Function at 0x643c377c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ecx, 0xa
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x982]
mov esi, 0x643ea23d
push ebx
sub esp, 0x99c
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x96e]
mov esi, str.Networking
mov ecx, 0xb
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x718], al
inc eax
cmp eax, 0x100
jne 0x643c37ae
xor edi, edi
xor ebx, ebx
mov ecx, 0xa
mov eax, ebx
xor edx, edx
movzx esi, byte [ebp + ebx - 0x718]
div ecx
mov eax, esi
add al, byte [ebp + edx - 0x96e]
add eax, edi
movzx edi, al
imul eax, dword [0x643e7f08], 0xeef13e9
mov dword [0x643e7f08], eax
mov al, byte [ebp + edi - 0x718]
mov byte [ebp + ebx - 0x718], al
xor eax, eax
cmp byte [eax + str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer], 0
je 0x643c3828
inc eax
cmp eax, 0x12fd
jne 0x643c3801
mov dword [esp], str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
call fcn.643d3a44
or dword [0x643e7f08], 0xd009d9fe
mov eax, dword [0x643e7f08]
inc ebx
or eax, 0x364bb592
imul eax, eax, 0x5adc97c4
mov dword [0x643e7f08], eax
call fcn.643d0254
mov eax, esi
mov byte [ebp + edi - 0x718], al
cmp ebx, 0x100
jne 0x643c37c1
mov eax, dword [0x643e7f08]
or eax, 0x5c3b2cf2
imul eax, eax, 0xe8e6eb66
mov dword [0x643e7f08], eax
call fcn.643d05d4
xor eax, eax
cmp word [eax + eax + str.CompanyName], 0
je 0x643c3898
inc eax
cmp eax, 0x2212
jne 0x643c3874
call fcn.643d1310
and dword [0x643e7f08], 0x5b41755
jmp 0x643c389f
cmp eax, 0x1fa5
jle 0x643c38c4
mov eax, dword [0x643e7f08]
mov dword [esp + 8], str.CompanyName
mov dword [esp + 4], str.CompanyName
mov dword [esp + 0xc], eax
mov dword [esp], str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
call fcn.643d0978
mov eax, dword [0x643e7f08]
xor ecx, ecx
xor esi, esi
xor ebx, ebx
lea edi, [eax + 0x55e3e07c]
inc ebx
movzx ebx, bl
mov dl, byte [ebp + ebx - 0x718]
add esi, edx
mov eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x718]
mov byte [ebp + ebx - 0x718], al
lea eax, [edi + 0x1517d605]
mov byte [ebp + esi - 0x718], dl
add dl, byte [ebp + ebx - 0x718]
imul edi, eax, 0x11b44e8b
movzx edx, dl
mov dl, byte [ebp + edx - 0x718]
xor dl, byte [ecx + ebp - 0x982]
movzx edx, dl
mov word [ebp + ecx*2 - 0x918], dx
inc ecx
cmp ecx, 0xa
jne 0x643c38d5
mov word [ebp - 0x904], 0
mov eax, edi
mov esi, 0x643ea252
lea edi, [ebp - 0x978]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x93b]
mov esi, 0x643ea25c
mov ecx, 0x11
rep movsb byte es:[edi], byte [esi]
xor eax, 0xe8a9ad16
mov dword [0x643e7f08], eax
mov dword [esp], 0x13e3
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor eax, eax
push esi
mov byte [ebp + eax - 0x618], al
inc eax
cmp eax, 0x100
jne 0x643c3975
xor ebx, ebx
xor eax, eax
mov edx, eax
movzx esi, byte [ebp + eax - 0x618]
and edx, 0xf
movzx edx, byte [ebp + edx - 0x93b]
mov ecx, esi
add edx, esi
add ebx, edx
movzx ebx, bl
mov dl, byte [ebp + ebx - 0x618]
mov byte [ebp + eax - 0x618], dl
inc eax
mov byte [ebp + ebx - 0x618], cl
cmp eax, 0x100
jne 0x643c3988
xor edx, edx
xor edi, edi
xor esi, esi
lea eax, [esi + 1]
xor ecx, ecx
movzx esi, al
mov bl, byte [ebp + esi - 0x618]
lea eax, [ebx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x618]
mov byte [ebp + esi - 0x618], al
cmp byte [ecx + str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer], 0
je 0x643c3a41
inc ecx
cmp ecx, 0x1671
jne 0x643c39ec
mov eax, dword [0x643e7f08]
mov dword [ebp - 0x98c], edx
mov dword [esp + 8], str.CompanyName
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.CompanyName
mov dword [esp], str.The_volume_change_journal_is_being_deleted.
call fcn.643d0978
or dword [0x643e7f08], 0xd972a016
call dword [sym.imp.USER32.dll_AnyPopup]
mov edx, dword [ebp - 0x98c]
jmp 0x643c3a53
mov eax, dword [0x643e7f08]
or eax, 0xab28e680
cmp ecx, 0x14a7
jle 0x643c3a5d
mov eax, dword [0x643e7f08]
sub eax, 0x650da881
add eax, 0x6d36c358
mov dword [ebp - 0x98c], edx
mov dword [0x643e7f08], eax
call fcn.643d4480
mov eax, dword [0x643e7f08]
and eax, 0xda0a05c5
or eax, 0x16cc5fad
mov dword [0x643e7f08], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.CompanyName
mov dword [esp + 4], str.CompanyName
mov dword [esp], str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
call fcn.643d0978
mov edx, dword [ebp - 0x98c]
mov byte [ebp + edi - 0x618], bl
add bl, byte [ebp + esi - 0x618]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x618]
xor al, byte [ebp + edx - 0x978]
movzx eax, al
mov word [ebp + edx*2 - 0x904], ax
inc edx
cmp edx, 0xa
jne 0x643c39c9
lea edi, [ebp - 0x963]
mov esi, 0x643ea26d
mov ecx, 0xb
mov word [ebp - 0x8f0], 0
imul eax, dword [0x643e7f08], 0x159599bc
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x7b2]
mov esi, str.The_specified_pack_is_not_the_primary_pack.
or eax, 0xc533e4f9
mov dword [0x643e7f08], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov ecx, 0xb
xor edx, edx
push ebx
mov eax, dword [0x643e7f08]
rep movsd dword es:[edi], dword [esi]
add eax, 0x198dff0f
xor eax, 0x99ea04f1
mov dword [0x643e7f08], eax
cmp word [edx + edx + str.CompanyName], 0
je 0x643c3b66
inc edx
cmp edx, 0x1053
jne 0x643c3b41
call fcn.643d4480
xor dword [0x643e7f08], 0x1cd2dbbc
jmp 0x643c3b74
imul eax, eax, 0xc925a7e9
cmp edx, 0x460
jle 0x643c3b9a
mov dword [esp + 8], str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
mov dword [esp + 4], str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
mov dword [esp], str.CompanyName
call fcn.643d0738
mov eax, dword [0x643e7f08]
sub eax, 0x7ba0f92f
add eax, 0x406d24ae
mov dword [0x643e7f08], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor eax, eax
mov byte [ebp + eax - 0x518], al
inc eax
cmp eax, 0x100
jne 0x643c3bac
xor edi, edi
xor ecx, ecx
mov esi, 0x2b
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x518]
div esi
movzx eax, byte [ebp + edx - 0x7b2]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x518]
mov byte [ebp + ecx - 0x518], al
inc ecx
mov byte [ebp + edi - 0x518], bl
cmp ecx, 0x100
jne 0x643c3bc4
mov eax, dword [0x643e7f08]
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x98c], eax
and dword [ebp - 0x98c], 0x4824064
inc ecx
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x518]
add ebx, edx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x518]
mov byte [ebp + ecx - 0x518], al
mov byte [ebp + ebx - 0x518], dl
add dl, byte [ebp + ecx - 0x518]
movzx edx, dl
mov dl, byte [ebp + edx - 0x518]
xor dl, byte [esi + ebp - 0x963]
movzx edx, dl
mov word [ebp + esi*2 - 0x8dc], dx
inc esi
cmp esi, 0xb
jne 0x643c3c12
mov eax, dword [ebp - 0x98c]
lea edi, [ebp - 0x94b]
mov esi, 0x643ea2a4
xor ebx, ebx
mov word [ebp - 0x8c6], 0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
add eax, 0x6a04c3a3
lea edi, [ebp - 0x92a]
mov esi, 0x643ea2b4
and eax, 0x64c3647a
mov ecx, 0x12
rep movsb byte es:[edi], byte [esi]
mov dword [0x643e7f08], eax
call fcn.643d0254
sub dword [0x643e7f08], 0x1475bcd4
mov edx, str.The_volume_change_journal_is_being_deleted.
mov ecx, 0x1e4f
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c3d1c
add ecx, eax
cmp ecx, 0x2638
jbe 0x643c3cc7
mov eax, dword [0x643e7f08]
mov dword [esp + 8], str.CompanyName
mov dword [esp + 4], str.CompanyName
mov dword [esp + 0xc], eax
mov dword [esp], str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
call fcn.643d0978
xor dword [0x643e7f08], 0xddfa767a
mov dword [esp + 4], str.CompanyName
mov dword [esp], str.CompanyName
call fcn.643cf620
mov eax, dword [0x643e7f08]
xor eax, 0x6a2a001f
and eax, 0xcf2518ef
mov dword [0x643e7f08], eax
call fcn.643ce1b4
mov edx, str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
mov al, byte [edx]
test al, al
je 0x643c3d56
sub eax, 0x30
cmp al, 9
jbe 0x643c3d53
and dword [0x643e7f08], 0xcac67625
jmp 0x643c3d56
inc edx
jmp 0x643c3d3a
and dword [0x643e7f08], 0x690ee644
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov byte [ebp + ebx - 0x418], bl
inc ebx
cmp ebx, 0x100
jne 0x643c3cbd
xor edi, edi
xor ecx, ecx
mov esi, 0x11
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x418]
div esi
movzx eax, byte [ebp + edx - 0x92a]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x418]
mov byte [ebp + ecx - 0x418], al
inc ecx
mov byte [ebp + edi - 0x418], bl
cmp ecx, 0x100
jne 0x643c3d83
xor esi, esi
xor edi, edi
xor ebx, ebx
inc ebx
movzx ebx, bl
mov cl, byte [ebp + ebx - 0x418]
lea eax, [ecx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x418]
mov byte [ebp + ebx - 0x418], al
mov byte [ebp + edi - 0x418], cl
add cl, byte [ebp + ebx - 0x418]
movzx ecx, cl
mov al, byte [ebp + ecx - 0x418]
mov byte [ebp - 0x98c], al
mov eax, dword [0x643e7f08]
xor eax, 0xc2509da8
and eax, 0x4380e102
sub eax, 0x6f5119a3
mov dword [0x643e7f08], eax
call dword [sym.imp.USER32.dll_AnyPopup]
mov dword [esp], str.The_volume_change_journal_is_being_deleted.
call fcn.643d3a44
mov al, byte [ebp - 0x98c]
xor al, byte [ebp + esi - 0x94b]
movzx eax, al
mov word [ebp + esi*2 - 0x894], ax
inc esi
cmp esi, 0x10
jne 0x643c3dc6
mov word [ebp - 0x874], 0
mov eax, dword [0x643e7f08]
add eax, 0x63c5b319
cmp byte [str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer], 0
mov dword [0x643e7f08], eax
je 0x643c3e86
imul eax, eax, 0xd5fee31b
mov dword [0x643e7f08], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push ecx
call fcn.643cfc74
mov eax, dword [0x643e7f08]
lea edi, [ebp - 0x8f0]
xor ebx, ebx
mov esi, 0x643ea2c6
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
xor eax, 0x779c0e2f
lea edi, [ebp - 0x808]
mov esi, str.AslpFileGetChecksumAttributes_failed___x_
imul eax, eax, 0xd75993f9
mov ecx, 0x2a
rep movsb byte es:[edi], byte [esi]
mov dword [0x643e7f08], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov byte [ebp + ebx - 0x318], bl
inc ebx
imul eax, eax, 0xf23c7a7e
sub eax, 0x513211fb
mov dword [0x643e7f08], eax
cmp ebx, 0x100
jne 0x643c3ec6
xor edi, edi
xor esi, esi
xor edx, edx
mov ecx, 0x29
mov eax, esi
mov bl, byte [ebp + esi - 0x318]
div ecx
movzx eax, byte [ebp + edx - 0x808]
movzx edx, bl
add eax, edx
add eax, edi
cmp byte [str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer], 0
movzx edi, al
je 0x643c3f2c
call fcn.643d0254
sub dword [0x643e7f08], 0xe930121
mov eax, dword [0x643e7f08]
xor eax, 0xcc29831d
imul eax, eax, 0x31ca49d1
mov dword [0x643e7f08], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.CompanyName
mov dword [esp + 4], str.CompanyName
mov dword [esp], str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
call fcn.643d0978
imul eax, dword [0x643e7f08], 0x491440a1
mov dword [0x643e7f08], eax
mov al, byte [ebp + edi - 0x318]
mov byte [ebp + esi - 0x318], al
inc esi
mov byte [ebp + edi - 0x318], bl
cmp esi, 0x100
jne 0x643c3ef0
xor edi, edi
xor esi, esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x318]
lea edx, [eax + esi]
movzx esi, dl
mov dl, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], dl
mov byte [ebp + esi - 0x318], al
add al, byte [ebp + ebx - 0x318]
movzx eax, al
mov al, byte [ebp + eax - 0x318]
xor al, byte [ebp + edi - 0x8f0]
movzx eax, al
mov word [ebp + edi*2 - 0x830], ax
inc edi
cmp edi, 0x14
jne 0x643c3f98
mov eax, dword [0x643e7f08]
lea edi, [ebp - 0x8c6]
mov esi, 0x643ea304
mov word [ebp - 0x808], 0
mov ecx, 0x16
rep movsb byte es:[edi], byte [esi]
xor eax, 0x64ea46c1
lea edi, [ebp - 0x786]
mov esi, str.The_Terminal_Connection_driver__1_is_invalid.
imul eax, eax, 0x8e95a12
mov ecx, 0x2e
rep movsb byte es:[edi], byte [esi]
xor eax, 0x21d6eb18
and eax, 0xfc78d85a
or eax, 0x8438d81a
mov dword [0x643e7f08], eax
mov dword [esp], str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer
call fcn.643d3a44
imul eax, dword [0x643e7f08], 0x35cd589a
and eax, 0x7b2be18a
mov dword [0x643e7f08], eax
xor eax, eax
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x643c4060
xor edi, edi
xor ecx, ecx
mov esi, 0x2d
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x218]
div esi
movzx eax, byte [ebp + edx - 0x786]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x218]
mov byte [ebp + ecx - 0x218], al
inc ecx
mov byte [ebp + edi - 0x218], bl
cmp ecx, 0x100
jne 0x643c4078
xor esi, esi
xor edi, edi
xor ebx, ebx
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x218]
mov byte [ebp - 0x98c], al
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x218]
mov byte [ebp + ebx - 0x218], al
xor eax, eax
cmp word [eax + str.CompanyName], 0
je 0x643c4104
add eax, 2
cmp eax, 0x37de
jne 0x643c40e1
call fcn.643d1310
and dword [0x643e7f08], 0xb3257319
imul eax, dword [0x643e7f08], 0xf363991d
sub eax, 0x24a380ca
mov dword [0x643e7f08], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.CompanyName
mov dword [esp + 4], str.CompanyName
mov dword [esp], str.The_volume_change_journal_is_being_deleted.
call fcn.643d0978
mov dl, byte [ebp - 0x98c]
mov eax, dword [0x643e7f08]
mov byte [ebp + edi - 0x218], dl
mov cl, byte [ebp + ebx - 0x218]
sub eax, 0x3cd84942
mov dword [0x643e7f08], eax
add ecx, edx
movzx ecx, cl
mov cl, byte [ebp + ecx - 0x218]
xor cl, byte [ebp + esi - 0x8c6]
movzx ecx, cl
mov word [ebp + esi*2 - 0x7de], cx
inc esi
cmp esi, 0x16
jne 0x643c40bb
and eax, 0xee80c203
lea edi, [ebp - 0x873]
mov esi, 0x643ea348
mov word [ebp - 0x7b2], 0
mov dword [0x643e7f08], eax
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x853]
mov esi, str.RtlpResolveAssemblyStorageMapEntry
mov ecx, 0x23
rep movsb byte es:[edi], byte [esi]
call fcn.643d05d4
mov ebx, dword [0x643e7f08]
call fcn.643cfc74
sub ebx, 0x29d39da3
and ebx, 0x766ca629
mov dword [0x643e7f08], ebx
xor ebx, ebx
mov dword [esp], str.The_volume_change_journal_is_being_deleted.
call fcn.643d3a44
imul eax, dword [0x643e7f08], 0x23f18eda
and eax, 0x541bb94c
sub eax, 0x7d589a79
mov dword [0x643e7f08], eax
mov dword [esp], str.The_volume_change_journal_is_being_deleted.
call fcn.643d3a44
mov byte [ebp + ebx - 0x118], bl
inc ebx
cmp ebx, 0x100
jne 0x643c41de
imul eax, dword [0x643e7f08], 0xa23b8847
xor esi, esi
xor ebx, ebx
mov dword [0x643e7f08], eax
mov eax, dword [0x643e7f08]
mov edi, 0x22
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push eax
mov eax, dword [0x643e7f08]
and eax, 0x8b1421c
add eax, 0x9fc384
mov dword [0x643e7f08], eax
mov dword [esp], 0x13c6
call dword [sym.imp.USER32.dll_GetTopWindow]
mov eax, ebx
push edx
xor edx, edx
mov cl, byte [ebp + ebx - 0x118]
div edi
mov edi, dword [0x643e7f08]
movzx eax, byte [ebp + edx - 0x853]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
lea eax, [edi - 0x73f5770]
inc ebx
mov dword [0x643e7f08], eax
mov byte [ebp + esi - 0x118], cl
cmp ebx, 0x100
jne 0x643c4232
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], bl
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + esi - 0x873]
movzx eax, al
mov word [ebp + esi*2 - 0x758], ax
inc esi
cmp esi, 0x20
jne 0x643c42c0
sub edi, 0x37c202cb
xor esi, esi
mov word [ebp - 0x718], 0
mov dword [ebp - 0x958], 0x55
or edi, 0x7916f301
mov dword [ebp - 0x954], 0x53
imul edi, edi, 0x6038b682
mov dword [ebp - 0x950], 0xffffff58
xor edi, 0xbf805922
mov dword [0x643e7f08], edi
xor edi, edi
xor eax, eax
cmp byte [eax + str.The_volume_change_journal_is_being_deleted.], 0
je 0x643c4379
inc eax
cmp eax, 0xd90
jne 0x643c4359
call fcn.643cfc74
xor dword [0x643e7f08], 0x5ec757fa
mov eax, dword [0x643e7f08]
and eax, 0xddf24272
sub eax, 0x3c315946
cmp byte [str.AslpEnvResolveVars_failed_to_fail_properly_for_null_buffer], 0
mov dword [0x643e7f08], eax
je 0x643c43a5
call fcn.643d4480
add dword [0x643e7f08], 0x70802081
sub esi, dword [ebp + edi*4 - 0x958]
inc edi
add dword [0x643e7f08], 0x49dd592b
cmp edi, 3
jne 0x643c4357
lea eax, [ebp - 0x918]
xor ebx, ebx
mov dword [ebp - 0x8b0], eax
lea eax, [ebp - 0x904]
mov dword [ebp - 0x8ac], eax
lea eax, [ebp - 0x8dc]
mov dword [ebp - 0x8a8], eax
lea eax, [ebp - 0x894]
mov dword [ebp - 0x8a4], eax
lea eax, [ebp - 0x830]
mov dword [ebp - 0x8a0], eax
lea eax, [ebp - 0x7de]
mov dword [ebp - 0x89c], eax
lea eax, [ebp - 0x758]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp + ebx*4 - 0x8b0]
mov dword [esp], eax
call fcn.643c10e8
test eax, eax
je 0x643c4436
or dword [0x643e7f08], 0xd4a24f
mov esi, 1
jmp 0x643c443c
inc ebx
cmp ebx, 7
jne 0x643c4412
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret