Function at 0x656896f8
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x22
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x4c5]
mov esi, 0x656ae21e
push ebx
sub esp, 0x5cc
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x431]
mov esi, str.The_allocation_being_referenced_has_been_closed_permanently.
mov ecx, 0x3d
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x6568972a
xor esi, esi
xor ebx, ebx
mov eax, dword [0x656a8c60]
mov ecx, str.Log_service_cannot_delete_log_file_or_file_system_container.
and eax, 0x88b560d7
mov dword [0x656a8c60], eax
mov dl, byte [ecx]
test dl, dl
je 0x6568976e
sub edx, 0x30
cmp dl, 9
jbe 0x6568976b
add eax, 0x29e330d9
mov dword [0x656a8c60], eax
jmp 0x6568976e
inc ecx
jmp 0x65689751
mov eax, dword [0x656a8c60]
mov edi, 0x3c
xor eax, 0x1401d9ec
mov dword [0x656a8c60], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._fiWymsJEXztn8kHA9xx5OCWQKcoq4yYMm7zZyi7gEU0Z
mov dword [esp + 4], str.Access_to_the_specified_handle_has_been_revoked.
mov dword [esp], 0x656a9760
call fcn.656946fc
mov eax, ebx
xor edx, edx
mov cl, byte [ebp + ebx - 0x318]
div edi
mov al, byte [ebp + edx - 0x431]
add eax, ecx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], al
inc ebx
mov byte [ebp + esi - 0x318], cl
cmp ebx, 0x100
jne 0x6568973d
xor edi, edi
xor esi, esi
xor ebx, ebx
inc ebx
mov edx, 0x656a9760
mov ecx, 0x525
movzx ebx, bl
mov al, byte [ebp + ebx - 0x318]
mov byte [ebp - 0x58c], al
add eax, esi
movzx esi, al
movzx eax, byte [edx]
inc edx
test al, al
je 0x65689817
add ecx, eax
cmp ecx, 0x6e8
jbe 0x65689805
mov eax, dword [0x656a9014]
lea edx, [eax + 0x68b4d83d]
add eax, 0x69a1734f
xor eax, 0xb54ea4f8
cmp byte [0x656a9760], 0
mov dword [0x656a9014], edx
mov dword [0x656a8c60], eax
mov al, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], al
mov al, byte [ebp - 0x58c]
mov byte [ebp + esi - 0x318], al
je 0x6568988a
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.SdbpCheckAttribute_failed___x_
mov dword [esp + 4], str.AslpFileLargeMapCreate
mov dword [esp], str.Log_service_cannot_delete_log_file_or_file_system_container.
call fcn.656946fc
mov eax, dword [0x656a8c60]
add eax, 0x12999a20
mov dword [0x656a9014], eax
mov dword [esp + 8], 0x656a9760
mov dword [esp + 4], str.Non_Inheritable_ACL
mov eax, dword [0x656a8c60]
mov dword [esp], eax
call fcn.6568fb28
mov eax, dword [0x656a9014]
and eax, 0x3abc3116
or eax, 0xd7fdb5e6
mov dword [0x656a8c60], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
call fcn.65690694
mov al, byte [ebp - 0x58c]
add al, byte [ebp + ebx - 0x318]
movzx eax, al
mov edx, dword [0x656a8c60]
mov al, byte [ebp + eax - 0x318]
xor al, byte [ebp + edi - 0x4c5]
movzx eax, al
or edx, 0xae42291d
mov word [ebp + edi*2 - 0x3f4], ax
inc edi
mov dword [0x656a9014], edx
cmp edi, 0x22
jne 0x656897e5
mov word [ebp - 0x3b0], 0
imul edx, edx, 0x9f60270b
lea edi, [ebp - 0x503]
xor eax, eax
mov esi, 0x656ae27d
mov ecx, 0x13
mov dword [ebp - 0x549], 0x70797466
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x541], 0
mov dword [0x656a9014], edx
mov dword [ebp - 0x545], 0x69637661
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x6568994f
xor esi, esi
xor ebx, ebx
movzx edi, byte [ebp + ebx - 0x218]
mov eax, ebx
and eax, 7
mov ecx, edi
add cl, byte [ebp + eax - 0x549]
mov eax, ecx
mov ecx, str.Log_service_cannot_delete_log_file_or_file_system_container.
add eax, esi
movzx esi, al
mov eax, dword [0x656a8c60]
sub eax, 0x2ad04de0
mov dword [0x656a8c60], eax
mov dl, byte [ecx]
test dl, dl
je 0x656899b6
sub edx, 0x30
cmp dl, 9
jbe 0x656899b3
imul edx, dword [0x656a9014], 0x15fe01b1
mov dword [0x656a9014], edx
jmp 0x656899b6
inc ecx
jmp 0x65689993
xor dword [0x656a9014], 0xb3b44293
mov dword [esp + 8], eax
mov dword [esp + 4], str.SdbpCheckAttribute
mov dword [esp], 0x656a9760
call fcn.65691bb0
mov al, byte [ebp + esi - 0x218]
mov byte [ebp + ebx - 0x218], al
mov eax, edi
inc ebx
mov byte [ebp + esi - 0x218], al
cmp ebx, 0x100
jne 0x65689962
xor edx, edx
xor edi, edi
xor esi, esi
lea eax, [esi + 1]
movzx esi, al
mov bl, byte [ebp + esi - 0x218]
lea eax, [ebx + edi]
movzx edi, al
imul eax, dword [0x656a8c60], 0x48628880
cmp byte [0x656a9760], 0
mov dword [0x656a8c60], eax
je 0x65689a65
mov eax, dword [0x656a9014]
mov dword [ebp - 0x58c], edx
mov dword [esp + 4], str.TPM_1.2:_Signed_data_cannot_include_additional_DER_information.
mov dword [esp + 8], eax
mov dword [esp], str.Log_service_cannot_delete_log_file_or_file_system_container.
call fcn.65691bb0
mov edx, dword [ebp - 0x58c]
imul eax, dword [0x656a9014], 0x607f0b65
mov dword [0x656a8c60], eax
mov eax, dword [0x656a8c60]
mov dword [ebp - 0x58c], edx
mov dword [esp + 8], str.The_request_needs_to_be_retried.
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.SdbpGetProcessHistory
mov dword [esp], 0x656a9760
call fcn.656946fc
mov eax, dword [0x656a9014]
sub eax, 0x4d934d37
imul eax, eax, 0x1419cd0c
mov dword [0x656a8c60], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov al, byte [ebp + edi - 0x218]
mov edx, dword [ebp - 0x58c]
mov byte [ebp + esi - 0x218], al
mov byte [ebp + edi - 0x218], bl
add bl, byte [ebp + esi - 0x218]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x218]
xor al, byte [ebp + edx - 0x503]
movzx eax, al
mov word [ebp + edx*2 - 0x480], ax
inc edx
cmp edx, 0x13
jne 0x65689a02
mov edx, 0x656a9760
mov al, byte [edx]
test al, al
je 0x65689b19
sub eax, 0x30
cmp al, 9
jbe 0x65689b16
mov eax, dword [0x656a8c60]
or eax, 0xe261e9e4
mov dword [0x656a9014], eax
jmp 0x65689b19
inc edx
jmp 0x65689af8
mov eax, dword [0x656a9014]
lea edi, [ebp - 0x459]
mov esi, 0x656ae290
mov word [ebp - 0x45a], 0
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
and eax, 0x615c9cad
cmp byte [str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
lea edi, [ebp - 0x4a3]
mov esi, str.The_supplied_device_ID_is_invalid.
mov ecx, 0x23
mov dword [0x656a8c60], eax
rep movsb byte es:[edi], byte [esi]
je 0x65689b89
mov dword [esp + 8], 0x656a9760
mov dword [esp + 4], 0x656a9760
mov dword [esp], str.TPM_2.0:_Hash_algorithm_not_supported_or_not_appropriate.
call fcn.656947c0
mov eax, dword [0x656a9014]
and eax, 0x59797ae5
mov dword [0x656a8c60], eax
mov eax, dword [0x656a8c60]
and eax, 0x9993ea73
or eax, 0x12e220
mov dword [0x656a9014], eax
mov dword [esp], str.An_integer_value_is_outside_the_allowed_range.
call fcn.65690928
cmp byte [str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x65689bd8
mov dword [esp + 8], str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dword [esp + 4], 0x656a9760
mov dword [esp], str.TimeZoneInformation
call fcn.656947c0
or dword [0x656a8c60], 0x661c8e99
mov eax, dword [0x656a8c60]
or eax, 0xfd969e48
mov dword [0x656a9014], eax
mov dword [esp], str.Log_service_cannot_delete_log_file_or_file_system_container.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edx
mov eax, dword [0x656a9014]
sub eax, 0xf374a4e
mov dword [0x656a8c60], eax
call fcn.65690694
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x65689c0b
mov edi, dword [0x656a8c60]
xor esi, esi
xor ecx, ecx
mov al, byte [ebp + ecx - 0x118]
mov ebx, 0x22
xor edx, edx
mov byte [ebp - 0x58c], al
mov eax, ecx
div ebx
mov bl, byte [ebp - 0x58c]
movzx eax, byte [ebp + edx - 0x4a3]
movzx edx, byte [ebp - 0x58c]
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
imul eax, edi, 0x992191d0
inc ecx
mov byte [ebp + esi - 0x118], bl
lea edi, [eax + 0x7e5a9f53]
cmp ecx, 0x100
jne 0x65689c24
mov dword [0x656a9014], eax
xor edi, edi
xor esi, esi
xor ebx, ebx
inc ebx
mov edx, str.Log_service_cannot_delete_log_file_or_file_system_container.
mov ecx, 0x1084
movzx ebx, bl
movzx eax, byte [edx]
inc edx
test al, al
je 0x65689cca
add ecx, eax
cmp ecx, 0x1bd8
jbe 0x65689c9b
mov eax, dword [0x656a9014]
sub eax, 0x450dbe48
mov dword [0x656a8c60], eax
mov dword [esp], 0x13f6
call dword [sym.imp.USER32.dll_IsIconic]
push eax
mov ecx, dword [0x656a9014]
mov al, byte [ebp + ebx - 0x118]
mov edx, ecx
add esi, eax
xor edx, 0x18ac872d
mov dword [0x656a8c60], edx
and edx, 0xd99daf88
mov dword [ebp - 0x58c], edx
mov dword [0x656a9014], edx
mov edx, esi
movzx esi, dl
mov dl, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], dl
mov byte [ebp + esi - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + edi - 0x459]
movzx eax, al
mov word [ebp + edi*2 - 0x368], ax
inc edi
cmp edi, 0x28
jne 0x65689c8d
mov word [ebp - 0x318], 0
mov edx, dword [ebp - 0x58c]
sub edx, 0x3187f1dd
cmp byte [0x656a9760], 0
mov dword [0x656a9014], edx
je 0x65689d70
xor ecx, 0xc38bc2af
mov dword [0x656a8c60], ecx
mov dword [esp], str.The_connection_handle_given_to_the_transport_was_invalid.
call fcn.65690928
add dword [0x656a9014], 0x54067bdb
and dword [0x656a8c60], 0xa7084bf6
call fcn.65691e00
imul eax, dword [0x656a9014], 0x72741f53
cmp byte [str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
mov dword [0x656a8c60], eax
je 0x65689dc1
call fcn.65691e00
mov eax, dword [0x656a8c60]
add eax, 0x6eef5244
mov dword [0x656a9014], eax
mov eax, dword [0x656a9014]
xor ebx, ebx
mov esi, 0x32
and dword [0x656a8c60], 0xede96722
and eax, 0xee5da1fb
mov dword [0x656a9014], eax
mov dword [esp], eax
mov dword [esp + 8], str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dword [esp + 4], str.Microsoft_Time_Stamp_PCA_2010
call fcn.6568fb28
mov eax, dword [0x656a9014]
mov dword [ebp - 0x574], 0x4c
mov dword [ebp - 0x570], 0xffffff82
lea edx, [eax - 0x57768457]
xor eax, 0xc1bbd31c
mov dword [0x656a8c60], edx
mov dword [0x656a9014], eax
mov edx, 0x656a9760
mov ecx, 0x28d
movzx eax, byte [edx]
inc edx
test al, al
je 0x65689e59
add ecx, eax
cmp ecx, 0x676
jbe 0x65689e32
call fcn.65690694
xor dword [0x656a9014], 0x77592d83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x656a8c60]
add eax, 0x70b889ee
mov dword [0x656a8c60], eax
imul eax, eax, 0xb441538e
mov dword [0x656a9014], eax
call fcn.656924a8
mov edx, dword [0x656a9014]
add esi, dword [ebp + ebx*4 - 0x574]
mov dword [ebp - 0x590], esi
lea eax, [edx + 0xaf687b8]
mov dword [0x656a8c60], eax
test ebx, ebx
jne 0x65689ea1
mov ebx, 1
jmp 0x65689e28
and eax, 0x5873754d
mov ecx, 0x656a9760
mov dword [0x656a8c60], eax
mov al, byte [ecx]
test al, al
je 0x65689ece
sub eax, 0x30
cmp al, 9
jbe 0x65689ecb
add edx, 0xfc29f9b
mov dword [0x656a9014], edx
jmp 0x65689ece
inc ecx
jmp 0x65689eb0
and dword [0x656a9014], 0x9b34455a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x472e54de
mov dword [0x656a8c60], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
xor eax, eax
cmp byte [eax + str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x65689f0b
inc eax
cmp eax, 0xa21
jne 0x65689ef0
add dword [0x656a9014], 0x2a4a4110
lea edi, [ebp - 0x4f0]
mov esi, str.__b4_
mov ecx, 5
imul eax, dword [0x656a9014], 0x2a6ab9b6
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
mov dword [0x656a9014], eax
or eax, 0xdc7d44ee
mov dword [0x656a8c60], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub edi, dword [ebp + esi*4 - 0x4f0]
inc esi
mov dword [ebp - 0x594], edi
cmp esi, 5
jne 0x65689f3a
xor eax, eax
cmp byte [eax + str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x65689f87
inc eax
cmp eax, 0xac0
jne 0x65689f55
mov eax, dword [0x656a8c60]
or eax, 0x9103ed25
mov dword [0x656a9014], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add eax, 0x6268f243
mov dword [0x656a8c60], eax
jmp 0x65689f8e
cmp eax, 0x8c2
jle 0x65689fb4
mov dword [esp + 0xc], str.No_expand_callback_method_set._Cannot_expand_ZDB_file.
mov eax, dword [0x656a9014]
mov dword [esp + 4], str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dword [esp + 8], eax
mov eax, dword [0x656a8c60]
mov dword [esp], eax
call fcn.65691c84
mov edx, dword [0x656a9014]
imul eax, edx, 0x770b3c0b
imul edx, edx, 0xab3d60c5
mov ecx, eax
mov dword [0x656a8c60], edx
or ecx, 0xd77d1b4f
mov dword [0x656a9014], ecx
mov ecx, str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dl, byte [ecx]
test dl, dl
je 0x6568a001
sub edx, 0x30
cmp dl, 9
jbe 0x65689ffe
and eax, 0x47006ddc
or eax, 0x4700094c
mov dword [0x656a8c60], eax
jmp 0x6568a001
inc ecx
jmp 0x65689fdf
imul eax, dword [0x656a8c60], 0xb69ddba4
mov dword [0x656a8c60], eax
call fcn.65690694
xor dword [0x656a8c60], 0x89d5e465
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 0x656a9760
mov al, byte [edx]
test al, al
je 0x6568a046
sub eax, 0x30
cmp al, 9
jbe 0x6568a043
xor dword [0x656a9014], 0x591a5a0e
jmp 0x6568a046
inc edx
jmp 0x6568a02a
mov eax, dword [0x656a9014]
mov ecx, str.Log_service_cannot_delete_log_file_or_file_system_container.
xor eax, 0xb309ab12
mov dword [0x656a9014], eax
mov dl, byte [ecx]
test dl, dl
je 0x6568a077
sub edx, 0x30
cmp dl, 9
jbe 0x6568a074
add eax, 0x49831709
mov dword [0x656a9014], eax
jmp 0x6568a077
inc ecx
jmp 0x6568a05a
or dword [0x656a8c60], 0xc381813d
lea edi, [ebp - 0x534]
mov esi, 0x656950f4
call fcn.656924a8
mov eax, dword [0x656a8c60]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
or eax, 0x6256fbc8
mov dword [0x656a9014], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov edx, 0x656a9760
mov al, byte [edx]
test al, al
je 0x6568a0d7
sub eax, 0x30
cmp al, 9
jbe 0x6568a0d4
mov eax, dword [0x656a8c60]
and eax, 0xe4008432
mov dword [0x656a9014], eax
jmp 0x6568a0d7
inc edx
jmp 0x6568a0b6
sub dword [0x656a9014], 0x72f5fdb8
mov dword [esp + 8], str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dword [esp + 4], 0x656a9760
mov dword [esp], str.AslpFileGetModuleType_failed___x_
call fcn.656947c0
sub edi, dword [ebp + esi*4 - 0x534]
inc esi
mov dword [ebp - 0x598], edi
cmp esi, 4
jne 0x6568a0ab
cmp byte [0x656a9760], 0
je 0x6568a128
call fcn.65690694
xor dword [0x656a9014], 0x39fd5120
mov eax, dword [0x656a8c60]
lea edi, [ebp - 0x4dc]
mov esi, 0x65695104
mov dword [esp + 8], str.STATUS_ABANDONED_WAIT_0
mov dword [esp + 4], str.The_operation_is_not_supported_on_mirrored_volumes.
mov dword [esp + 0xc], eax
mov dword [esp], 0x656a9760
call fcn.656946fc
xor dword [0x656a8c60], 0xa5f9bc15
xor dword [0x656a9014], 0x2e6f4fd7
mov dword [esp + 8], 0x656a9760
mov dword [esp + 4], str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_WerpValidatePebHeader_failed
call fcn.656947c0
imul eax, dword [0x656a8c60], 0xb0de3a40
mov dword [0x656a8c60], eax
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x1b8
cmp byte [str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x6568a1be
add dword [0x656a9014], 0x2957feba
mov eax, dword [0x656a9014]
and eax, 0xeabead30
lea edx, [eax + 0x664bfc80]
mov dword [0x656a9014], eax
mov dword [0x656a8c60], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.The_GUID_allocation_server_is__already__enabled_at_the_moment.
mov dword [esp + 4], str.LegalCopyright
mov dword [esp], str.Log_service_cannot_delete_log_file_or_file_system_container.
call fcn.656946fc
sub edi, dword [ebp + esi*4 - 0x4dc]
inc esi
mov dword [ebp - 0x59c], edi
cmp esi, 5
jne 0x6568a1ab
xor dword [0x656a9014], 0x81435088
xor edi, edi
mov esi, 0x1c
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov dword [ebp - 0x540], 0x2e
mov dword [ebp - 0x53c], 0x5f
mov dword [ebp - 0x538], 0xffffff57
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, dword [0x656a9014]
add esi, dword [ebp + edi*4 - 0x540]
inc edi
mov dword [ebp - 0x58c], esi
or eax, 0xdde9253a
mov dword [0x656a9014], eax
cmp edi, 3
jne 0x6568a241
mov ecx, str.Log_service_cannot_delete_log_file_or_file_system_container.
mov esi, 0x24f
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x6568a285
add esi, edx
cmp esi, 0x4fc
jbe 0x6568a273
lea edx, [eax - 0x155a780]
add eax, 0x18b60236
mov dword [0x656a9014], eax
mov dword [0x656a8c60], edx
xor edx, edx
cmp byte [edx + str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x6568a2bb
inc edx
cmp edx, 0xcfc
jne 0x6568a29d
or eax, 0x853752bf
mov dword [0x656a9014], eax
jmp 0x6568a2c3
cmp edx, 0x5b7
jle 0x6568a2ea
mov eax, dword [0x656a9014]
mov dword [esp + 8], str.Log_service_encountered_an_invalid_log_block.
mov dword [esp + 4], str.setmiterlimit
mov dword [esp + 0xc], eax
mov dword [esp], 0x656a9760
call fcn.656946fc
jmp 0x6568a2fa
or eax, 0x6d3286d7
mov dword [0x656a8c60], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x656a8c60]
lea edi, [ebp - 0x524]
mov esi, 0x65695118
xor edx, edx
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
sub eax, 0xde90510
mov ecx, 0x63
add ecx, dword [ebp + edx*4 - 0x524]
inc edx
and eax, 0xaff09228
mov dword [ebp - 0x5a0], ecx
cmp edx, 4
jne 0x6568a31d
mov dword [0x656a9014], eax
xor esi, esi
mov edi, 0x5b
mov dword [ebp - 0x56c], 0x12
mov dword [ebp - 0x568], 0xffffff94
xor eax, eax
cmp byte [eax + str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x6568a37e
inc eax
cmp eax, 0x2204
jne 0x6568a357
call fcn.656935b0
mov eax, dword [0x656a8c60]
xor eax, 0x14350ef5
mov dword [0x656a9014], eax
jmp 0x6568a385
cmp eax, 0x4e1
jle 0x6568a38a
call fcn.656935b0
mov eax, dword [0x656a9014]
mov ecx, str.Log_service_cannot_delete_log_file_or_file_system_container.
mov edx, eax
xor eax, 0xe4d8a08a
and edx, 0x137377f
mov dword [0x656a9014], eax
mov dword [0x656a8c60], edx
mov al, byte [ecx]
test al, al
je 0x6568a3da
sub eax, 0x30
cmp al, 9
jbe 0x6568a3d7
add edx, 0x3260118b
mov dword [0x656a9014], edx
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
add eax, 0x4c4641fb
mov dword [0x656a9014], eax
jmp 0x6568a3da
inc ecx
jmp 0x6568a3ac
or dword [0x656a9014], 0x365d26f
mov dword [esp + 8], 0x656a9760
mov dword [esp + 4], str.The_specified_disk_is_not_a_virtual_disk.
mov eax, dword [0x656a8c60]
mov dword [esp], eax
call fcn.6568fb28
add edi, dword [ebp + esi*4 - 0x56c]
mov dword [ebp - 0x5a4], edi
test esi, esi
jne 0x6568a419
mov esi, ebx
jmp 0x6568a355
mov edx, str.Log_service_cannot_delete_log_file_or_file_system_container.
mov ecx, 0xf4f
movzx eax, byte [edx]
inc edx
test al, al
je 0x6568a444
add ecx, eax
cmp ecx, 0xdc
jbe 0x6568a423
mov eax, dword [0x656a9014]
sub eax, 0x4cc3567b
mov dword [0x656a8c60], eax
mov eax, dword [0x656a8c60]
lea edx, [eax + 0x7781f4f2]
add eax, 0x1dea749
mov dword [0x656a8c60], eax
mov dword [0x656a9014], edx
mov dword [esp + 8], 0x656a9760
mov dword [esp + 4], 0x656a9760
mov dword [esp], str.csrss.exe
call fcn.656947c0
xor eax, eax
cmp byte [eax + str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x6568a498
inc eax
cmp eax, 0x1bdf
jne 0x6568a47d
and dword [0x656a9014], 0xf3a342f6
imul eax, dword [0x656a9014], 0x6b7a399c
mov dword [0x656a8c60], eax
xor eax, 0xc439438e
cmp byte [0x656a9760], 0
mov dword [0x656a9014], eax
je 0x6568a4c4
sub eax, 0x1e36a46
mov dword [0x656a8c60], eax
call fcn.65690694
mov eax, dword [0x656a9014]
xor eax, 0x6306745f
mov edx, eax
and edx, 0xab929cd8
mov dword [0x656a9014], edx
xor edx, edx
cmp byte [edx + str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x6568a4ff
inc edx
cmp edx, 0xe7
jne 0x6568a4e3
and eax, 0x2100400
mov dword [0x656a9014], eax
mov eax, dword [0x656a9014]
mov edx, eax
and edx, 0xd70a686a
or edx, 0xd60a282a
add edx, 0x68725e1e
mov dword [0x656a9014], edx
xor edx, edx
cmp byte [edx + str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x6568a546
inc edx
cmp edx, 0x165e
jne 0x6568a520
and eax, 0x91004048
or eax, 0x90000008
sub eax, 0x56b1d63c
mov dword [0x656a9014], eax
mov eax, dword [0x656a9014]
mov edx, eax
or eax, 0x491cc770
xor edx, 0x1e1d1bd2
mov dword [0x656a9014], eax
mov dword [0x656a8c60], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.Wipe_of_free_space_is_not_currently_taking_place.
mov dword [esp + 4], str.STATUS_TIMEOUT
mov dword [esp], str.Log_service_cannot_delete_log_file_or_file_system_container.
call fcn.656946fc
mov ecx, 0x656a9760
mov edx, 0x1f7b
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x6568a5b0
add edx, eax
cmp edx, 0xae7
jbe 0x6568a58d
mov eax, dword [0x656a9014]
and eax, 0xe1d8dbf8
mov dword [0x656a8c60], eax
jmp 0x6568a5b8
cmp edx, 0xae7
jbe 0x6568a5bd
call fcn.656935b0
imul eax, dword [0x656a8c60], 0x1b40dc3a
mov dword [0x656a9014], eax
call fcn.65690694
cmp byte [0x656a9760], 0
je 0x6568a5e9
mov eax, dword [0x656a9014]
or eax, 0xcd60e3d1
mov dword [0x656a8c60], eax
mov eax, dword [0x656a8c60]
mov ecx, 0x656a9760
mov ebx, 0x620
add eax, 0x529871f7
mov dword [0x656a9014], eax
and eax, 0x139f3835
mov dword [0x656a8c60], eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x6568a628
add ebx, edx
cmp ebx, 0x1d53
jbe 0x6568a60c
sub eax, 0xd298495
mov dword [0x656a9014], eax
mov eax, dword [0x656a9014]
add eax, 0x529c134d
or eax, 0xc977359e
cmp byte [str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
mov dword [0x656a9014], eax
je 0x6568a659
call fcn.6569077c
mov eax, dword [0x656a9014]
xor eax, 0x3ab40f09
mov dword [0x656a8c60], eax
lea ebx, [ebp - 0x564]
lea esi, [ebp - 0x55c]
add dword [0x656a9014], 0x203a0fd
imul eax, dword [0x656a8c60], 0x47ef2346
lea edi, [ebp - 0x554]
mov dword [0x656a8c60], eax
mov dword [esp], str.LdrResSearchResource_Enter
call fcn.65690928
lea eax, [ebp - 0x3f4]
xor dword [0x656a9014], 0x7229d64f
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.6568ded8
lea eax, [ebp - 0x480]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.6568ded8
lea eax, [ebp - 0x368]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.6568ded8
xor eax, eax
mov dword [ebp - 0x584], eax
xor eax, eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x590]
mov dword [esp + 0x10], edi
lea edi, [ebp - 0x3ac]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x584]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], esi
mov dword [esp], eax
mov eax, dword [0x65695064]
call dword [eax + 0x18]
xor eax, eax
mov ecx, 0x11
mov dword [ebp - 0x3b0], 0x48
rep stosd dword es:[edi], eax
sub esp, 0x2c
mov dword [esp], 0x34
call fcn.6568d9ac
mov ecx, 0x2511
mov dword [eax], 0x34
mov ebx, eax
xor eax, eax
cmp dword [ebp - 0x598], 0
setne al
xor edx, edx
shl eax, 0x12
cmp dword [ebp - 0x594], 0
setne dl
shl edx, 0x10
or eax, edx
mov edx, 0x656a9760
or eax, 0x20005
mov dword [ebx + 4], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x6568a7c5
add ecx, eax
cmp ecx, 0x26a9
jbe 0x6568a783
mov dword [esp + 0xc], str.The_specified_number_of_disks_is_invalid.
mov eax, dword [0x656a8c60]
mov dword [esp + 4], 0x656a9760
mov dword [esp + 8], eax
mov eax, dword [0x656a9014]
mov dword [esp], eax
call fcn.65691c84
add dword [0x656a9014], 0x2a546f9d
imul eax, dword [0x656a8c60], 0x7bcdfbf6
add dword [0x656a9014], 0x79ad7859
mov dword [0x656a8c60], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.The_type_UUID_is_not_supported.
mov dword [esp + 4], str.Please_check_the_disk__and_reformat_if_necessary.
mov dword [esp], str.Log_service_cannot_delete_log_file_or_file_system_container.
call fcn.656946fc
mov dword [esp], 0x3c1
call dword [sym.imp.USER32.dll_GetParent]
mov edx, str.Log_service_cannot_delete_log_file_or_file_system_container.
push edi
mov al, byte [edx]
test al, al
je 0x6568a832
sub eax, 0x30
cmp al, 9
jbe 0x6568a82f
mov eax, dword [0x656a8c60]
add eax, 0x53f424be
mov dword [0x656a9014], eax
jmp 0x6568a832
inc edx
jmp 0x6568a811
mov eax, dword [0x656a9014]
sub eax, 0x2da13899
mov dword [0x656a8c60], eax
call fcn.656935b0
movzx eax, word [ebp - 0x564]
xor edx, edx
mov cl, byte [ebp - 0x59c]
mov esi, dword [ebp - 0x5a0]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x560]
mov dword [ebx + 0xc], eax
xor eax, eax
test cl, 0x20
sete al
setne dl
shl eax, cl
shl edx, cl
cmp dword [ebp - 0x58c], 0
cmove esi, dword [ebp - 0x58c]
mov dword [ebp - 0x580], eax
xor eax, eax
cmp dword [ebp - 0x5a4], 0
setne al
mov dword [ebp - 0x57c], edx
mov edx, 0x656a9760
shl eax, 0x11
or eax, esi
or eax, 0x10
mov dword [ebx + 0x14], eax
mov al, byte [edx]
test al, al
je 0x6568a94e
sub eax, 0x30
cmp al, 9
ja 0x6568a8c0
inc edx
jmp 0x6568a8ac
mov edx, 0x656a9760
mov ecx, 0xb6c
movzx eax, byte [edx]
inc edx
test al, al
je 0x6568a90a
add ecx, eax
cmp ecx, 0x1e86
jbe 0x6568a8ca
call fcn.65690694
or dword [0x656a8c60], 0x125bdab
mov dword [esp + 8], str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dword [esp + 4], 0x656ae0a8
mov eax, dword [0x656a9014]
mov dword [esp], eax
call fcn.6568fb28
jmp 0x6568a919
mov eax, dword [0x656a9014]
or eax, 0x75badc91
mov dword [0x656a8c60], eax
mov eax, dword [0x656a8c60]
mov edx, eax
xor edx, 0xb77b452c
mov dword [0x656a9014], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str.There_are_not_enough_resources_to_complete_the_operation.
mov dword [esp], 0x656a9760
call fcn.65691bb0
or dword [0x656a8c60], 0xe0b47f0f
imul eax, dword [0x656a8c60], 0x4b12aad0
mov dword [ebx + 0x18], 8
mov dword [0x656a9014], eax
lea eax, [ebp - 0x580]
mov dword [ebx + 0x1c], eax
call fcn.6568c2f4
mov dword [ebp - 0x590], eax
dec eax
cmp eax, 0xfffffffd
ja 0x6568acb0
mov edx, str.Log_service_cannot_delete_log_file_or_file_system_container.
mov al, byte [edx]
test al, al
je 0x6568a9a3
sub eax, 0x30
cmp al, 9
jbe 0x6568a9a0
or dword [0x656a8c60], 0x5975a02b
jmp 0x6568a9a3
inc edx
jmp 0x6568a987
and dword [0x656a9014], 0x485606b9
call fcn.656924a8
cmp byte [str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x6568a9e1
mov dword [esp + 8], str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dword [esp + 4], 0x656a9760
mov dword [esp], str.The_cluster_request_is_not_valid_for_this_object.
call fcn.656947c0
xor dword [0x656a8c60], 0x13015d5
mov eax, dword [0x656a8c60]
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
sub eax, 0x538488fd
mov dword [0x656a9014], eax
call esi
xor dword [0x656a9014], 0x79072bd6
cmp byte [0x656a9760], 0
je 0x6568aa17
mov dword [esp], str.Error_Status_was_0x_x
call fcn.65690928
mov eax, dword [0x656a8c60]
sub eax, 0x23a127be
mov dword [0x656a9014], eax
xor eax, 0xbabd0b65
and eax, 0xa9d15e28
mov dword [0x656a8c60], eax
call esi
xor ecx, ecx
movzx eax, ax
mov dword [ebp - 0x58c], ecx
or eax, 0x23802a4f
mov dword [0x656a8c60], eax
mov ecx, str.Log_service_cannot_delete_log_file_or_file_system_container.
mov edx, 0x1773
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x6568aa68
add edx, eax
cmp edx, 0x2186
jbe 0x6568aa56
mov eax, dword [0x656a8c60]
cmp edx, 0x2186
jbe 0x6568aa87
and eax, 0xa5e774ff
mov dword [0x656a9014], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
jmp 0x6568aa92
imul eax, eax, 0xaff20e78
mov dword [0x656a8c60], eax
mov eax, dword [0x656a8c60]
add eax, 0x2ea78cb3
mov dword [0x656a9014], eax
call fcn.65690694
inc dword [ebp - 0x58c]
cmp dword [ebp - 0x58c], 4
jne 0x6568aa4c
mov ecx, dword [ebp - 0x58c]
lea edi, [ebp - 0x514]
mov esi, 0x65695128
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x3c0000
xor dword [0x656a9014], 0x522fb7a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
sub edi, dword [ebp + esi*4 - 0x514]
inc esi
mov dword [ebp - 0x58c], edi
cmp esi, 4
jne 0x6568aacf
mov eax, dword [0x656a8c60]
or eax, 0x9f76a1c4
sub eax, 0x39e3929b
cmp byte [0x656a9760], 0
mov dword [0x656a9014], eax
je 0x6568ab23
call fcn.6569077c
mov eax, dword [0x656a8c60]
add eax, 0x4f099a9a
mov dword [0x656a9014], eax
mov eax, dword [0x656a9014]
mov esi, 0x1227
add eax, 0x51b147f0
mov dword [0x656a8c60], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov eax, dword [0x656a8c60]
or eax, 0xb2964789
mov dword [0x656a9014], eax
call fcn.656924a8
mov ecx, 0x656a9760
imul edx, dword [0x656a9014], 0xea648f2
mov dword [0x656a9014], edx
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x6568ab84
add esi, eax
cmp esi, 0x254a
jbe 0x6568ab66
and edx, 0x68c76b63
mov dword [0x656a9014], edx
mov eax, dword [0x656a9014]
sub eax, 0x386126c6
mov dword [0x656a8c60], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, 0x7981daf3
imul edx, eax, 0xcfcc542e
mov dword [0x656a8c60], eax
mov dword [0x656a9014], edx
xor edx, edx
cmp byte [edx + str.Log_service_cannot_delete_log_file_or_file_system_container.], 0
je 0x6568abd3
inc edx
cmp edx, 0x16d7
jne 0x6568abb1
or eax, 0xfbd0eb30
mov dword [0x656a9014], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
or dword [0x656a9014], 0x3ff2fd1f
call fcn.6569077c
mov eax, dword [0x656a9014]
mov ecx, 0x656a9760
mov edx, eax
xor edx, 0xfd8ce6ec
mov dword [0x656a8c60], edx
mov edx, eax
xor edx, 0xf001b765
mov dword [0x656a9014], edx
mov edx, dword [ebp - 0x58c]
or edx, 0x20000
mov dword [ebx + 0x24], edx
mov dl, byte [ecx]
test dl, dl
je 0x6568ac34
sub edx, 0x30
cmp dl, 9
jbe 0x6568ac31
xor eax, 0x46cd4d05
mov dword [0x656a9014], eax
jmp 0x6568ac34
inc ecx
jmp 0x6568ac17
and dword [0x656a9014], 0x2d0cc4ed
call fcn.65690694
mov edx, dword [0x656a8c60]
mov ecx, str.Log_service_cannot_delete_log_file_or_file_system_container.
mov dword [ebx + 0x28], 4
lea eax, [edx - 0x8840233]
mov dword [0x656a9014], eax
mov al, byte [ecx]
test al, al
je 0x6568ac7e
sub eax, 0x30
cmp al, 9
jbe 0x6568ac7b
add edx, 0x1791aa33
mov dword [0x656a9014], edx
jmp 0x6568ac7e
inc ecx
jmp 0x6568ac60
mov eax, dword [0x656a9014]
add eax, 0x1e013d75
mov dword [0x656a9014], eax
mov dword [esp], eax
mov dword [esp + 8], 0x656a9760
mov dword [esp + 4], str.Windows.IoTHeadless
call fcn.6568fb28
mov eax, dword [ebp - 0x590]
mov dword [ebx + 0x2c], eax
jmp 0x6568acb3
sub dword [ebx], 0x10
lea eax, [ebp - 0x3b0]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x584]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2000000
mov dword [esp + 8], 0x2000000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.65681097
mov esi, eax
mov eax, dword [ebp - 0x590]
mov dword [esp], eax
call fcn.65681065
mov dword [esp], ebx
call fcn.6568d9e0
mov eax, dword [ebp - 0x584]
mov dword [esp], eax
mov eax, dword [0x65695064]
call dword [eax + 0x1c]
mov eax, esi
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret