Function at 0x643c6ba0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x125]
mov esi, str._d_readimage
push ebx
sub esp, 0x14c
call fcn.643d1c54
mov eax, dword [0x643e819c]
lea edx, [eax + 0x25ee5403]
add eax, 0x2e99d34c
mov dword [0x643e8258], edx
mov dword [0x643e819c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0xd
mov dword [ebp - 0x133], 0x195a5bd8
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x130], 0x1f51a819
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0x91547405
mov dword [0x643e819c], eax
mov eax, dword [0x643e7d6c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c6c19
mov eax, dword [0x643e819c]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x13c], eax
mov eax, ecx
mov edi, 0xc
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x125]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov eax, dword [ebp - 0x13c]
mov dl, byte [ebp + esi - 0x118]
add eax, 0xca19dbc
imul edi, eax, 0xceb54f49
mov byte [ebp + ecx - 0x118], dl
inc ecx
mov byte [ebp + esi - 0x118], bl
mov dword [ebp - 0x13c], edi
cmp ecx, 0x100
jne 0x643c6c37
and eax, 0xe7640d11
mov byte [ebp - 0x19], dl
xor edi, edi
xor edx, edx
mov dword [0x643e819c], eax
mov byte [ebp + esi - 0x118], bl
xor ebx, ebx
inc ebx
mov dword [ebp - 0x140], edx
lea esi, [ebp - 0x12c]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
lea ecx, [eax + edi]
mov byte [ebp - 0x13c], al
movzx edi, cl
mov ecx, dword [0x643e819c]
xor ecx, 0x15a0b0fc
mov dword [0x643e8258], ecx
call fcn.643cf804
mov cl, byte [ebp + edi - 0x118]
mov al, byte [ebp - 0x13c]
mov edx, dword [ebp - 0x140]
mov byte [ebp + ebx - 0x118], cl
mov byte [ebp + edi - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + edx - 0x133]
mov byte [ebp + edx - 0x12c], al
inc edx
cmp edx, 7
jne 0x643c6caa
mov eax, dword [0x643e819c]
mov byte [ebp - 0x125], 0
or eax, 0xaa33ca75
mov dword [0x643e8258], eax
xor eax, eax
cmp word [eax + str.Compression_is_disabled_for_this_volume.], 0
je 0x643c6d65
add eax, 2
cmp eax, 0x2dc
jne 0x643c6d42
call fcn.643d0d0c
and dword [0x643e7d6c], 0x5a8a16d1
imul eax, dword [0x643e819c], 0xde3c1dd8
mov dword [0x643e8258], eax
imul eax, dword [0x643e7d6c], 0xc00c6c5b
mov dword [0x643e819c], eax
call fcn.643d4004
mov edx, str.Compression_is_disabled_for_this_volume.
mov ecx, 0x92e
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c6da7
add ecx, eax
cmp ecx, 0x1d11
jbe 0x643c6d92
mov eax, dword [0x643e8258]
mov edx, eax
and eax, 0x566201f9
and edx, 0x73717988
mov dword [0x643e8258], eax
mov dword [0x643e819c], edx
call fcn.643d2c24
call fcn.643d0d0c
xor dword [0x643e8258], 0x5ed607b6
and dword [0x643e7d6c], 0x6f08023
call fcn.643d4004
mov dword [esp + 8], esi
mov dword [esp + 0xc], 7
mov dword [esp + 4], 0x136c
mov dword [esp], str.5r9bxpJVMk6ppts7cepxVQAPVsZQXAl1H9gZOirbr7yRQwo5e7qxU4P8E2J_nE70Rpff0EiZU3vdmJ_A0RR0eIrERpr10fFeZ8JV_1c_TKM6nLOdLo3NzRRigHsfaxS70E304rfTUg1IUFUiGREN6CkxpWVIZ0aTZxxvoA2wumLEOu5tlpNRwT7lhhpb5JbXAGGvBDmJBJaiD21lhecKaWpyLwlpFAmIXGQpgWJs_t56x84_UmFl8l6ejf6rFWtJbnJdNHJCfNlNbtm_oRxJx7rN0G1tmc2F3vccCkDxWV6TPFwCB3Hv_t15Zz0fHRTNhPQAuQLDv1gpoed0e0Cs2jz1MyJ3DyIPfR4cFTA0JScnvHDAgrGV3Y20y9CZgk1cqsIXH0IMHVxLZlTjJwK214Y9Z_Rh3eTdwl0wlCIi3NXhywjQUO9VwbpDvcyhgLaCZc2KZbGEU5vzWZ_lETomXR4heF7qqrVJbDrs_paj04Ovj0IdSz2OSffx5rwzbbG3kqgibypCn16u1NBd3yTOI7kvhMhGTYpQacix_upTEifJUm1UWo8DhLS_I8ac9XTJr1lJof2upkUbc__DXiOdR81OUOoNYbnIYB0SPC1xtNezwC__REejuQHOmanVQP9cm2kSNzVgiL2TIZl0IQi7esCVU8tA1iH9qpZC3duKPVjhHfkz2EWLyjPQOinxmwbX698x8HKCBj4ECERRtaNIgHwyFbT2m29Cc_gxiFclUnD4vIQBTVQI01Pqt0a2f2nzLhY38yBCfmVerEZtJ9HGXnfCnAjAGMVUR5UKJeZsmMgUSyrkuKovHg2VPsf0MuZN6WTGcgJ1n9gGtW93bL94BHVlGdTnEM0XZy0h0SlMmZQlthhVDIjukeKlEF5efsobnDKO_QVqokZlCkGMBLPLKXRw5jhafLgsvZQVcBNveuBJHIQIhf_Hv1pNsCK_PZNZZdwzBcdHAcXylOfzZpkhnJP9RzalzXY2t42aQSWDt93iS95OQGTlzwD5F2tpu64cWczRaBHcZUVKfBZMMguw2Wxv_Iv8BXXz2fxrK8Pp3mk8oiNPnWF8EJx3ofcrOkLc902yhIB2EX1G3yA808oJx3SpNvLhVnOCVm_XkVfHnFpb7UPBiXPu73frJLqFlXdiouj3Psin2c_Eg2WBoc0Yc7SAG3TIwFuymU4bJS4x6FU2UUuxin0PcqR2Lb8sAGDjxhVSWpZeQCQTrXM7GWqwkJA9rEZbIs8EP0IxnXDrcRUbl0g7MqHcJbTQ2cOM0sKT9LUElxmyXNfr9SvJNlz89tZMtOKgHw7wxVvnRirxD9z8sgiYo6_ZO19uLwvoCA_JSucdqv1lpSeYnScTU0nsazOhhDGC5f7VZS8XaIit4fqTUx8sfDjxbZtwmYOzr3KsftagQNbSafmWbDyFZLPQCZy06rKknWIu0o50LsJM92cppJp0g_T8K9gq82rRjYedaX9IhFRpmqakVF1Ogd0mJAhFuPa6LjDPpGd8ydQJwIlZHNeCfFSTRF0Iwi59YbIZZ8wBLNM82eFpfP_TCgmd50uHGQRnGHiK6Kn7eYUmvIlBWb02CsqGX0AFaXxaOhF5NYQo9fu3JtG_NGHgDSqivcPfyxSjzRlo04uxpJajQwg0MvNdyaQ7zxmfrLi4pC1XqGXJLJwumb7rHOePKhZlNTJJQsDNNsKHvkSxf1uLULRmQHUv2_20qr27BImMghmF1FUvHcuASdq8a8vbQ9yLiw8rxSW8OyBOd1uskEhMVA0keQrpCF6wY17gEF1kPy8mKJmZjeJQPpdrJX9D2PghG6UeIDgcCVgb7v9yl9nzWboGg4mABrB0RauYIu60ieW3wdFvrX1ZsH403zMSKACyDGDqCbZ1KX54V92WMtDh8gimOsDqiI1FPNVvK52IJw7t2oLpAvO7CapABZHZh2jPs0OxH0J71zcMe3zVckQsqWzzvtQ6BydxXeqvKcM77evYvUQk0OLMlAID811jAauBsUFTj4Pf893mE2Tx1JQSPUt6EfbpFzi26LNT7hAU39OA03e0L3cCwQQnbrkFAZSaDJtKDr6VbjHUBmEOCwSP7OdnxKy7SueCriLP7rk72_XGPJlPsY0ocNx6VpADSCiLtqLYezSKJTrrBXfpfJ7uoDNrv7sX1ab5nzGehf924vb7jOfiafh3bxNyLUQda6wLMITokfqcalZUdrlqMUZy4rWKqfRiT9XhiBZy31QbcNKbIjwrk4qecT7ayRazKEm_bA2Ji6mRFP0pNW86tQGu4kDIulWyyYNpIQcV0DLf6NRqEQgTqX_gzZUwqBKqfKQwLVnCSH3CBWvk_BAwUnyCAtE7YYcb2x_d2niWdoPHfUnfWA31F0zEX4JSurGkfCtm1NQJF3z5x4w_y99DiShKYo7aVXHe4QMSYZ1FpbEOuJmBoBs20UTMXtIrdVtHm_L7DuWxb18XmvXIF3ai7HEEC52kMCKZlJF8ltZFrQhtdhamXg4SF9KP9OGQXU5Z1bAjvHFSdwgyGr6L79zQHm7CgnQOJZ7WViqe7bB16rq06hNk2ol7X_snmOTZvTPKSnxfllhubktZFSuIA9wSTA8MwpfOVhRNefQ0_E8aUd3swVIZE6L0WPUxpicNxLeBNsCK2mgu7KkrocGFJXniOjZfyxAoORTQc0vDp_TpYPBAaBnuhWd68s27dwGGnNdMGj274niDnV9LfvcRXVBPgr7aXtrF79k_izPsbtGVx8rCP7soND4nx3RrbOH8x1dyGhgkD3znxSr5fK1CpBgKQkergUyQBdZu5M9_IHX3DWrUnT6RvIFq26bW1uSjgwswiivPV2if6ZkrPsw90Z1Baa7bK_ocMcEeU95cwcjD5vA38BN9hzTXFk3RFLmg1Dip7rrMGJET2xHREDMHSlmnU9xpE_2CrZ5NRElFn3HrdaPVZAe2oVGdvfmdRZZ44iCcB3WWnpLUEjN8A9FTsuBbXPhV_gud0R6_MgHDAeeqAs51rBJEIUamh4ztPGrnQa_LUkzHxHxEdELg8JsdF9XEVJAV5Y75fmBADe1zUHIvxPTQeGegw8uftS7mrrlcSnBgcYDjVFvKRzU2aC7RW2JECERAzLj6KUP2fhIsjx_H4a9kcaB36FpZt9Ekm0yF9UwYHn1K8lTIZedrQPXHLgJmHBYf7WlYs8Bc5xm7L9468zeB1F3Q2MnpDHRMxa4aiyRBaBcYt0AqCCATLVmkxk2CRtk1kTOemE80DxLkuB3WXSXNaXR_v2ux83vAZ9YIJuDrAf_3e3dBcUUiatw1xZaCjKufjviyHRzNsoty6nIX70fdoniE2QDwrVOnAWYqMay1_jYoXpQxCgA2dhA4l9lTASSo6uz_YCWSudf2KutKABsYmx2UAUHvrJV1F7IBRn_5clgMF3Uh2oaJ0Pmup8RkLtqr_HwWrdLfzmyrD2XbuIHzu9H6Wa_3IP62c9pnga4PBYnRBC898dDPSFb5NR1MVYCzs3kBXVojnyEG4e5mlxIjMXKQzF2ZHnkIH8mmQl_Uc25BRWDG22VQJYMtOhdXpi6GK5JqOM6WJY8N4DzGDTgybvbjQOoBASfp0EHZLZJctqJL4It2kL8fhMtXv25P0_HLSHIIEdvQPPEnBe_YiF4WVc5Dbg9EO5ivekdBjdRMqMgIoFJuUC274wL1K33JgAOlC5VxS1LpRjRKQQLPBLZm7NMjBlrHTEwC618Gijb3QfnqLPdbu4ezOk_8VD0uinochmnXGyBJeU2ijSMF8DLeCDKjlGfQlAbYQH6CpPckxv9VfZ0Cc_M7nJ_ksKFRC9J9C6hxb_JeaTi91pqNayrH0nO8wRmABFJZThFmc_jw9mLhhAb3Jiy5sy8XGU8LuSvJQqnVoztxDe2wWCtmP5GgaQNdNWhhtDdXss14_VaZteHq9cNorgcR6COl59iXsYp7GY7T8_NlPd7tFPH1nuWmbTagaHJ4isbTNVB9VLZ4wvu6vYcFsxN3J9uY0nQ11b0ka6YpC_Yh5UsvQMn2JZnLbZjcluu
call fcn.643cb468
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret