Function at 0x643c1438
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xb
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0xe15]
mov esi, 0x643ea055
push ebx
sub esp, 0xe5c
or dword [0x643e8088], 0xfb5feb36
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb8c]
mov esi, 0x643ea060
mov ecx, 0x36
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0xb18], al
inc eax
cmp eax, 0x100
jne 0x643c1474
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov edi, 0x35
xor edx, edx
mov cl, byte [ebp + ebx - 0xb18]
div edi
mov byte [ebp - 0xe4c], cl
movzx eax, byte [ebp + edx - 0xb8c]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov eax, dword [0x643e8088]
sub eax, 0x26982ff
mov dword [0x643e80bc], eax
call fcn.643d05d4
mov eax, dword [0x643e80bc]
imul edx, eax, 0x4a89ee84
mov dword [0x643e8088], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_network_address_is_invalid.
call fcn.643d0978
mov eax, dword [0x643e8088]
mov cl, byte [ebp - 0xe4c]
mov edx, eax
and eax, 0x62173b1d
or eax, 0x22150a00
or edx, 0x3b1dcae2
mov dword [0x643e8088], eax
mov al, byte [ebp + esi - 0xb18]
mov byte [ebp + ebx - 0xb18], al
inc ebx
mov byte [ebp + esi - 0xb18], cl
cmp ebx, 0x100
jne 0x643c1487
lea eax, [edx + 0x6924a919]
add edx, 0x6bbad2fe
xor edi, edi
xor esi, esi
mov dword [0x643e8088], eax
xor ebx, ebx
mov dword [0x643e80bc], edx
call fcn.643ce1b4
inc ebx
mov edx, str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov ecx, 0x2315
movzx ebx, bl
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c158e
add ecx, eax
cmp ecx, 0x237e
jbe 0x643c156a
sub dword [0x643e8088], 0x66c383c6
call fcn.643d0254
mov al, byte [ebp + ebx - 0xb18]
mov edx, dword [0x643e80bc]
lea ecx, [eax + esi]
movzx esi, cl
mov cl, byte [ebp + esi - 0xb18]
mov byte [ebp + ebx - 0xb18], cl
mov ecx, edx
mov byte [ebp + esi - 0xb18], al
add al, byte [ebp + ebx - 0xb18]
and ecx, 0x9cfbe06
movzx eax, al
mov dword [0x643e8088], ecx
mov al, byte [ebp + eax - 0xb18]
xor al, byte [ebp + edi - 0xe15]
movzx eax, al
mov word [ebp + edi*2 - 0xd58], ax
inc edi
cmp edi, 0xb
jne 0x643c155c
imul edx, edx, 0xca618e69
lea edi, [ebp - 0xda7]
mov esi, 0x643ea096
mov word [ebp - 0xd42], 0
mov ecx, 0x11
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc15]
mov esi, 0x643ea0a7
mov ecx, 0x29
rep movsb byte es:[edi], byte [esi]
lea eax, [edx + 0x192d70cb]
mov dword [0x643e8088], edx
mov dword [0x643e80bc], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.Failed_to_construct_full_key_path
call fcn.643d0978
and dword [0x643e8088], 0x4acece17
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, str.The_network_address_is_invalid.
mov ecx, 0x15b6
mov ebx, dword [0x643e8088]
imul eax, ebx, 0x70dcf41c
mov dword [0x643e80bc], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c16bc
add ecx, eax
cmp ecx, 0x1826
jbe 0x643c1680
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_cluster_node_has_been_poisoned.
call fcn.643d0978
or dword [0x643e80bc], 0xe6311ba1
mov eax, dword [0x643e8088]
add eax, 0x339c343b
imul eax, eax, 0x136b96bb
mov dword [0x643e8088], eax
call fcn.643d4480
xor eax, eax
mov byte [eax + ebp - 0xa18], al
inc eax
cmp eax, 0x100
jne 0x643c16d8
mov eax, dword [0x643e80bc]
xor esi, esi
xor ebx, ebx
or eax, 0xa85bb8db
mov dword [0x643e8088], eax
mov ecx, 0x28
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0xa18]
div ecx
mov eax, edi
mov ecx, 0xa75
add al, byte [ebp + edx - 0xc15]
mov edx, str.The_network_address_is_invalid.
add eax, esi
movzx esi, al
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c1746
add ecx, eax
cmp ecx, 0x1fe6
jbe 0x643c1725
imul eax, dword [0x643e8088], 0xf20bfa3e
mov dword [0x643e8088], eax
imul eax, dword [0x643e8088], 0x829e14f2
mov dword [0x643e80bc], eax
call fcn.643ce1b4
mov eax, dword [0x643e80bc]
or eax, 0x47f4f9f
mov dword [0x643e8088], eax
mov dword [esp], str.The_cluster_node_has_been_poisoned.
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [0x643e8088]
xor eax, 0x3dcaa8d4
mov dword [0x643e80bc], eax
mov al, byte [ebp + esi - 0xa18]
mov byte [ebp + ebx - 0xa18], al
mov eax, edi
inc ebx
mov byte [ebp + esi - 0xa18], al
cmp ebx, 0x100
jne 0x643c16fa
xor edi, edi
xor esi, esi
xor ebx, ebx
mov eax, dword [0x643e80bc]
inc ebx
movzx ebx, bl
or eax, 0x612caae3
mov cl, byte [ebp + ebx - 0xa18]
mov dword [0x643e8088], eax
imul eax, eax, 0xbd187843
lea edx, [ecx + esi]
mov byte [ebp - 0xe4c], cl
movzx esi, dl
and eax, 0xe21eed45
mov dword [0x643e80bc], eax
call fcn.643d0254
mov edx, str.Failed_to_construct_full_key_path
mov ecx, 0x126d
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c1825
add ecx, eax
cmp ecx, 0x1d5f
jbe 0x643c17f5
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643cf620
sub dword [0x643e8088], 0x3b16a7e1
mov eax, dword [0x643e80bc]
and eax, 0xcc512d7d
or eax, 0x4010011
mov dword [0x643e80bc], eax
call fcn.643d2564
mov al, byte [ebp + esi - 0xa18]
mov byte [ebp + ebx - 0xa18], al
mov al, byte [ebp - 0xe4c]
mov byte [ebp + esi - 0xa18], al
add al, byte [ebp + ebx - 0xa18]
movzx eax, al
mov al, byte [ebp + eax - 0xa18]
xor al, byte [ebp + edi - 0xda7]
movzx eax, al
mov word [ebp + edi*2 - 0xc82], ax
inc edi
cmp edi, 0x11
jne 0x643c17b0
lea edi, [ebp - 0xe0a]
mov esi, 0x643ea0d0
mov ecx, 0xb
mov word [ebp - 0xc60], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xcb8]
mov esi, 0x643ea0db
mov ecx, 0x1a
rep movsb byte es:[edi], byte [esi]
call fcn.643d0254
mov eax, dword [0x643e80bc]
and eax, 0x623e1ae
mov dword [0x643e80bc], eax
or eax, 0xc7ce814c
imul eax, eax, 0x80ad0bd5
mov dword [0x643e8088], eax
xor eax, eax
mov byte [ebp + eax - 0x918], al
inc eax
cmp eax, 0x100
jne 0x643c18d9
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor esi, esi
xor ecx, ecx
mov edi, 0x19
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x918]
div edi
movzx eax, byte [ebp + edx - 0xcb8]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x918]
mov byte [ebp + ecx - 0x918], al
inc ecx
mov byte [ebp + esi - 0x918], bl
cmp ecx, 0x100
jne 0x643c18f7
mov eax, dword [0x643e8088]
xor esi, esi
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0xe4c], eax
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x918]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x918]
mov byte [ebp + edx - 0x918], bl
mov byte [ebp + ecx - 0x918], al
add al, byte [ebp + edx - 0x918]
movzx eax, al
mov al, byte [ebp + eax - 0x918]
xor al, byte [esi + ebp - 0xe0a]
movzx eax, al
mov word [ebp + esi*2 - 0xd42], ax
inc esi
cmp esi, 0xb
jne 0x643c1945
mov eax, dword [ebp - 0xe4c]
mov esi, 0x643ea0f5
mov ecx, 3
mov ebx, dword [ebp - 0xe4c]
mov word [ebp - 0xd2c], 0
lea edi, [ebp - 0xdde]
rep movsd dword es:[edi], dword [esi]
sub eax, 0x525ae762
sub ebx, 0x692970be
xor eax, 0xb5f342c9
mov dword [0x643e8088], ebx
mov dword [0x643e80bc], eax
call fcn.643d0254
mov eax, dword [0x643e80bc]
mov dword [ebp - 0xe32], 0x696c6f50
mov dword [ebp - 0xe2e], 0x73656963
add eax, 0x1f4f653b
mov byte [ebp - 0xe2a], 0
mov dword [0x643e8088], eax
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643cf620
mov eax, dword [0x643e80bc]
and eax, 0x8cf7ed65
mov dword [0x643e8088], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_cluster_node_has_been_poisoned.
call fcn.643d0978
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643cf620
mov eax, dword [0x643e8088]
lea edx, [eax + 0xd9b5b19]
add eax, 0x3764a4bc
mov dword [0x643e80bc], edx
mov dword [0x643e8088], eax
call fcn.643d05d4
mov eax, dword [0x643e80bc]
or eax, 0x77a7b00
mov dword [0x643e8088], eax
xor eax, eax
mov byte [ebp + eax - 0x818], al
inc eax
cmp eax, 0x100
jne 0x643c1a92
xor edi, edi
xor ebx, ebx
movzx esi, byte [ebp + ebx - 0x818]
mov eax, ebx
mov edx, str.The_network_address_is_invalid.
and eax, 7
mov ecx, esi
add cl, byte [ebp + eax - 0xe32]
mov eax, ecx
mov ecx, 0x1bfe
add eax, edi
movzx edi, al
imul eax, dword [0x643e80bc], 0x1b679e2
mov dword [0x643e80bc], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c1b10
add ecx, eax
cmp ecx, 0x1cc3
jbe 0x643c1adb
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643cf620
mov eax, dword [0x643e80bc]
add eax, 0x745b0219
mov dword [0x643e8088], eax
mov eax, dword [0x643e80bc]
mov ecx, esi
add eax, 0x2030da0f
mov edx, eax
or edx, 0x25599aee
mov dword [0x643e80bc], edx
mov dl, byte [ebp + edi - 0x818]
mov byte [ebp + ebx - 0x818], dl
inc ebx
mov byte [ebp + edi - 0x818], cl
cmp ebx, 0x100
jne 0x643c1aa5
mov ecx, str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov ebx, 0xf8c
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x643c1b7a
add ebx, edx
cmp ebx, 0x1957
jbe 0x643c1b56
and eax, 0x6e590226
or eax, 0x24590226
mov dword [0x643e8088], eax
mov eax, dword [0x643e8088]
xor ebx, ebx
xor eax, 0xee892cf8
mov dword [0x643e80bc], eax
call dword [sym.imp.USER32.dll_AnyPopup]
imul eax, dword [0x643e80bc], 0x7fafe588
mov dword [0x643e8088], eax
mov dword [esp], 0x21d0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor edx, edx
push ecx
xor ecx, ecx
imul esi, dword [0x643e8088], 0x6771264b
mov dword [0x643e80bc], esi
inc edx
movzx edx, dl
movzx edi, byte [ebp + edx - 0x818]
add ecx, edi
movzx ecx, cl
mov al, byte [ebp + ecx - 0x818]
mov byte [ebp + edx - 0x818], al
mov eax, edi
mov byte [ebp + ecx - 0x818], al
add al, byte [ebp + edx - 0x818]
movzx eax, al
mov al, byte [ebp + eax - 0x818]
xor al, byte [ebx + ebp - 0xdde]
movzx eax, al
mov word [ebp + ebx*2 - 0xcea], ax
inc ebx
cmp ebx, 0xc
jne 0x643c1bc2
sub esi, 0x545c9148
lea edi, [ebp - 0xdd2]
mov ecx, 0xd
mov word [ebp - 0xcd2], 0
mov dword [0x643e8088], esi
mov esi, 0x643ea101
rep movsb byte es:[edi], byte [esi]
mov dword [esp], str.RtlArrayGet_failed_to_get_the_next_node
lea edi, [ebp - 0xb56]
mov esi, str.The_source_objects_SID_already_exists_in_destination_forest.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x3e
xor eax, 0xc20ee21a
push edx
rep movsb byte es:[edi], byte [esi]
mov dword [0x643e80bc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
cmp byte [eax + str.The_cluster_node_has_been_poisoned.], 0
je 0x643c1ca2
inc eax
cmp eax, 0x1e7b
jne 0x643c1c6c
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643cf620
mov eax, dword [0x643e8088]
add eax, 0x43e3cba9
mov dword [0x643e80bc], eax
jmp 0x643c1ca9
cmp eax, 0x1a36
jle 0x643c1cb5
mov dword [esp], str.Failed_to_construct_full_key_path
call fcn.643d3a44
mov eax, dword [0x643e8088]
and eax, 0x1b337226
mov dword [0x643e80bc], eax
xor eax, eax
cmp word [eax + str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.], 0
je 0x643c1ce9
add eax, 2
cmp eax, 0x29c0
jne 0x643c1cc6
call fcn.643d4480
sub dword [0x643e8088], 0x42d194df
mov eax, dword [0x643e8088]
and eax, 0xa2b481ed
mov dword [0x643e80bc], eax
xor eax, eax
mov byte [ebp + eax - 0x718], al
inc eax
cmp eax, 0x100
jne 0x643c1cfa
xor esi, esi
xor ebx, ebx
mov al, byte [ebp + ebx - 0x718]
mov ecx, 0x3d
xor edx, edx
mov edi, str.Failed_to_construct_full_key_path
mov byte [ebp - 0xe4c], al
mov eax, ebx
div ecx
mov al, byte [ebp - 0xe4c]
add al, byte [ebp + edx - 0xb56]
mov edx, 0x149c
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x718]
mov byte [ebp + ebx - 0x718], al
movsx eax, byte [edi]
mov ecx, dword [0x643e8088]
test al, al
je 0x643c1dd9
add edx, eax
cmp edx, 0x1a13
jbe 0x643c1d88
mov eax, ecx
xor eax, 0x1f2bc338
mov dword [0x643e80bc], eax
call fcn.643d0254
xor dword [0x643e80bc], 0x10d1ff18
call fcn.643d05d4
jmp 0x643c1dd9
mov dword [ebp - 0xe50], edx
inc edi
add dword [0x643e80bc], 0x431a9de9
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov eax, dword [0x643e80bc]
add eax, 0x21b5e3ac
mov dword [0x643e8088], eax
mov dword [esp + 8], str.Failed_to_construct_full_key_path
mov dword [esp + 4], str.The_network_address_is_invalid.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643d0738
mov edx, dword [ebp - 0xe50]
jmp 0x643c1d4f
mov eax, dword [0x643e8088]
xor eax, 0xb8e98c95
lea edx, [eax + 0x637c0b7c]
sub eax, 0x3abb3358
mov dword [0x643e80bc], edx
mov dword [0x643e8088], eax
call fcn.643d4480
mov eax, dword [0x643e8088]
imul edx, eax, 0x1eb19fb7
add eax, 0x6d410f6d
mov dword [0x643e8088], eax
xor eax, eax
mov ecx, edx
or ecx, 0x156dbf10
mov dword [0x643e80bc], ecx
cmp byte [eax + str.Failed_to_construct_full_key_path], 0
je 0x643c1e48
inc eax
cmp eax, 0x2494
jne 0x643c1e23
and edx, 0x4fff6abe
or edx, 0x56d2a10
mov dword [0x643e80bc], edx
jmp 0x643c1e4f
cmp eax, 0x793
jle 0x643c1e63
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643cf620
mov eax, dword [0x643e80bc]
inc ebx
and eax, 0xb9d62932
mov dword [0x643e8088], eax
call fcn.643d05d4
mov al, byte [ebp - 0xe4c]
mov byte [ebp + esi - 0x718], al
cmp ebx, 0x100
jne 0x643c1d0d
xor ebx, ebx
xor edi, edi
xor esi, esi
mov eax, dword [0x643e80bc]
lea ecx, [eax - 0x374b5ba3]
lea eax, [esi + 1]
movzx esi, al
mov dword [0x643e8088], ecx
xor ecx, 0xf560e3b
mov dl, byte [ebp + esi - 0x718]
mov dword [0x643e80bc], ecx
lea eax, [edx + edi]
mov byte [ebp - 0xe4c], dl
movzx edi, al
mov al, byte [ebp + edi - 0x718]
mov byte [ebp + esi - 0x718], al
call fcn.643d4480
mov eax, dword [0x643e8088]
add eax, 0x1edd643f
mov dword [0x643e80bc], eax
mov dword [esp + 8], str.The_cluster_node_has_been_poisoned.
mov dword [esp + 4], str.The_cluster_node_has_been_poisoned.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643d0738
xor dword [0x643e80bc], 0xd7450f26
add dword [0x643e8088], 0x11db2e52
mov dword [esp + 8], str.Failed_to_construct_full_key_path
mov dword [esp + 4], str.Failed_to_construct_full_key_path
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643d0738
mov dl, byte [ebp - 0xe4c]
mov byte [ebp + edi - 0x718], dl
mov al, byte [ebp + esi - 0x718]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x718]
xor al, byte [ebp + ebx - 0xdd2]
movzx eax, al
mov word [ebp + ebx*2 - 0xcd2], ax
inc ebx
cmp ebx, 0xd
jne 0x643c1e97
mov eax, dword [0x643e80bc]
lea edi, [ebp - 0xdff]
mov esi, 0x643ea14c
mov word [ebp - 0xcb8], 0
mov ecx, 0xb
rep movsb byte es:[edi], byte [esi]
add eax, 0x6f93e7fd
lea edi, [ebp - 0xdc5]
mov ecx, ebx
and eax, 0x1e973be6
mov esi, 0x643ea157
rep movsb byte es:[edi], byte [esi]
mov edx, eax
xor eax, 0xa9e2278f
sub eax, 0x2188eddf
xor edx, 0x9eb73b3f
mov dword [0x643e80bc], eax
mov dword [0x643e8088], edx
mov dword [esp], str.Failed_to_construct_full_key_path
call fcn.643d3a44
xor eax, eax
mov byte [ebp + eax - 0x618], al
inc eax
cmp eax, 0x100
jne 0x643c1fdb
xor esi, esi
xor ecx, ecx
mov edi, 0xc
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x618]
div edi
movzx eax, byte [ebp + edx - 0xdc5]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x618]
mov byte [ebp + ecx - 0x618], al
inc ecx
mov byte [ebp + esi - 0x618], bl
cmp ecx, 0x100
jne 0x643c1ff3
mov eax, dword [0x643e80bc]
xor ecx, ecx
xor esi, esi
xor ebx, ebx
xor eax, 0x60b16057
or eax, 0x81eb7309
mov dword [0x643e8088], eax
mov eax, dword [0x643e8088]
mov dword [ebp - 0xe50], ecx
mov edi, 0x1ce0
mov dword [ebp - 0xe4c], eax
call fcn.643cfc74
mov ecx, dword [ebp - 0xe50]
mov edx, str.Failed_to_construct_full_key_path
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c209e
add edi, eax
cmp edi, 0x1e7c
jbe 0x643c2070
mov eax, dword [ebp - 0xe4c]
add eax, 0x52cf3e14
mov dword [0x643e80bc], eax
xor eax, 0x2d18f0f7
mov dword [0x643e8088], eax
jmp 0x643c20ae
mov eax, dword [ebp - 0xe4c]
sub eax, 0x280cc5f0
mov dword [0x643e80bc], eax
or dword [0x643e8088], 0xc1288d07
inc ebx
mov dword [ebp - 0xe4c], ecx
movzx ebx, bl
mov dword [esp], str.The_network_address_is_invalid.
call fcn.643d3a44
mov dl, byte [ebp + ebx - 0x618]
xor dword [0x643e80bc], 0x9a26be5
lea eax, [edx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x618]
mov byte [ebp + ebx - 0x618], al
mov byte [ebp + esi - 0x618], dl
add dl, byte [ebp + ebx - 0x618]
movzx edx, dl
movzx edi, byte [ebp + edx - 0x618]
call fcn.643d0254
xor dword [0x643e80bc], 0xdf9c75b4
mov dword [esp], str.The_cluster_node_has_been_poisoned.
call fcn.643d3a44
mov eax, dword [0x643e8088]
xor eax, 0xbe813360
mov dword [0x643e8088], eax
add eax, 0x16ca00fb
mov dword [0x643e80bc], eax
mov dword [esp], 0x1a9a
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
mov ecx, dword [ebp - 0xe4c]
mov eax, edi
or dword [0x643e8088], 0xb79c6ae7
xor al, byte [ebp + ecx - 0xdff]
movzx eax, al
mov word [ebp + ecx*2 - 0xd2c], ax
inc ecx
cmp ecx, 0xb
jne 0x643c204a
mov word [ebp - 0xd16], 0
lea edi, [ebp - 0xdf4]
mov esi, 0x643ea164
xor eax, eax
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc3b]
mov esi, str.The_NtConnectPort_request_is_refused.
mov ecx, 0x26
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x518], al
inc eax
cmp eax, 0x100
jne 0x643c21a6
mov eax, dword [0x643e80bc]
xor esi, esi
xor ebx, ebx
lea edx, [eax + 0x4e54ec9c]
imul eax, eax, 0xeee5b4b0
mov dword [0x643e8088], edx
mov dword [0x643e80bc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
cmp byte [eax + str.The_network_address_is_invalid.], 0
je 0x643c2204
inc eax
cmp eax, 0x265c
jne 0x643c21dd
call fcn.643d0254
mov eax, dword [0x643e8088]
or eax, 0xfb94a9ec
mov dword [0x643e80bc], eax
jmp 0x643c220b
cmp eax, 0x25bd
jle 0x643c221f
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643cf620
mov edi, 0x25
mov eax, ebx
xor edx, edx
mov cl, byte [ebp + ebx - 0x518]
div edi
mov edi, dword [0x643e80bc]
mov al, byte [ebp + edx - 0xc3b]
lea edx, [edi + 0x6728dc9d]
add eax, ecx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x518]
mov byte [ebp + ebx - 0x518], al
mov eax, dword [0x643e80bc]
inc ebx
mov dword [0x643e80bc], edx
sub eax, 0x7bbf8ca8
mov byte [ebp + esi - 0x518], cl
mov dword [0x643e8088], eax
cmp ebx, 0x100
jne 0x643c21d5
mov edx, eax
imul eax, eax, 0x6233e570
xor esi, esi
xor ecx, ecx
and edx, 0x6d316972
mov dword [0x643e80bc], edx
xor edx, edx
mov dword [0x643e8088], eax
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x518]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x518]
mov byte [ebp + edx - 0x518], bl
mov byte [ebp + ecx - 0x518], al
add al, byte [ebp + edx - 0x518]
movzx eax, al
mov al, byte [ebp + eax - 0x518]
xor al, byte [esi + ebp - 0xdf4]
movzx eax, al
mov word [ebp + esi*2 - 0xd16], ax
inc esi
cmp esi, 0xb
jne 0x643c22a1
lea edi, [ebp - 0xe29]
mov esi, 0x643ea195
mov ecx, 0xa
mov word [ebp - 0xd00], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xbc0]
mov esi, str.Windows_was_unable_to_parse_the_requested_XML_data.
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
imul eax, eax, 0x3ba36b57
mov dword [0x643e8088], eax
xor eax, eax
mov byte [ebp + eax - 0x418], al
inc eax
cmp eax, 0x100
jne 0x643c232f
mov eax, dword [0x643e80bc]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0xe4c], eax
mov eax, ecx
mov edi, 0x33
xor edx, edx
mov bl, byte [ebp + ecx - 0x418]
div edi
xor dword [ebp - 0xe4c], 0x9d7897f5
movzx eax, byte [ebp + edx - 0xbc0]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x418]
mov byte [ebp + ecx - 0x418], al
inc ecx
mov byte [ebp + esi - 0x418], bl
cmp ecx, 0x100
jne 0x643c234d
mov edi, dword [ebp - 0xe4c]
mov byte [ebp - 0x319], al
mov byte [ebp + esi - 0x418], bl
xor esi, esi
xor ebx, ebx
mov dword [0x643e80bc], edi
xor edi, edi
inc ebx
xor eax, eax
movzx ebx, bl
cmp word [eax + str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.], 0
je 0x643c23e1
add eax, 2
cmp eax, 0xc68
jne 0x643c23be
mov eax, dword [0x643e80bc]
sub eax, 0xf911533
mov dword [0x643e8088], eax
mov eax, dword [0x643e8088]
and eax, 0x898a9e49
mov dword [0x643e80bc], eax
call fcn.643d2564
mov eax, dword [0x643e80bc]
mov edx, str.The_network_address_is_invalid.
