Function at 0x1401041e0
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x78], 0x10
mov dword [rsp + 0x7c], 0x10
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], Ordinal_26
mov dword [rsp + 0x8c], Ordinal_26
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x90], rax
lea rcx, str._nSAMKey_:
call fcn.140013fd0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [0x1401aa420]
xor r8d, r8d
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x120]
call fcn.1400199f0
test eax, eax
je 0x1401044ac
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 2
je 0x1401042b7
cmp dword [rsp + 0x50], 3
je 0x1401042b7
jmp 0x140104489
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x68]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 1
je 0x1401042da
cmp dword [rsp + 0x54], 2
je 0x1401043d2
jmp 0x140104473
lea rcx, [rsp + 0xa0]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov rax, qword [rsp + 0x48]
add rax, 0x70
mov r8d, 0x10
mov rdx, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 0x2f
lea rdx, str.______qwertyUIOPAzxcvbnmQQQQQQQQQQQQ____
lea rcx, [rsp + 0xa0]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 0x10
mov rdx, qword [rsp + reloc.WLDAP32.dll_Ordinal_304]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
lea rdx, str.0123456789012345678901234567890123456789
lea rcx, [rsp + 0xa0]
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.cryptdll.dll_MD5Final]
mov rax, qword [rsp + 0x48]
add rax, 0x80
mov r8d, 0x10
mov rdx, rax
mov rcx, qword [rsp + 0x138]
call fcn.140161160
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
test eax, eax
jl 0x1401043aa
mov dword [rsp + 0x58], 1
jmp 0x1401043b2
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1401043cd
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___RtlDecryptData2_KO
call fcn.140013fd0
jmp 0x140104487
mov rax, qword [rsp + 0x48]
add rax, 0x68
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
add rax, 0x20
mov rcx, qword [rsp + 0x68]
add rcx, 0x10
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x68]
mov r9d, dword [rdx + 0xc]
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + reloc.WLDAP32.dll_Ordinal_304]
call fcn.140007e20
test eax, eax
je 0x140104471
cmp dword [rsp + 0x60], 0x10
jne 0x140104437
mov dword [rsp + 0x5c], 1
jmp 0x14010443f
mov dword [rsp + 0x5c], 0
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140104466
mov r8d, 0x10
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x138]
call fcn.140161160
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140104487
mov rax, qword [rsp + 0x48]
mov edx, dword [rax + 0x68]
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_Struct_Key_revision___u_
call fcn.140013fd0
jmp 0x14010449f
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_F_revision___hu_
call fcn.140013fd0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1401044b8
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___kull_m_registry_OpenAndQueryWithAlloc_KO
call fcn.140013fd0
cmp dword [rsp + 0x40], 0
je 0x1401044d4
xor r8d, r8d
mov edx, 0x10
mov rcx, qword [rsp + 0x138]
call fcn.1400204a0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.140013fd0
mov eax, dword [rsp + 0x40]
add rsp, 0x118
ret