Function at 0x6568ad74
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x656aa440
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x16d0
sub esp, 0x15c
mov eax, dword [0x656a8dd0]
imul edx, dword [0x656a8ef0], 0x3f7b0178
sub eax, 0x40556cfc
mov dword [0x656a8dd0], eax
mov dword [0x656a8ef0], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x65687eb6
add ebx, edx
cmp ebx, 0x2311
jbe 0x65687e95
and eax, 0xcf6afaf7
mov dword [0x656a8dd0], eax
call fcn.65692604
mov eax, dword [0x656a8dd0]
mov ebx, 0x656aa440
lea edx, [eax + 0x7d0ff39]
mov dword [0x656a8dd0], edx
movzx edi, byte [ebx]
lea ecx, [edi - 0x30]
cmp cl, 9
ja 0x65687eda
inc ebx
jmp 0x65687ecc
add eax, 0x19e277d4
lea edi, [ebp - 0x136]
mov esi, 0x656ad1f7
mov ecx, 0xf
rep movsb byte es:[edi], byte [esi]
imul eax, eax, 0x3772b580
lea edi, [ebp - 0x144]
mov esi, str.0_setlinejoin
mov ecx, 0xe
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x656aa440
mov dword [0x656a8ef0], eax
mov al, byte [ecx]
test al, al
je 0x65687f31
sub eax, 0x30
cmp al, 9
jbe 0x65687f2e
mov eax, edx
and eax, 0x1ee889e5
mov dword [0x656a8ef0], eax
jmp 0x65687f31
inc ecx
jmp 0x65687f13
imul eax, dword [0x656a8ef0], 0x371824c
xor ebx, ebx
mov dword [0x656a8ef0], eax
mov edx, 0x656aa440
mov al, byte [edx]
test al, al
je 0x65687f76
sub eax, 0x30
cmp al, 9
jbe 0x65687f73
imul eax, dword [0x656a8dd0], 0x388b634a
mov dword [0x656a8dd0], eax
mov dword [esp], 0x12f
call dword [sym.imp.USER32.dll_GetTopWindow]
push edx
jmp 0x65687f76
inc edx
jmp 0x65687f47
mov edx, dword [0x656a8ef0]
mov ecx, 0x656af3c0
mov esi, 0x1e22
lea eax, [edx + 0x4e2cd090]
mov dword [0x656a8dd0], eax
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x65687fb2
add esi, eax
cmp esi, 0x2184
jbe 0x65687f91
xor edx, 0xfa69f875
mov dword [0x656a8ef0], edx
imul eax, dword [0x656a8ef0], 0x1d432675
and eax, 0x790e993c
mov dword [0x656a8ef0], eax
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov byte [ebp + ebx - 0x118], bl
inc ebx
cmp ebx, 0x100
jne 0x65687f42
xor edi, edi
xor ecx, ecx
mov esi, 0xd
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div esi
movzx eax, byte [ebp + edx - 0x144]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + edi - 0x118], bl
cmp ecx, 0x100
jne 0x65687fe9
xor eax, eax
cmp byte [eax + 0x656aa440], 0
je 0x65688063
inc eax
cmp eax, 0x1e4f
jne 0x65688028
mov eax, dword [0x656a8ef0]
mov dword [esp + 8], 0x656af3c0
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.65691b18
mov eax, dword [0x656a8ef0]
and eax, 0xa5fa8f64
