Function at 0x6568c2f4
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x3c0]
push ebx
sub esp, 0x3fc
mov eax, dword [0x656a8f3c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
sub eax, 0x384da7bb
mov dword [0x656a8c30], eax
call ebx
mov esi, dword [sym.imp.USER32.dll_GetMessageTime]
call esi
call esi
call esi
mov esi, 0x656950cc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [0x656a8f3c]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
mov edx, eax
and eax, 0x4e32ba5a
and edx, 0xf03605f4
or eax, 0x4e32220a
imul edx, edx, 0x3e6be07e
mov dword [0x656a8f3c], eax
mov dword [0x656a8c30], edx
call fcn.65691e00
mov eax, dword [0x656a8c30]
sub eax, 0x73a6ad48
mov dword [0x656a8c30], eax
and eax, 0x7e5ff271
mov dword [0x656a8f3c], eax
mov dword [esp], str.Cant_convert_TAGID
call fcn.65690928
mov eax, dword [0x656a8f3c]
mov edx, eax
and eax, 0x2b6c2733
or edx, 0x8745caa3
or eax, 0x3440223
mov dword [0x656a8f3c], edx
mov dword [0x656a8c30], eax
call fcn.6569077c
sub edi, dword [ebp + esi*4 - 0x3c0]
inc esi
mov dword [ebp - 0x3ec], edi
cmp esi, 5
jne 0x6568c367
mov eax, dword [0x656a8f3c]
mov esi, str.The_maximum_number_of_sublayers_has_been_reached.
mov ecx, 0xf35
mov edi, dword [0x656a8c30]
sub eax, 0x4322d5bd
movzx edx, word [esi]
add esi, 2
test dx, dx
je 0x6568c400
add ecx, edx
cmp ecx, 0x1874
jbe 0x6568c3e5
imul eax, eax, 0x116df71e
add eax, 0x7189b289
mov ecx, str.The_maximum_number_of_sublayers_has_been_reached.
mov esi, 0xf35
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x6568c42a
add esi, edx
cmp esi, 0x1874
jbe 0x6568c40f
imul eax, eax, 0x116df71e
add eax, 0x7189b289
sub edi, 0x2aec4fd6
xor esi, esi
mov dword [0x656a8f3c], eax
mov dword [0x656a8c30], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.The_maximum_number_of_sublayers_has_been_reached.
mov dword [esp + 4], str.The_specified_weight_is_invalid.
mov dword [esp], str.RtlpResUltimateFallbackInfo_Enter
call fcn.656946fc
mov eax, dword [0x656a8c30]
lea edx, [eax + 0x2c31e0b2]
add eax, 0x72f6c47
and eax, 0xc9e7eab9
mov dword [0x656a8c30], edx
mov dword [0x656a8f3c], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
sub eax, 0x1af71931
and eax, 0x5e3d5648
mov dword [0x656a8f3c], eax
mov dword [esp + 8], str.RtlpResUltimateFallbackInfo_Enter
mov dword [esp + 4], str.The_specified_weight_is_invalid.
mov eax, dword [0x656a8c30]
mov dword [esp], eax
call fcn.6568fb28
mov eax, dword [0x656a8f3c]
mov ecx, 0x24
mov dword [ebp - 0x244], 0x2a
mov dword [ebp - 0x240], 0x5d
mov dword [ebp - 0x23c], 0xffffff55
mov edx, eax
xor eax, 0x100c6f02
xor edx, 0x4f23ed3e
mov dword [0x656a8c30], eax
or edx, 0x55e1e2c9
mov dword [0x656a8f3c], edx
or dword [0x656a8f3c], 0x40978b60
mov edx, str.RtlpResUltimateFallbackInfo_Enter
mov edi, 0x274
movsx eax, byte [edx]
inc edx
test al, al
je 0x6568c549
add edi, eax
cmp edi, 0x11b6
jbe 0x6568c50e
mov dword [ebp - 0x3f0], ecx
mov dword [esp + 8], str.RtlpResUltimateFallbackInfo_Enter
mov dword [esp + 4], str.Cant_convert_TAGID
mov eax, dword [0x656a8c30]
mov dword [esp], eax
call fcn.6568fb28
mov ecx, dword [ebp - 0x3f0]
imul eax, dword [0x656a8f3c], 0x24159bc1
mov edi, dword [ebp + esi*4 - 0x244]
inc esi
add edi, ecx
xor eax, 0x639f918e
mov ecx, edi
mov dword [0x656a8c30], eax
cmp esi, 3
jne 0x6568c4fa
sub eax, 0x52e7bb42
mov dword [0x656a8f3c], eax
xor eax, eax
cmp word [eax + str.The_maximum_number_of_sublayers_has_been_reached.], 0
je 0x6568c593
add eax, 2
cmp eax, 0xa8a
jne 0x6568c57a
call fcn.656924a8
imul eax, dword [0x656a8f3c], 0xd2b497d1
xor esi, esi
mov dword [0x656a8c30], eax
call ebx
mov eax, dword [0x656a8c30]
xor ebx, ebx
mov dword [ebp - 0x394], 0x18
mov dword [ebp - 0x390], ebx
xor eax, 0xb5bec5aa
mov dword [ebp - 0x388], ebx
mov dword [0x656a8f3c], eax
call fcn.656924a8
mov eax, dword [0x656a8f3c]
and eax, 0x7acd90f9
lea edx, [eax + 0x5ffac45]
mov dword [0x656a8f3c], eax
mov dword [0x656a8c30], edx
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], str.Cant_convert_TAGID
mov dword [esp + 4], str.RtlpResUltimateFallbackInfo_Enter
call fcn.65691c84
mov dword [esp + 0xc], str.The_maximum_number_of_sublayers_has_been_reached.
mov eax, dword [0x656a8c30]
mov dword [esp + 4], str.RtlpResUltimateFallbackInfo_Enter
mov dword [esp + 8], eax
mov eax, dword [0x656a8f3c]
mov dword [esp], eax
call fcn.65691c84
mov eax, dword [0x656a8c30]
xor eax, 0xf8f9c78c
lea edx, [eax - 0x123f4214]
add eax, 0x392fbce1
mov dword [0x656a8f3c], edx
mov dword [0x656a8c30], eax
call fcn.65690694
mov eax, dword [0x656a8f3c]
mov dword [ebp - 0x384], edi
xor edi, edi
mov dword [ebp - 0x38c], esi
sub eax, 0x52caf219
mov dword [ebp - 0x380], edi
and eax, 0xb246be77
mov dword [ebp - 0x3dc], edi
mov dword [0x656a8c30], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3d8], edi
mov dword [ebp - 0x244], 0x22c
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [0x65695064]
call dword [eax + 0x34]
push edx
push edx
mov dword [ebp - 0x3ec], eax
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3ec]
mov dword [esp], eax
mov eax, dword [0x65695064]
call dword [eax + 0x38]
dec eax
push ecx
push ecx
jne 0x6568ca1d
mov dword [ebp - 0x3d4], 0x3f
xor ebx, ebx
mov esi, 0x14
mov dword [ebp - 0x3d0], 0xffffffae
call fcn.656924a8
mov edx, dword [0x656a8f3c]
mov eax, edx
or eax, 0x509b75d3
imul eax, eax, 0xc8185fcd
mov dword [0x656a8c30], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_GetTopWindow]
and eax, 0x4d8a517
push ecx
mov dword [0x656a8f3c], eax
mov eax, dword [0x656a8c30]
mov dword [esp + 4], str.The_specified_weight_is_invalid.
mov dword [esp + 8], eax
mov dword [esp], str.RtlpResUltimateFallbackInfo_Enter
call fcn.65691bb0
mov eax, dword [0x656a8f3c]
add eax, 0x3d0d6ad9
mov dword [0x656a8c30], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
or eax, 0x204aaa88
mov dword [0x656a8f3c], eax
add eax, 0x142d135
mov dword [0x656a8c30], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
add esi, dword [ebp + ebx*4 - 0x3d4]
add eax, 0x40726be3
mov dword [ebp - 0x3f0], esi
mov dword [0x656a8c30], eax
test ebx, ebx
jne 0x6568c954
mov ebx, 1
jmp 0x6568c6f2
mov byte [ebp + eax - 0x344], al
inc eax
cmp eax, 0x100
jne 0x6568c798
imul eax, dword [0x656a8c30], 0x6350ba30
xor esi, esi
xor ecx, ecx
mov edi, 0x36
mov dword [ebp - 0x3f4], eax
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x344]
div edi
movzx eax, byte [ebp + edx - 0x37b]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x344]
mov byte [ebp + ecx - 0x344], al
inc ecx
mov byte [ebp + esi - 0x344], bl
cmp ecx, 0x100
jne 0x6568c7c0
xor ebx, ebx
xor ecx, ecx
xor edx, edx
inc edx
lea esi, [ebp - 0x3aa]
movzx edx, dl
movzx edi, byte [ebp + edx - 0x344]
add ecx, edi
movzx ecx, cl
mov al, byte [ebp + ecx - 0x344]
mov byte [ebp + edx - 0x344], al
mov eax, edi
mov byte [ebp + ecx - 0x344], al
add al, byte [ebp + edx - 0x344]
movzx eax, al
mov al, byte [ebp + eax - 0x344]
xor al, byte [ebx + ebp - 0x3cb]
movzx eax, al
mov word [esi + ebx*2], ax
inc ebx
cmp ebx, 0xb
jne 0x6568c803
mov word [ebp - 0x394], 0
mov eax, dword [ebp - 0x3f4]
add eax, 0x1ecdca16
mov dword [0x656a8f3c], eax
and eax, 0x3b48dfea
mov dword [0x656a8c30], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6568ed04
test eax, eax
jne 0x6568c954
mov edx, str.Cant_convert_TAGID
mov ecx, 0xfe5
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x6568c8e3
add ecx, eax
cmp ecx, 0x25e9
jbe 0x6568c89d
mov eax, dword [0x656a8f3c]
xor eax, 0x948c95fb
mov dword [0x656a8f3c], eax
mov dword [esp + 0xc], str.The_specified_weight_is_invalid.
mov edx, dword [0x656a8c30]
mov dword [esp + 4], str.RtlpResUltimateFallbackInfo_Enter
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.65691c84
mov eax, dword [0x656a8f3c]
xor eax, 0xab1c699f
imul eax, eax, 0xaf78c546
mov dword [0x656a8c30], eax
call fcn.656935b0
imul eax, dword [0x656a8f3c], 0xc3684a33
add dword [0x656a8c30], 0x79737027
mov dword [0x656a8f3c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x3dc], eax
lea eax, [ebp - 0x3dc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x394]
mov dword [esp + 8], eax
lea eax, [ebp - 0x3e0]
mov dword [esp + 4], 0x1fffff
mov dword [esp], eax
call fcn.6568108d
test eax, eax
jns 0x6568c9fa
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3ec]
mov dword [esp], eax
mov eax, dword [0x65695064]
call dword [eax + 0x3c]
push edx
push edx
mov ebx, dword [ebp - 0x3f0]
cmp eax, ebx
jne 0x6568ca1d
lea edi, [ebp - 0x3cb]
mov esi, 0x656ad770
mov ecx, 0xb
imul eax, dword [0x656a8c30], 0x587b60c1
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x37b]
mov esi, str.The_operation_is_not_supported_by_the_specified_layer.
mov ecx, 0x37
rep movsb byte es:[edi], byte [esi]
and eax, 0x7cf64888
imul edx, eax, 0x39c0744e
mov dword [0x656a8f3c], eax
mov dword [0x656a8c30], edx
mov dword [esp + 8], eax
mov dword [esp], edx
mov dword [esp + 0xc], str.The_specified_weight_is_invalid.
mov dword [esp + 4], str.RtlpResUltimateFallbackInfo_Enter
call fcn.65691c84
mov eax, dword [0x656a8c30]
sub eax, 0x490ebecf
mov dword [0x656a8f3c], eax
call fcn.656935b0
xor eax, eax
jmp 0x6568c798
cmp dword [ebp - 0x3e0], 0
je 0x6568c954
mov eax, dword [ebp - 0x3ec]
mov dword [esp], eax
call fcn.65681065
mov eax, dword [ebp - 0x3e0]
jmp 0x6568ca2e
mov eax, dword [ebp - 0x3ec]
mov dword [esp], eax
call fcn.65681065
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret