Function at 0x6568dd58
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov edx, 0x100
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xbc
mov eax, dword [0x656a9048]
and eax, 0x50408640
and eax, 0xefb72d1f
dec edx
jne 0x6568afd7
xor eax, 0x2dbd8bb3
mov esi, 0x2d
mov dword [0x656a9048], eax
mov eax, dword [0x656a9048]
and eax, 0x956d4b93
or eax, 0xffbfe9e2
mov dword [0x656a9048], eax
call fcn.65692a34
call dword [sym.imp.USER32.dll_GetDesktopWindow]
and dword [0x656a9048], 0x114123b
call fcn.6568f154
mov eax, dword [0x656a9048]
xor eax, 0x6e19cdf0
mov dword [0x656a9048], eax
dec esi
jne 0x6568afee
add eax, 0x6b6a1b0f
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x886822d0
mov dword [0x656a9048], eax
call ebx
add eax, 0x4236fafc
and eax, 0x48608210
xor eax, 0x40188638
cmp byte [str.The_driver_stack_doesnt_match_the_expected_driver_model.], 0
lea edx, [eax + 0x125dc7ce]
mov dword [0x656a9048], edx
je 0x6568b073
add eax, 0x52bf0be1
mov dword [0x656a9048], eax
mov eax, dword [0x656a9048]
or eax, 0xdba84d9a
sub eax, 0x37f4cdf4
mov dword [0x656a9048], eax
cmp word [esi + str.The_IPsec_authentication_transform_is_not_valid.], 0
je 0x6568b0c6
add esi, 2
cmp esi, 0x437e
jne 0x6568b087
mov dword [esp + 0xc], str.AslFileMappingCreate
mov dword [esp + 8], str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov dword [esp + 4], str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov dword [esp], eax
call fcn.656901f0
xor dword [0x656a9048], 0xb28d567b
mov eax, dword [0x656a9048]
lea edi, [ebp - 0x60]
mov esi, 0x65695034
and eax, 0x727c5d6e
imul eax, eax, 0xd276e0a
mov dword [0x656a9048], eax
call fcn.6568f698
mov edx, dword [0x656a9048]
mov ecx, 4
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xf00
sub ecx, dword [ebp + eax*4 - 0x60]
inc eax
or edx, 0x6cd2a876
mov dword [ebp - 0x90], ecx
cmp eax, 4
jne 0x6568b0fc
mov dword [0x656a9048], edx
mov esi, 0x123d
call fcn.6568f248
mov eax, dword [0x656a9048]
sub eax, 0x537a2f02
mov dword [0x656a9048], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsIconic]
add eax, 0x19a5cd84
push edx
and eax, 0xcfe0346
add eax, 0x12c8fecb
mov dword [0x656a9048], eax
mov dword [esp + 0xc], str.Cached_page_was_locked_during_operation.
mov dword [esp + 8], eax
mov dword [esp + 4], str.Cached_page_was_locked_during_operation.
mov dword [esp], str.The_driver_stack_doesnt_match_the_expected_driver_model.
call fcn.65690e1c
mov eax, dword [0x656a9048]
mov ecx, str.The_IPsec_authentication_transform_is_not_valid.
mov edx, eax
or edx, 0xb2b2142d
mov dword [0x656a9048], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x6568b1bb
add esi, edx
cmp esi, 0x21d4
jbe 0x6568b187
and eax, 0x50ac31ec
or eax, 0x10a0102c
mov dword [0x656a9048], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
add eax, 0x51c58c54
mov dword [0x656a9048], eax
sub dword [0x656a9048], 0x297d4e89
call fcn.6568f698
imul eax, dword [0x656a9048], 0x8c3fa1bd
mov dword [ebp - 0x98], 0x2c
mov dword [0x656a9048], eax
call dword [sym.imp.USER32.dll_AnyPopup]
imul eax, eax, 0xd6ad4dad
dec dword [ebp - 0x98]
mov dword [0x656a9048], eax
jne 0x6568b1e3
mov ecx, str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov dl, byte [ecx]
test dl, dl
je 0x6568b21e
sub edx, 0x30
cmp dl, 9
jbe 0x6568b21b
xor eax, 0xe6b9209c
mov dword [0x656a9048], eax
jmp 0x6568b21e
inc ecx
jmp 0x6568b201
add dword [0x656a9048], 0x81b5a0b
lea edi, [ebp - 0x50]
mov esi, 0x65695044
call ebx
mov ecx, 4
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
and eax, 0x97044796
mov esi, 0x58
sub eax, 0x5a8d3541
mov dword [0x656a9048], eax
mov edx, str.Cached_page_was_locked_during_operation.
mov ecx, 0x1472
movsx eax, byte [edx]
inc edx
test al, al
je 0x6568b27f
add ecx, eax
cmp ecx, 0x2289
jbe 0x6568b259
call fcn.656921c4
imul eax, dword [0x656a9048], 0xae07151b
mov dword [0x656a9048], eax
mov eax, dword [0x656a9048]
add esi, dword [ebp + ebx*4 - 0x50]
inc ebx
mov dword [ebp - 0x9c], esi
add eax, 0x57f803e0
or eax, 0xfffbbe3e
mov dword [0x656a9048], eax
cmp ebx, 4
jne 0x6568b24f
imul eax, eax, 0x81a9c56
lea edi, [ebp - 0x40]
mov esi, 0x65695054
mov dword [0x656a9048], eax
mov dword [esp + 0xc], str.Cached_page_was_locked_during_operation.
mov dword [esp + 8], eax
mov dword [esp + 4], str.Cached_page_was_locked_during_operation.
mov dword [esp], str.The_driver_stack_doesnt_match_the_expected_driver_model.
call fcn.65690e1c
add dword [0x656a9048], 0x1e80b6d7
call fcn.65691248
mov eax, dword [0x656a9048]
add eax, 0x673e5aae
and eax, 0x8fc993ff
mov dword [0x656a9048], eax
call fcn.65692b4c
mov ecx, ebx
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4c
xor eax, eax
cmp word [eax + str.The_IPsec_authentication_transform_is_not_valid.], 0
je 0x6568b329
add eax, 2
cmp eax, 0x152e
jne 0x6568b30b
or dword [0x656a9048], 0xc92edff8
mov eax, dword [0x656a9048]
and eax, 0xf569095a
or eax, 0x5fea79d9
mov dword [0x656a9048], eax
mov dword [esp], eax
mov dword [esp + 8], str.The_IPsec_authentication_transform_is_not_valid.
mov dword [esp + 4], str.AslFileMappingCreate
call fcn.656919fc
mov eax, dword [0x656a9048]
or eax, 0xb3bf49b3
add eax, 0x6ad9b68d
mov dword [0x656a9048], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [0x656a9048]
mov edi, dword [ebp + ebx*4 - 0x40]
inc ebx
sub eax, 0x6db0f076
add edi, esi
mov dword [0x656a9048], eax
mov esi, edi
cmp ebx, 4
jne 0x6568b309
mov dword [ebp - 0x6c], 0x3c
xor edx, edx
mov dword [ebp - 0x68], 0x12
mov dword [ebp - 0x64], 0xffffffb2
cmp byte [edx + str.The_driver_stack_doesnt_match_the_expected_driver_model.], 0
je 0x6568b3c5
inc edx
cmp edx, 0x18bc
jne 0x6568b3a7
xor eax, 0xbd77fec6
mov dword [0x656a9048], eax
jmp 0x6568b3cd
cmp edx, 0x25c
jle 0x6568b3d2
call fcn.65692a34
mov eax, dword [0x656a9048]
xor ebx, ebx
xor edx, edx
and eax, 0x67aa67cf
add eax, 0x61c6870b
mov dword [0x656a9048], eax
mov dword [ebp - 0x8c], edx
and dword [0x656a9048], 0x540253b3
call fcn.6568f248
mov eax, dword [0x656a9048]
mov esi, dword [ebp - 0x8c]
sub esi, dword [ebp + ebx*4 - 0x6c]
inc ebx
or eax, 0x96492f88
mov edx, esi
add eax, 0x6e0a46e
imul eax, eax, 0xf9ee7ef2
mov dword [0x656a9048], eax
cmp ebx, 3
jne 0x6568b3ea
add eax, 0x6e487445
or eax, 0xf0225349
add eax, 0x1e1cfac
or eax, 0x1268639f
imul eax, eax, 0x1963dbe3
mov dword [0x656a9048], eax
call fcn.6568f0c8
mov eax, dword [0x656a9048]
xor eax, 0xfdad090c
mov dword [0x656a9048], eax
mov dword [esp], eax
mov dword [esp + 8], str.The_IPsec_authentication_transform_is_not_valid.
mov dword [esp + 4], str.The_IPsec_authentication_transform_is_not_valid.
call fcn.656919fc
mov eax, dword [0x656a9048]
and eax, 0x5fa116fc
imul eax, eax, 0x7543677c
mov dword [0x656a9048], eax
mov dword [esp], eax
mov dword [esp + 8], str.AslFileMappingCreate
mov dword [esp + 4], str.AslFileMappingCreate
call fcn.656919fc
mov eax, dword [0x656a9048]
xor edx, edx
lea ecx, [eax + 0x3e230d]
mov dword [0x656a9048], ecx
cmp word [edx + edx + str.The_IPsec_authentication_transform_is_not_valid.], 0
je 0x6568b4d8
inc edx
cmp edx, 0x26b2
jne 0x6568b4b6
imul ecx, ecx, 0x828ba06a
mov dword [0x656a9048], ecx
jmp 0x6568b4e5
add eax, 0x1d6c9ea6
cmp edx, 0x2aa
jle 0x6568b4ef
mov eax, dword [0x656a9048]
and eax, 0xf3c6313f
add eax, 0x1699a29f
mov ebx, 6
mov dword [0x656a9048], eax
call fcn.65691248
mov eax, dword [0x656a9048]
xor eax, 0xdaed3dfa
sub eax, 0xabd1129
or eax, 0x909215da
mov dword [0x656a9048], eax
call fcn.65692b4c
imul eax, dword [0x656a9048], 0x784b53c3
xor eax, 0xa0d322c9
sub eax, 0xf8d5ff8
mov dword [0x656a9048], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [ebp - 0x74], 0x62
mov dword [ebp - 0x70], 0xff98
mov dword [ebp - 0x94], eax
xor eax, eax
cmp word [eax + str.The_IPsec_authentication_transform_is_not_valid.], 0
je 0x6568b574
add eax, 2
cmp eax, 0x14
jne 0x6568b558
sub dword [0x656a9048], 0x6e418dc4
imul eax, dword [0x656a9048], 0xe20f06ce
or eax, 0x86fb8564
mov dword [0x656a9048], eax
call fcn.6568ef20
mov eax, dword [0x656a9048]
or eax, 0x6ecf76ea
add eax, 0x18313523
mov dword [0x656a9048], eax
call fcn.6568f248
mov eax, dword [ebp - 0x94]
add ebx, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0xa0], ebx
test eax, eax
jne 0x6568b5c6
mov dword [ebp - 0x94], 1
jmp 0x6568b556
add dword [0x656a9048], 0x5609107f
mov edx, str.The_IPsec_authentication_transform_is_not_valid.
mov ecx, 0x174e
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x6568b5fe
add ecx, eax
cmp ecx, 0x21fc
jbe 0x6568b5da
call fcn.656921c4
xor dword [0x656a9048], 0xacc534d6
mov eax, dword [0x656a9048]
xor ebx, ebx
add eax, 0x146a9e5e
or eax, 0x6e33a6b5
imul eax, eax, 0xb5cf1488
or eax, 0x49d16f49
sub eax, 0x6939acd2
or eax, 0x613b8c63
sub eax, 0x1d8b1013
and eax, 0x44773c04
mov dword [0x656a9048], eax
call fcn.65691248
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x80], ebx
xor eax, 0xd8414383
sub eax, 0x1e89309c
mov dword [0x656a9048], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or eax, 0xf41a5440
mov dword [0x656a9048], eax
lea eax, [ebp - 0x80]
mov dword [esp + 4], eax
lea eax, [ebp - 0x84]
mov dword [esp], eax
call fcn.656896f8
test eax, eax
jns 0x6568b7e7
mov eax, dword [0x656a9048]
and eax, 0x10d18449
xor eax, 0x2848441
imul eax, eax, 0xd43a737d
cmp byte [str.The_driver_stack_doesnt_match_the_expected_driver_model.], 0
mov dword [0x656a9048], eax
je 0x6568b6af
call fcn.6568f698
and dword [0x656a9048], 0xc6211e5f
imul ecx, dword [0x656a9048], 0x1f52f784
xor ebx, ebx
xor edx, edx
or ecx, 0xef261c3b
mov dword [0x656a9048], ecx
imul eax, edx, 0xb44582b7
add eax, ecx
cmp word [edx + edx + str.AslFileMappingCreate], 0
je 0x6568b6fe
inc edx
cmp edx, 0x1a6f
jne 0x6568b6fa
test bl, bl
je 0x6568b6ee
mov dword [0x656a9048], eax
add dword [0x656a9048], 0x3bcd8bd3
jmp 0x6568b71d
mov bl, 1
jmp 0x6568b6c9
test bl, bl
je 0x6568b707
mov dword [0x656a9048], eax
mov eax, dword [0x656a9048]
xor eax, 0x8a828a56
cmp edx, 0x3b1
jle 0x6568b7ac
mov edx, str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov al, byte [edx]
test al, al
je 0x6568b73e
sub eax, 0x30
cmp al, 9
jbe 0x6568b73b
and dword [0x656a9048], 0x3510778f
jmp 0x6568b73e
inc edx
jmp 0x6568b722
sub dword [0x656a9048], 0x2bbe8e74
call fcn.6568f154
mov edx, str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov ecx, 0x13cc
movzx eax, byte [edx]
inc edx
test al, al
je 0x6568b789
add ecx, eax
cmp ecx, 0x21d6
jbe 0x6568b757
call fcn.65692b4c
or dword [0x656a9048], 0x9ccb7e5d
call fcn.6568f154
mov eax, dword [0x656a9048]
or eax, 0xea6a7b51
jmp 0x6568b793
mov eax, dword [0x656a9048]
xor eax, 0xaa5d88bb
and eax, 0xa1e57a8
mov dword [0x656a9048], eax
call fcn.6568f0c8
mov eax, dword [0x656a9048]
or eax, 0x85b3d9b3
sub eax, 0x6a2ed981
mov dword [0x656a9048], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov dword [esp + 4], str.The_IPsec_authentication_transform_is_not_valid.
mov dword [esp], str.The_IPsec_authentication_transform_is_not_valid.
call fcn.65694148
add dword [0x656a9048], 0x59f84825
xor ecx, ecx
mov dword [ebp - 0x94], ecx
jmp 0x6568bfe8
mov dword [esp], 0x100000
call fcn.6568d9ac
mov edx, dword [0x65695064]
add dword [0x656a9048], 0x5eb3835c
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x7c]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x4c]
mov dword [esp + 8], 0x100000
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x90]
or eax, 2
movzx eax, ax
mov dword [esp], eax
call dword [edx + 0x14]
xor eax, eax
xor edx, edx
sub esp, 0x18
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call fcn.65681083
add dword [0x656a9048], 0x31e10c8f
mov dword [esp], 0x248
call fcn.6568d9ac
imul edx, dword [0x656a9048], 0xa00469d6
mov ebx, eax
xor eax, eax
mov dword [0x656a9048], edx
cmp byte [eax + str.Cached_page_was_locked_during_operation.], 0
je 0x6568b8b5
inc eax
cmp eax, 0x282
jne 0x6568b898
xor edx, 0x579ab151
mov dword [0x656a9048], edx
mov eax, dword [0x656a9048]
and eax, 0x50030406
mov dword [0x656a9048], eax
mov dword [esp + 0xc], str.Cached_page_was_locked_during_operation.
mov dword [esp + 8], eax
mov dword [esp + 4], str.Cached_page_was_locked_during_operation.
mov dword [esp], str.Cached_page_was_locked_during_operation.
call fcn.65690e1c
add dword [0x656a9048], 0x38ab3836
mov dword [esp], 0x106b
call dword [sym.imp.USER32.dll_IsIconic]
push eax
imul eax, dword [0x656a9048], 0xc3244856
mov dword [0x656a9048], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp + 0xc], 0x248
mov dword [esp + 0x10], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call fcn.656810ab
mov dword [esp], ebx
call fcn.6568d9e0
cmp byte [str.The_driver_stack_doesnt_match_the_expected_driver_model.], 0
je 0x6568b956
call fcn.65690b18
or dword [0x656a9048], 0x4e2ce3c1
mov eax, dword [0x656a9048]
or eax, 0x9b358aea
sub eax, 0x6914288c
mov dword [0x656a9048], eax
call fcn.6568f248
imul eax, dword [0x656a9048], 0xd72af810
mov dword [0x656a9048], eax
call fcn.6568f248
mov eax, dword [ebp - 0x8c]
cmp word [eax], 0x5a4d
je 0x6568ba6a
mov eax, dword [0x656a9048]
sub eax, 0x5e988c58
or eax, 0xe5c29059
mov dword [0x656a9048], eax
mov dword [esp + 0xc], str.The_IPsec_authentication_transform_is_not_valid.
mov dword [esp + 8], str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov dword [esp + 4], str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov dword [esp], eax
call fcn.656901f0
imul eax, dword [0x656a9048], 0x75a8c620
add eax, 0x57d63879
xor eax, 0xb8cb09a0
mov dword [0x656a9048], eax
call fcn.6568f248
mov eax, dword [0x656a9048]
xor edx, edx
add eax, 0x76a6857b
xor eax, 0xbc477e60
and eax, 0x3eabfc69
mov dword [0x656a9048], eax
cmp byte [edx + str.The_driver_stack_doesnt_match_the_expected_driver_model.], 0
je 0x6568ba1f
inc edx
cmp edx, 0xe01
jne 0x6568ba01
xor eax, 0x17feae19
mov dword [0x656a9048], eax
jmp 0x6568ba27
cmp edx, 0x413
jle 0x6568ba4c
mov dword [esp + 0xc], str.AslFileMappingCreate
mov dword [esp + 8], str.Cached_page_was_locked_during_operation.
mov dword [esp + 4], str.Cached_page_was_locked_during_operation.
mov eax, dword [0x656a9048]
mov dword [esp], eax
call fcn.656901f0
mov eax, dword [0x656a9048]
sub eax, 0x5b5a3510
or eax, 0xd3adf140
mov dword [0x656a9048], eax
call fcn.6568f698
jmp 0x6568beab
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x78], edi
mov ebx, dword [eax + 0x3c]
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0x40
add ebx, eax
mov dword [esp + 0x10], 0x3000
lea eax, [ebx + 0x50]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call fcn.656810b5
mov eax, dword [ebx + 0x54]
mov dword [esp], eax
call fcn.6568d9ac
mov esi, eax
mov eax, dword [ebx + 0x54]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.6568d818
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x54]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call fcn.656810bf
mov dword [ebp - 0x90], eax
test eax, eax
je 0x6568bc25
or dword [0x656a9048], 0xc38985be
mov ebx, 0x100
mov edx, dword [0x656a9048]
mov ecx, str.AslFileMappingCreate
mov edi, 0x1b4e
and edx, 0x35097a48
mov dword [0x656a9048], edx
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x6568bb69
add edi, eax
cmp edi, 0x1fa6
jbe 0x6568bb2d
mov dword [esp + 8], str.The_IPsec_authentication_transform_is_not_valid.
mov dword [esp + 4], str.AslFileMappingCreate
mov dword [esp], edx
call fcn.656919fc
imul eax, dword [0x656a9048], 0x71977002
mov dword [0x656a9048], eax
mov eax, dword [0x656a9048]
add eax, 0x6994d7cd
xor eax, 0x102bd1b5
mov dword [0x656a9048], eax
call fcn.6568f0c8
dec ebx
jne 0x6568bb11
mov eax, dword [0x656a9048]
mov ebx, 0x46
xor eax, 0x95f8b703
and eax, 0xb4496729
mov dword [0x656a9048], eax
mov eax, dword [0x656a9048]
or eax, 0xff9445e
add eax, 0x16c53327
imul eax, eax, 0xab821e16
and eax, 0x8c008080
add eax, 0x6e2b1e9d
mov dword [0x656a9048], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
add eax, 0x66ea8caf
mov dword [0x656a9048], eax
dec ebx
jne 0x6568bb9e
and eax, 0x44d039dc
cmp byte [str.The_driver_stack_doesnt_match_the_expected_driver_model.], 0
mov dword [0x656a9048], eax
je 0x6568bbf7
call fcn.6568ef20
sub dword [0x656a9048], 0x4875924d
mov eax, dword [0x656a9048]
sub eax, 0x16dcc18c
xor eax, 0xc5712116
mov dword [0x656a9048], eax
mov dword [esp], eax
call fcn.65690910
and dword [0x656a9048], 0xd2a75ca7
mov dword [esp], esi
jmp 0x6568bea6
mov dword [esp], esi
call fcn.6568d9e0
movzx eax, word [ebx + 0x14]
lea esi, [ebx + eax + 0x18]
xor eax, eax
mov dword [ebp - 0x9c], eax
jmp 0x6568bc50
mov dword [esp], edi
add esi, 0x28
call fcn.6568d9e0
inc dword [ebp - 0x9c]
movzx eax, word [ebx + 6]
mov edi, dword [ebp - 0x9c]
cmp eax, edi
jle 0x6568bf5d
mov eax, dword [0x656a9048]
mov edx, str.The_IPsec_authentication_transform_is_not_valid.
mov ecx, 0x2e
sub eax, 0x2a07f959
or eax, 0x5d12609d
mov dword [0x656a9048], eax
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x6568bca4
add ecx, eax
cmp ecx, 0xc49
jbe 0x6568bc80
call fcn.65691248
or dword [0x656a9048], 0xafb8261f
imul edi, dword [0x656a9048], 0x55e58ccd
xor edi, 0xd64b8f3a
mov dword [0x656a9048], edi
mov dword [esp + 4], str.The_IPsec_authentication_transform_is_not_valid.
mov dword [esp], str.AslFileMappingCreate
call fcn.65694148
mov edx, str.The_IPsec_authentication_transform_is_not_valid.
mov ecx, 0x1276
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x6568bd17
add ecx, eax
cmp ecx, 0x1938
jbe 0x6568bcd8
mov dword [esp + 0xc], str.AslFileMappingCreate
mov dword [esp + 8], str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov dword [esp + 4], str.Cached_page_was_locked_during_operation.
mov dword [esp], edi
call fcn.656901f0
and dword [0x656a9048], 0x4484286a
imul eax, dword [0x656a9048], 0xc1f73e96
and eax, 0xf9c9db2b
mov dword [0x656a9048], eax
call fcn.6568ef20
xor eax, eax
cmp byte [eax + str.The_driver_stack_doesnt_match_the_expected_driver_model.], 0
je 0x6568bd4d
inc eax
cmp eax, 0xc5f
jne 0x6568bd32
xor dword [0x656a9048], 0x8dcac992
mov eax, dword [0x656a9048]
or eax, 0x2683e763
xor eax, 0x5bbe4d99
mov dword [0x656a9048], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, 0x678cfd82
mov dword [0x656a9048], eax
call fcn.6568f698
mov eax, dword [esi + 0x10]
sub dword [0x656a9048], 0x53bce27e
mov dword [esp], eax
call fcn.6568d9ac
mov edi, eax
mov eax, dword [esi + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x8c]
add eax, dword [esi + 0x14]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.6568d818
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call fcn.656810bf
test eax, eax
je 0x6568bc3f
imul eax, dword [0x656a9048], 0xfab1dc66
sub eax, 0x73811850
xor eax, 0xd3098342
and eax, 0x487618a2
mov dword [0x656a9048], eax
mov ebx, dword [ebp - 0x98]
cmp word [ebx + str.AslFileMappingCreate], 0
je 0x6568be25
add dword [ebp - 0x98], 2
cmp dword [ebp - 0x98], 0xedc
jne 0x6568bdf8
or eax, 0x2dbc24c7
mov dword [0x656a9048], eax
imul eax, dword [0x656a9048], 0xf3da70a9
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x656a9048], eax
call ebx
and eax, 0x51353b3
xor eax, 0x5ed4ed26
mov dword [0x656a9048], eax
mov dword [esp], eax
call fcn.65690910
mov eax, dword [0x656a9048]
xor edx, edx
mov ecx, dword [ebp - 0x90]
cmp word [ecx + ecx + str.AslFileMappingCreate], 0
jne 0x6568bec1
test dl, dl
je 0x6568be74
mov dword [0x656a9048], eax
mov eax, dword [0x656a9048]
or eax, 0x6b35f1cf
cmp dword [ebp - 0x90], 0x795
jg 0x6568befe
or eax, 0x439d2df7
mov dword [0x656a9048], eax
call fcn.6568f248
or dword [0x656a9048], 0xe04bfc1
mov dword [esp], edi
call fcn.6568d9e0
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call fcn.656810dd
jmp 0x6568b7da
inc dword [ebp - 0x90]
cmp dword [ebp - 0x90], 0x1f97
jne 0x6568bee8
test dl, dl
je 0x6568bedc
mov dword [0x656a9048], eax
and dword [0x656a9048], 0xd829a21a
jmp 0x6568befe
sub eax, 0x37003a7d
mov dl, 1
xor eax, 0x274a101a
sub eax, 0x271c791f
jmp 0x6568be5a
mov edx, str.The_driver_stack_doesnt_match_the_expected_driver_model.
mov ecx, 0x1b18
movzx eax, byte [edx]
inc edx
test al, al
je 0x6568bf29
add ecx, eax
cmp ecx, 0x1c81
jbe 0x6568bf08
imul eax, dword [0x656a9048], 0xbc12e295
mov dword [0x656a9048], eax
mov eax, dword [0x656a9048]
xor eax, 0x1b09765b
and eax, 0xc8739bcf
or eax, 0x482193c2
sub eax, 0x61afd9b2
xor eax, 0x900fac3
mov dword [0x656a9048], eax
call ebx
mov eax, dword [0x656a9048]
and eax, 0xfbfdeb04
jmp 0x6568be8a
mov dword [esp], 0x2cc
call fcn.6568d9ac
mov esi, eax
mov eax, dword [ebp - 0xa0]
or eax, 0x10007
mov dword [esi], eax
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call fcn.656810c9
mov eax, dword [ebx + 0x28]
add eax, dword [ebp - 0x78]
mov dword [esi + 0xb0], eax
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call fcn.656810d3
xor eax, eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x78]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
add eax, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call fcn.656810bf
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call fcn.656810dd
mov dword [esp], esi
call fcn.6568d9e0
mov eax, dword [ebp - 0x94]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x14
cmp byte [eax + str.MitigationAuditOptions], 0
je 0x6568dd7c
inc eax
cmp eax, 0x2a9
jne 0x6568dd61
and dword [0x656a8c5c], 0x80ba3617
sub dword [0x656a8c5c], 0x4c55e5e3
mov ebx, 0x2a
mov dword [esp], str.Device_Timeout
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
imul eax, eax, 0xe1695a6
push ecx
mov dword [0x656a8c5c], eax
call fcn.65693de4
mov eax, dword [0x656a8c5c]
sub eax, 0x5b85dee5
and eax, 0xe4180387
or eax, 0x70c9532
mov dword [0x656a8c5c], eax
call fcn.65692940
dec ebx
jne 0x6568dda9
mov dword [esp], 0x100000
mov ebx, dword [0x65695064]
call fcn.6568d9ac
xor edx, edx
mov dword [ebx + 0x4c], eax
mov eax, dword [0x65695064]
mov dword [eax + 0x50], edx
call fcn.6568ad74
mov ebx, dword [ebp - 4]
leave
jmp 0x6568afbc