mov dword [0x656a8dd0], eax
jmp 0x6568806a
cmp eax, 0x148
jle 0x6568806f
call fcn.65692604
mov eax, dword [0x656a8ef0]
xor edi, edi
xor esi, esi
add eax, 0x53e2b609
mov dword [0x656a8dd0], eax
xor eax, eax
mov dword [ebp - 0x14c], eax
lea eax, [esi + 1]
movzx esi, al
mov bl, byte [ebp + esi - 0x118]
lea eax, [ebx + edi]
movzx edi, al
mov eax, dword [0x656a8dd0]
lea edx, [eax + 0x29c614c4]
xor eax, eax
mov ecx, edx
mov dword [0x656a8dd0], edx
xor ecx, 0x9ea7fdc3
imul ecx, ecx, 0xcffbd7b0
mov dword [0x656a8ef0], ecx
cmp word [eax + 0x656af3c0], 0
je 0x65688103
add eax, 2
cmp eax, 0x2e60
jne 0x656880c4
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x656aa440
mov dword [esp + 4], 0x656af3c0
mov dword [esp], edx
call fcn.656930f8
mov eax, dword [0x656a8dd0]
add eax, 0x21ee402b
mov dword [0x656a8ef0], eax
mov eax, dword [0x656a8ef0]
add eax, 0x3b6d607a
mov ecx, eax
mov dword [0x656a8ef0], eax
xor ecx, 0x6649260d
mov dword [0x656a8dd0], ecx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x656af3c0
call fcn.65691b18
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
mov eax, dword [0x656a8ef0]
mov byte [ebp + edi - 0x118], bl
add bl, byte [ebp + esi - 0x118]
movzx ebx, bl
mov bl, byte [ebp + ebx - 0x118]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x656aa440
mov dword [esp + 4], 0x656af3c0
mov dword [esp], eax
call fcn.656930f8
or dword [0x656a8dd0], 0xac6f57c8
mov dword [esp], 0x656af3c0
call fcn.65690064
imul eax, dword [0x656a8dd0], 0x348c01b1
mov dword [0x656a8ef0], eax
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov eax, dword [0x656a8ef0]
mov edx, dword [ebp - 0x14c]
inc dword [ebp - 0x14c]
imul ecx, eax, 0xf7ef6745
xor bl, byte [ebp + edx - 0x136]
sub eax, 0xdb5de10
cmp dword [ebp - 0x14c], 0xf
mov dword [0x656a8ef0], eax
lea eax, [ebp - 0x127]
mov byte [ebp + edx - 0x127], bl
mov dword [0x656a8dd0], ecx
jne 0x6568808a
mov byte [ebp - 0x118], 0
mov dword [esp + 0xc], 0xf
mov dword [esp + 8], eax
mov dword [esp + 4], 0xb34
mov dword [esp], str.qbPNmxTmVVmKx2I1YR8VRaBIiI9rwBMCXXslpx_uNqp_MQ7gZAiBzp137qlVl7GcGsCAfrWil0hcho4e4PonMMnYLVas1Q8Qj37FPSBz8BXPODHSo2xmOvIRZt4NlLypRRDoTwdXXamvCfgDUV7XVu_ypyz_U3mvMXrfPsK8vE22uzEbA8WaStwIzUrMueRKa8YP5v9s7XPTz3DQassgB4x8X4a1CF0jqKQCQ6gA7sqfJ4GtyGi8MGNt2JJcvIOY94WDt4CX4P679XWPx4j29no3xegMlTt7oTWgo_emJ59HszXETZBCV_rGkM6MHoRYLB4a3k5kCtm7n1ciLGYoVhR7Jsbdc4731A62PimUA45R2Q1jQrJtBy59WhxqvBMElnOG3F4BuoGCFEABEUjW_YMqlAmjVy73T7hod5baiaglfXTJQjfoyr95w6vW2AbWmF1Qg4RU3YGNZT0bELXe7vuZQzFMhvw0PxgWfH6zCIFfGj9EXgysbQ4ncZXwJq61MlWJToAgG57_SQ2LK1kO8J56YOQCBm53qgSSyHm1oTmkdNdpDzFi1dn9Wrh6NeYEGkE4vE1naIqvkWKzPTxs5EDoXBPHEGDuu1E80EU16DHeSRQwx9uRCqGVKSHuSUwG4eXBKplS9P_a8IgZm_4qg5M4ID71QtCU2wahYEbCCDj4qSa5aQKX3kGF0avEfjKEnEDcG5Uw5FLBrQUVUJ14MYLXdzctaYHLEMhyyaHyqygKt9MvZbXm5s_gTkcUKChmikmc0i2_CdpkExCKyiEZJmI_2Gda4PdqW9fuRTyzfmSENiKs_pSiKKkqkrRwkDlUwHRnHZGucy3sz5EfAxvpqSrSC27N5kXnR_bvQTyUDZAFSspFU54XZoPc66q_7kg20VPI4Bv7YseRiyOniPGhKaNiudehkWZNY5YPeBg57u8P7sAkovDsIZUZ1PsfPu_gQwRdQvgVRJ0Um4e8r6xBYRNTZI6P6C_mowcawD9h_m2BK1zqO7rbXW5gXR8pG6p9vQGPvsjoSXZicWUlm3ZT5h3iZyKG14sSiTPbfkhk0QvEScT5FdDvUfl66xz8O8cy0YgVKBuO2pIknCLosTqMEMBGbkFWGZHIIDJscw1EH1SenBtfxbFzVc3PHc85C0Bb8CyzmJEBk8YbdHKAv7K7dd4ZU18tdfLFDKVjwRYfQ6skKL4h9Vwwx3iQyAYZ3eLF5Bg4D7shrg2obkk9EzLd4IJ6qarLiffpBjA1FdTLHotqzm_YqW00RVHbGscBqVWFrYJfBGWEL1zrdfkeJfH7nmNvHWlNfXugWQqMaFiq9qkHdXzcteSQponyhEAgYmLllkvgTexkoY3MGL7kL5Qoy1LV_On8bMflvsI5oVSiQ9h921eYyskmgJW3XMBGY3FawBvavNs44WAVpgbaTE0sIQoHWGX5t5xNOaAjib82mGtnOiJqTEqi_7i8JEFkRb_M4MOhVFFudqv1vDgLDpEkleFMO8c65GVFRBN8b1C12ImkZaMKL5QEeeGGJcxp9sHzlPfo7lMFaxs8C1NY9ydiVZOaAyPqyi48EmelyeWabndKfckJotuqK6bJiUlTl3a5E5ByDZDcoYT2jphy5c8YgFGnxelsVIlV3E9OxHdwdE4AgtaD2trZNs2UTqZvaO3Lf3SwH2devaUj9BJAFyUXJmkATZ1bHQdsEX3mvIkxNU3zttm50KbXgXW2w5xyeWGbTvqIiPuHBKkFTaB3Z6oIw_pUbeaGt9Z4W0JHSpCrvP4cZCGhOUOo6EMBFWh5e5H86NRWCPy2g1_bkSJ6aChk_e2Ad6Cyw7MaySl5tHL12vvimOYM5sCmN5cZaJN6LStrvpx4YUbIBi8SacEGlkuMswdeuLVyzCs_UaPtPHJmf2O9NZ0cDKgKvdn93z1G3JcQyyWjawDgK_iragAGHaWjHhWqHZFpk3FtDPesYf9sVAoeGergIJrwJbbhyCTECyVJMbG2F6wn1Cw74egDzgYavUwgMiCQKaWPK1cIw5iIFxMjjMm1hQYArLwMitBTx6VCnlIK4fgE0fdXWEuJ3e5UOryAS5A5EgH7gNzRn7i7lom7osxJ8LpWdNlRxDnJOAFj3L1hj6QS2IhHH5OQpYyXyVJDoN4051Q8wC5k8lXM44ZYbrqReLKCIE9SioX327nKdSDc4pNgEzEOXiJvb3oAuiFwGshIt71hSC8T4LSfXygNXJ48Bkm1KR_BrWEFKpzQCJyfsp5c4lXsq8mh4UbfOllzNnqNcj9EPYs8xf9uh2W8EWvml1t7a1Vd0ldfOnOniqkFTrhAVJTwRpAx5G2vpwTeuv_n2oX7dTwINTkWHEFXIKkUy39kcATmdxKBwyybBFg3BCPWeWCGMBZQyRaB5bTeB4hlsvN_vdO2OLVhVNBvPKBRiH18rvdn69U6_zb3bODs_uWdy8CvSntwzrhG9bJVxHQCzgMGXla9iWCAZxQFzZoTB6ZYKCli4QK8PESg6QrQ4WI1jzNNYbbOTmc_Fuo5NMtVmThElsJYGVNfe1EsTDBb8V9h831zpaHQrSvfe8YSOiN8NhsqjNYaf8Uuu3tpmwuUP12YXgor3TYgiuRnxEdZn1nMUTnc5IIX4Qglw95ZNqJy1OsEH0AUAKSxcHZ872MImA728xDx7mEFtrmrtXUlii8tbfdA5EzfRUUFAe5_rQe0WQ_1r3tM6wqJ9bi0sOKrjYP1RoXJPumUShDTiXQyQBhYkS6X4wImLhVcEvLjyxnInJW7NNo2SsgoQSSmQKvnJu6xLmDgMl23EWDzvuE_i4yinAHoclhMmuXpqmsg
call fcn.6568bff8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x18
cmp byte [eax + str.A_portion_of_the_file_system_requires_repair.], 0
je 0x6568ad97
inc eax
cmp eax, 0x162f
jne 0x6568ad7c
xor dword [0x656a8dc4], 0x6fdb28d6
mov eax, dword [0x656a8dc4]
and eax, 0xb74b6502
imul eax, eax, 0x8b3471cb
mov dword [0x656a8dc4], eax
call fcn.65687bec
call fcn.656883ac
mov edx, str.Microsoft_Time_Stamp_Service
mov al, byte [edx]
test al, al
je 0x6568add7
sub eax, 0x30
cmp al, 9
jbe 0x6568add4
and dword [0x656a8dc4], 0x3a1f1a5a
jmp 0x6568add7
inc edx
jmp 0x6568adbb
xor dword [0x656a8dc4], 0xb120d3f1
call fcn.65687770
xor eax, eax
cmp byte [eax + str.A_portion_of_the_file_system_requires_repair.], 0
je 0x6568ae18
inc eax
cmp eax, 0xad
jne 0x6568ade8
mov eax, dword [0x656a8dc4]
mov dword [esp + 4], str.SdbpGetMappedStringFromTable
mov dword [esp], eax
call fcn.65690fb4
sub dword [0x656a8dc4], 0x6d943aa6
mov eax, dword [0x656a8dc4]
and eax, 0xc1066daf
sub eax, 0xee6ad1d
mov dword [0x656a8dc4], eax
call fcn.65688b70
call fcn.656875ec
call fcn.65693328
mov eax, dword [0x656a8dc4]
xor eax, 0xf7542c0e
imul eax, eax, 0x9a43d9a7
mov dword [0x656a8dc4], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
or eax, 0xfa6e65cb
imul eax, eax, 0xb8ed0198
mov dword [0x656a8dc4], eax
call fcn.65692978
call fcn.65689470
call fcn.65688e50
call fcn.656870b4
call fcn.65688554
cmp byte [str.A_portion_of_the_file_system_requires_repair.], 0
je 0x6568ae92
and dword [0x656a8dc4], 0x117e4c90
add dword [0x656a8dc4], 0x753c9815
call fcn.65692604
add dword [0x656a8dc4], 0x66c2f949
call fcn.65688ff0
xor eax, eax
cmp byte [eax + str.Microsoft_Time_Stamp_Service], 0
je 0x6568aed2
inc eax
cmp eax, 0xd9d
jne 0x6568aeb2
call fcn.65693328
and dword [0x656a8dc4], 0x1112beef
mov eax, dword [0x656a8dc4]
mov ecx, str.Microsoft_Time_Stamp_Service
or eax, 0xbd0e2179
imul eax, eax, 0xb9ab8b40
mov dword [0x656a8dc4], eax
mov dl, byte [ecx]
test dl, dl
je 0x6568af19
sub edx, 0x30
cmp dl, 9
jbe 0x6568af16
or eax, 0xf337f1ca
mov dword [0x656a8dc4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
and eax, 0x5bd626a3
mov dword [0x656a8dc4], eax
jmp 0x6568af19
inc ecx
jmp 0x6568aeec
add dword [0x656a8dc4], 0x6409d2ea
call fcn.65693704
mov edx, str.The_Secure_Boot_policy_file_is_required_but_could_not_be_found.
mov ecx, 0x13b4
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x6568af56
add ecx, eax
cmp ecx, 0x1cda
jbe 0x6568af32
call fcn.65693328
xor dword [0x656a8dc4], 0x9df2739a
sub dword [0x656a8dc4], 0x6453e84d
call fcn.656888ac
call fcn.65687360
call fcn.6568792c
call fcn.65688220
call fcn.65689238
mov eax, dword [0x656a8dc4]
sub eax, 0x51e324bf
or eax, 0xd08b738b
mov dword [0x656a8dc4], eax
leave
jmp 0x65687e60