Function at 0x4337d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1521
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x258], 0
call fcn.004830b0
add esp, 0xc
call fcn.0047337c
test al, al
je 0x43388c
cmp al, 0x6b
cmp dword [ecx], ebx
xchg esi, eax
insd dword es:[edi], dx
lea ecx, [esi + 0x28307a0a]
xor ecx, dword [edi]
scasb al, byte es:[edi]
mov eax, 0xaf16267d
mov dword [0x67d8d959], eax
or al, ch
daa
inc byte [ebx]
add byte [eax + eax*8 - 0x71eee8c], al
call fcn.004736b8
add eax, dword [eax]
test al, al
je 0x4338a6
loope 0x43388f
adc eax, 0x8b789419
mov esp, edx
sbb eax, esp
cmp eax, edi
test al, 0xee
dec ecx
dec eax
call fcn.00473742
test al, al
je 0x4338c6
shr dword [eax], cl
scasd eax, dword es:[edi]
sbb esp, dword [esi - 0x5bcfa3a7]
cdq
nop
mov byte [edx + edi*8 - 0xc4c45f8], dh
and eax, 0xc35c0753
push 1
xor eax, eax
mov dword [ebp - 0x234], 7
push 0x5ebfd8
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
enter 0xfffffffffffffffd, 0xffffffffffffffff
add byte [eax], al
add byte [eax], al
mov word [ebp - 0x248], ax
call fcn.00402650
push 0x24
push str.D95D7A21_6C71_4F46_A997_FADE6D59F64B
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00405710
push 1
push 0x5ec02c
lea ecx, [ebp - 0x248]
call fcn.00405710
call fcn.0047337c
test al, al
je 0x433943
add bl, byte [esi]
std
jmp [edx + 1]
fcom dword [edx + 0xc]
inc esi
cli
inc edx
lea edi, [ebx - 0x5b]
test al, 0x6c
div byte [ecx]
mov esp, 0x8e897e1b
dec ebx
jbe 0x43390a
aam 0x58
in al, dx
add eax, edi
clc
call fcn.0047355f
test al, al
je 0x433962
xor dword [esi + esi*2], ebx
xchg ecx, eax
jbe 0x4338e1
dec ebp
aad 0x7f
jno 0x433942
rol dword [eax], 0x36
mov edi, 0x67ddf78c
mov bl, 0x69
shl byte [edx], cl
or eax, 0x3fb6ee8
add byte [eax + eax*8 + 0x38f31874], al
ret
call fcn.004734d5
test al, al
je 0x433983
cmp bl, al
mov ecx, 0xb34cab4b
sti
popfd
inc esp
push edi
push ebp
mov esp, 0x2cee4e83
enter 0x662c, 0xffffffffffffffdb
aam 0x8e
call fcn.00473925
test al, al
je 0x4339a6
push edi
add ah, byte [ecx - 0x639a1a7d]
loopne 0x43394e
dec edi
inc edi
jg 0x4339c0
salc
wait
fcom qword [edx - 0x1d]
popfd
scasd eax, dword es:[edi]
mov ah, ah
jnp 0x433a1f
sahf
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x268]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf003f
push 0
inc ebx
test dword [eax + 0x6afffffd], edi
add byte [ecx + 0x6a], dl
add byte [eax + 0x3f], ch
add byte [edi], cl
add byte [edx], ch
push 0
push 0
push eax
push dword [ebp - 0x26c]
call edi
test eax, eax
jne 0x434074
call fcn.00473856
test al, al
je 0x433a02
aaa
salc
fadd dword [edx - 0x616123c6]
push eax
sbb al, 0x34
scasd eax, dword es:[edi]
in al, dx
xchg ebp, eax
cmpsb byte [esi], byte es:[edi]
push ebx
mov dword [ebx - 0x7a72ff96], ebp
mov ah, 0xfd
invalid
push 0
lea eax, [ebp - 0x24c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e8a44
push dword [ebp - 0x268]
call edi
test eax, eax
jne 0x433ffa
cwde
std
invalid
call fcn.00473337
test al, al
je 0x433a53
or al, 0x67
mov al, byte [0x9d2a1901]
jbe 0x433a50
int3
pop ebx
push edi
or eax, ebp
sbb edi, esp
add eax, dword [eax]
call fcn.00473673
test al, al
je 0x433a75
ret
call fcn.00473490
test al, al
je 0x433a96
mov dh, 0x3f
xor byte [ecx - 0x1d], cl
mov eax, 0x82ec5d9e
and ah, 9
dec edi
stc
add al, 0x38
or ebp, dword [ebx]
stosd dword es:[edi], eax
out dx, al
xchg esi, eax
jle 0x433aac
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x250]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e8a4c
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x433dd1
call fcn.0047344b
test al, al
je 0x433ae0
mov ss, word [edx + 0x4a]
loopne 0x433b20
inc edi
add byte [edx + 0x64], cl
ror ecx, cl
xor cl, bl
outsd dx, dword [esi]
push 0
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win32
push dword [ebp - 0x250]
call ebx
test eax, eax
jne 0x433c3b
invalid
call fcn.00473925
test al, al
je 0x433b2f
mov ebp, gs
hlt
in eax, dx
cmpxchg dword [esi + esi], edx
in eax, 0x22
dec esp
jmp 0xe688bf62
call fcn.004732f2
test al, al
je 0x433b50
fisubr word [esi + 0x4c]
jle 0x433b00
push 0x45
retf
call fcn.004739af
test al, al
je 0x433b6d
bound eax, qword [ebp - 0x6d]
push cs
shl dword ds:[eax + 0x2f], 0x4a
sbb eax, eax
adc ecx, dword [ecx]
lcall 0x3dab, 0xe607b7f0
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402530
push str.NOvic32.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.0040aae0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433bd0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433bf0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x254]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00448f80
call fcn.00473856
test al, al
je 0x433c63
mov ebx, 0xb1fd7926
push esi
dec ecx
dec esp
inc esp
ret
call fcn.00473337
test al, al
je 0x433c88
jo 0x433cc9
dec ebx
cmp dl, byte [ebp + 0x19]
mov esi, 0xe3acb2e1
cmp byte [edx - 0x30ebfe5c], bh
and ebx, dword [ebp + 0x2d]
xchg esi, eax
aam 0x7e
cmpsb byte [esi], byte es:[edi]
fimul dword [eax + ecx - 0x70]
call fcn.004733c1
test al, al
je 0x433ca7
push edx
iretd
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win64
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
adc eax, sym.imp.ADVAPI32.dll_RegCreateKeyExW
test eax, eax
jne 0x433d9e
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00402530
push str.NOvic64.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0040aae0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433d30
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433d50
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x258]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00448f80
jmp 0x433da4
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0047337c
test al, al
je 0x433dc4
ret 0xb3fd
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x433dd1
push eax
call edi
call fcn.0047337c
test al, al
je 0x433df1
push esp
rol byte [esi - 0x31569d04], 0x6a
or eax, 0xec78772a
xchg ebp, eax
adc ch, bl
jbe 0x433de2
out dx, al
jmp 0x433e65
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x25c]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.FLAGS
push dword [ebp - 0x24c]
call esi
test eax, eax
jne 0x433e6d
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x30
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433e31
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x25c]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp dword [ecx + sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00473925
test al, al
je 0x433e95
xchg ecx, eax
inc edi
cmp esp, dword [ebx + 0x66492906]
aad 0x2c
push esi
notrack jmp 0x1b868be4
call fcn.004736fd
test al, al
je 0x433eb7
mov dword [esi], esi
invalid
push 0
lea eax, [ebp - 0x264]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.HELPDIR
push dword [ebp - 0x24c]
call esi
test eax, eax
jne 0x433f87
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00402530
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433f27
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433f41
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
call fcn.00448f80
pushfd
std
invalid
mov ch, 0x9c
std
invalid
invalid
add al, ch
and ebx, esi
add eax, dword [eax]
call fcn.004732ad
test al, al
je 0x433fa9
loope 0x433f86
sbb edi, dword [esi]
jnp 0x433f5f
cli
inc edx
pushfd
dec ecx
jb 0x433fe5
dec ebp
cld
ja 0x433fab
retf 0x97e2
call fcn.00473742
test al, al
je 0x433fc9
test dword [ebx], 0x74c08400
pop ss
lodsb al, byte [esi]
sbb al, 0x69
insd dword es:[edi], dx
jecxz 0x433f66
inc eax
mov al, 0xba
pop ebx
cmp byte [ebx], 0x25
mov esi, 0xfd13305f
lea ebx, [ecx]
and eax, 0xf2dfe801
add eax, dword [eax]
call fcn.004732ad
test al, al
je 0x433fe9
pushal
inc edx
push es
dec edx
salc
jp 0x433f73
dec esp
rol ebx, 0x92
jp 0x433f71
cmp ecx, eax
fist word [ecx + 0x17]
pop ss
adc ecx, dword [ebx]
je 0x433f75
mov eax, dword [ebp - 0x24c]
test eax, eax
test dword [ebp + edi*8 - 0x3f7a0001], esi
je 0x433ffa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0047362e
test al, al
je 0x434023
cmp dword [eax - 0x31], 0x52
cmp dl, byte [ebp + 0x5a]
sub byte [ecx], 0x5e
pop esi
outsd dx, dword [esi]
mov dl, 0xa8
outsb dx, byte [esi]
lodsd eax, dword [esi]
shr dl, 1
fadd qword [ebp + 0x2e350530]
add esp, dword [edx + 0x56]
popfd
adc al, 0x32
imul edx, dword [ebp - 0x6f], 0x3f4f2e8
add byte [eax + eax*8 - 0x672ce88c], al
push eax
mov esp, 0x2d16b43
call fcn.0047351a
test al, al
je 0x434043
rcr dword [eax + 0x6b43bc50], cl
rol dword [edx], 1
fidivr dword [esi + 0x68c04309]
loope 0x43400c
leave
jno 0x43403f
hlt
call fcn.004733c1
test al, al
je 0x434063
mov byte [edx + 0x22e2c634], dh
xor al, 0xc6
loop 0x434074
jne 0x433fdf
loopne 0x43404e
xchg edx, eax
cmp eax, 0xc2ee9e90
push ecx
dec ecx
ret 0x2be3
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x434074
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x434092
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4