Function at 0x5e3a140
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x12
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x12a]
mov esi, 0x5e5b60b
push ebx
sub esp, 0x15c
mov eax, dword [0x5e581f8]
mov dword [ebp - 0x13a], 0x7f605a7
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x136], 0x19784e73
sub eax, 0x21534a61
mov dword [0x5e58248], eax
call fcn.05e43548
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x5e38928
mov eax, dword [0x5e581f8]
xor esi, esi
xor ebx, ebx
and eax, 0x5bc77165
mov dword [0x5e58260], eax
mov ecx, 0x11
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x118]
div ecx
mov eax, edi
mov ecx, 0x1433
and dword [0x5e58248], 0x82b1f742
add al, byte [ebp + edx - 0x12a]
mov edx, str.The_user_kernel_marshalling_buffer_has_overflowed.
add eax, esi
movzx esi, al
imul eax, dword [0x5e58260], 0x41148703
mov dword [0x5e581f8], eax
add eax, 0x5b4dd3ce
mov dword [0x5e58260], eax
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
movsx eax, byte [edx]
inc edx
test al, al
je 0x5e389cc
add ecx, eax
cmp ecx, 0x19c2
jbe 0x5e389a6
call fcn.05e43548
xor dword [0x5e58248], 0x42feda54
call fcn.05e44004
mov eax, dword [0x5e58248]
inc ebx
lea edx, [eax + 0x2daaf478]
sub eax, 0x5a6b0ea5
mov dword [0x5e58248], eax
mov eax, edi
mov dword [0x5e58260], edx
mov byte [ebp + esi - 0x118], al
cmp ebx, 0x100
jne 0x5e3894a
mov edx, str.AslFileMappingGetImageTypeEx_failed___x_
mov ecx, 0x2ab
movsx eax, byte [edx]
inc edx
test al, al
je 0x5e38a32
add ecx, eax
cmp ecx, 0x254d
jbe 0x5e38a07
call fcn.05e40d0c
mov eax, dword [0x5e58260]
sub eax, 0x5ef588a
mov dword [0x5e58248], eax
call fcn.05e42c24
mov eax, dword [0x5e58260]
xor ebx, ebx
xor eax, 0x64c1e63e
mov dword [0x5e581f8], eax
imul eax, eax, 0x5d2d4122
mov dword [0x5e58260], eax
call fcn.05e4089c
mov esi, dword [0x5e58248]
xor ecx, ecx
xor edx, edx
xor esi, 0xd372b643
inc edx
lea edi, [ebp - 0x132]
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
mov byte [ebp - 0x149], al
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], al
mov al, byte [ebp - 0x149]
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebx + ebp - 0x13a]
mov byte [ebp + ebx - 0x132], al
inc ebx
cmp ebx, 8
jne 0x5e38a63
mov dword [esp + 8], edi
mov dword [esp + 0xc], 8
mov dword [esp + 4], 0xb40
mov dword [esp], 0x5e54d80
mov dword [0x5e581f8], esi
mov byte [ebp - 0x12a], 0
xor dword [0x5e58260], 0x973c4cb0
call fcn.05e3b468
add esp, 0x15c
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.05e375d0
xor eax, eax
cmp byte [eax + str.Alignment_Error], 0
je 0x5e3a16d
inc eax
cmp eax, 0xa49
jne 0x5e3a14d
imul eax, dword [0x5e57dc4], 0xd92c67ab
mov dword [0x5e57dc4], eax
mov eax, dword [0x5e57dc4]
or eax, 0x286a5be9
add eax, 0x40d8ed27
and eax, 0x34ce225f
mov dword [0x5e57dc4], eax
call fcn.05e40f40
call fcn.05e3723c
call fcn.05e38120
call fcn.05e38b04
call fcn.05e37c9c
call fcn.05e40f40
mov dword [esp], 0x227e
sub dword [0x5e57dc4], 0x7afa913b
call dword [sym.imp.USER32.dll_IsZoomed]
push edx
and eax, 0x40475c
or eax, 0x3e7eb0ab
mov dword [0x5e57dc4], eax
call fcn.05e3f804
call fcn.05e37f64
xor eax, eax
cmp byte [eax + str.Insufficient_quota_exists_to_complete_the_operation], 0
je 0x5e3a1f4
inc eax
cmp eax, 0x22ea
jne 0x5e3a1d7
add dword [0x5e57dc4], 0x28530ce4
jmp 0x5e3a1fb
cmp eax, 0x1d79
jle 0x5e3a200
call fcn.05e427ac
imul eax, dword [0x5e57dc4], 0x8389c94e
mov dword [0x5e57dc4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call fcn.05e41c54
call fcn.05e383bc
imul eax, dword [0x5e57dc4], 0xbe43772c
mov dword [0x5e57dc4], eax
call fcn.05e36ba0
call fcn.05e3780c
call fcn.05e36e10
mov eax, dword [0x5e57dc4]
or eax, 0x4afa03af
imul eax, eax, 0x293d29fc
add eax, 0x61262ddf
mov dword [0x5e57dc4], eax
call fcn.05e37014
call fcn.05e3874c
call fcn.05e385e4
call fcn.05e37a28
leave
jmp 0x5e388e0