Function at 0x656869a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x198]
mov esi, 0x656acc70
push ebx
sub esp, 0x1fc
mov ebx, dword [0x656a8c40]
call fcn.6569024c
mov ecx, 0x10
xor eax, eax
rep movsd dword es:[edi], dword [esi]
or ebx, 0xc0fa60c7
lea edi, [ebp - 0x1d5]
mov esi, str.Unit_Attention_data_is_available_for_the_initiator_to_query.
imul ebx, ebx, 0x541810cb
mov ecx, 0x3d
rep movsb byte es:[edi], byte [esi]
add ebx, 0x1e228e29
or ebx, 0x5b60a32b
mov dword [0x656a8c3c], ebx
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x656869fb
xor esi, esi
xor ebx, ebx
mov al, byte [ebp + ebx - 0x118]
mov ecx, 0x3c
xor edx, edx
mov edi, dword [0x656a8c3c]
mov byte [ebp - 0x1ec], al
mov eax, ebx
div ecx
mov al, byte [ebp - 0x1ec]
mov ecx, 0x1fa1
add al, byte [ebp + edx - 0x1d5]
mov edx, str.The_specified_address_range_conflicts_with_the_address_space.
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x65686a76
add ecx, eax
cmp ecx, 0x24e0
jbe 0x65686a56
lea eax, [edi + 0x325deaa2]
mov dword [0x656a8c3c], eax
imul eax, dword [0x656a8c3c], 0x6b02b278
inc ebx
mov dword [0x656a8c40], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0xd76a965e
mov dword [0x656a8c3c], eax
mov al, byte [ebp - 0x1ec]
mov byte [ebp + esi - 0x118], al
cmp ebx, 0x100
jne 0x65686a0e
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], bl
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [esi + ebp - 0x198]
mov byte [ebp + esi - 0x158], al
inc esi
cmp esi, 0x40
jne 0x65686ab5
mov ebx, dword [0x656a8c40]
mov byte [ebp - 0x118], 0
xor edi, edi
call fcn.6569024c
and ebx, 0xa9b70817
or ebx, 0x81920002
mov dword [0x656a8c40], ebx
xor ebx, ebx
mov dword [esp], 0x20dc
call dword [sym.imp.USER32.dll_GetTopWindow]
and eax, 0x218ed41
push ecx
mov dword [0x656a8c40], eax
add eax, 0x1c3ce388
mov dword [0x656a8c3c], eax
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
imul eax, dword [0x656a8c3c], 0x807b228d
mov dword [ebp - 0x1e4], 0x29
mov dword [ebp - 0x1e0], 0x35
mov dword [ebp - 0x1dc], 0xffffffa2
add eax, 0x3187749d
mov dword [0x656a8c40], eax
mov edx, str.The_specified_address_range_conflicts_with_the_address_space.
mov ecx, 0x161a
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x65686bbf
add ecx, eax
cmp ecx, 0x18a3
jbe 0x65686b8b
mov eax, dword [0x656a8c40]
mov edx, eax
or eax, 0xfbef1043
xor edx, 0x53bb9ad7
mov dword [0x656a8c40], eax
mov dword [0x656a8c3c], edx
jmp 0x65686bce
mov eax, dword [0x656a8c40]
or eax, 0x444be4ba
mov dword [0x656a8c3c], eax
or dword [0x656a8c3c], 0x68efe31c
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
sub edi, dword [ebp + ebx*4 - 0x1e4]
inc ebx
and eax, 0xfcc5bde6
mov esi, edi
or eax, 0x38449522
sub eax, 0x79f63ca7
mov dword [0x656a8c40], eax
or eax, 0x27267d36
mov dword [0x656a8c3c], eax
cmp ebx, 3
jne 0x65686b81
mov dword [esp], 0x104
xor edi, edi
call fcn.6568d9ac
mov dword [ebp - 0x1f0], eax
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1f0]
mov dword [esp], eax
call fcn.6568ed98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ec], eax
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x1f4], eax
mov ebx, dword [0x656a8c3c]
mov ecx, dword [ebp - 0x1f4]
cmp dword [ebp - 0x1ec], ecx
je 0x65687007
and ebx, 0xfa4d03d5
mov eax, ebx
xor eax, 0xb28c0d08
mov dword [0x656a8c3c], eax
call fcn.6569024c
xor eax, eax
cmp word [eax + str.The_specified_address_range_conflicts_with_the_address_space.], 0
je 0x65686c9e
add eax, 2
cmp eax, 0x1374
jne 0x65686c7e
xor ebx, 0x616c4c8d
mov dword [0x656a8c3c], ebx
imul eax, dword [0x656a8c3c], 0xcaa80a2a
mov dword [0x656a8c3c], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsZoomed]
push edx
xor eax, 0x76b0ae59
mov dword [0x656a8c3c], eax
and eax, 0x683895c0
mov dword [0x656a8c40], eax
call fcn.65694440
mov edx, dword [0x656a8c40]
mov eax, dword [ebp - 0x1ec]
or edx, 0x84c05d4a
mov cl, byte [eax]
xor eax, eax
mov dword [0x656a8c40], edx
mov ebx, dword [ebp - 0x1f0]
cmp byte [ebx + eax], cl
je 0x65686cff
inc eax
cmp eax, 0x40
jne 0x65686cec
mov al, 0x40
mov ebx, edi
lea ecx, [edi + 1]
movzx ebx, bl
mov byte [ebp + ebx - 0x1e8], al
mov eax, edi
cmp al, 3
jne 0x65686ffa
add edx, 0x1dadf7bd
mov dword [0x656a8c40], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
add eax, 0x5360ce4e
mov dword [0x656a8c40], eax
imul eax, eax, 0xf1c314e8
mov dword [0x656a8c3c], eax
xor eax, eax
cmp byte [eax + str.An_error_that_lies_in_the_reserved_range_has_been_received.], 0
je 0x65686d69
inc eax
cmp eax, 0xf82
jne 0x65686d44
call fcn.656917e8
mov eax, dword [0x656a8c3c]
and eax, 0x1a443791
mov dword [0x656a8c40], eax
xor dword [0x656a8c40], 0x940401f6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, str.An_error_that_lies_in_the_reserved_range_has_been_received.
mov ecx, 0x806
xor eax, 0x32306917
mov dword [0x656a8c40], eax
sub eax, 0x61a5412b
mov dword [0x656a8c3c], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x65686dae
add ecx, eax
cmp ecx, 0x996
jbe 0x65686d97
call fcn.6568f7b4
mov eax, dword [0x656a8c3c]
and eax, 0x566aadeb
xor eax, 0x13a91646
mov dword [0x656a8c40], eax
call dword [sym.imp.USER32.dll_AnyPopup]
or eax, 0x764596b5
mov dword [0x656a8c40], eax
mov dword [esp], eax
call fcn.656910e8
mov edx, dword [0x656a8c40]
xor eax, eax
xor edx, 0xaa6348ae
mov dword [0x656a8c3c], edx
cmp word [eax + str.The_specified_address_range_conflicts_with_the_address_space.], 0
je 0x65686e24
add eax, 2
cmp eax, 0x34a0
jne 0x65686dee
mov dword [esp + 8], str.An_error_that_lies_in_the_reserved_range_has_been_received.
mov dword [esp + 4], str.An_error_that_lies_in_the_reserved_range_has_been_received.
mov dword [esp], edx
call fcn.656910a0
or dword [0x656a8c3c], 0x59e64982
mov eax, dword [0x656a8c3c]
or eax, 0xb1fd395a
mov dword [0x656a8c40], eax
call fcn.6568f498
mov eax, dword [0x656a8c40]
add eax, 0x4b11ccc
mov dword [0x656a8c3c], eax
or eax, 0xa1011287
sub eax, 0x55e15f50
mov dword [0x656a8c40], eax
call fcn.65691310
call dword [sym.imp.USER32.dll_AnyPopup]
mov edx, str.The_specified_address_range_conflicts_with_the_address_space.
mov ecx, 0x19db
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x65686e95
add ecx, eax
cmp ecx, 0x1fc5
jbe 0x65686e6b
mov eax, dword [0x656a8c40]
sub eax, 0x19f44a06
mov dword [0x656a8c3c], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov edx, dword [0x656a8c3c]
lea edi, [esi + 1]
mov eax, edx
and edx, 0xcd178107
or edx, 0xcc020007
or eax, 0xccca3aa7
mov dword [0x656a8c40], eax
mov dword [0x656a8c3c], edx
mov dword [ebp - 0x1f8], edx
call fcn.6569024c
mov al, byte [ebp - 0x1e7]
mov cl, byte [ebp - 0x1e8]
mov ebx, eax
shr bl, 4
lea ecx, [ebx + ecx*4]
mov ebx, dword [ebp + 8]
mov byte [ebx + esi], cl
movzx ecx, byte [ebp - 0x1e6]
mov ebx, ecx
cmp cl, 0x40
je 0x65686f2b
mov edx, dword [ebp - 0x1f8]
shl eax, 4
sar ecx, 2
add eax, ecx
lea edi, [edx - 0x5fb81e4]
add edx, 0x7cd1d49
and edx, 0xab8dc903
mov dword [0x656a8c40], edi
mov edi, dword [ebp + 8]
or edx, 0xbcb9981c
mov dword [0x656a8c3c], edx
mov byte [edi + esi + 1], al
lea edi, [esi + 2]
movzx esi, byte [ebp - 0x1e5]
mov eax, esi
cmp al, 0x40
je 0x65686ff6
mov edx, str.An_error_that_lies_in_the_reserved_range_has_been_received.
mov ecx, 0x1fcb
movsx eax, byte [edx]
inc edx
test al, al
je 0x65686f74
add ecx, eax
cmp ecx, 0x248e
jbe 0x65686f46
mov eax, dword [0x656a8c3c]
mov dword [esp], eax
call fcn.656910e8
imul eax, dword [0x656a8c40], 0xf02c2905
mov dword [0x656a8c40], eax
imul eax, dword [0x656a8c40], 0x9a6580a6
sub dword [0x656a8c3c], 0x1728d62d
mov dword [0x656a8c40], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov eax, dword [0x656a8c3c]
xor edx, edx
sub eax, 0x38c713d5
mov dword [0x656a8c3c], eax
cmp byte [edx + str.An_error_that_lies_in_the_reserved_range_has_been_received.], 0
je 0x65686fc2
inc edx
cmp edx, 0x21f9
jne 0x65686fa4
and eax, 0x7dfce800
mov dword [0x656a8c3c], eax
jmp 0x65686fca
cmp edx, 0x81c
jle 0x65686fcf
call fcn.65691310
mov eax, dword [0x656a8c40]
shl ebx, 6
add ebx, esi
imul edx, eax, 0xd84b7559
and eax, 0x67828aa
mov dword [0x656a8c40], eax
mov eax, dword [ebp + 8]
mov dword [0x656a8c3c], edx
mov byte [eax + edi], bl
inc edi
mov esi, edi
xor ecx, ecx
inc dword [ebp - 0x1ec]
mov edi, ecx
jmp 0x65686c4d
or ebx, 0xc2d089b3
mov edx, str.The_specified_address_range_conflicts_with_the_address_space.
mov ecx, 0x8bf
mov dword [0x656a8c40], ebx
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x65687046
add ecx, eax
cmp ecx, 0x211f
jbe 0x6568701d
call fcn.65694440
mov eax, dword [0x656a8c40]
sub eax, 0x74791ec0
mov dword [0x656a8c3c], eax
mov edi, dword [0x656a8c3c]
mov eax, dword [0x656a8c40]
lea edx, [edi + 0x5a752fd]
xor eax, 0x341afc13
mov dword [0x656a8c40], eax
mov dword [0x656a8c3c], edx
mov dword [esp + 0xc], edx
mov dword [esp], eax
mov dword [esp + 8], str.An_error_that_lies_in_the_reserved_range_has_been_received.
mov dword [esp + 4], str.The_specified_address_range_conflicts_with_the_address_space.
call fcn.656931cc
mov eax, dword [ebp + 8]
mov byte [eax + esi], 0
mov eax, dword [ebp - 0x1f0]
mov dword [esp], eax
call fcn.6568d9e0
mov eax, dword [0x656a8c3c]
or eax, 0x67032f03
mov dword [0x656a8c40], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret