e]
movzx ecx, word [rdi + 0x3c]
mov rax, qword [rdi + 0x48]
mov rdx, qword [rsp + 0x78]
mov qword [rax + rcx*8], 0
inc word [rdi + 0x3c]
or dword [rdi + 0x38], 0x8000
mov r9, qword [r15 + 0x10]
mov rcx, qword [rsp + 0x48]
movzx r10d, word [r9 + rsi*2]
sub r10w, word [r9 + rbx]
sub word [rdi + 0x16], r10w
lea r9d, [r10 + r13]
add r9w, 5
call fcn.14035b1d0
movzx ecx, word [rsp + 0x44]
mov eax, dword [rsp + 0x64]
mov word [rdi + 0x3e], cx
mov word [rdi + 0x16], r12w
mov word [rdi + 0x18], si
mov dword [rdi + 0x38], eax
mov r12, qword [rsp + 0x138]
mov eax, ebp
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1403c3c50
add rsp, 0x140
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp r8d, 0xffffffff
je 0x14035b38f
mov ecx, pe_nt_image_headers64
jmp 0x14035b52b
movzx r9d, word [rsp + 0x32]
mov rax, qword [rdi + 8]
test qword [r12 + 0x28], rax
jne 0x14035b38f
test word [r12 + 0x12], cx
je 0x14035b54d
cmp r13w, 0x10
je 0x14035b38f
mov r10, qword [rsp + 0x78]
movzx edx, byte [r10 + 0x3c]
test dl, 0x58
je 0x14035b58a
mov rcx, qword [r12]
mov r8d, dword [rcx + 4]
test r8b, 3
je 0x14035b38f
mov eax, dword [r10 + 0x44]
cmp dword [rcx + 0x34], eax
jne 0x14035b38f
test dl, 0x18
je 0x14035b58a
test r8b, 2
jne 0x14035b38f
cmp byte [r15 + 0x62], 0
je 0x14035b5a7
movzx eax, word [r15 + 0x5e]
dec eax
movzx ecx, r9w
cmp ecx, eax
jne 0x14035b5a7
or byte [r14 + 0x2c], 2
jmp 0x14035b5ac
or byte [r14 + 0x2c], 1
mov eax, dword [rsp + 0x64]
mov dword [rdi + 0x38], eax
movzx eax, word [rsp + 0x3e]
mov word [rdi + 0x1a], ax
movzx eax, word [rsp + 0x40]
mov word [rdi + 0x1c], ax
movzx eax, word [rsp + 0x42]
mov word [rdi + 0x18], r9w
mov word [rdi + 0x3c], ax
cmp ax, word [rdi + 0x40]
jb 0x14035b603
mov r14, qword [rsp + 0x58]
lea r8d, [rax + 1]
mov rcx, r14
mov rdx, rdi
call fcn.14035d4c0
test eax, eax
jne 0x14035bcab
movzx r9d, word [rsp + 0x32]
xor r11d, r11d
mov r10, qword [rsp + 0x78]
movzx ecx, word [rdi + 0x3c]
movzx r14d, r13w
mov rax, qword [rdi + 0x48]
mov qword [rax + rcx*8], r12
movzx edx, word [rdi + 0x3c]
mov rcx, qword [rsp + 0xa0]
inc dx
mov rax, qword [rdi + 8]
mov word [rdi + 0x3c], dx
not rax
or rcx, qword [r12 + 0x28]
and rcx, rax
mov qword [rdi], rcx
and r14w, 1
je 0x14035b752
mov r8, qword [r12]
test dword [r8 + 4], 0x1000
je 0x14035b68b
movzx eax, dx
mov ebx, 0x2e
dec eax
mov dword [rsp + 0x38], ebx
test eax, eax
jle 0x14035b6a7
mov rcx, qword [rdi + 0x48]
mov edx, eax
nop dword [rax]
mov rax, qword [rcx]
test rax, rax
je 0x14035b67f
cmp qword [rax], r8
cmove ebx, r11d
add rcx, 8
sub rdx, 1
jne 0x14035b670
jmp 0x14035b6a3
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x14035b6a7
movsxd rcx, dword [rax]
test ecx, ecx
je 0x14035b6a7
call fcn.1403177c0
movsx ebx, ax
mov dword [rsp + 0x38], ebx
test byte [r15 + 0x64], 0x80
je 0x14035b736
movzx r10d, word [rsp + 0x3c]
cmp r10w, 0xa
jl 0x14035b736
mov rax, qword [r15 + 0x10]
movzx ecx, r9w
movzx r8d, word [rax + rcx*2]
cmp bx, 0xa
jg 0x14035b6d8
movzx eax, r11w
jmp 0x14035b6e5
movsx rcx, bx
call fcn.1403177c0
sub ax, 0x21
sub ax, bx
sub ax, r10w
movzx r10d, word [rsp + 0x30]
add ax, r8w
add ax, 0xa
jns 0x14035b73c
cmp r10w, 2
jge 0x14035bc92
mov rax, qword [rsp + 0x58]
test dword [rax + 0x60], 0x20000
jne 0x14035bc92
or dword [rdi + 0x38], 0x100000
or dword [rdi + 0x38], 4
mov edx, dword [rdi + 0x38]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
jmp 0x14035b8e1
movzx r10d, word [rsp + 0x30]
or dword [rdi + 0x38], 4
mov edx, dword [rdi + 0x38]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
jmp 0x14035b8e1
test r13b, 0x82
je 0x14035b7ec
mov rax, qword [r15 + 8]
movzx r10d, word [rsp + 0x30]
movzx ecx, r9w
movsx r9d, word [rax + rcx*2]
mov ecx, dword [rdi + 0x38]
or ecx, 1
mov dword [rdi + 0x38], ecx
cmp r9d, 0xffffffff
je 0x14035b7bd
mov r8d, ecx
mov edx, ecx
test r9d, r9d
js 0x14035b7c9
test r10w, r10w
jne 0x14035b7c9
movzx r9d, word [r15 + 0x5e]
lea eax, [r9 - 1]
cmp dword [rsp + 0x70], eax
jne 0x14035b7c9
test byte [r15 + 0x64], 8
jne 0x14035b7bd
cmp r9d, 1
jne 0x14035b7b7
cmp byte [r15 + 0x62], r10b
je 0x14035b7b7
cmp r13w, 2
je 0x14035b7bd
bts edx, 0x10
jmp 0x14035b7c3
mov edx, ecx
bts edx, 0xc
mov r8d, edx
mov dword [rdi + 0x38], edx
cmp byte [rsp + 0xd9], 1
jbe 0x14035b7dd
mov edx, r8d
bts edx, 0x15
mov dword [rdi + 0x38], edx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
jmp 0x14035b8e1
bt r13w, 8
jae 0x14035b80c
mov edx, dword [rdi + 0x38]
mov rax, qword [rsp + 0x50]
or edx, 8
mov rcx, qword [rsp + 0x68]
mov dword [rdi + 0x38], edx
jmp 0x14035b8db
mov r9d, dword [rsp + 0x70]
mov r8, r15
mov edx, dword [r10 + 0x44]
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.14035f6a0
mov edx, dword [rdi + 0x38]
test r13b, 0x24
je 0x14035b8a7
mov word [rdi + 0x1a], ax
or edx, 0x22
xor eax, eax
mov dword [rdi + 0x38], edx
mov qword [rsp + 0x50], rax
mov eax, pe_nt_image_headers64
mov qword [rsp + 0x68], r12
test word [r12 + 0x12], ax
je 0x14035b89a
movzx r8d, word [rdi + 0x3c]
lea rax, [r12 + 0x38]
mov rcx, qword [rsp + 0x58]
inc r8d
mov rdx, rdi
mov qword [rsp + 0x50], rax
call fcn.14035d4c0
test eax, eax
jne 0x14035bca0
movzx ecx, word [rdi + 0x3c]
mov rax, qword [rdi + 0x48]
mov r8, qword [rsp + 0x50]
mov qword [rax + rcx*8], r8
inc word [rdi + 0x3c]
or dword [rdi + 0x38], 0x10
mov edx, dword [rdi + 0x38]
mov word [rdi + 0x1c], 1
mov rax, qword [rsp + 0x50]
mov rcx, r12
xor r11d, r11d
jmp 0x14035b8db
or edx, 0x12
mov word [rdi + 0x1c], ax
xor r11d, r11d
mov dword [rdi + 0x38], edx
mov rax, r12
mov qword [rsp + 0x50], rax
test dl, 0x20
je 0x14035b8d3
mov rax, qword [rdi + 0x48]
movzx ecx, word [rdi + 0x3c]
mov rcx, qword [rax + rcx*8 - 0x10]
mov rax, r12
jmp 0x14035b8d6
mov rcx, r11
mov qword [rsp + 0x68], rcx
movzx r10d, word [rsp + 0x30]
test dl, 2
je 0x14035b906
mov r14, qword [rsp + 0x48]
mov r8, rcx
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov r9, rax
mov rcx, rsi
call fcn.14035ee10
jmp 0x14035bb83
movzx eax, word [rdi + 0x18]
inc ax
movzx esi, ax
mov word [rdi + 0x18], si
movzx edx, word [r12 + 0x10]
mov dword [rsp + 0x74], esi
test dx, dx
jg 0x14035b93f
movzx ecx, word [rsp + 0x32]
mov rax, qword [r15 + 8]
cmp word [rax + rcx*2], 0
jl 0x14035b93f
sub dx, bx
add word [rdi + 0x16], dx
jmp 0x14035bb7e
mov rbx, r11
mov qword [rsp + 0x80], rbx
test r10w, r10w
jne 0x14035bb53
cmp dword [r15 + 0x68], 0
je 0x14035bb53
cmp esi, dword [r15 + 0x6c]
jg 0x14035bb53
test r14w, r14w
je 0x14035b980
mov rax, qword [r12]
test dword [rax + 4], 0x1000
jne 0x14035bb53
mov rax, qword [rsp + 0x58]
test dword [rax + 0x60], 0x800
jne 0x14035bb53
mov rax, qword [r12]
mov ecx, 0x182
test cx, r13w
je 0x14035b9cf
mov r14, qword [rsp + 0x48]
lea r9, [rsp + 0x80]
mov r8, qword [rax + 0x18]
mov rdx, r14
mov rcx, qword [rsp + 0x88]
call fcn.14035a080
mov rbx, qword [rsp + 0x80]
jmp 0x14035ba6f
mov r13, qword [rax + 0x20]
mov r10, qword [rsp + 0x48]
mov rax, qword [r10 + 0x10]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 0x10]
movzx ecx, word [rcx]
call fcn.140317960
mov r12d, dword [r10 + 0x28]
lea r14, [r13 + 8]
mov r15, rax
mov rbp, r11
mov eax, r11d
mov esi, r11d
cmp esi, dword [r13]
jge 0x14035ba46
mov r8, qword [r14]
lea r9, [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdx, r10
mov qword [rsp + 0x80], r15
call fcn.14035a080
mov r10, qword [rsp + 0x48]
inc esi
add rbp, qword [rsp + 0x80]
add r14, 0x20
mov dword [r10 + 0x28], r12d
test eax, eax
je 0x14035ba00
jmp 0x14035ba50
cmp rbp, r15
mov rbx, rbp
cmova rbx, r15
mov esi, dword [rsp + 0x74]
mov r15, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x98]
movzx r13d, word [rsp + 0x60]
mov r14, qword [rsp + 0x48]
xor r11d, r11d
cmp eax, 0xc
mov ebp, r11d
cmovne ebp, eax
test ebp, ebp
jne 0x14035bca0
test rbx, rbx
je 0x14035bb53
lea eax, [rbp + 0x28]
cmp rbx, 8
jae 0x14035bab0
cmp rbx, 2
jae 0x14035baa1
movzx eax, r11w
jmp 0x14035baff
add ax, 0xfff6
add rbx, rbx
cmp rbx, 8
jb 0x14035baa1
jmp 0x14035baed
cmp rbx, 0xff
jbe 0x14035bad1
nop dword [rax]
add ax, 0x28
shr rbx, 4
cmp rbx, 0xff
ja 0x14035bac0
cmp rbx, 0xf
jbe 0x14035baed
nop word [rax + rax]
add ax, 0xa
shr rbx, 1
cmp rbx, 0xf
ja 0x14035bae0
and ebx, 7
lea rcx, [0x1404ce950]
sub ax, 0xa
add ax, word [rcx + rbx*2]
mov word [rdi + 0x16], ax
cmp si, 1
jne 0x14035bb37
movsx edx, ax
mov rax, qword [r15 + 0x10]
add edx, 0xa
movsx ecx, word [rax]
cmp edx, ecx
jle 0x14035bb37
mov eax, 0x4000
or word [r12 + 0x12], ax
mov eax, 0x2000
test word [r12 + 0x12], ax
je 0x14035bb37
or byte [r14 + 0x2d], 4
movzx eax, word [rdi + 0x16]
cmp ax, word [rsp + 0x34]
mov esi, dword [rsp + 0x38]
cmovg ax, word [rsp + 0x34]
sub ax, si
mov word [rdi + 0x16], ax
jmp 0x14035bb87
mov rax, qword [r15 + 0x10]
movzx ecx, si
movzx edx, word [rax + rcx*2]
sub dx, word [rax + rcx*2 - 2]
add dx, word [rdi + 0x16]
bt r13w, 8
mov word [rdi + 0x16], dx
movzx eax, dx
jae 0x14035bb7e
add ax, 0xa
mov word [rdi + 0x16], ax
mov r14, qword [rsp + 0x48]
mov esi, dword [rsp + 0x38]
mov eax, dword [r15 + 0x64]
movzx ebx, word [rdi + 0x16]
and eax, 3
mov r12, qword [rsp + 0x78]
cmp al, 3
jne 0x14035bba0
lea eax, [rbx + 0x10]
jmp 0x14035bbbc
movsx eax, word [r15 + 0x5c]
mov rcx, qword [r12 + 0x20]
imul eax, eax, 0xf
movsx r8d, word [rcx + 0x3c]
cdq
idiv r8d
inc ax
add ax, bx
movzx ecx, word [rsp + 0x3c]
movzx edx, ax
call fcn.140317850
test dword [rdi + 0x38], 0x4000140
jne 0x14035bbdd
lea edx, [rbx + 0x10]
movzx ecx, ax
call fcn.140317850
movzx r13d, word [rsp + 0x30]
add ax, si
movzx r8d, word [rsp + 0x62]
add ax, r13w
mov word [rdi + 0x14], ax
mov rdx, rdi
lea eax, [rsi + rbx]
add ax, r13w
mov word [rdi + 0x16], ax
mov rcx, qword [r14 + 8]
call fcn.14035d2a0
mov rdx, rdi
mov rcx, r14
call fcn.14035cf90
mov edx, dword [rdi + 0x38]
mov ebp, eax
movzx ecx, word [rsp + 0x34]
test dl, 2
cmove cx, bx
mov word [rdi + 0x16], cx
test dl, 0x10
jne 0x14035bc71
movzx ecx, word [rdi + 0x18]
cmp cx, word [r15 + 0x60]
jae 0x14035bc71
cmp cx, word [r15 + 0x5e]
jb 0x14035bc4c
mov eax, dword [r15 + 0x64]
and al, 3
cmp al, 2
je 0x14035bc71
cmp cx, 3
jbe 0x14035bc5f
mov rcx, qword [rsp + 0x88]
call fcn.140322420
lea r9d, [rsi + r13]
mov r8, r15
mov rdx, r12
mov rcx, r14
call fcn.14035b1d0
movzx ecx, word [rsp + 0x34]
mov eax, dword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov word [rdi + 0x16], cx
mov dword [r14 + 0x28], eax
jmp 0x14035b395
mov r14, qword [rsp + 0x48]
movzx r13d, r10w
jmp 0x14035b395
movzx r13d, word [rsp + 0x30]
jmp 0x14035b3c0
movzx r13d, word [rsp + 0x30]
jmp 0x14035b3c5