Function at 0x14002bb90
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov r8, qword [rcx + 0x40]
xor r11d, r11d
mov dword [rbp + 0x6f], r11d
mov r13d, 1
mov rbx, rcx
mov edi, r11d
mov r12d, r13d
test r8, r8
je 0x14002c326
mov r10, qword [rcx + 0x68]
test r10, r10
je 0x14002c326
lea rax, [r10 + 0xd8]
mov qword [rsp + 0xf0], r14
test rax, rax
je 0x14002bbf9
mov rcx, qword [rax]
test rcx, rcx
je 0x14002bbf9
mov ecx, dword [rcx + 4]
jmp 0x14002bbfc
mov ecx, r11d
mov r14, qword [rbx + 0xe0]
cmp r14, qword [r10 + 0x10]
jae 0x14002bc13
mov eax, 0xffff8e80
jmp 0x14002c182
mov qword [rsp + 0xf8], rsi
mov esi, 8
mov qword [rsp + 0xe8], r15
cmp ecx, 7
jne 0x14002bc81
mov r9, qword [rbx + 0xc8]
lea rcx, [rbp + 0x77]
mov r8, qword [r10 + 0x18]
lea rdx, [r10 + 0x40]
mov qword [rsp + 0x30], rcx
mov r15, r11
mov qword [rsp + 0x28], r9
mov rcx, rax
mov qword [rsp + 0x20], r14
mov qword [rbp + 0x77], r11
call fcn.1400148d0
test eax, eax
jne 0x14002c172
mov rax, qword [rbp + 0x77]
cmp qword [rbx + 0xe0], rax
je 0x14002bffe
mov eax, 0xffff9400
jmp 0x14002c172
lea eax, [rcx - 6]
test eax, 0xfffffffd
je 0x14002c1a9
cmp ecx, 2
jne 0x14002bc77
mov rdx, r11
mov qword [rbp + 0x7f], r11
cmp dword [rbx + 0x18], ecx
jl 0x14002bca4
mov rdx, qword [r10 + 0x18]
mov rcx, qword [r10 + 0x18]
add rcx, rdx
cmp r14, rcx
jb 0x14002c16d
mov rcx, qword [r10 + 0x28]
lea rax, [rcx + 1]
add rax, rdx
cmp r14, rax
jb 0x14002c16d
mov r15, qword [rbx + 0xc8]
cmp dword [r8 + 0x94], r12d
jne 0x14002bdcd
mov rax, qword [rbx + 0xa8]
lea rdx, [rbp - 0x69]
sub r14, rcx
mov r8d, recv
mov qword [rbx + 0xe0], r14
mov rcx, qword [rax]
mov qword [rbp - 0x69], rcx
mov rcx, qword [rbx + 0xb0]
movzx eax, word [rcx]
mov word [rbp - 0x61], ax
movzx eax, byte [rcx + 2]
lea rcx, [r10 + 0x68]
mov byte [rbp - 0x5f], al
movzx eax, byte [rbx + 0xe1]
mov byte [rbp - 0x5e], al
movzx eax, r14b
mov byte [rbp - 0x5d], al
call fcn.14001e2e0
mov rcx, qword [rbx + 0x68]
mov r8, qword [rbx + 0xe0]
add rcx, 0x68
mov rdx, qword [rbx + 0xc0]
call fcn.14001e2e0
mov rcx, qword [rbx + 0x68]
lea rdx, [rbp - 0x31]
add rcx, 0x68
call fcn.14001e310
mov rcx, qword [rbx + 0x68]
add rcx, 0x68
call fcn.14001e3c0
mov r10, qword [rbx + 0xe0]
xor r11d, r11d
add r10, qword [rbx + 0xc0]
mov r9d, r11d
mov rax, qword [rbx + 0x68]
mov byte [rbp + 0x6f], dil
cmp qword [rax + 0x28], rdi
jbe 0x14002bdba
lea rax, [rbp - 0x31]
sub r10, rax
nop
lea rdx, [rbp - 0x31]
add rdx, r9
inc r9
movzx eax, byte [r10 + rdx]
movzx r8d, byte [rdx]
xor r8d, eax
movzx eax, byte [rbp + 0x6f]
or eax, r8d
mov byte [rbp + 0x6f], al
mov rax, qword [rbx + 0x68]
cmp r9, qword [rax + 0x28]
jb 0x14002bd90
movzx eax, byte [rbp + 0x6f]
test al, al
jne 0x14002c16d
mov edi, r13d
mov dword [rbp + 0x6f], r13d
mov r9, qword [rbx + 0x68]
xor edx, edx
mov rcx, qword [rbx + 0xe0]
mov rax, rcx
mov r8, qword [r9 + 0x18]
div r8
test rdx, rdx
jne 0x14002c16d
cmp dword [rbx + 0x18], 2
jl 0x14002be30
sub rcx, r8
sub r14, r8
mov qword [rbx + 0xe0], rcx
mov rdx, r11
cmp qword [r9 + 0x18], 0
jbe 0x14002be30
nop word [rax + rax]
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0x68]
movzx eax, byte [rdx + rax]
mov byte [rdx + rcx + 0x40], al
inc rdx
mov rax, qword [rbx + 0x68]
cmp rdx, qword [rax + 0x18]
jb 0x14002be10
mov r8, qword [rbx + 0x68]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov r9, r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
lea rdx, [r8 + 0x40]
lea rcx, [r8 + 0xd8]
mov r8, qword [r8 + 0x18]
call fcn.1400148d0
test eax, eax
jne 0x14002c172
cmp r14, qword [rbp + 0x7f]
jne 0x14002bc77
cmp dword [rbx + 0x18], 2
jge 0x14002be8e
mov r8, qword [rbx + 0x68]
lea rdx, [r8 + 0x110]
lea rcx, [r8 + 0x40]
mov r8, qword [r8 + 0x18]
call fcn.140035790
mov r9, qword [rbx + 0xe0]
mov rax, qword [rbx + 0x68]
mov r8, qword [rbx + 0xc8]
mov qword [rbp - 0x41], r9
mov rcx, qword [rax + 0x28]
movzx r15d, byte [r8 + r9 - 1]
inc r15d
lea rax, [rcx + r15]
cmp r9, rax
jae 0x14002bec7
test edi, edi
jne 0x14002bec7
xor r11d, r11d
mov r15d, r11d
mov r12d, r11d
cmp dword [rbx + 0x18], 0
jle 0x14002bc77
xor edi, edi
lea rax, [r15 + 1]
mov rdx, r9
mov r14d, edi
sub rdx, r15
mov r11d, edi
dec rdx
mov esi, edi
cmp r9, rax
mov ebx, edi
lea rax, [rcx + 0x4000]
mov r9d, edi
cmovae r14, r12
mov ecx, edi
cmp rdx, rax
mov r10d, 2
setb cl
and r14, rcx
imul rdx, r14
mov qword [rbp - 0x49], r14
lea r14, [r15 - 1]
lea r12, [r8 + rdx]
nop dword [rax]
lea rax, [r10 - 1]
mov rcx, rdi
cmp rax, r15
mov r8, rdi
movzx eax, byte [r12 + r10 - 1]
mov rdx, rdi
cmovbe rdx, r13
cmp rax, r14
movzx eax, byte [r12 + r10]
mov r13, rdi
sete cl
and rcx, rdx
add r11, rcx
mov rcx, rdi
cmp r10, r15
setbe r8b
and r8, rdx
mov rdx, rdi
cmp rax, r14
lea rax, [r10 + 1]
cmove rcx, r8
add r9, rcx
mov rcx, rdi
cmp rax, r15
movzx eax, byte [r12 + r10 + 1]
cmovbe rdx, r8
cmp rax, r14
lea rax, [r10 + 2]
sete cl
and rcx, rdx
add rbx, rcx
mov rcx, rdi
cmp rax, r15
movzx eax, byte [r12 + r10 + 2]
setbe r13b
and r13, rdx
cmp rax, r14
cmove rcx, r13
add r10, 4
add rsi, rcx
lea rax, [r10 - 1]
cmp rax, 0x100
jbe 0x14002bf20
lea rax, [rsi + rbx]
mov r12, rdi
mov rbx, qword [rbp + 0x67]
add rax, r9
mov r9, qword [rbp - 0x41]
add r11, rax
mov edi, dword [rbp + 0x6f]
cmp r11, r15
mov esi, 8
cmove r12, qword [rbp - 0x49]
imul rax, r12, 0x1ff
and r15, rax
sub r9, r15
mov qword [rbx + 0xe0], r9
test edi, edi
jne 0x14002c199
mov rax, qword [rbx + 0x68]
mov rcx, qword [rbx + 0xe0]
sub rcx, qword [rax + 0x28]
mov rax, qword [rbx + 0xb8]
mov qword [rbx + 0xe0], rcx
shr rcx, 8
mov byte [rax], cl
mov rcx, qword [rbx + 0xb8]
movzx eax, byte [rbx + 0xe0]
mov byte [rcx + 1], al
cmp dword [rbx + 0x18], 0
jle 0x14002bc77
mov rcx, qword [rbx + 0x68]
mov r8, rsi
mov rdx, qword [rbx + 0xa8]
add rcx, 0x68
mov rdi, qword [rbx + 0xe0]
call fcn.14001e2e0
mov rcx, qword [rbx + 0x68]
mov r8d, 3
mov rdx, qword [rbx + 0xb0]
add rcx, 0x68
call fcn.14001e2e0
mov rcx, qword [rbx + 0x68]
mov r8d, 2
mov rdx, qword [rbx + 0xb8]
add rcx, 0x68
call fcn.14001e2e0
mov rcx, qword [rbx + 0x68]
mov r8, qword [rbx + 0xe0]
add rcx, 0x68
mov rdx, qword [rbx + 0xc8]
call fcn.14001e2e0
mov rcx, qword [rbx + 0x68]
lea rdx, [rbp - 0x11]
add rcx, 0x68
call fcn.14001e310
lea rax, [rdi + 0x15]
shr rax, 6
lea rcx, [r15 + 0x15]
add rcx, rdi
imul rdi, r12, 0xff
shr rcx, 6
sub rcx, rax
and rdi, rcx
add rdi, 1
je 0x14002c0fa
mov rcx, qword [rbx + 0x68]
mov rdx, qword [rbx + 0xc8]
add rcx, 0x68
call fcn.14001e420
sub rdi, 1
jne 0x14002c0e0
mov rcx, qword [rbx + 0x68]
add rcx, 0x68
call fcn.14001e3c0
mov r10, qword [rbx + 0xe0]
xor r11d, r11d
add r10, qword [rbx + 0xc8]
mov r9d, r11d
mov rax, qword [rbx + 0x68]
mov byte [rbp + 0x67], 0
cmp qword [rax + 0x28], r11
jbe 0x14002c15a
lea rax, [rbp - 0x11]
sub r10, rax
lea rdx, [rbp - 0x11]
add rdx, r9
inc r9
movzx eax, byte [rdx + r10]
movzx r8d, byte [rdx]
xor r8d, eax
movzx eax, byte [rbp + 0x67]
or eax, r8d
mov byte [rbp + 0x67], al
mov rax, qword [rbx + 0x68]
cmp r9, qword [rax + 0x28]
jb 0x14002c130
movzx eax, byte [rbp + 0x67]
test al, al
cmovne r12, r11
test r12, r12
jne 0x14002c2ad
mov eax, 0xffff8e80
mov rsi, qword [rsp + 0xf8]
mov r15, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xf0]
add rsp, 0x100
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
cmp edi, 1
je 0x14002c2aa
mov eax, 0xffff9400
jmp 0x14002c172
mov rax, qword [r10]
mov r15d, reloc.WS2_32.dll_recv
mov rcx, qword [r10 + 0x18]
sub rcx, qword [r10 + 0x20]
test byte [rax + 0x2c], 2
cmovne r15, rsi
lea rax, [r15 + rcx]
cmp r14, rax
jb 0x14002c16d
mov rax, qword [rbx + 0xa8]
lea r9, [rbp - 0x50]
mov rdi, qword [rbx + 0xc8]
sub r14, r15
mov edx, dword [rbx + 0x18]
sub r14, rcx
mov qword [rbx + 0xe0], r14
mov rcx, qword [rax]
movzx eax, byte [rbx + 0xd8]
mov byte [rbp - 0x51], al
mov rax, qword [rbx]
mov qword [rbp - 0x59], rcx
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rax + 0x144]
shr r8d, 1
and r8d, r12d
call fcn.14002f6b0
movzx ecx, byte [rbx + 0xe1]
movzx eax, r14b
mov r8, qword [r10 + 0x18]
sub r8, qword [r10 + 0x20]
mov rdx, qword [rbx + 0xc0]
mov byte [rbp - 0x4e], cl
lea rcx, [r10 + 0x40]
add rcx, qword [r10 + 0x20]
mov byte [rbp - 0x4d], al
call fcn.140035790
mov r8, qword [rbx + 0x68]
lea rax, [rdi + r14]
mov qword [rsp + 0x50], r15
lea r9, [rbp - 0x59]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
lea rdx, [r8 + 0x40]
lea rcx, [r8 + 0xd8]
mov qword [rsp + 0x30], r14
mov r8, qword [r8 + 0x18]
mov qword [rsp + 0x28], rdi
call fcn.1400149e0
mov ecx, eax
test eax, eax
je 0x14002c2a0
mov eax, 0xffff8e80
cmp ecx, 0xffff9d00
cmove ecx, eax
mov eax, ecx
jmp 0x14002c172
cmp qword [rbp - 0x39], r14
jne 0x14002bc77
xor r11d, r11d
cmp qword [rbx + 0xe0], 0
jne 0x14002c2cb
inc dword [rbx + 0x118]
cmp dword [rbx + 0x118], 3
jle 0x14002c2d2
jmp 0x14002c16d
mov dword [rbx + 0x118], r11d
mov rax, qword [rbx]
test byte [rax + 0x144], 2
jne 0x14002c31f
nop
mov rax, qword [rbx]
mov ecx, dword [rax + 0x144]
and ecx, 2
cmp rsi, rcx
jbe 0x14002c304
mov rax, qword [rbx + 0xa8]
add byte [rax + rsi - 1], 1
jne 0x14002c304
dec rsi
jmp 0x14002c2e0
mov rax, qword [rbx]
mov ecx, dword [rax + 0x144]
and ecx, 2
cmp rsi, rcx
jne 0x14002c31f
mov eax, 0xffff9480
jmp 0x14002c172
xor eax, eax
jmp 0x14002c172
mov eax, 0xffff9400
add rsp, 0x100
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret