Function at 0x838554
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xb
xor edx, edx
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x158]
mov esi, 0x85d0b1
push ebx
sub esp, 0x17c
mov eax, dword [0x858f30]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x142]
mov esi, str.Microsoft.Windows.Kernel.VsmEnclaveLoader
mov ecx, 0x2a
rep movsb byte es:[edi], byte [esi]
and eax, 0x3d10cede
mov dword [0x858f30], eax
cmp word [edx + str.The_ALPC_port_does_not_accept_new_request_messages.], 0
je 0x8385b4
add edx, 2
cmp edx, 0x464c
jne 0x838595
xor eax, 0x994d4483
mov dword [0x858f30], eax
imul ecx, dword [0x858f30], 0x62e1bd0a
xor eax, eax
or ecx, 0xf7e5b654
xor ecx, 0xa3b44bad
or ecx, 0xbb110055
mov byte [ebp + eax - 0x118], al
inc eax
imul ecx, ecx, 0x2709875b
and ecx, 0xb5fc9133
cmp eax, 0x100
jne 0x8385cc
xor edi, edi
xor esi, esi
mov al, byte [ebp + esi - 0x118]
mov ebx, 0x29
xor edx, edx
and ecx, 0x5c664e1e
mov byte [ebp - 0x16c], al
mov eax, esi
div ebx
movzx eax, byte [ebp + edx - 0x142]
movzx edx, byte [ebp - 0x16c]
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
mov al, byte [ebp - 0x16c]
inc esi
mov byte [ebp + edi - 0x118], al
cmp esi, 0x100
jne 0x8385f1
mov dword [0x858f30], ecx
mov edx, str.Bad_Image_Checksum
mov ecx, 0x2c6
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x838682
add ecx, eax
cmp ecx, 0x8dc
jbe 0x838659
call fcn.00842978
imul eax, dword [0x858f30], 0x21ebc7d9
mov dword [0x858f30], eax
mov eax, dword [0x858f30]
mov dword [esp + 8], str.The_ALPC_port_does_not_accept_new_request_messages.
xor esi, esi
or eax, 0x89754cd6
add eax, 0x728905d2
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [0x858f30], eax
call fcn.00841b18
imul eax, dword [0x858f30], 0x35639f07
add eax, 0x33ac1a66
and eax, 0x3b04bd24
mov dword [0x858f30], eax
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov eax, dword [0x858f30]
mov dword [esp + 4], str.Bad_Image_Checksum
mov dword [esp], eax
call fcn.00840fb4
mov eax, dword [0x858f30]
or eax, 0xe3691742
add eax, 0x582f6d5e
or eax, 0xc57f40d
mov dword [esp], eax
mov dword [0x858f30], eax
call fcn.00843ccc
xor ecx, ecx
xor edx, edx
lea eax, [esi + 1]
mov edi, str.This_operation_is_not_supported_on_a_DAX_volume.
mov dword [ebp - 0x16c], 0xc70
movzx esi, al
mov bl, byte [ebp + esi - 0x118]
add edx, ebx
movzx edx, dl
movzx eax, byte [edi]
inc edi
test al, al
je 0x83874f
add dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xff6
jbe 0x838726
imul eax, dword [0x858f30], 0xf39ff7ef
mov dword [0x858f30], eax
mov eax, dword [0x858f30]
mov dword [esp + 8], str.This_operation_is_not_supported_on_a_DAX_volume.
lea edi, [ebp - 0x14d]
mov dword [esp + 4], str.Bad_Image_Checksum
sub eax, 0x239668ff
mov dword [ebp - 0x170], ecx
and eax, 0x7e26877c
mov dword [ebp - 0x16c], edx
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [0x858f30], eax
call fcn.008430f8
mov edx, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x170]
mov al, byte [ebp + edx - 0x118]
mov byte [ebp + esi - 0x118], al
mov byte [ebp + edx - 0x118], bl
add bl, byte [ebp + esi - 0x118]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
xor al, byte [ebp + ecx - 0x158]
mov byte [ebp + ecx - 0x14d], al
inc ecx
cmp ecx, 0xb
jne 0x838705
mov byte [ebp - 0x142], 0
mov edx, str.This_operation_is_not_supported_on_a_DAX_volume.
mov dword [ebp - 0x160], 0x24
mov dword [ebp - 0x15c], 0xffffffaf
mov al, byte [edx]
test al, al
je 0x838817
sub eax, 0x30
cmp al, 9
jbe 0x838814
add dword [0x858f30], 0x6414fda3
jmp 0x838817
inc edx
jmp 0x8387fb
imul eax, dword [0x858f30], 0xc1e8295d
xor esi, esi
mov ebx, 0x38
xor eax, 0xe9d005e4
mov dword [0x858f30], eax
xor eax, eax
cmp word [eax + str.Bad_Image_Checksum], 0
je 0x838857
add eax, 2
cmp eax, 0xde4
jne 0x838834
call fcn.00842604
xor dword [0x858f30], 0xb5163f75
or dword [0x858f30], 0x83bd40a7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add ebx, dword [ebp + esi*4 - 0x160]
xor eax, 0x4bc11ede
mov dword [0x858f30], eax
test esi, esi
jne 0x838883
mov esi, 1
jmp 0x838832
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 0x14b0
mov dword [esp], str.uK6KcGYH9kQ25ifrBH97ftlFThgSw7JWxCgKpotkEpTIAlBXsbGEDh0ycjB7wJDZnnCHTQU_ScCdruZqpKzVI6CdJPDXJxvWiLKST8qrnVfI332BX28ttTdPcZX_YtPxMPAjOgQICqE5T0KFtXXv5fN2ZPxgU4DTT8m10mmhjZyahXD3zRHpS_wY_u2WWxxfpBJqkYCeWFOMKJ61cuaf40WYR_KBDQskppWZ1bSlZVJz2XyYLpTwTNSqJWg5eGWclepiTshvoHwMcWM35afjowFx_0AXS7Hu3Ts6uUudu4ypqj7uCKuDa7Y9uSAuDnytZnTwGMHUw_ajzF4bSlNiTXLBSPk75Lgd6sFFagoFQd9TOKIa2q_bqXIB7_7VQMYtI6oL9Iko_iAQCzn_uPTH9luD24ND0hpkI588dgreL_mw77tVUfvsAAnAjMhqyNERCXkuPDs4ToCIcSlP2qsvk4peJgb0qEABn_0vcPR8lndgjqsVP7G3yGLE6eCZeQJ7ZeGMNUJs8IlSJe8_IAGorzuGBB7H29jsxlTNqiM7C5fKhcBpsbxbqIhy8499lVaIgDNl00RbR_13Z5vNVG7wjKrfrdc0Qp6z0DUlNkY4uN12WOpLu1LQC4tQfkXmDm918eI1ngG3d6Lz2gshjMJDInp77fHFmcCZj89WJlssGR_7fbj7IYPFE9EK98VzqGCdEp4FNkCQYiktoUeBdYMqptREs1E512VH9iNORqXUjiGvrif5WV7yYYA4ErwgKVDBXfJYio2rUA4OY1sHCKbG6EofO8nqMFZk7fn1vP9kAwPPzZuvomL3u8MONxnpAZtEhObQ9YvaB0_wiBQZrPHebjPNeIyw0mxF6VlWnuYBmSX85Wtx5Qm7fa5KUni4W2ZvPRG0Zfa1hfyTOGVrlRUgZuo6t33TtlnZBLHQwyCD5P8bQLDixB2BIsd_aYko1A0pBzoEyd4Q2T_glQZnnGKtARx5VPgRm08vzkTgJSTvbBW9SH13UB0MAmCm7NaE0FSrCFfWySuTbNkVNrzzCsALwjFcZtdst90b6sv8Q9Hs6v9Ihfs8B2pOrOxMmuLBLstrGiqk7x5EOZjbfMpwtWbxq3SOUWSlR3gbL3Jwa95j8fSfTN2mkCVtwVgLSjHtH1xAGYXLbqgdiXPAxUrDqXws5RM3nWBUvedyX41pmU2pxRun5s7q3ejkyDZByu_tT06Y5Sy4IYydTJmqhhiNUxenO3qiCqiH5oo3NB7Irxar8vxSgqseH7USjBSvLQfWTwrjJeflUNOs6EUnMP6PyEn_Mp1PmTEqg3_Kc05WPrQ5M3UvlYD1imXZJfxT8CWjJpqDmSD5wfJUuyOIjJP3swkhGrZENcxcYGFTIJwJns1XBTOwuG_FoMvV_CtS6z4RAgEYse9nKBmVxvFDibHrpgo2SgKKZINIa_j6xsey937p1nDFGU9Gk0VSf4uwMoq5UADjMwRefX32kGgdxGxAanJp116knvK3oJs0kq3giOQG6yvYZmj6ceW9qg4zGsnPsJmuysRsG0c63gSNKdQnwOctwywOarZJNMwCNaTYDxPzBkXYuXWRIpifxeLlbt8nVBdnWKoAx3_CxVC0o3FYbDdHZy23OXNJ_e7vTa48apvSn4s3GOO4Vjv0cbpUm80KTpdqSWiARcWtZDbawFNMjwiNB3wJTThyC7aaWy9jrOHsV3O1D3dMrkVygAzFr6VNByQK1SbmnXS_Wr1uxWoZqSjTaaUvl2BpfGDBXNkk4QmgwWwqv0O6UpQrF_ipZhHltHblIlPbRQuLL1Wimg8bt7eJyLkioFog9Ytysbzg7cmzwQ6Mou7n5z6SRSfpwBD44RSwaCQ3zgM1hizPjMShAzHwBxOxUhbFnglx5zim92p4IXOTEMyNjAq9CxWx3RFsUgGryEfhfcy8Omj9h5MfFqZFyTNA3NUfTIiT4isXQ5F1zVnla_oyIAymPKCePf6F6B6RVM2q1UhgDKZXUll4ZgTdqwpHcg6iyYnOcoZE9ZcZhJGFwukQe8BvacwOYt_ios32O7qrhecwxot5ZBQULiqeR0WVn1Xtj5Ijp6mltc33at1pkYk9gmoV0_bX_6BFE5vIRka2F5Oqni57d1mhC_t4LyTBgHjCto0NAzOMNwafEZe8LKkqGKPcZeZvrpUZ2sU57Doh3rP4K5YisUbdG0TbCb4MNaiE1x3g1roAPdxFmGtLCp4GHw1_AllDbboyqp4ZcPClkywXRmPERLCBhrP6NunRHO5Jcb5SSxbwz2ymZUyYV_4yF1z270vXbREQW5We0EYf66qtS0Wp0qHzYELzr16zCZJAEQkuoG4CYvWMkYQYAOVp32YS4gUElIFFwy9z7pIfFPdrj1PARI5_IVIAM9OKB00Namcqq_mCRe92rhTZzfrQD6jPDiAzSf4TFsJCGVByJmzwvzReENifMFWsA9Lo_myVrvxT84OHDfbNMCrcsp9XrNcVB9rLcx06Qn8YUumqWDi75fKdwoxNxgo59ukD566Ski86OEWlJad7K6cbtiCLtvLaLr2B3gseuVolSEWkQiKBslYcUHBARSHs_LkunLJXnkYkWFvoLAWfKwNE8gwmKd0k7wco_yS4BHSVxMwU7xt7u1xsoacBcwZvWVz7efkavbL2KP4OUjZTbzhqAkuyxiwK7pqvNT9UWchS_l9dUlcXdccTa6TKlwmegdGxlmxTqgyPQcLq0DakPNxyAnCc1jjV2W0e61IDYA40eS5H_kX5LmaXSDoialIacu8GenlnjMpitMYZFSl4RVy0gihwY7YqiSrAhe6zCXOOglqfrtB94aedCuOYElu0xxY5rxD_zW9woi1uBbFbROmXI_6SroLSb1PPz8zc1jXz2rKlmGZhK7jpHwyeJjNCBhwaCVsZTOC6M6CcsxFYa9Fo3KRdE3GIsQwMQCAhvsH83yqBwNh6QVVWuQ8QxpqQ3xzEkjcyB7ycNqia7E5HxUfEpNvuUzWHyiM6O1VUd2rLZ6tUHcq9FFumGBCzF4ZE5aZ454opQcIlzHjR0OdsI7wBuxDENccmrFTwGVZpkwcrw87GWpbVU30i1UHjivHlNza9CkbzxgYKqP4rKJbBgnuy3srC308GrK97rrbzsZEssT6IefOj65UB901IQU0sNZhkXLKqPThe3zYu4AOA5v5WlvfHkTQBnZdnQSreBMX0SoaYW5tlqAUYm_V3PhYqhmFQOLY4cBHPLanFJX580JEBnFPeoKeLy68p662Ff9zKPRMYUkeDl2Dao3U2LvmJg54vMkYHcRWKLvgbzMWkJbO54yoEb9K_JXfhTqtVKpzIoEV1HVdWrpd5PLV3XKd934z8A1DxIS3pxUwxan9ewyWmNkTOBa9Z2fGcCpdY40w6S7RBUS7dLonf3J4YgP3XPb7bWXtJhu6WVcDrK_QE35INPBWRSX6g_J7JU_xgPyZsrxibZrOyCP0zH0fvRtoBMlVV4zVuKKSVxWY1BX3skfxEaf_CKu7KeiRIgubDZc5CiU5Nely60MW5Jf5rwhX8kfWQ7FKv6q5nB6AaA3QAkF02W_1W4DhmkElKAjRpQ_5SlKPc2Y6PYnaDmbCahSh4cDJzIdYrxTfSIZmYfGZ7l2Fec0JeRD0o2sGnGNc7rdzw3uGKalr0RXrc_1Qoq7WoJyMVoUwYwuPcYiH61jF9xWyezRNK9SfrBAp_SOjcF6aiOuhRTgDB984xhlDV8mSElOOxcNaTEGQP1rSnb8yG0LYZqbeMLwAVzQQ6GXr_5GJ6sdQhVTcZ04SNeCXgoaVyJXaEeSHUCqWX8ZrChzRN7lJ0QefyqQPVzdVYC33E2cI9Rztw1t9u3wvwzdTsvQKTQFmQH8YMOgM_oap3YdBfOnSLU4sMfL3ZK1IcopSCVGV8XRJHlsIih2v9yp8k0RZN3mkXyGONXku26vZkYsaU3gVqSIkw3OSoQLkr0B9IegTqfHuoeqpfza_vgRRn_PzmkqrmOIl7DyoEdkLQoL2qIxdSBYGDrO64u31CXMuE47
call fcn.0083bff8
add esp, 0x17c
pop ebx
pop esi
pop edi
pop ebp
ret