Function at 0x656888ac
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xd
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x14f]
mov esi, 0x656ad11c
push ebx
sub esp, 0x16c
rep movsb byte es:[edi], byte [esi]
cmp byte [eax + str.Scrub_is_disabled_on_the_specified_file.], 0
je 0x6568890e
inc eax
cmp eax, 0x2205
jne 0x656888cc
mov eax, dword [0x656a8fe8]
mov dword [esp + 0xc], str.LdrpResGetResourceDirectory_Enter
mov dword [esp + 8], str.LdrpResGetResourceDirectory_Enter
mov dword [esp + 4], eax
mov dword [esp], str.The_operation_cannot_be_performed.
call fcn.65694650
xor dword [0x656a8fe8], 0x160697f9
jmp 0x65688915
cmp eax, 0x1734
jle 0x65688926
call fcn.65693328
mov eax, dword [0x656a8fe8]
sub eax, 0x7a3abe31
jmp 0x65688930
imul eax, dword [0x656a8fe8], 0x5e0df30d
xor eax, 0x55046c9d
mov ecx, 0x656a9a80
mov dword [0x656a8fe8], eax
mov dl, byte [ecx]
test dl, dl
je 0x6568895c
sub edx, 0x30
cmp dl, 9
jbe 0x65688959
add eax, 0x494632e9
mov dword [0x656a8fe8], eax
jmp 0x6568895c
inc ecx
jmp 0x6568893f
mov eax, dword [0x656a8fe8]
mov dword [esp], str.Scrub_is_disabled_on_the_specified_file.
xor ebx, ebx
lea edi, [ebp - 0x142]
mov dword [esp + 0xc], str.LdrpResGetResourceDirectory_Enter
mov esi, str.LDR_Database
xor eax, 0x34802d2b
mov dword [esp + 8], str.LdrpResGetResourceDirectory_Enter
mov dword [esp + 4], eax
mov dword [0x656a8fe8], eax
call fcn.65694650
mov eax, dword [0x656a8fe8]
mov ecx, 0xd
rep movsb byte es:[edi], byte [esi]
xor eax, 0xee699240
sub eax, 0x7ac53df4
mov dword [0x656a8fe8], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov byte [ebp + ebx - 0x118], bl
inc ebx
sub eax, 0x7574904
mov dword [0x656a8fe8], eax
cmp ebx, 0x100
jne 0x656889b3
xor esi, esi
xor ecx, ecx
mov edi, 0xc
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x142]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x656889dc
xor edi, edi
xor esi, esi
xor ebx, ebx
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
mov byte [ebp - 0x159], al
add eax, esi
movzx esi, al
mov eax, dword [0x656a8fe8]
or eax, 0x3cb59e69
mov dword [esp], eax
mov dword [0x656a8fe8], eax
call fcn.65693ccc
mov eax, dword [0x656a8fe8]
and eax, 0x197ec44a
imul eax, eax, 0x43ef3f73
mov dword [0x656a8fe8], eax
call fcn.65692604
xor eax, eax
cmp byte [eax + 0x656a9a80], 0
je 0x65688a97
inc eax
cmp eax, 0x22d3
jne 0x65688a68
mov dword [esp + 4], str.LdrpResGetResourceDirectory_Enter
mov dword [esp], 0x656a9a80
call fcn.65692fc4
and dword [0x656a8fe8], 0xa6dec045
mov eax, dword [0x656a8fe8]
xor eax, 0xe4595de0
and eax, 0xefc394f8
mov dword [0x656a8fe8], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dl, byte [ebp + esi - 0x118]
mov cl, byte [ebp - 0x159]
sub eax, 0x6ac729be
mov byte [ebp + ebx - 0x118], dl
mov dl, byte [ebp - 0x159]
mov dword [0x656a8fe8], eax
mov byte [ebp + esi - 0x118], dl
add cl, byte [ebp + ebx - 0x118]
lea edx, [ebp - 0x135]
movzx ecx, cl
mov cl, byte [ebp + ecx - 0x118]
xor cl, byte [ebp + edi - 0x14f]
mov byte [ebp + edi - 0x135], cl
inc edi
cmp edi, 0xd
jne 0x65688a1f
lea edi, [ebp - 0x128]
mov esi, 0x65695068
mov ecx, 4
mov byte [ebp - 0x128], 0
rep movsd dword es:[edi], dword [esi]
imul eax, eax, 0xfe7909a1
mov ebx, 0x21
add ebx, dword [ebp + ecx*4 - 0x128]
imul eax, eax, 0x78632938
inc ecx
cmp ecx, 4
jne 0x65688b2f
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], 0x1344
mov dword [esp], str.xk51RudRIW9Kpy4sIjtzgBCIBmm5XieDSDllfoIm0znrfDtWAwUCy5gIJ3NxQrBPMOFX4S06knfkis5FjNo7vpkEIDTuYWpHrzn4yYQlEe3QTT79_qi87oAVMe8EqashzFNjU0XaQq8KL9GLPIW9R46SyDp7zLreoP7CbKTY15zCRbteWYsDNI6CVE97Mn7mlYkrzYAJYsMJmF2Wtp2C5Euj5mTBNnKQjFEpx4a2bY4_MkSfPWIyuWg0D4VsgFucJ2QLNYso1uZHgVl1zVXfPnLJh8eq4SQara5Vv2dihUc1ks6IkWDHbJ5CFv8IN0NUFNkHSrLXpiTs2lpN1yo4oz7XAy5Fz3fgVlrIh3z729PG3xXraE5B_V5dZgzD94_jrMboCT409KHV_zMSGsCfedp_P1sAy1zllsKFelMMbOuj0uBppBHnTbD9wsmeBotzh_1zPdySYClnxLpzWSdPuuHkbk3EjZDgdh3LVdvApFCo5rE3AnpXla5rkOKFQjg61MAIGQMqVUqv3WTX_9MzlKifs8329qj1gjx_QmX_Mti7kwgOn_EnGWc0NujJI_7KWCly5ZHs6OgXYFa54nt2yvCgWza8OmYG9HwaXVUKJW1vDUtntkbLD_XDa74_7WrvyzZh36vAEX2xle8sciHJsS9vyD2nemOg0fLsTJMR5xNpOTFExvkif1XtLJ9hDjNXQqFWAKRNJeqTypR1YLSP1HTHHJBcdPodRySZs0DElvIB2hQwtB401z8ZapyrYJIpxupoVBaC84uydf7Awb71nFIxNxf_vMu1XhineOOQxVMAOFCxGy6giwFHLRipXeusB1_wn8JJAk7h22BemfdYIN1k5briGkETrfmzhgukoWfgD9dUOId89m7JsqwrIxz24VMjhLBpU6OM2Z6OKCnUYe8KHyiR93HJqkKs8F23aBMVkYa9oegNyproNAbqNsw6bh3IsELPKCRDf5gy5EAzz3VIjiHlE59_Lq0Bc2gU7ktazpqq4R5AH1Ft0azxXQq4oX_rCJY_QFvtnWdXNXOKHBDJJrvf_SJUEV1283eRSM8EwKG4K_zNf4_lYr8lwecYVxhwr5gzL6CPgrtOQrZbYgFdh8J8DoFahRtC8DWn9hZJyhsPV2PXBrg2Sqj6LypQZscbeM4jXFx01ClGLWnU_ke7B4AMEJFUKBSHyNayJ1uH5gtNYuQw0DlMWjwH97jHe6Vg59li3MLHO7iqLaR5qDweKk9WgzvF_WRIvKZ3X15zHy3frw29LVNwUGBXANvuSamdtp5kIvxED6wb9MZbFpydnQo5uBl3GJRU0OY4b29Ud1eIOxZqsDqNVXXOy3qcAGm1fM1SKfxA94mgwx1oPWjuFAGrEkg4yaBb5tszhN9a21smuKaynDOGlYbIpgzZaf4ukqJrQoPDrjKwUzJetacZEHbt8x0dwd5bLxjBD2Ob1HUADD1qIXO0HTnKZjg89hVYcWfKsw6z0CYtC9niPwHeVwJWvQJkYCEWocgP7pStOYnEsboM2IjbYFgaUzKJt65bb5vXmJ47QrVbaJPaAYaiHaem32fBBz8n5NvDWtkKwQ8Ebxio0NwfKtViFS32ZqOGdxoXE4Oc93EZe1XT0EEFMNfbANNx4SHW9FMm2Ld9ZzguuwzzbrKsA0sgHr7Ib2p_01rE1v_eNfnWFOsBEzQbbRXDyyGbLLVAcnN7a87_0vNe03PNp8rAjczRCdIjcDNwcHXZNHXYaX5xR1wmD6CqxYLyo_OO69kJXnD_lR3oHnKkyUevzyQYbilUgmmIWrTzjCjeTJqADb4awvbl6hsC7ZxLH_i9wljnMZ1YI79mXTxL7XVDK8B2Bmc1TNqyO_9qXQv92myyy1EGmJ5BxI6JzDg5qOenVrrNgSKsuIeHvtS2BTxgNZ1livgs6JM8UncdrPNtuTIyeH51MlPKgMuJA036nLk8_g7oAgdU6Vu75tCOVR1Bu4T49axfGHPpvSCG_nf_qEiuaNRK4EsofnrzYMeZVKtV4OUPTpnJK2efwpPgYnfg7yqewF9y42HdQXmHH_Xm9h2JA8m7QwPG5bENjaYBBvKdRnWWpIHoGHTLpGpW414ydiB1bk7oT2t_3wi7dH_6uKQJ3lymJ8q9SRk4RRkCK2UTViRMDoaeVQ8WtuXNdFG6ah5XpvVQYWKt5HOuh75Mke0btqC2Rwcj46pOQIMKZsi08_WfjuMxEUbbn3ml47LMYl281CUK3XI5q8Wzs7_H6ZHAfHdmMwJkNUBCQLZI9PSltIN3spyyIikR4mQhLdysbF0IcuvPyJOSj71opFlf4dn6S1NHR7Y0ScjFkp2VTmUyLlxysTvQRs98PcXezsHfkuK9Smd0m2c_Hv5DIPLjsbIxCvIOsTFOw7A5ScLAC9f5Y9lZif1Yau6J6vxFFMfnM8Jev8w6sbxWpuE7TXaxd5z0uRoIQ6irTh3YY3YR6_ht8nUCQEA1afn4HRl3IwAaOSrwb0e9ESD_CoSO6E2OOyOVCi_oIQVY3ppqP57RGu44BAmbCnR274g5s41Ff1E0rWFBZrwCXD1znYNAw0OOoTta4GYF1Tp6fvIDxkusmwvOgDdSKYH5J52fuqnIS6xDY3DzrtocvtkaHp0lfNAdhhaCgJ7GpeJyU6N7sOtz21sqKfE_5jaVhy5hTshjkLoBWIboI4YQxn1ADqQJDj7mlBeQc9SraxBWLbRgjiB1u7_PR9V_FIkWH3eSxfhXt5VJ7BahoHhFuJMjOeyut_HKWGrTy86Exf3AnWpkMFcGx0GpCLm_M_n_kL1JFZ3inB9zDYpXbUrorEP02NhW1iAYpcXXSW2kEB4uzWZ6Ma3hIhbmTOPuqOoYU47ZuY6rJtNmfsOx6xbkuQnI2DaxHjp2_JMnSgIybRRpmagEnTYODSl6iWswSesEjNv9V9aNNFPr3vCqAj_lQ3a2UQe40BgGKZCW09AH41Gj3v_cr6kTHosxK0J4j1kxn2QJxOrlHqC34RsoAKwv8B3eSTwQtznVqXvxAxNCitaieH9y5fXWrFmFHKev82RauW91K5TNHiIATBWXEdPY39cc3scQ72hhaRoFGEgnvy9Jyh73Cy98uDsiAwvQLWPTYkf5WNVz1wvpkH4lU2Vo8QEmdC7FwFiqPwknjFBGwkvHapdvIDFPi8bQ1prPAMyzcspOVAM0QbS2uvEySj_4yurJPGQHrlOibn981zB0GfntDGNa8Ew6VYxlTKGjWjbq45Dj5XpXFffUYgWo1KtgT7vzYMGoOkEtOZMPkOI7vN79c0zx5kAETIFaT0638U06HDVKtB8J6_XS2nQVq_6dC6SK1wChq7pBtleHZUsvtZtFrdowwaka6RlwE7w9yWLMW9aZ5nVHW0sBzFFSIRyoG_cdWMtBeIH5vxFhCk7Yiru9T_A9jsXOOcqh3h3Y2bybIRxZDQBoITdOMzv3wU146N3bMMBngia9f7ARnsi68K2nzJwPWGuY7pW0zr3hKBwWHChCiNm7Qsn4NMiqPHB82X9V2Ml4QZh2UwFDb3B2yEv05h4hNORDULlib93RQ2S10IOdtwQfJj4Z5nMN6kVvq7PLwgLl77MsU5nJ38qlT1bpUhm0gu8pQzzEM89AH71l9CfTrN7gRVd6PPBq_IxN0VrRUjMlIOD2Byg_yR524TkuywJLrM_fYlCa4hCHR_REm5GAXIUyyPm6J4ETxuL2fVWbBS4khd4102AWBTjQRATd58yYwMdDs6EC5USv8ohpizBheoI_BvgDYj5jm9OHOj9Ttt_jsOVyYC6QfePKlHqBQEzsU7kyjYnmLMzkPGi7yyWBZWepqFEKzNNliFPqkzYvEr3_WQJFshNiJ55CZwGypJd5_yyEzsM9X9WYCnqsaHx6igaBQ_be5JWoc7WcmqwVjmBGs5K50XwqRwD5PDY7SnFVmjFPiBK3Is3Ds9AYv8zAeVWJWiGjgIhKCUf4s8jTn27ku6G7Hc4gpRJaJ_KDIUx_EJa8kLZ4m36TT4U73f7jxkZFLeDhT_As
mov dword [0x656a8fe8], eax
call fcn.6568bff8
add esp, 0x16c
pop ebx
pop esi
pop edi
pop ebp
ret