mov ecx, 0xa92
xor eax, 0x54a16394
mov dword [ebp - 0xe4c], eax
add eax, 0x3177f119
mov dword [0x643e8088], eax
mov al, byte [ebp + ebx - 0x418]
mov byte [ebp - 0xe50], al
add eax, esi
movzx esi, al
imul eax, dword [ebp - 0xe4c], 0x25433f2d
mov dword [0x643e80bc], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c2460
add ecx, eax
cmp ecx, 0x243b
jbe 0x643c243a
imul eax, dword [ebp - 0xe4c], 0x34f0b185
mov dword [0x643e80bc], eax
call fcn.643d0254
mov edx, dword [0x643e80bc]
mov al, byte [ebp + esi - 0x418]
or edx, 0xac7a6195
mov byte [ebp + ebx - 0x418], al
mov dword [0x643e8088], edx
xor edx, 0xabc06b3f
add edx, 0x583ed65c
mov dword [0x643e80bc], edx
call fcn.643d2564
mov al, byte [ebp - 0xe50]
mov ecx, dword [0x643e8088]
mov byte [ebp + esi - 0x418], al
add al, byte [ebp + ebx - 0x418]
lea edx, [ecx - 0x60fb02c1]
movzx eax, al
mov dword [0x643e80bc], edx
mov al, byte [ebp + eax - 0x418]
xor al, byte [ebp + edi - 0xe29]
movzx eax, al
mov word [ebp + edi*2 - 0xd96], ax
inc edi
cmp edi, 0xa
jne 0x643c23b8
mov word [ebp - 0xd82], 0
xor eax, eax
cmp byte [eax + str.The_cluster_node_has_been_poisoned.], 0
je 0x643c252a
inc eax
cmp eax, 0xed
jne 0x643c24ee
mov dword [esp + 8], str.The_network_address_is_invalid.
mov dword [esp + 4], str.Failed_to_construct_full_key_path
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643d0738
mov eax, dword [0x643e80bc]
and eax, 0x77981b1a
mov dword [0x643e8088], eax
imul eax, dword [0x643e8088], 0x1964be57
mov dword [0x643e80bc], eax
call fcn.643d1310
xor eax, eax
cmp byte [eax + str.The_network_address_is_invalid.], 0
je 0x643c2560
inc eax
cmp eax, 0xb2a
jne 0x643c2540
mov eax, dword [0x643e8088]
xor eax, 0x427a96e9
mov dword [0x643e80bc], eax
mov eax, dword [0x643e80bc]
lea edi, [ebp - 0xde9]
mov esi, 0x643ea1d3
mov edx, eax
imul eax, eax, 0xf6e23d98
xor edx, 0x599b9d7e
mov dword [0x643e8088], edx
mov dword [0x643e80bc], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
or eax, 0x7aebd0c9
mov dword [0x643e80bc], eax
call fcn.643ce1b4
mov ecx, 0xb
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
lea edi, [ebp - 0xd6d]
mov esi, 0x643ea1de
mov dword [esp], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
call fcn.643cf620
mov eax, dword [0x643e8088]
mov ecx, 0x15
rep movsb byte es:[edi], byte [esi]
xor eax, 0xe80d700c
or eax, 0xb446b2e0
add eax, 0x6213c40
mov dword [0x643e8088], eax
xor eax, eax
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x643c25e6
xor edi, edi
xor esi, esi
mov ecx, 0x14
mov eax, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x318]
div ecx
movzx eax, byte [ebp + edx - 0xd6d]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov eax, dword [0x643e8088]
or eax, 0xec5c12c9
add eax, 0x2453a64
and eax, 0x9ace172b
add eax, 0x1c19cd66
mov dword [0x643e80bc], eax
and eax, 0xcba438cf
mov dword [0x643e8088], eax
mov dword [esp], str.Failed_to_construct_full_key_path
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ecx
call fcn.643d2564
mov al, byte [ebp + edi - 0x318]
mov byte [ebp + esi - 0x318], al
inc esi
mov byte [ebp + edi - 0x318], bl
cmp esi, 0x100
jne 0x643c25f9
mov edx, str.The_cluster_node_has_been_poisoned.
mov ecx, 0x877
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c26b7
add ecx, eax
cmp ecx, 0xddc
jbe 0x643c2680
call fcn.643d0254
imul eax, dword [0x643e8088], 0xb3b94eed
mov dword [0x643e8088], eax
call fcn.643d2564
mov eax, dword [0x643e80bc]
xor eax, 0xd956a34a
jmp 0x643c26c1
mov eax, dword [0x643e8088]
add eax, 0x2592edc6
mov dword [0x643e80bc], eax
imul eax, eax, 0xbe0cbf5b
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [0x643e8088], eax
call fcn.643d4480
xor eax, eax
cmp word [eax + eax + str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.], 0
je 0x643c2702
inc eax
cmp eax, 0x21e2
jne 0x643c26de
imul eax, dword [0x643e80bc], 0xa5b6608c
mov dword [0x643e8088], eax
jmp 0x643c2709
cmp eax, 0x49d
jle 0x643c2710
call fcn.643d2564
jmp 0x643c271f
imul eax, dword [0x643e8088], 0x9aff6521
mov dword [0x643e8088], eax
call fcn.643cfc74
inc ebx
mov ecx, dword [0x643e8088]
movzx ebx, bl
mov dl, byte [ebp + ebx - 0x318]
mov eax, ecx
or ecx, 0xd9e8e1f8
and eax, 0x450608ee
sub ecx, 0x138d645d
or eax, 0x410000e8
add esi, edx
mov dword [0x643e80bc], ecx
mov dword [ebp - 0xe4c], eax
mov dword [0x643e8088], eax
mov eax, esi
movzx esi, al
mov cl, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], cl
mov byte [ebp + esi - 0x318], dl
add dl, byte [ebp + ebx - 0x318]
movzx edx, dl
mov dl, byte [ebp + edx - 0x318]
xor dl, byte [ebp + edi - 0xde9]
movzx edx, dl
mov word [ebp + edi*2 - 0xd00], dx
inc edi
cmp edi, 0xb
jne 0x643c26dc
mov eax, dword [ebp - 0xe4c]
lea edi, [ebp - 0xc9e]
mov word [ebp - 0xcea], 0
mov esi, str.TimeZoneInformationSettings
mov dword [ebp - 0xe3a], 0xeebc6c1a
mov ecx, 7
mov dword [ebp - 0xe36], 0xded21f1b
sub eax, 0x223aa56d
rep movsd dword es:[edi], dword [esi]
mov dword [0x643e80bc], eax
imul eax, eax, 0xd265b048
mov dword [0x643e8088], eax
call fcn.643d1310
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, str.The_cluster_node_has_been_poisoned.
mov ecx, 0x2e3
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c281d
add ecx, eax
cmp ecx, 0x16ed
jbe 0x643c2806
call fcn.643d0254
imul eax, dword [0x643e8088], 0x3977942f
mov dword [0x643e8088], eax
xor eax, 0x2976a02
mov dword [0x643e80bc], eax
call fcn.643d4480
xor eax, eax
cmp byte [eax + str.The_cluster_node_has_been_poisoned.], 0
je 0x643c2864
inc eax
cmp eax, 0x1b5d
jne 0x643c283d
mov dword [esp], str.The_network_address_is_invalid.
call fcn.643d3a44
xor dword [0x643e8088], 0xd2540ad1
mov eax, dword [0x643e8088]
xor eax, 0xd644dab1
add eax, 0x599b7324
mov dword [0x643e80bc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp + 4], str.The_file_size_exceeds_the_limit_allowed_and_cannot_be_saved.
mov dword [esp], str.The_cluster_node_has_been_poisoned.
call fcn.643d0978
xor eax, eax
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x643c289a
xor esi, esi
xor ebx, ebx
mov ecx, str.The_network_address_is_invalid.
mov edx, 0x15f4
movsx eax, byte [ecx]
inc ecx
test al, al
je 0x643c28c9
add edx, eax
cmp edx, 0x18c3
jbe 0x643c28b7
mov eax, dword [0x643e8088]
mov edi, 0x1b
sub eax, 0x347e7f72
mov dword [0x643e80bc], eax
mov dword [esp], str.The_network_address_is_invalid.
call fcn.643d3a44
mov eax, ebx
xor edx, edx
mov cl, byte [ebp + ebx - 0x218]
div edi
mov al, byte [ebp + edx - 0xc9e]
add eax, ecx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x218]
mov byte [ebp + ebx - 0x218], al
inc ebx
mov byte [ebp + esi - 0x218], cl
cmp ebx, 0x100
jne 0x643c28ad
xor edi, edi
xor esi, esi
xor ebx, ebx
mov edx, str.The_cluster_node_has_been_poisoned.
mov ecx, 0xc91
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c2953
add ecx, eax
cmp ecx, 0x230e
jbe 0x643c2932
call fcn.643d4480
and dword [0x643e8088], 0x49053100
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x218]
lea edx, [eax + esi]
movzx esi, dl
mov edx, dword [0x643e8088]
mov cl, byte [ebp + esi - 0x218]
mov byte [ebp + ebx - 0x218], cl
mov ecx, edx
mov byte [ebp + esi - 0x218], al
add al, byte [ebp + ebx - 0x218]
and ecx, 0x5844db86
movzx eax, al
mov dword [0x643e8088], ecx
or ecx, 0xfef9ea00
mov al, byte [ebp + eax - 0x218]
xor al, byte [ebp + edi - 0xe3a]
sub ecx, 0x333ab305
movzx eax, al
mov dword [0x643e80bc], ecx
mov word [ebp + edi*2 - 0xdb8], ax
inc edi
cmp edi, 8
jne 0x643c2928
and edx, 0x40000302
lea edi, [ebp - 0xe1f]
mov esi, 0x643ea20f
mov word [ebp - 0xda8], 0
mov ecx, 0xa
mov dword [0x643e80bc], edx
xor edx, 0x787c758f
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc5f]
mov esi, 0x643ea219
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov dword [0x643e8088], edx
mov dword [esp], 0xfda
call dword [sym.imp.USER32.dll_IsZoomed]
add eax, 0x36a89efc
push edx
xor edx, edx
mov dword [0x643e80bc], eax
mov byte [ebp + edx - 0x118], dl
inc edx
cmp edx, 0x100
jne 0x643c2a2b
mov ecx, str.The_network_address_is_invalid.
mov ebx, 0x873
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x643c2a57
add ebx, edx
cmp ebx, 0x1a5e
jbe 0x643c2a45
xor eax, 0x31544d04
xor esi, esi
xor ebx, ebx
mov edi, 0x23
mov dword [0x643e8088], eax
call fcn.643d05d4
mov ecx, dword [0x643e80bc]
mov al, byte [ebp + ebx - 0x118]
xor edx, edx
imul ecx, ecx, 0x14863cee
mov byte [ebp - 0xe4c], al
mov eax, ebx
div edi
xor ecx, 0xd916eba
movzx eax, byte [ebp + edx - 0xc5f]
movzx edx, byte [ebp - 0xe4c]
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
mov al, byte [ebp - 0xe4c]
inc ebx
mov byte [ebp + esi - 0x118], al
cmp ebx, 0x100
jne 0x643c2a75
mov dword [0x643e80bc], ecx
xor edi, edi
xor esi, esi
xor ebx, ebx
or ecx, 0x9a44a3ed
mov dword [0x643e8088], ecx
inc ebx
movzx ebx, bl
mov dl, byte [ebp + ebx - 0x118]
lea eax, [edx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
xor eax, eax
cmp byte [eax + str.The_network_address_is_invalid.], 0
je 0x643c2b38
inc eax
cmp eax, 0x23f7
jne 0x643c2b07
mov byte [ebp - 0xe4c], dl
call fcn.643d4480
mov dl, byte [ebp - 0xe4c]
imul eax, dword [0x643e8088], 0x867b51e4
mov dword [0x643e80bc], eax
mov eax, dword [0x643e8088]
mov byte [ebp + esi - 0x118], dl
lea ecx, [ebp - 0xd82]
add dl, byte [ebp + ebx - 0x118]
and dword [0x643e80bc], 0x6fdf2dce
sub eax, 0x3e36716a
movzx edx, dl
imul eax, eax, 0x469aa82f
mov dl, byte [ebp + edx - 0x118]
xor dl, byte [ebp + edi - 0xe1f]
movzx edx, dl
mov word [ecx + edi*2], dx
inc edi
mov dword [0x643e8088], eax
cmp edi, 0xa
jne 0x643c2ae6
mov word [ebp - 0xd6e], 0
xor eax, 0x378ab77f
xor ebx, ebx
or eax, 0xde634d4c
imul eax, eax, 0xdd6a24da
mov dword [0x643e80bc], eax
mov dword [esp], str.Failed_to_construct_full_key_path
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
imul eax, dword [0x643e8088], 0xe09c996
and eax, 0xcd9298fa
mov dword [0x643e8088], eax
call fcn.643d1310
lea edx, [ebp - 0xd58]
mov eax, dword [0x643e80bc]
lea ecx, [ebp - 0xd82]
mov dword [ebp - 0xbec], edx
lea edx, [ebp - 0xc82]
mov dword [ebp - 0xbe8], edx
lea edx, [ebp - 0xd42]
xor eax, 0x96575b83
mov dword [ebp - 0xbe4], edx
lea edx, [ebp - 0xcea]
mov dword [ebp - 0xbe0], edx
lea edx, [ebp - 0xcd2]
mov dword [ebp - 0xbdc], edx
lea edx, [ebp - 0xd2c]
mov dword [ebp - 0xbd8], edx
lea edx, [ebp - 0xd16]
mov dword [0x643e8088], eax
imul eax, eax, 0x70aed4cf
mov dword [ebp - 0xbd4], edx
lea edx, [ebp - 0xd96]
mov dword [ebp - 0xbd0], edx
lea edx, [ebp - 0xd00]
mov dword [ebp - 0xbcc], edx
lea edx, [ebp - 0xdb8]
mov dword [ebp - 0xbc8], edx
mov dword [ebp - 0xbc4], ecx
mov dword [0x643e80bc], eax
mov eax, dword [ebp + ebx*4 - 0xbec]
mov dword [esp], eax
call fcn.643c10e8
test eax, eax
jne 0x643c2c8d
inc ebx
cmp ebx, 0xb
jne 0x643c2c72
jmp 0x643c2c92
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret