Function at 0x437890
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x44964c]
mov dword [esp + 8], eax
mov dword [esp + 0x50], 0xf8e7e6fd
mov ecx, 0x8d
mov edx, 0x72
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x73
mov ebx, ecx
and ebx, 0x8c
or ebx, esi
xor bl, byte [esp + ecx - 0x3d]
xor bl, 0x73
add bl, 0x98
mov byte [esp + ecx - 0x3d], bl
inc ecx
dec edx
cmp ecx, 0x91
jne 0x4378c0
mov ecx, dword [esp + 0x50]
mov dword [esp + 4], 0x7574737f
xor esi, esi
mov edx, 0xffffffff
nop
nop
nop
nop
nop
nop
mov edi, edx
or edi, 0x62
mov ebx, esi
or ebx, 0x62
add ebx, edi
add ebx, esi
inc bl
xor bl, byte [esp + esi + 4]
add bl, 0xf0
mov byte [esp + esi + 4], bl
lea edi, [esi + 1]
dec edx
mov esi, edi
cmp edi, 4
jne 0x437900
mov edx, dword [esp + 4]
mov dword [esp + 0xc], 0xdc88dafc
mov dword [esp + 0x10], 0xd0acde54
mov dword [esp + 0x14], 0xd4b6d2a5
mov dword [esp + 0x18], 0xe893d6a8
mov dword [esp + 0x1c], 0xec92ea9b
mov dword [esp + 0x20], 0xe08aee9b
mov dword [esp + 0x24], 0xe4e3e2c4
mov esi, 0xa741ef51
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi + 0x58be10bb]
xor edi, esi
lea ebx, [edi + 0x77]
mov eax, 8
sub eax, edi
or eax, 1
add eax, edi
xor ebx, 1
lea eax, [ebx + eax*2]
add al, 0xf0
mov byte [esp + esi + 0x58be10bb], al
inc esi
cmp esi, 0xa741ef6d
jne 0x437970
lea edi, [esp + 0x74]
lea eax, [esp + 0x8c]
lea esi, [esp + 0xc]
push edi
push ecx
push eax
push edx
push esi
push 0
call dword [esp + 0x20]
test eax, eax
jns 0x437a32
mov word [esp + 0xc], 0x703c
xor eax, eax
mov cl, 1
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xc]
lea edx, [eax + 0x7fd3a47]
mov edi, 0x45b8
sub edi, eax
and edi, 0x4118
and edx, 0x79c0a47
or edx, edi
lea edi, [eax + 0x47]
and edi, esi
xor edx, esi
xor edx, 0x18
or edx, edi
lea ebx, [edi + edi]
not ebx
add ebx, edi
and ebx, edx
add bl, 0xc8
mov byte [esp + eax + 0xc], bl
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x4379d0
movzx eax, word [esp + 0xc]
mov word [esp + 0x8c], ax
mov word [esp + 0x8e], 0x3a
mov word [esp + 0xc], 0xcf72
xor eax, eax
mov cl, 1
nop
nop
nop
movzx esi, byte [esp + eax + 0xc]
mov edx, eax
or edx, 0xde35143e
xor edx, esi
mov edi, edx
and edi, 0xe15140d
mov ebx, edx
and ebx, 2
mov esi, ebx
xor esi, 2
imul esi, edi
or edi, 2
imul edi, ebx
xor edx, 0xe575e0f
add esi, edx
add esi, edi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + eax + 0xc], dl
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x437a40
movzx eax, word [esp + 0xc]
mov word [esp + 0x90], ax
mov word [esp + 0x92], 0
mov dword [esp + 0x80], 0x6510ff3
mov dword [esp + 0x7c], 0x50b3e0fa
mov dword [esp + 0x78], 0xfafd1800
mov dword [esp + 0x74], 0x4e1dfbbd
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x44067c
push 1
push 0
push 0x44068c
call dword [0x440dbc]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x43801c
mov dword [esp + 0xc], 0xe9a7e754
mov dword [esp + 0x10], 0xed58eba5
mov dword [esp + 0x14], 0xd193ef52
mov dword [esp + 0x18], 0xd599d39b
mov dword [esp + 0x1c], 0xd98ad760
mov word [esp + 0x20], 0xdbda
mov eax, 0xe7fb856
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xe7fb84a]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0x4d
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
xor ecx, 0x4f
add ecx, edi
add ecx, edx
inc cl
mov byte [esp + eax - 0xe7fb84a], cl
inc eax
cmp eax, 0xe7fb86c
jne 0x437b30
lea eax, [esp + 0xc]
push eax
call dword [0x440dd4]
mov esi, eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x43800b
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [0x440dc8]
test eax, eax
js 0x438001
mov dword [esp + 0xc], 0x500e5e0a
mov dword [esp + 0x10], 0x5453520d
mov eax, 0x3c47a8f5
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x3c47a8e9]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x58
mov byte [esp + eax - 0x3c47a8e9], cl
inc eax
cmp eax, 0x3c47a8fd
jne 0x437be0
lea eax, [esp + 0xc]
push eax
call dword [0x440dd4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x3470153
mov dword [esp + 0x10], 0x7430548
mov dword [esp + 0x14], 0xb5e094b
mov dword [esp + 0x18], 0xf240d2c
mov dword [esp + 0x1c], 0x13541130
mov dword [esp + 0x20], 0x17591546
mov dword [esp + 0x24], 0x1b3a1955
mov dword [esp + 0x28], 0x1f771d4b
mov dword [esp + 0x2c], 0x2311214e
mov dword [esp + 0x30], 0x27792516
mov dword [esp + 0x34], 0x2b63296a
mov dword [esp + 0x38], 0x2f7d2d63
mov word [esp + 0x3c], 0x3130
xor eax, eax
nop
xor byte [esp + eax + 0xc], al
inc eax
cmp eax, 0x32
jne 0x437c80
mov dword [esp + 0x48], esi
lea eax, [esp + 0xc]
push eax
call dword [0x440dd4]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi]
lea edx, [esp + 0x70]
push edx
push 0
push 0x30
mov dword [esp + 0x50], eax
push eax
push dword [esp + 0x18]
push esi
call dword [ecx + 0x50]
test eax, eax
js 0x437feb
mov dword [esp + 0x68], 0
mov eax, dword [esp + 0x70]
mov ecx, dword [eax]
lea edx, [esp + 0x68]
lea esi, [esp + 0x6c]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x437fe1
cmp eax, 1
je 0x437fe1
cmp dword [esp + 0x68], 0
je 0x437fe1
lea eax, [esp + 0x50]
push eax
call dword [0x440de0]
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], 0xccaeca9a
mov dword [esp + 0x10], 0xc0b6cebf
mov dword [esp + 0x14], 0xc4bfc2a0
mov dword [esp + 0x18], 0xd8b2c69b
mov dword [esp + 0x1c], 0xdcb9daa4
mov dword [esp + 0x20], 0xd0addeb8
mov word [esp + 0x24], 0xd2d1
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 2
mov ebx, edx
xor ebx, 0xc1
add ebx, esi
xor bl, byte [esp + edx + 0xc]
add bl, 0xf8
mov byte [esp + edx + 0xc], bl
inc edx
add ecx, 2
cmp edx, 0x1a
jne 0x437d50
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x58]
push esi
push 0
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x437fd0
cmp word [esp + 0x50], 8
jne 0x437fd0
mov eax, dword [esp + 0x58]
movzx ecx, word [eax]
test cx, cx
je 0x437ded
mov edi, eax
add eax, 2
xor esi, esi
jmp 0x437dcc
inc esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x437df1
cmp cx, 0x7f
jbe 0x437dc0
movzx edx, cx
cmp edx, 0x7ff
ja 0x437de2
add esi, 2
jmp 0x437dc1
cmp cx, 0xffff
je 0x437dc1
add esi, 3
jmp 0x437dc1
mov edi, eax
xor esi, esi
lea eax, [esi + 1]
push eax
call fcn.00408b20
add esp, 4
mov dword [esp + 0x40], eax
mov dword [esp + 0x64], esi
test esi, esi
je 0x437f7f
mov ecx, edi
movzx edx, word [edi]
mov eax, dword [esp + 0x40]
test dx, dx
je 0x437f7f
mov esi, dword [esp + 0x64]
mov eax, dword [esp + 0x40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, dx
lea edx, [ecx + 2]
cmp bx, 0x7f
ja 0x437e50
lea edi, [eax + 1]
mov byte [eax], bl
jmp 0x437f20
mov dword [esp], eax
cmp ebx, 0x7ff
ja 0x437e7f
cmp esi, 2
jb 0x437e7f
mov eax, ebx
shr eax, 6
add al, 0xc0
mov ecx, dword [esp]
mov byte [ecx], al
mov eax, ecx
lea edi, [ecx + 2]
and bl, 0x3f
or bl, 0x80
mov byte [ecx + 1], bl
jmp 0x437f20
mov eax, ebx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x437f3a
cmp esi, 4
jb 0x437f3a
movzx edi, word [ecx + 2]
mov dword [esp + 0x88], edi
shl ebx, 0xa
mov eax, edi
or eax, 0xffff23ff
and edi, 0x23ff
add edi, ebx
mov ebx, 0xfe
sub ebx, edi
sub ebx, eax
lea edx, [eax + edi]
inc edx
mov dword [esp + 0x84], ecx
lea ecx, [eax + edi]
add ecx, 0xfca10001
mov eax, ecx
shr eax, 0x12
add al, 0xf0
mov edi, dword [esp]
mov byte [edi], al
mov eax, edi
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [edi + 1], cl
shr edx, 6
and dl, 0x3f
or dl, 0x80
mov byte [edi + 2], dl
or ebx, 0x3f
add ebx, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
add edx, 4
add bl, 0x81
mov byte [edi + 3], bl
add edi, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
add esi, eax
sub esi, edi
mov ecx, edx
mov eax, edi
movzx edx, word [ecx]
test dx, dx
je 0x437f7f
test esi, esi
jne 0x437e30
jmp 0x437f7f
movzx eax, ax
cmp eax, 0xdc00
jne 0x437f4b
mov ecx, edx
mov eax, dword [esp]
jmp 0x437f28
cmp esi, 3
jb 0x437f78
mov eax, ebx
shr eax, 0xc
or al, 0xe0
mov ecx, dword [esp]
mov byte [ecx], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [ecx + 1], al
mov eax, ecx
and bl, 0x3f
or bl, 0x80
lea edi, [ecx + 3]
mov byte [ecx + 2], bl
jmp 0x437f20
mov eax, dword [esp]
mov edi, eax
jmp 0x437f20
mov byte [eax], 0
mov eax, 3
mov ecx, dword [esp + 0x64]
sub eax, ecx
cmp eax, 0xfffffffd
jae 0x437f97
mov eax, 0xfffffffc
add eax, ecx
shr eax, 2
cmp eax, 3
mov ebx, dword [ebp + 8]
lea esi, [esp + 0x50]
jb 0x437fad
mov eax, 3
lea eax, [eax*4 + 4]
push eax
mov edi, dword [esp + 0x44]
push edi
lea eax, [esp + 0x7c]
push eax
call fcn.00408b50
add esp, 0xc
push edi
call fcn.00408b30
add esp, 4
push esi
call dword [0x440ddc]
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [0x440dd8]
push dword [esp + 8]
call esi
push dword [esp + 0x44]
call esi
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [0x440dd8]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x448644]
call fcn.0043dba0
add esp, 8
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
lea ecx, [esp + 0xa8]
push ecx
call eax
test eax, eax
je 0x438056
mov eax, dword [esp + 0xc]
mov dword [esp + 0x74], eax
xor edi, edi
jmp 0x43806d
add ebx, 8
inc edi
cmp edi, 4
je 0x438187
mov eax, 0
test edi, edi
je 0x438080
cmp dword [esp + edi*4 + 0x74], 1
mov eax, edi
sbb eax, 0
mov dword [esp], edi
mov dword [esp + 8], ebx
mov eax, dword [esp + eax*4 + 0x74]
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], 0x4e67240e
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xd3
xor cl, byte [esp + eax + 0x50]
add cl, 0x68
mov byte [esp + eax + 0x50], cl
inc eax
cmp eax, 4
jne 0x4380a0
mov eax, dword [esp + 0x50]
mov dword [esp + 0x44], eax
mov dword [esp + 0xc], 0xe6f201b9
mov dword [esp + 0x10], 0xb1b08f8e
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0xc]
mov eax, edx
and eax, 4
mov esi, ecx
xor esi, 0x8bad4a5a
add esi, eax
lea eax, [edi + edi]
not eax
add eax, edi
mov ebx, edi
and ebx, 0x47
and eax, 0xb8
or eax, ebx
xor eax, edi
xor eax, 0x47
and eax, edi
mov ebx, esi
not eax
and eax, esi
not esi
or esi, edi
sub ebx, edi
add ebx, esi
not ebx
or ebx, eax
add bl, 0x30
mov byte [esp + ecx + 0xc], bl
inc ecx
add edx, 2
cmp ecx, 8
jne 0x4380e0
mov eax, dword [esp + 0x44]
imul eax, dword [esp + 0x48]
add eax, dword [esp + 0xc]
mov edi, dword [esp]
mov dword [esp + edi*4 + 0x74], eax
mov esi, 0xfffffff7
push 0x10
push 9
mov ebx, dword [esp + 0x10]
push ebx
push eax
call fcn.0041f8b0
add esp, 0x10
nop
nop
nop
nop
nop
cmp byte [eax + esi + 9], 0
lea esi, [esi + 1]
jne 0x438160
test esi, esi
je 0x438060
add eax, esi
neg esi
push esi
push 0x30
push eax
call fcn.00408cb0
add esp, 0xc
jmp 0x438060
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret