Function at 0x439e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x439e82
cmp eax, 2
je 0x439efb
jmp 0x43a051
push 0xbbf966b4
push dword [0x44c2a4]
call fcn.0043f9e0
add esp, 8
test eax, eax
je 0x439ebf
mov ecx, dword [esi]
test ecx, ecx
je 0x439eef
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x439ecb
cmp dword [esp], 0
je 0x439ecb
mov dword [esi + 4], 3
jmp 0x439eef
mov dword [esi + 4], 1
jmp 0x43a051
lea eax, [esp + 0x40]
push eax
call fcn.004402f0
add esp, 4
test al, al
je 0x439eef
mov eax, dword [esp + 0x40]
mov ecx, 2
cmp eax, 3
je 0x439eec
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43a051
mov dword [esp], 0xc2a5c7be
mov dword [esp + 4], 0xafc1c9d3
mov dword [esp + 8], 0xcacecdd3
mov dword [esp + 0xc], 0xe68debdf
mov dword [esp + 0x10], 0xfef4eaef
mov byte [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x15], 0
mov dword [esp + 0x18], 0
mov eax, 0x96e89013
mov edi, 0x29176fec
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x69176fed]
mov ecx, edi
and ecx, 0x20032498
mov edx, eax
and edx, 0x94c81027
or edx, ecx
xor edx, ebx
mov ecx, edx
and ecx, 0xa0
xor ecx, 0x80
mov ebx, edx
and ebx, 0x5f
xor ebx, 0xb8
add ebx, ecx
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + eax + 0x69176fed], bl
inc eax
dec edi
cmp eax, 0x96e8902f
jne 0x439f50
mov ebx, esp
lea eax, [esp + 0x70]
push ebx
push eax
call fcn.0043eaf0
add esp, 8
mov eax, dword [esi]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0x30
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
lea eax, [esp + 0x40]
push 6
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call fcn.0043ebc0
mov ecx, dword [esp]
mov edx, dword [esp + 4]
mov esi, dword [ebp + 0x10]
mov dword [esi + 4], edx
mov dword [esi], ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov esi, dword [ebp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp + 0x18]
mov dword [edx], ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ebp + 0x1c]
mov dword [edx], ecx
jmp 0x43a120
mov dword [esp + 0x40], 0x710e0f70
mov word [esp + 0x44], 0
mov eax, 0x2daa4cbd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x2daa4c7d]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x4f
mov byte [esp + eax - 0x2daa4c7d], cl
inc eax
cmp eax, 0x2daa4cc3
jne 0x43a070
mov ebx, dword [esp + 0x40]
mov edi, dword [esi]
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x5a
xor cl, byte [esp + eax]
add cl, 0x3e
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x43a0c0
mov eax, dword [esp]
mov ecx, dword [0x44c2b0]
test ecx, ecx
je 0x43a0fe
xor edx, edx
mov esi, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xba50defc
je 0x43a12a
inc edx
cmp ecx, edx
jne 0x43a0f0
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov dword [edx + 4], 0
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edi
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edi
mov edx, dword [esi + edx*8 + 4]
cmp edx, eax
je 0x43a0fe
mov eax, esp
push 0
push dword [esp + 0x3c]
push eax
push 0
push dword [ebp + 8]
push dword [esp + 0x50]
push 6
push edx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x24
mov ecx, dword [esp]
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
jmp 0x43a0fe