Function at 0x643c7c9c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov edx, str.This_volume_is_locked_by_BitLocker_Drive_Encryption.
mov ecx, 0x1b01
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x16c
movzx eax, byte [edx]
inc edx
test al, al
je 0x643c7cc9
add ecx, eax
cmp ecx, 0x1d27
jbe 0x643c7cb2
call fcn.643cf804
mov eax, dword [0x643e7f5c]
lea edi, [ebp - 0x149]
mov esi, 0x643eb40d
mov ecx, 0xa
rep movsb byte es:[edi], byte [esi]
mov ecx, str.This_volume_is_locked_by_BitLocker_Drive_Encryption.
mov edx, eax
or eax, 0xddfff26f
or edx, 0x997b26b
mov dword [0x643e81d4], eax
mov dword [0x643e81f0], edx
mov dl, byte [ecx]
test dl, dl
je 0x643c7d1a
sub edx, 0x30
cmp dl, 9
jbe 0x643c7d17
xor eax, 0xe788f601
mov dword [0x643e81f0], eax
jmp 0x643c7d1a
inc ecx
jmp 0x643c7cfd
sub dword [0x643e81f0], 0x34b0552c
call fcn.643d27ac
mov edx, str.This_volume_is_locked_by_BitLocker_Drive_Encryption.
mov al, byte [edx]
test al, al
je 0x643c7d5d
sub eax, 0x30
cmp al, 9
jbe 0x643c7d5a
mov eax, dword [0x643e81d4]
sub eax, 0x17a4282b
mov dword [0x643e81f0], eax
mov dword [esp], str.This_volume_is_locked_by_BitLocker_Drive_Encryption.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
jmp 0x643c7d5d
inc edx
jmp 0x643c7d2e
mov eax, dword [0x643e7f5c]
add eax, 0x44714bef
mov dword [0x643e81d4], eax
call fcn.643d0f40
mov edx, str.This_volume_is_locked_by_BitLocker_Drive_Encryption.
mov al, byte [edx]
test al, al
je 0x643c7d97
sub eax, 0x30
cmp al, 9
jbe 0x643c7d94
imul eax, dword [0x643e81d4], 0xd3f2e636
mov dword [0x643e81f0], eax
jmp 0x643c7d97
inc edx
jmp 0x643c7d76
mov eax, dword [0x643e7f5c]
lea edi, [ebp - 0x135]
mov esi, str.The_sublayer_does_not_exist.
xor ebx, ebx
mov ecx, 0x1d
rep movsb byte es:[edi], byte [esi]
or eax, 0x4d75aa1a
mov dword [0x643e81d4], eax
xor eax, eax
cmp byte [eax + str.This_volume_is_locked_by_BitLocker_Drive_Encryption.], 0
je 0x643c7df1
inc eax
cmp eax, 0xa4
jne 0x643c7dbc
mov dword [esp + 4], str.This_volume_is_locked_by_BitLocker_Drive_Encryption.
mov eax, dword [0x643e7f5c]
mov dword [esp], eax
call fcn.643d2a58
mov eax, dword [0x643e81f0]
and eax, 0x7745cccf
mov dword [0x643e7f5c], eax
mov eax, dword [0x643e7f5c]
mov edx, eax
and eax, 0xa5633a02
and edx, 0xf78b2e24
mov dword [0x643e81d4], eax
imul edx, edx, 0xcd34d2e5
mov dword [0x643e81f0], edx
mov dword [esp], 0xe4c
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push eax
cmp byte [str.This_volume_is_locked_by_BitLocker_Drive_Encryption.], 0
je 0x643c7e30
call fcn.643d4004
mov eax, dword [0x643e7f5c]
mov edx, eax
xor edx, 0xb0a50884
mov dword [0x643e81d4], edx
mov dword [esp + 4], str.This_volume_is_locked_by_BitLocker_Drive_Encryption.
mov dword [esp], eax
call fcn.643d2a58
mov byte [ebp + ebx - 0x118], bl
inc ebx
cmp ebx, 0x100
jne 0x643c7dba
xor esi, esi
xor ecx, ecx
mov edi, 0x1c
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x135]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x643c7e70
mov eax, dword [0x643e7f5c]
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x15c], eax
inc ecx
lea edi, [ebp - 0x13f]
and dword [ebp - 0x15c], 0x7fcc4c00
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x118]
add ebx, edx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
mov byte [ebp + ecx - 0x118], al
mov byte [ebp + ebx - 0x118], dl
add dl, byte [ebp + ecx - 0x118]
movzx edx, dl
mov dl, byte [ebp + edx - 0x118]
xor dl, byte [esi + ebp - 0x149]
mov byte [ebp + esi - 0x13f], dl
inc esi
cmp esi, 0xa
jne 0x643c7ebe
mov eax, dword [ebp - 0x15c]
mov byte [ebp - 0x135], 0
mov dword [0x643e7f5c], eax
or eax, 0xe3d6bc9b
xor eax, 0x90d98122
mov dword [0x643e81f0], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0xa
mov dword [esp + 4], 0x13b8
mov dword [esp], str.ErEf12BUvB2qZnyd4jg50bfrf13KaanjMCF7zQzwwh6OlhjhkReMPj1I0E6oCWXkqvN0Buk5ldGWlaRBULS7DLvHFr4lwgqDaAz0HAmBh_pSFB0TXqaM_qJUwxW6Yy2D9a8OtNFGl5cayjGIioS92Fzwq0LWJ_7GCDO_z7caMvSjXX2QVrCQVp3HIceGPgR5zl_nl2e5ODvecqbgOjLGAdqSCkNDp1Loulg81laK_7ZhbH1IXKERCo6K8kVo0Jwrz1NL8qAQvZV5pLmdaoQBAIPRy3QCPToWd9vFZhbQVn9Fx9m2aLHYPc9vLs9NFMrvNsti2zKBlz9CPDNWE2q6xTFKCIDOYdE4hZGWMLU4KHfWSF0JCPXqQahtuCEnlkTHSJw168n8gh0_nXE4b7SwHwFdWcN9cEa4CgwcgrmBFSnRJB_gWguHW5FkW7WZc8ZWa7zI_N_U9LcPjAaaxWUq1RFSJ2BCWK2UEe31REtK_hbMciSc4bGHn820hb07J65N5PEm9r5fqM8AgXXIQmcyB17gDlbz3TzKStVbYLr_x_RcHsNqaJJ72IQ2qUB3aY89agE31KHPQfUHgCSQH7QX2qEIocj3Ql8aKKhJ8_Z29BamspGajURUhNLwD3EAUkQ7e2EPXOWPAlVH40Ue96QwDVB9HswM6TDHnRG92GTpqnXJbvo139uIGs2LMigyxhCp8i8dFVxo_3ktvbZBnzbRXUBj5Gplxa3GBJXC32AdyEAnBNUCZKyDJag1DHgRmJz6YMWP_4bOSmbUW7GKob9UcFiHGccirSWiR00K1qPPTJQgMeaMWHySlLFzQmXjxeNkRlaC37Rd0CHMznsfx65zgmvMfobEPb27UhjvxOWkpRCJtFanL5ln1cGusTgMVrAFF6_Vm_8UeZdzbUoLfgEnZ33LH9CeW_MRZ_OfRgV0Lrk2xWv1LWpSX0V6Wvvxow7AWLpiAo7ZfUSjDBksHN2xV71TdnTGo9Ov2_N9CfH2HayXJrQfnLdNCud4JDvchSzuFPqLFh5KQeCzrh9hlCH_fsAAmeSGpinW48Spdjv4Ni0psH3U9I_jopX2QV2dHgnh9X0HGQJYHrLQ9Reqv7J1WJlrYO2Ar2z_xgIId3HsEEp8gec8G8uMR5Wwp6QGFMVCu8g59HFU9MY8cpQu2IwGPeNq54FCugeMTGDiecL3ifaA1fELV8zT2aXA7kZ9jGFnWOqre307nrDhiV7aUQrHzBxtzPCbLQQkneTIH1gQ3exEx4xCeyH_nJfofU6bioaodTs4I29PxzEA9shScE1ixdnYm9raHHXJGkNLX1He4tA_8YPmYdROg0EA1XyGsKyGmFB1aAPF3bImfbQ8SLao_xHyFqxi0rkSJMg8DCo0YA4RaNFtuzVMHi72Y7cluV3kXZN1RCbjSQrh5_6QI79llR4EZfjHmGLObpxBxZu6xCjMNc9k3xvBkZkVX287AIIB6RyQqV8Yq3Q8xns4EOAdy98JdC1d07OCVO2w37pj_H3hfqya2oat1dXNvdRLTSWKsvclEMJTpiRmW8q4211jHdK33piO9I5BtUSgt1qcDZAJ9e7iQZ7HUyeudGJvGi9A5xvFp6rQs7cTBq6Q0My0_8AcqioUBWA3tU0wFZ5FkkB7Gf3Buy2AEYCDXYF131qzLbSGib133hfnHZG1ost_hpoR6LgYZhB8lzzEjA2ELNn3t8vxO1RJa1g0Yjkz3z8ITz9uXTOaH8pRO03HlOD0uh3ywY7erjaEvTDZFTYWwTtIK4KDPzJOjq1KVbpX2SiMmrA_XgYr0CQ_qCSyyn2iQRaPFZwojaD3MuyPpnepif0nvc1WPWfNa_ONpqINSzkjF3LgoVFh_T1OdcG1vsjDYFc7bWS5UEbERTYGQAXS8nkcWByX_Zhc2Hj5_AZenUctVWXDAxpZnofg0gWawbsea5vVN9Bfpv6RujKVs9BkBnQeUSYpK0USnL7TQlVPlf4sEHla2gNPoJnszH_QrXo5UIdJlFXUnNv0nkj5uQAYV613r4tAtI3GlIyovjVs1AbGXciLwEmixlcppSehsuaRfN_T_qWiTA7kN6kPP4Emfj4iA1SrCrRA4psBAb4GTv0jS7hoZnigQgcRZE29bNbPYK9P7AQAXXMr8kABGaaGakKK1wRFM3r5fqKFCmtEIbne6T2_wZwztScQ1IQ63ROt7sgk2VeFESO4pedL3C8VrOMLdvxv6wRgEpckxqQhlWmwgsn2vJ9ltb1rNEPvwUH_V5yaKXAX6ubxPGANigHE2UGChDi_j0g7xh4Y84wCnY5WrPSxzTqw2RmTVRDs_u3h2duHuFHDfCzAZ36brUeMjH8M2VeZVTYDVlPNKfzyJe6o6qfRZv2d4ZTJqIZ6SFFWAJesLeIEZcN91UnxiZDFOf0FniQJ3nTCQUn9BmQZtpDnvlBt3Toc42j4V4dtFUezDFL7VBLvO1NrOrkx9J6osRcbQFIxD6rvcfJzpCE0qjGIfg6KZ1vcH_6AY6QaFQpCCHpweL_eiCLm1l_MzUyzmzS4V9V2rwQYFYQ53po_G2q3Ihj72LEnx3BNUp94sMamMuLKlWBHsC_jzkKhdsAb2sTBhppTn3Y5KNt72kle4NnEirxM10SXeZzUyTYEo4OLsGoXwqybzTkoCJJ15uN2AVJ9SxVrLHCn6DZIUI_Y4xsOZMEZcoehg0n7K877AJn0VcRUILu2MiIqEV7s5CgUQ_cMy4BE8bvW6NbHw33znuiidtyfofhbiRH9FcSELN7ZAjRkBCTwquTxqkJRwpLhZ9EoEbQFrwgo_combwqbUdZX7Hi2GDpgmW0dtBUBDZ_MIa0WVbmUD9hP6F4GE4HSw3fmdiFimV2SJ8cUcU4Qi8qKob7KtXDgNCtCac3jpnuIYqKdVvBDpP9GzBBL5PtXtKXkFsirwk1tGUDDQraPItEMxxHjPMWyiSw8gZp4iGvTIk3EIIQf09cDdFrSXF06cjbVDqpOSAQTOW_LudEON0jOUsceSDdvXCF58rxIi3mCNOMNsClR7fBUUXCk7SekV24kOpR2YVnBByFTJDMTwkkYIFhNoqx7sf5NxF3jckcm3Rf8t_5v3YutuxcTc5lVoyfZPIBzof8qJjR4H_xiy14TuQFj38R400T_Dst11YY3ZGWJ6tryWBI7Zz_IvH1gsAydhYtocSc4oLYnsSZ0VlCOj5IigEj27pVH2H_8iLXP9uGbnhaP93bLZSKobNGgvIXY5gQ92q_7G4Vok3apK2cpamiIsIyjj9CEeK1nCFLM83Qz0oBU38kGbiclB8DbIo54TwBK8iPPpr3ZcUB1trPjWFxxuWnmn0HiDtKJVilqjlmfg5BNqgn6iKE8uBwuRU2ERjfSve76MkoiIfrniYhUzfFXB3oCyeuKYehJxGoMsT762bwFB16WR6ehaG2m8ifauLuCXRvjdaqXJnrJrLjLQK5mrwR3TBJw_4QBGvTElFZ7qpcA_gXfpvHw7evRwQs49ojTbRR9NNP_vXTbMtIRp7NyHbYRsjAjMfU6Nx1YpZGlBDimUWllAkh6nXYdTX39lXmb6U7mjZfRqWPENPLd12YZwNZVm8ckkgEjaGRPvojOjr4JfcXEexpSHIsX8yTz4ZDt7UnUclU2WtNlFS2GKlfRV7lSabw5E_i_JwU0I4aE_lRS0uetDTTIzeOr1xsD6krGs2aUXyLrYh9B9wsgvvfJGNRn0MyAyLxsD6KzVOWhRJmgOU_P097mK6UIdrrX9CUZQZ2U5zsuU8QtoXHbOgPmF_5EyMqZY91tuAmv16jPTJTTgQsW8NH9i9Nrbp5Axt0kBaOKgaKPAyd1FCkZbT885cobanFTsHL2_hR2IKmj4okzIggUEJUsN2w37rp2Yu5nBQzbFR89ZuGJ86a3wdNKv1VAa36XE0cYaK6Cf68M43_rKLocygp8ie0EjYaGKLWSWiN8dzNwtKhKz5k7xd4IZEPp42e4EnSZDwQnaIFNUnxHfByPu9J5KOC_6Ym3lT3BQ9O0J93riIOi6mBnvvVx
call fcn.643cb468
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret