Function at 0x608d40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x608ffa
mov edi, dword [esp + 0xc]
push str.RtlInitAnsiString
push esi
call edi
test eax, eax
mov dword [0x614f64], eax
je 0x608fec
push str.RtlFreeUnicodeString
push esi
call edi
test eax, eax
mov dword [0x614f74], eax
je 0x608fec
push str.RtlAdjustPrivilege
push esi
call edi
test eax, eax
mov dword [0x614fac], eax
je 0x608fec
push str.LdrLockLoaderLock
push esi
call edi
test eax, eax
mov dword [0x614fd8], eax
je 0x608fec
push str.RtlInitializeSid
push esi
call edi
test eax, eax
mov dword [0x614fcc], eax
je 0x608fec
push str.RtlSetDaclSecurityDescriptor
push esi
call edi
test eax, eax
mov dword [0x614fbc], eax
je 0x608fec
push str.NtDeleteValueKey
push esi
call edi
test eax, eax
mov dword [0x614f88], eax
je 0x608fec
push str.RtlSetOwnerSecurityDescriptor
push esi
call edi
test eax, eax
mov dword [0x614fc0], eax
je 0x608fec
push str.NtQueryInformationProcess
push esi
call edi
test eax, eax
mov dword [0x614fa0], eax
je 0x608fec
push str.NtCreateKey
push esi
call edi
test eax, eax
mov dword [0x614f7c], eax
je 0x608fec
push str.swprintf
push esi
call edi
test eax, eax
mov dword [0x614fa8], eax
je 0x608fec
push str.LdrQueryProcessModuleInformation
push esi
call edi
test eax, eax
mov dword [0x614f98], eax
je 0x608fec
push str.NtSetValueKey
push esi
call edi
test eax, eax
mov dword [0x614f80], eax
je 0x608fec
push str.NtQueryInformationThread
push esi
call edi
test eax, eax
mov dword [0x614fa4], eax
je 0x608fec
push str.RtlNtStatusToDosError
push esi
call edi
test eax, eax
mov dword [0x614fd0], eax
je 0x608fec
push str.RtlAddAccessAllowedAceEx
push esi
call edi
test eax, eax
mov dword [0x614fb4], eax
je 0x608fec
push str.RtlCreateAcl
push esi
call edi
test eax, eax
mov dword [0x614fb0], eax
je 0x608fec
push str.NtNotifyChangeKey
push esi
call edi
test eax, eax
mov dword [0x614f90], eax
je 0x608fec
push str.LdrGetDllHandle
push esi
call edi
test eax, eax
mov dword [0x614f9c], eax
je 0x608fec
push str.NtQueryValueKey
push esi
call edi
test eax, eax
mov dword [0x614f84], eax
je 0x608fec
push str.RtlAnsiStringToUnicodeString
push esi
call edi
test eax, eax
mov dword [0x614f68], eax
je 0x608fec
push str.RtlUnicodeStringToAnsiString
push esi
call edi
test eax, eax
mov dword [0x614f6c], eax
je 0x608fec
push str.NtDeleteKey
push esi
call edi
test eax, eax
mov dword [0x614f8c], eax
je 0x608fec
push str.RtlInitUnicodeString
push esi
call edi
test eax, eax
mov dword [0x614f70], eax
je 0x608fec
push str.RtlSetGroupSecurityDescriptor
push esi
call edi
test eax, eax
mov dword [0x614fc4], eax
je 0x608fec
push str.RtlCreateSecurityDescriptor
push esi
call edi
test eax, eax
mov dword [0x614fb8], eax
je 0x608fec
push str.NtOpenKey
push esi
call edi
test eax, eax
mov dword [0x614f78], eax
je 0x608fec
push str.NtClose
push esi
call edi
test eax, eax
mov dword [0x614f94], eax
je 0x608fec
push str.RtlAbsoluteToSelfRelativeSD
push esi
call edi
test eax, eax
mov dword [0x614fc8], eax
je 0x608fec
push str.RtlRandom
push esi
call edi
test eax, eax
mov dword [0x614fd4], eax
je 0x608fec
push str.LdrUnlockLoaderLock
push esi
call edi
test eax, eax
mov dword [0x614fdc], eax
je 0x608fec
push str.LdrUnregisterDllNotification
push esi
call edi
push str.LdrRegisterDllNotification
push esi
mov dword [0x614fe4], eax
call edi
mov dword [0x614fe0], eax
xor eax, eax
jmp 0x609000
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x7f
jmp 0x609000
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x614f64
mov dword [0x614c0c], 0x40
mov edi, dword [ecx]
add ecx, 4
xor eax, edi
cmp ecx, 0x615064
jb 0x60900f
pop edi
and eax, 0xff
pop esi
ret