Function at 0x643c83bc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x11
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x15e]
mov esi, 0x643eb4a2
push ebx
sub esp, 0x17c
mov eax, dword [0x643e8108]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x13c]
mov esi, 0x643eb4b3
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
add eax, 0x1335a6a7
cmp byte [str.Failed_to_get_key_path_tag], 0
mov dword [0x643e8108], eax
je 0x643c840f
imul eax, eax, 0xf5f3f0f6
mov dword [0x643e8108], eax
mov eax, dword [0x643e8108]
or eax, 0x9fab9f90
imul eax, eax, 0xb8a4c88d
mov dword [0x643e8108], eax
call fcn.643d4004
mov edx, str.TPM_1.2:_Signed_data_cannot_include_additional_DER_information.
mov al, byte [edx]
test al, al
je 0x643c844a
sub eax, 0x30
cmp al, 9
jbe 0x643c8447
xor dword [0x643e8108], 0xd38cf93c
jmp 0x643c844a
inc edx
jmp 0x643c842e
mov eax, dword [0x643e8108]
and eax, 0x9d4d6134
imul eax, eax, 0xa0cfce10
mov dword [0x643e8108], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c8461
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x23
xor edx, edx
mov esi, eax
mov al, byte [ebp + ebx - 0x118]
imul esi, esi, 0x89aafe7d
mov byte [ebp - 0x16c], al
mov eax, ebx
div ecx
or esi, 0x92941b4b
mov dword [0x643e8108], esi
movzx eax, byte [ebp + edx - 0x13c]
movzx edx, byte [ebp - 0x16c]
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + ebx - 0x118], al
inc ebx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edx
mov al, byte [ebp - 0x16c]
mov byte [ebp + edi - 0x118], al
cmp ebx, 0x100
jne 0x643c8474
xor eax, eax
xor edi, edi
xor esi, esi
mov dword [ebp - 0x16c], eax
lea eax, [esi + 1]
movzx esi, al
mov bl, byte [ebp + esi - 0x118]
lea eax, [ebx + edi]
movzx edi, al
imul eax, dword [0x643e8108], 0x745a75f4
and eax, 0xf2a8d630
mov dword [0x643e8108], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, str.Failed_to_get_key_path_tag
mov edx, 0x1294
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x643c854e
add edx, eax
cmp edx, 0x1ee8
jbe 0x643c852d
and dword [0x643e8108], 0x4ce5c0c6
call fcn.643d1c54
imul eax, dword [0x643e8108], 0xa28c7930
sub eax, 0x4aa0ed22
mov dword [0x643e8108], eax
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
lea eax, [ebp - 0x14d]
mov byte [ebp + edi - 0x118], bl
add bl, byte [ebp + esi - 0x118]
movzx ebx, bl
mov cl, byte [ebp + ebx - 0x118]
mov ebx, dword [ebp - 0x16c]
inc dword [ebp - 0x16c]
xor cl, byte [ebp + ebx - 0x15e]
cmp dword [ebp - 0x16c], 0x11
mov byte [ebp + ebx - 0x14d], cl
jne 0x643c84f6
mov byte [ebp - 0x13c], 0
mov dword [esp + 0xc], 0x11
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1318
mov dword [esp], str.QBDNQP_j_qp2tEKDIOREnP3DykGgCsDseOl2KKokvF3MLyVBrGBVj_3XhoC_jb2mfmhRO4VyC8hPRFD9ae3lrHisrpYFBGi793qB2kjivC5z7Esd9S_94LAIlzW5PM5fizTDi0rZhitCfXNdyQnxQWmHePtlDcU2PcZwK6VALHuojE4KHvtCDGhtEUQqmgpfz2CYmOIHovsgQoZfKCjIkOdZQc8rFVBd4ZBRhee9U4CdEzu5n2HM0Z2hDADtEKSAo9u0EZfYTCby61riQn9YU4h98RtGOaXzcfLBkNdKWS6ijd80pTFaOsi8uYPKkFVUIqJkJ0vsWXApSLjaQ_6eEHi0116IPHM4uy78fQtZWoRDCb7LZCyeGLj9p7IOg1wNHeijH8nxFDeJDE9_Dv0fqRNglHk2hhgS7OFJ2wOW732cWNSF4qUPXNy0DHBnmcEAZooUXj_41zmKlUxIKy5y9cDa2k57uXYdTi0g1fA1vjM4Kz6OpFmv8aaSjDKSbMmhMCWCwl5DggHdclbMhuRV1lj2OujzHhhI2fV6fqB649Y91WEttDQaQWG5p1R93w4VOA_bjpmEgDJ62pG39Ey7l0PLYZkyhbTjaelDyMN5bvJMY937coxO6FSw6AdEhIFrROSMG0ywDTc46skahnJLLXHQzUMZdugfXqxiN1mO1CR0xZS1IvGXMdShjbhdHJGyjkON5WTIuZOExY9y6KCa5ppCY5rbnLEpYqHqVBIo_viC6QH6i1hahM1AalM716J296I24RsLkuc1W2Utog83dpkmb3n2paOsfIoH5Exd709GRTvd8dNyzyln2QJf6t1SQhLmvyAGPACLbGYbYvQI6hUEk1LhL7DF1c52s9e7J0oJJSWCW1x2XdlBTtHjBOGvnEyL1el621UbJtYTuTbIkgJEccCcUMZ6BYWgLZ9CLYaqIOWmfA3knqYXO0ziQBkjkHPexVhuAnga2YVjv__522zskFvWex85V_3yLimA_ZVzSXys5BwnSvKWegjCDhqtmIUq7uCPJl6x7ASf_5f5m9NTVk0b7tilvat9MD5eL_Bpd8bxbaFESzyGIwwBLVX2BOvKsraYHom1ek6f7JyDumcZMjgjq8xlIK4Q0XbuFqJN4BNaLs_Ljd0_i3atHuYQMHEx09ZIlVxOTGoHY8802sYkNO7auaFDsv_fScZNVwnySIvvX1o9_vbSdVQDgjRZgYG4vrxTSvtXPr7FNbUSACiKpbUigy7VZCUfpkh6WybwNWqKrvWNFfi2loG_9yR_y45gDuCoHioQn2cPd5Tr02UAKKnIwCAmWP77Te9FpoSCecLYwDhPYjF_wiOG8tAIjhC4dBHC756Z4y1UsDfa_fJWL95DZT9E1s9RzjwZGihjI4R2Zg3LY7PUkxKZ2_76BCGXofzVpiA0qk_KfyZsVitlMuc3oAKMtk2bLCXhY7jEeUCCDH5BWSRlx_GvK3KIpoJk2wPvVXVbBdoVPX5d1JWVPa587ADInIw7xLKb_1kBp1Ws3Sj3T9IBeYXl78PuxXiYF2estKGrtYy1aLVa6wUD8AHmAHz64zBJ37VRB0K3cbwOlk_ENNs8lALJlcZZl7ODO09jZjnx0SUoL2rTW69JOQV0uuFnDFVJ3nNH0wG1kSNmt6ppnTJC3aU8fyMKY0sGoLzPWM82VrnaElsHlI24qG5cU3tkk_ZzT_pOL1Z5ulOWE6Vzp36xk_nELma_M9sMqXIpeTSPKsnhEDj5ohYyyae4Ru7LhfNXBJCfjPVI7Bl3tgqukNPqGROxrcwFD0lLYR1VTgmTq20nHOsbwzhYxSROMuwa1P18wMK5l_ZjGjeK6A50B_p8FvVZCh7wB8kGKR_EP2xCHETuh2OpOofv7kBzUEq3mxHFOP7_Ku0qqAVKEcaJqkYAMmKDzAGyzLVjTKFSlw1I8RTr27p50YwGmr90wWJRBqnW_IrGZguCrqN_F370Dey6FyqWpnL0Z57tco4FAWuWAGu5UCrREHSESIuyi0LFPav0I6NB0D81OY8IAckO1duLWiC659TB112AwQBF4u6QXHTwPyeBNcEKTA0SGVTReVFLj9amsmYyGeimdxZ2DFl_zdHcbmBY4yIy_IKMomMp29Fy119p3PeNPUxtqvpMzbaeYG17Q57U7aixnRNcwuGEvnQUURiUKAdl3Dpx9d6cC4WGx8_vVEKk7jeDi_zURPAsmW2GW7VUEEN5Npu9ToaAraCQGQPgyxps5Rbkr6wiCQSYqhqZqRhjau37CySMejLHCzGU6TMin4E7tzp05VgW0LSPFXsgwGQquLVL8Ym5_JNY5BXWJ_lxD5mH4HctaJLyxJEZBNmj62SARDOI78vS0Hs1MKMSjcO8BAW4yS1DGiBntCzSnvdafBGrTgTfssv0mTJxRBhCqAP4r4HZyr6bE93Ec5ntmJHJSnXQdNyFVnYpOyA5_pCcFExWpL_W2H41MycQHE1IUaHtNE9xz9Lekx6Fesq3rQjkXIhOCcmCfM4nWc8vrk9MBHcRHQBxdcJs1f4WicV0SS3XPTGKDWpiROBosarywZDnMm6c91GaeVYShVPAsqiv_32qKvEx61_2fRcdCotMl67HGPhuEOE1V01oJLeWWjYJ4J1nQFQEOEpziVcX8KPWoFx50oARdmJi_37TaOT49glgqFlKSEzkq8VlBC9xpS7Kz1NNbJhDg4sdjv4acZIyrf3vGYk51MS8GNjtz28MK70rqyxC_k2P86eTezI93vpx01IKDmsuNIhsiP4QDn1fe7ZV3rtxyKRd9sSWorOS8aYic2mBwgi4zoIHy5Eut7WIoe1oJy745wl1CDuadL1dUo9IITWmnUfxohJH8f4mf0ukVu5KPCP60eVcUtosUYdBBllKzmYARhQFYPN_or5KYzgNSvjPtMOOVmfgUMc0fcAHARBHqqnxa9zLuDBQuXU04Ga4XbSgIWohwTqAhlsmKOl6d0P1Mrs6XN7Eux0VI_fvSccbXPTT2affDIVh8FGTz1aIofmxWlMqcDcDkI0GH6KGwV0Wa6nKjPqwdXENOS2lOHlZFxNPEQByQMW2vSuQejCZfBT16yXOP4nGmwkjQC9GAEavZDYbCoLAzAzxpQRdFT7OcvwDkXzPzaAONq9dOyO7lv_7ocxkmqK53HEgIfnzqMtPJTo3nb2q2oWScoa7686KsCxMoFuY9rOYZ6YC1cg_pdo7dPK3fFRHm3Y_v60kSqECDyW1DJtij2eBSAEv2R9Hl3MjhxCRcWaZWOGsRylU6igI1XoPmGsASJKl62KQ9IYxXqVGolfBWlLT_5tM0bslrZYnjYSK58KodNWnVxuoS9fS0PcisY_KDeyUgqZ8FOx6yIgbIpqVb92SEv6xezqAEiwbyF8b6GAw2LToPpy3mMy8PLdWXaBRyNU0nPqybGzOFKuNMAGTqEpro1QWZwfaEARJwWUAUcMcf5ZIP76LBl47BM99ZHdOnXDJEfBCLI3r2raHE4SfdJKPISARxBZx6LfnvXFrEkeJ6aBDF1pO_Th0py9akXCPtxkP18rZci3nVfSzPUQvmWsghNldKeKO9ng7UPr_fnoqjBEoAfeXacvWBV20q8qIzFMydKbXUdhjW4ZHl4hoZZsXmpSFsG1qI5gngrjcDAOGgWBtzDbn1XSTU_eRUYB6_jM9Kt3m5QubB0iF5b1OD0CVATus4oiKZAHSOxRzwOPya2eJTjuEpJzMgFt4JAYArpCqXrNUh8St2dd2UcH6V54H977k5e5HW2qS1chF40xvMhm_8PYteczHxD5V4XGhsCytYyqpvkY3ZRt6udth3l2KE6be3yM8hCPE0lQXrvYqZUpAcjEMnkRxny5bPwZasOQWpMsX95VX1UI1iLUeUBkgmZJQOVf6EtywKsUJL0lmJfdV4yN_XHvvvDAXKyBuyL6mE_5NFEIkRkjiCWggWiupCEqCM9N53qf42cFmGoT1tvil2PckNl5eIWZPVyvXbToGExQOjahKq4JpK4sarIKAocWS1g8IllzCe
call fcn.643cb468
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret