Function at 0x643c7f64
Capabilities:
Encode data using xor
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x12
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x163]
mov esi, 0x643eb469
push ebx
xor ebx, ebx
sub esp, 0x17c
mov eax, dword [0x643e7dec]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x13f]
mov esi, 0x643eb47b
mov ecx, 0x27
rep movsb byte es:[edi], byte [esi]
sub eax, 0x16435a03
or eax, 0x7be2a3e6
mov dword [0x643e7dec], eax
mov eax, dword [0x643e7dec]
or eax, 0x6db27e1a
xor eax, 0xb88d891d
and eax, 0xe9b5b5dc
mov dword [0x643e7dec], eax
call fcn.643d1c54
mov byte [ebp + ebx - 0x118], bl
inc ebx
or dword [0x643e7dec], 0x458e240
cmp ebx, 0x100
jne 0x643c7faa
xor esi, esi
xor ebx, ebx
xor eax, eax
cmp byte [eax + str.RTL:_ERROR_MR_MID_NOT_FOUND_is_being_returned], 0
je 0x643c800d
inc eax
cmp eax, 0xeda
jne 0x643c7fe8
call fcn.643d2c24
imul eax, dword [0x643e7dec], 0x91e027ef
mov dword [0x643e7dec], eax
mov eax, dword [0x643e7dec]
mov edi, 0x26
xor eax, 0x1d7f740e
imul eax, eax, 0xce8c2b42
mov dword [0x643e7dec], eax
mov dword [esp], str.Failed_to_acquire_display_mode_management_interface.
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
push eax
mov eax, ebx
mov cl, byte [ebp + ebx - 0x118]
div edi
mov al, byte [ebp + edx - 0x13f]
add eax, ecx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
inc ebx
mov byte [ebp + esi - 0x118], cl
cmp ebx, 0x100
jne 0x643c7fe6
xor edx, edx
xor edi, edi
xor esi, esi
lea eax, [esi + 1]
mov dword [ebp - 0x16c], edx
movzx esi, al
mov bl, byte [ebp + esi - 0x118]
lea eax, [ebx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [ebp - 0x16c]
mov byte [ebp + edi - 0x118], bl
movzx eax, ax
add bl, byte [ebp + esi - 0x118]
or eax, 0xbcddb62b
movzx ebx, bl
imul eax, eax, 0x54b495f1
mov cl, byte [ebp + ebx - 0x118]
xor cl, byte [ebp + edx - 0x163]
mov byte [ebp + edx - 0x151], cl
inc edx
mov dword [0x643e7dec], eax
lea eax, [ebp - 0x151]
cmp edx, 0x12
jne 0x643c8078
mov byte [ebp - 0x13f], 0
mov dword [esp + 0xc], 0x12
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1584
mov dword [esp], str.fPmyk8EFSUHU4QcSWoLmY9BHsjUkljuo7a0vfbm9GeprttqGfNCBlouoRNJSuaSafOTds6djTNAxkwJBTSWCEADO8ZVOVTaOnxD6vZzR4Gy4O5IWAbg59lb51iNR1DQy4N68dCKE5ZzTtqoJMrxVj9zXg3daClee2BXTaL1S22ty3k9IpCe6oED53gO_vIMgYe070IL6qw3ETw6nag9CXCiiiAAdKdS7AebikxbOmKYTZGvdLPeU2aZkNb4geQF1gF5kPfo0qISnycymsw_EC8NSo7Idb7xY2OxOKdrRBB0P2sr3oM7krB5EBI64p2iN2uabSAkoCIBF_Y4zjDVG7kwhRy4g6Llwf5YxvJKV6i5c6t7l3UcYrZOPSKJJQoDMhP2Jg5oNPBuLSuTbLTJkMu2LidLwbPL_ZaelxLD5qvMvm7W9lYLDK17oLfmKZmXCCnDUG7_m0YpXzQFZeaj8mam2LHsb7lOiaPxj87SeDmMpCgzQ12Bbmbu93zxdgjvJVN1BrtJR0wiYNaLqKLLNxseQD3NzsP8VsbDqVfeNvLizToIZiTuICa8KmUISCDAfAIKMymDb8vIROI1TTRDpjR7SjTjS6kjrY31aU4Lu4O9o1U2CIK42A7uvkyuq1sCjIGKhGR1e6BfGrZ8V9ztoOfg_tbh7q5lKbXv4kL5VAydhVs0tXPAGlk8Lv9zOvF6L8Sn6VMKtJ3AdzAqQ36BWaYIuaJ_z69TpRmglAQXWUyaY7jqqTKu2rHbODniRQnDNuca60R59R_xgWwQC4GW6dDCJselij8H9RYWUu8seSmycrSoQMxcgaFH6PN_bSE2T3zL_T3YS1OmTbBJzzjxAkpgTICi8fEVLVFG8E9E4WqRZTpRMItjf8xpouwKI4ZcFg8LNdKZyG4eAHqRuoUuIj9T3VTlYPvX0HgxBArLWLlsp82scPC7zh4WQN2RwntW9bsqLaXEeC0EvnDg68xOYC_9j13n9fd_mGKf3q3EmvexA3XjnWS0kD59f809tz_vub36vDOVdoCVq2Y3lAh882gDOZY3AhgUUQpzCcQkIO0263NQjOOlxMW3TZqy7hlTmwkEsAZagOTpRUhChznxu44QAVMEcLtF30s_VhN6m7YoCslafY2wvujh9lAJZdKFviqtPejfza6bagleX2sdzbjAWcO3HQ3kWaROKlYGVcrSf9KZo12x6dPnj0jhf76Fl1cLKxnocxRgrO4JjrNnHh2qK1kbYWuP5XHXeGnuD5R7n3AB_EAn0AOpW15MHL0ZbwMbL4dDnuKVv47I6wlSfqugmtXX4NbeVrP001vSmnrTmiDR12vV6yY3TEeS6hss1xyOvpsP0IGT2gUETEBlRGuBziSdQNuw4RMX9ilRkKxtzKJ_hPwRjclK3lg8Yftx3zCbFgr98XW_Bz05I3lFSCKsSR1Frx20_II_KoOSCFwm5ERsOLONfhC41ysIEbFDJHRd6oWHehl9pDd6PgrFsHBD82juCcOHOahN44YkBxArbU0DEDT230rMAR7PMUjTBSK3s6CtEUOnyVW9jWk5_CQRUHKLDsJntG4PtMQo89PzTRDSVvlFmh1TrIEywv8_S0FNnCMPaPeGYNR9PI8KRB666K5QQE49Y5ahjEaHs5z2tl22xOYr7maR5jyzwJi0W6qqb58NGsj0fQlZofxOHnn_kXCgRxfWEIMo7JU5HEyZgwTjTUzAufJac1XElwliYO_eqgAKIjOHhixmwh0ZIIKsZ8DXOboySg2dV3GIL0Xi4vrww_q_HI086lDJQkkkSiBvWEUe6rR2Gye5eevmNEUbroxpSZVRtA5QMfyA6i8Q92XfuwQmPY_N2zBJ3660yM1JWEp6BHl2C8u6ioWDwxajd66NlZ9Qq_z9vFi0BoOnTQbW4FF5H_qfuOfvazUwWq2RZbDcMjLfKMDI3SbCxS707Uh4qiAiZZSOZsDyPDxp7PUHK3OAIged6RpBlym3BLGHwbY7xdLN5o3HHe6Oxta5SbXnO_7AxidcSt3kqgbbRiCFtxSoAe5mXoCW8BcPv4iWCCz1iCFB9Jk03cm0BDUR5xgKdYuI3IKTvcYPhe6LWzclyb3c64ZwT_WTIy3oynH3kji9k1sewYFPYH_78AqKqzV4kDNbsPBGx_iJA7ydrk88kgh1ad3WrPELWROcKht8f4q8BFND56GHqH9iHuV0x_ggSY0S0At8doEwjK7kBL2QpSEjfJ3Rj90mxtnquTgU3MtZOPeZ6_T0VDIuRM2nUi5kbg2sqfq6UUYHYiCqEAW7JPBK5pefNbxzSxSJByvQs7GXDiBObJVGvhlr5DsAgT2kNxpQJbrtW_35rwsJ7rERUr3ggkD6qIiRhFXwDwit1V2NlewEbgy6KT9lWBipL_ZBnUEvhkJwLtxi67Dd8nOkVtB1Ohczcia94IhOwVB9Ak_sM6fCmOPaxFPUoQqv3RL_khVWEFRqh1Twmf8uGkYEKO7hRivicslpLhphkA3Ih3lv8YW16qdjIyp8ydVSYyPdIKsH2p3zWECroDvHdKoodVVF57VBRuCbtYpwyH6ioLT8N5c6E_14yGD6JQ8joaHiW1CDl28qwshb_7btiYqJ5w_EHCXDSRCUqDwDlgzgm_Qce8sdfG5mcj_Pa3QI6IkFj6S9wQIwMLq_mze1KR0aQmJoLpbrwdCQdvpqEDmXIgROYjQXzP_le_H7rUJZQwFGJESxvOpLzbB6TLngRF_OHsnyWq9oUu_biXzm29YpkkpCc8BLSJdGSdmbcGaJp_1YZPNvwTjuzm8YLMJ91TK6N47Cd92dK41DTacnTSeA7luIt9PiUEp6Aw3vBExxIBrBok1n0KtNlqw0zsgpg5LXE5PT41Nslns5JuMyeSO68Qus1SnjytQeICIkA0UnyRzgNbNClx7si_r2zO2vOAhhuQ7so6o4NLu2lv52xIr1L7Ir1SuH5Jc6STRBrtGOwxzXNJFQ3oP4VioeY8Ynp0F6USN7Dnua2yM41nvHyn6Gp19xc8kfARZWcNhdTiQG9N7xLt6_wEn7olwqlAOo4SRiwLMoVW7hMCtQV61sucwXSmjjBTtf64FjxoOdTP9zbZ1yGFoQZCmYVQdYrLK12cMwN3JPzLwMlKn7pcRbg5D2o31amh_ANRUwdporI3AP3uFrYEvg_GsoUwFogekQ4Hlt_KPE_Al4wsfYeLZmC3s65yeI7l_VlzIJN_W1N3NVSTq4i2SpbjTamvjiwblwYl7CVRH6UARtnyCBdtZu0b3sKfmMWEaDRbmYN8tUWd0mJp_16Z1ZANDLGdLD4T9mjNVf3SaAggbJeZ1fD6ARJtTWDbCSViyMUwRorbQn36uC0mfkBO7yx03iilfbc8eMnJIRI0yhikxBapnsQCjJ24Y6tB4Kw4h7XDJ0U4o05uzhL_52ig5roE4dMFUsyg84Kxw1YttW5cAFDVIfXd9Bj9CNbJg7sSYrRewiy1UNxqKwy3_S1uJyz9V1GcYejGmH3OuvigMGNRTp3dMATL4ttEFNt1fegTXWdSu8a9egFGz5QKsLWLM33fUog1KLUs0pyUO0QDjg800yJgkqhgk5WPlodJl5ljR388_PyJhMRX0TGc1OPDExn0vylFfayHuG7MPpYXeS10j3Ave5EgNF5nE1w9GWcuVGHc2RFH7RDxnlFCvdQSKmzFYShAevXfo5e2_Y0ZTNSWnDNMHElT8ATcHJ4FaQMeHkyhCBi9ZBfg6dcbGdQGEHOQ1otgCcTm4OHUULipU0PpKHuAxQsxOmdAKv_9sCwDE1l0ngzk9QTJTWssc4FmjWPbq8DBZdrG6qaQTWEgKRvrhDNAnzsdsr5aLeuRcAScbTrDnCDK98gosjIQkiqnyoibioEo5LFlv9VToUIajyHJNVNW0HzaMkKZf2MnNhj22NWTi1cDHVxXAta37pSNUnKYEmyDXS4qVetCTJBLDhB7mDC13YYDSuSG6joorBbU2FpXjEIlezWEp3aQS_zmyomGZPZXqmmgVTfRmgNQP_HhA_8TPCSQl
call fcn.643cb468
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret