Function at 0x643cd314
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov edx, dword [0x643e7f14]
imul eax, edx, 0xd6cf8e7f
mov dword [0x643e7f14], eax
xor eax, eax
cmp word [eax + str.RtlpResUltimateFallbackInfo_Enter], 0
je 0x643cd350
add eax, 2
cmp eax, 0x9a0
jne 0x643cd330
imul edx, edx, 0x3662fc2a
mov dword [0x643e7f14], edx
mov eax, dword [0x643e7f14]
xor eax, 0x2d6b8606
imul eax, eax, 0xae74a7ef
mov dword [0x643e7f14], eax
mov dword [esp + 0xc], str.Industry_Other
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.643ceb94
call fcn.643d3474
sub dword [0x643e7f14], 0x130f7d8e
call fcn.643d4200
mov eax, dword [0x643e7f14]
and eax, 0x198df712
or eax, 0x81b712
mov dword [0x643e7f14], eax
mov dword [esp + 4], eax
mov dword [esp], str.TPM_2.0:_Asymmetric_algorithm_not_supported_or_not_correct.
call fcn.643cee3c
call fcn.643d04b8
add dword [0x643e7f14], 0xcd8630a
call fcn.643d4630
mov eax, dword [0x643e7f14]
xor edx, edx
or eax, 0xbbffbeff
sub eax, 0x9758e58
xor eax, 0xb12d7ee9
imul eax, eax, 0x2de74b09
and eax, 0xf3399748
mov dword [0x643e7f14], eax
cmp word [edx + str.TPM_2.0:_Asymmetric_algorithm_not_supported_or_not_correct.], 0
je 0x643cd40e
add edx, 2
cmp edx, 0xc70
jne 0x643cd3ef
xor eax, 0x3193a6f7
mov dword [0x643e7f14], eax
mov eax, dword [0x643e7f14]
lea edi, [ebp - 0x38]
mov esi, 0x643d50e0
xor ebx, ebx
sub eax, 0x15ced384
imul eax, eax, 0xadfc4911
mov dword [0x643e7f14], eax
call fcn.643d04b8
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov esi, 0x3d
call fcn.643d3474
mov eax, dword [0x643e7f14]
xor eax, 0x3c10fa43
add eax, 0x34a4a8bb
imul eax, eax, 0x6dd67323
mov dword [0x643e7f14], eax
call fcn.643d2eec
add esi, dword [ebp + ebx*4 - 0x38]
inc ebx
mov dword [ebp - 0x54], esi
cmp ebx, 4
jne 0x643cd43e
mov dword [ebp - 0x44], 0x10
xor ebx, ebx
mov dword [ebp - 0x40], 0x1c
mov dword [ebp - 0x3c], 0xffffffe0
mov dword [ebp - 0x4c], 0xd
mov eax, dword [0x643e7f14]
xor eax, 0xda353f85
imul eax, eax, 0x67a77bd
mov dword [0x643e7f14], eax
mov dword [esp + 4], eax
mov dword [esp], str.RtlpResUltimateFallbackInfo_Enter
call fcn.643cee3c
mov ecx, dword [ebp + ebx*4 - 0x44]
inc ebx
sub dword [ebp - 0x4c], ecx
cmp ebx, 3
jne 0x643cd48d
cmp dword [0x643e6be0], 0
mov eax, dword [0x643e7f14]
je 0x643cd4e3
and eax, 0x782d8734
mov dword [ebp - 0x4c], 1
mov dword [0x643e7f14], eax
jmp 0x643cd917
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
sub eax, 0x22b82d46
xor esi, esi
xor ebx, ebx
mov dword [0x643e7f14], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x18], 0
je 0x643cd64b
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
or eax, 0xd5811732
mov dword [0x643e7f14], eax
cmp word [edx + str.TPM_2.0:_Asymmetric_algorithm_not_supported_or_not_correct.], 0
je 0x643cd547
add edx, 2
cmp edx, 0x4a3a
jne 0x643cd520
mov dword [esp], eax
call fcn.643ce6f0
or dword [0x643e7f14], 0x3e694cd5
mov eax, dword [0x643e7f14]
lea edi, [ebp - 0x28]
mov esi, 0x643d50f0
add eax, 0x305aa929
or eax, 0xda524f4f
mov dword [0x643e7f14], eax
call fcn.643d04b8
mov ecx, 4
mov eax, dword [0x643e7f14]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
imul eax, eax, 0xe4cfe1f6
mov edi, ecx
sub edi, dword [ebp + edx*4 - 0x28]
inc edx
mov ecx, edi
and eax, 0x65f92436
cmp edx, 4
jne 0x643cd576
mov ecx, dword [ebp - 0x50]
lea edx, [eax - 0x7fcf771c]
mov dword [0x643e7f14], edx
xor edx, edx
mov esi, dword [ecx + 0x18]
mov ecx, dword [esi + 0x3c]
add ecx, esi
mov dword [ebp - 0x58], ecx
cmp word [edx + edx + str.RtlpResUltimateFallbackInfo_Enter], 0
je 0x643cd5d0
inc edx
cmp edx, 0x84a
jne 0x643cd5ab
call fcn.643d4630
xor dword [0x643e7f14], 0xe2ecd355
jmp 0x643cd5d8
cmp edx, 0x5f6
jle 0x643cd5f7
imul eax, dword [0x643e7f14], 0xd62afce9
mov dword [0x643e7f14], eax
mov dword [esp], 0x111a
call dword [sym.imp.USER32.dll_IsZoomed]
push eax
jmp 0x643cd601
add eax, 0x269993a
mov dword [0x643e7f14], eax
add dword [0x643e7f14], 0x1a77f6aa
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x78]
cmp edi, eax
je 0x643cd63e
lea ebx, [esi + eax]
mov edx, dword [ebx + 0xc]
add edx, esi
mov eax, dword [edx]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x643cd63e
mov eax, dword [edx + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x643cd70d
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
jmp 0x643cd501
test ebx, ebx
jne 0x643cd70d
mov eax, dword [0x643e7f14]
mov ecx, str.Industry_Other
mov ebx, 0x1944
add eax, 0x528769b7
mov dword [0x643e7f14], eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x643cd6aa
add ebx, edx
cmp ebx, 0x2176
jbe 0x643cd66c
mov dword [esp + 8], eax
mov dword [esp + 4], str.RtlpResUltimateFallbackInfo_Enter
mov dword [esp], str.TPM_2.0:_Asymmetric_algorithm_not_supported_or_not_correct.
call fcn.643d4d50
mov eax, dword [0x643e7f14]
sub eax, 0x761f9e1f
xor eax, 0x315e552c
jmp 0x643cd6b0
imul eax, eax, 0xd5fc757d
and eax, 0x595cbf44
lea edi, [ebp - 0x28]
mov esi, 0x643d5100
mov dword [0x643e7f14], eax
mov dword [esp + 4], str.save_initclip
mov dword [esp], str.Windows.Mobile
call fcn.643d3de8
mov ecx, 4
mov dword [ebp - 0x4c], 0x59
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x643e7f14]
imul eax, eax, 0x675658e1
mov ecx, dword [ebp + edx*4 - 0x28]
inc edx
add dword [ebp - 0x4c], ecx
sub eax, 0x18009d88
cmp edx, 4
jne 0x643cd6eb
mov dword [0x643e7f14], eax
jmp 0x643cd917
mov eax, dword [ebx + 0x1c]
mov edi, dword [ebx + 0x18]
mov dword [0x643e9da4], esi
add eax, esi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x20]
add eax, esi
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x24]
xor ebx, ebx
add eax, esi
mov dword [ebp - 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, dword [0x643e7f14]
mov ecx, dword [ebp - 0x50]
dec edi
xor edx, 0xe0a2e174
lea eax, [edx - 0x517412c0]
mov dword [0x643e7f14], eax
mov eax, dword [ecx + edi*4]
add eax, esi
cmp word [eax], 0x775a
jne 0x643cd7bb
add edx, 0x5f9fe15b
mov dword [ebp - 0x64], eax
imul edx, edx, 0xfa7f831b
and edx, 0x19b06e28
imul edx, edx, 0xbd5ae045
mov dword [0x643e7f14], edx
call fcn.643d04b8
mov eax, dword [ebp - 0x64]
lea edx, [ebx*8 + 0x643e6be4]
mov dword [ebp - 0x60], edx
mov dword [esp], eax
call fcn.643cd1f8
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x60]
mov dword [ebx*8 + 0x643e6be4], eax
mov eax, dword [ebp - 0x58]
inc ebx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
mov dword [edx + 4], eax
cmp ebx, 0x226
je 0x643cd7c3
test edi, edi
jne 0x643cd730
mov dword [0x643e6be0], ebx
xor esi, esi
mov eax, dword [0x643e6be0]
mov edi, dword [ebp - 0x54]
sub eax, edi
cmp esi, eax
jae 0x643cd917
xor ebx, ebx
mov eax, esi
not eax
add eax, dword [0x643e6be0]
cmp ebx, eax
jae 0x643cd911
call fcn.643d4630
mov eax, dword [0x643e7f14]
and eax, 0x5e9aa44
or eax, 0x7dbe89eb
xor eax, 0xc2b7d581
mov dword [0x643e7f14], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, dword [ebx*8 + 0x643e6be8]
inc ebx
sub eax, 0x3bba39ad
or eax, 0xa47fb7fa
mov dword [0x643e7f14], eax
cmp dword [ebx*8 + 0x643e6be8], edx
jae 0x643cd7df
imul eax, eax, 0x4e840ff8
and eax, 0x646141ed
imul eax, eax, 0x8380ee07
sub eax, 0x627561a4
mov dword [0x643e7f14], eax
call fcn.643ce448
mov eax, dword [0x643e7f14]
mov ecx, dword [ebx*8 + 0x643e6be4]
mov edx, dword [ebx*8 + 0x643e6bdc]
mov edi, dword [ebx*8 + 0x643e6be0]
add eax, 0xb1ee2ac
mov dword [ebx*8 + 0x643e6bdc], ecx
mov ecx, dword [ebx*8 + 0x643e6be8]
or eax, 0xa4bd275f
mov dword [ebx*8 + 0x643e6be4], edx
add eax, 0x4b7022dd
mov dword [ebx*8 + 0x643e6be0], ecx
and eax, 0x5def490d
xor eax, 0x53d2942
sub eax, 0x31a0420e
imul eax, eax, 0x9fc2d11f
or eax, 0xf5c9959f
mov dword [0x643e7f14], eax
call fcn.643d2e20
mov edx, str.Industry_Other
mov ecx, 0x392
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643cd8ec
add ecx, eax
cmp ecx, 0x1b8b
jbe 0x643cd8c8
call fcn.643d04b8
and dword [0x643e7f14], 0x1a7c7cfa
mov eax, dword [0x643e7f14]
mov dword [ebx*8 + 0x643e6be8], edi
and eax, 0x4d5ce686
or eax, 0x4442400
add eax, 0x5b95be4c
mov dword [0x643e7f14], eax
jmp 0x643cd7df
inc esi
jmp 0x643cd7cb
mov eax, dword [ebp - 0x4c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret