Function at 0x643ca140
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x12
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x12a]
mov esi, 0x643eb60b
push ebx
sub esp, 0x15c
mov eax, dword [0x643e81f8]
mov dword [ebp - 0x13a], 0x7f605a7
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x136], 0x19784e73
sub eax, 0x21534a61
mov dword [0x643e8248], eax
call fcn.643d3548
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c8928
mov eax, dword [0x643e81f8]
xor esi, esi
xor ebx, ebx
and eax, 0x5bc77165
mov dword [0x643e8260], eax
mov ecx, 0x11
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x118]
div ecx
mov eax, edi
mov ecx, 0x1433
and dword [0x643e8248], 0x82b1f742
add al, byte [ebp + edx - 0x12a]
mov edx, str.The_user_kernel_marshalling_buffer_has_overflowed.
add eax, esi
movzx esi, al
imul eax, dword [0x643e8260], 0x41148703
mov dword [0x643e81f8], eax
add eax, 0x5b4dd3ce
mov dword [0x643e8260], eax
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c89cc
add ecx, eax
cmp ecx, 0x19c2
jbe 0x643c89a6
call fcn.643d3548
xor dword [0x643e8248], 0x42feda54
call fcn.643d4004
mov eax, dword [0x643e8248]
inc ebx
lea edx, [eax + 0x2daaf478]
sub eax, 0x5a6b0ea5
mov dword [0x643e8248], eax
mov eax, edi
mov dword [0x643e8260], edx
mov byte [ebp + esi - 0x118], al
cmp ebx, 0x100
jne 0x643c894a
mov edx, str.AslFileMappingGetImageTypeEx_failed___x_
mov ecx, 0x2ab
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c8a32
add ecx, eax
cmp ecx, 0x254d
jbe 0x643c8a07
call fcn.643d0d0c
mov eax, dword [0x643e8260]
sub eax, 0x5ef588a
mov dword [0x643e8248], eax
call fcn.643d2c24
mov eax, dword [0x643e8260]
xor ebx, ebx
xor eax, 0x64c1e63e
mov dword [0x643e81f8], eax
imul eax, eax, 0x5d2d4122
mov dword [0x643e8260], eax
call fcn.643d089c
mov esi, dword [0x643e8248]
xor ecx, ecx
xor edx, edx
xor esi, 0xd372b643
inc edx
lea edi, [ebp - 0x132]
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
mov byte [ebp - 0x149], al
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], al
mov al, byte [ebp - 0x149]
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebx + ebp - 0x13a]
mov byte [ebp + ebx - 0x132], al
inc ebx
cmp ebx, 8
jne 0x643c8a63
mov dword [esp + 8], edi
mov dword [esp + 0xc], 8
mov dword [esp + 4], 0xb40
mov dword [esp], 0x643e4d80
mov dword [0x643e81f8], esi
mov byte [ebp - 0x12a], 0
xor dword [0x643e8260], 0x973c4cb0
call fcn.643cb468
add esp, 0x15c
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.643c75d0
xor eax, eax
cmp byte [eax + str.Alignment_Error], 0
je 0x643ca16d
inc eax
cmp eax, 0xa49
jne 0x643ca14d
imul eax, dword [0x643e7dc4], 0xd92c67ab
mov dword [0x643e7dc4], eax
mov eax, dword [0x643e7dc4]
or eax, 0x286a5be9
add eax, 0x40d8ed27
and eax, 0x34ce225f
mov dword [0x643e7dc4], eax
call fcn.643d0f40
call fcn.643c723c
call fcn.643c8120
call fcn.643c8b04
call fcn.643c7c9c
call fcn.643d0f40
mov dword [esp], 0x227e
sub dword [0x643e7dc4], 0x7afa913b
call dword [sym.imp.USER32.dll_IsZoomed]
push edx
and eax, 0x40475c
or eax, 0x3e7eb0ab
mov dword [0x643e7dc4], eax
call fcn.643cf804
call fcn.643c7f64
xor eax, eax
cmp byte [eax + str.Insufficient_quota_exists_to_complete_the_operation], 0
je 0x643ca1f4
inc eax
cmp eax, 0x22ea
jne 0x643ca1d7
add dword [0x643e7dc4], 0x28530ce4
jmp 0x643ca1fb
cmp eax, 0x1d79
jle 0x643ca200
call fcn.643d27ac
imul eax, dword [0x643e7dc4], 0x8389c94e
mov dword [0x643e7dc4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call fcn.643d1c54
call fcn.643c83bc
imul eax, dword [0x643e7dc4], 0xbe43772c
mov dword [0x643e7dc4], eax
call fcn.643c6ba0
call fcn.643c780c
call fcn.643c6e10
mov eax, dword [0x643e7dc4]
or eax, 0x4afa03af
imul eax, eax, 0x293d29fc
add eax, 0x61262ddf
mov dword [0x643e7dc4], eax
call fcn.643c7014
call fcn.643c874c
call fcn.643c85e4
call fcn.643c7a28
leave
jmp 0x643c88e0