Function at 0x438d80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x254
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
push ebx
xor ecx, ecx
push ebp
mov eax, dword [eax*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov ebp, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
imul eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
sar eax, 6
mov dword [esp + 0x1c], eax
or eax, reloc.KERNEL32.dll_GetProcessHeap
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
push esi
cmp eax, ecx
push edi
mov word [esp + 0x18], cx
mov word [esp + 0x1a], cx
mov dword [esp + 0x50], 0x1000
mov dword [esp + 0x1c], ecx
je 0x438e18
mov ebx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov edi, 0x8000
mov esi, edi
push ebp
call dword [0x50bc74]
imul eax, ebx
mov ecx, esi
add esp, 4
imul ecx, esi
shl eax, 1
cmp ecx, eax
jbe 0x438e04
xor esi, edi
shr edi, 1
je 0x438e0c
or esi, edi
jmp 0x438dea
lea eax, [esi + 0x30]
shr eax, 6
mov dword [esp + 0x4c], eax
jmp 0x438e1c
mov dword [esp + 0x4c], ecx
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
test eax, eax
mov dword [esp + reloc.KERNEL32.dll_GetProcessHeap], 0x1000
jl 0x438e65
mov ecx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
lea ecx, [ecx + eax*2]
xor esi, esi
mov si, word [ecx]
cmp word [edx + esi*2], 0
jne 0x438e59
dec eax
sub ecx, 2
test eax, eax
jge 0x438e43
jmp 0x438e65
cmp eax, 3
mov dword [esp + reloc.KERNEL32.dll_GetProcessHeap], eax
jge 0x438e71
mov eax, 3
mov dword [esp + reloc.KERNEL32.dll_GetProcessHeap], eax
test eax, eax
mov dword [esp + 0x10], 0
jl 0x4395a7
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [edx + eax*2]
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
xor eax, eax
mov ax, word [edx + ecx*2]
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
imul eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
sar eax, 4
movsx ebx, word [edx + ecx*2]
lea edi, [eax - 1]
lea ebp, [eax + eax]
or edi, 1
lea eax, [edi + ebp]
mov dword [esp + 0x20], eax
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
movsx edx, word [eax + ecx*2]
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x3c], edx
test eax, eax
je 0x438f7a
movsx esi, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
mov eax, dword [esp + 0x4c]
and eax, reloc.uxtheme.dll_HitTestThemeBackground
imul esi, eax
movsx eax, bx
cdq
xor eax, edx
add esi, 0x20
sub eax, edx
sar esi, 7
shl eax, 4
cmp esi, 0x10000
jb 0x438f15
mov esi, reloc.uxtheme.dll_HitTestThemeBackground
cmp ax, si
ja 0x438f1e
xor eax, eax
jmp 0x438f20
sub eax, esi
xor edx, edx
and eax, reloc.uxtheme.dll_HitTestThemeBackground
mov dx, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
add edx, eax
xor eax, eax
mov ax, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
imul edx, eax
sar edx, 0x10
and edx, reloc.uxtheme.dll_HitTestThemeBackground
movsx eax, bx
mov esi, edx
imul esi, edx
mov edx, eax
imul esi, dword [esp + 0x24]
imul edx, eax
imul edx, dword [esp + 0x24]
sar esi, 4
mov eax, 0x66666667
lea edx, [esi + edx*4]
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x54], edx
jmp 0x438f88
mov eax, ebx
imul eax, ebx
imul eax, dword [esp + 0x24]
mov dword [esp + 0x54], eax
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 0x1c]
add esi, edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0xf0000000
lea esi, [edx + 1]
cmp esi, 3
jae 0x439161
mov eax, dword [esp + 0x10]
test ebx, ebx
lea ebp, [eax*4]
lea eax, [esp + ebp + 0x5e]
mov dword [esp + 0x3c], eax
jge 0x438fd2
mov edx, dword [esp + 0x20]
mov word [eax], reloc.uxtheme.dll_HitTestThemeBackground
add ebx, edx
jmp 0x438fdf
mov word [eax], 1
mov eax, dword [esp + 0x20]
sub eax, ebx
mov ebx, eax
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x439083
movsx esi, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
mov edx, dword [esp + 0x4c]
and edx, reloc.uxtheme.dll_HitTestThemeBackground
imul esi, edx
movsx edi, bx
mov eax, edi
add esi, 0x20
cdq
xor eax, edx
sub eax, edx
sar esi, 7
shl eax, 4
cmp esi, 0x10000
jb 0x439023
mov esi, reloc.uxtheme.dll_HitTestThemeBackground
cmp ax, si
ja 0x43902c
xor eax, eax
jmp 0x43902e
sub eax, esi
xor edx, edx
and eax, reloc.uxtheme.dll_HitTestThemeBackground
mov dx, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
add edx, eax
xor eax, eax
mov ax, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
imul edx, eax
sar edx, 0x10
and edx, reloc.uxtheme.dll_HitTestThemeBackground
mov eax, dword [esp + 0x24]
mov ecx, edx
imul ecx, edx
mov edx, edi
imul ecx, eax
imul edx, edi
imul edx, eax
sar ecx, 4
mov eax, 0x66666667
lea ecx, [ecx + edx*4]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ebx, edx
jmp 0x43908b
imul ebx, ebx
imul ebx, dword [esp + 0x24]
mov ecx, dword [0x47f680]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x34]
lea eax, [esp + ebp + 0x5c]
mov ebp, dword [esp + ebp + reloc.KERNEL32.dll_GetProcessHeap]
and ecx, 0xff
mov dword [esp + 0x44], eax
mov word [eax], 1
shl ecx, 0xb
mov eax, edx
add ebp, ecx
sub eax, esi
add ebp, ebx
test eax, eax
mov dword [esp + 0x28], ebp
jle 0x439140
sub edx, eax
mov ecx, 0x47f780
dec ecx
lea edx, reloc.KERNEL32.dll_GetProcessHeap
mov dword [esp + 0x14], edx
mov edx, reloc.uxtheme.dll_GetThemePartSize
sub edx, ecx
lea edi, [ecx + eax]
dec edx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov esi, dword [ecx]
xor ecx, ecx
mov cl, byte [edx + edi]
xor edx, edx
mov dl, byte [edi]
add esi, ebx
shl ecx, 0xb
shl edx, 0xb
add ecx, esi
add edx, esi
cmp ecx, ebp
jae 0x439114
mov ebp, ecx
mov ecx, dword [esp + 0x44]
mov word [ecx], ax
cmp edx, dword [esp + 0x1c]
jae 0x43912b
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov word [esp + 0x18], ax
mov dword [esp + 0x40], edx
mov esi, dword [esp + 0x14]
dec eax
add esi, 4
dec edi
test eax, eax
mov dword [esp + 0x14], esi
jg 0x4390e8
mov dword [esp + 0x28], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x40]
cmp ecx, eax
jne 0x439518
mov ecx, dword [esp + 0x3c]
mov dx, word [ecx]
mov word [esp + 0x1a], dx
jmp 0x439518
lea eax, [edx + 0x19]
cmp eax, 0x33
jae 0x4394ba
cmp edx, 1
mov eax, edx
jle 0x4391ef
imul eax, ebp
sub eax, ebx
lea esi, [edx - 1]
add eax, edi
mov dword [esp + 0x20], esi
mov edi, eax
sub edi, ebp
cmp edx, 0x18
mov dword [esp + 0x2c], edi
jg 0x4391a1
mov edi, dword [edx*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x38], edi
mov edi, 0x47f180
jmp 0x4391aa
mov edi, 0x47f180
mov dword [esp + 0x38], edi
cmp esi, 0x18
jg 0x4391bc
mov ebx, dword [esi*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x48], ebx
jmp 0x4391c0
mov dword [esp + 0x48], edi
cmp edx, 6
jg 0x4391d2
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x30], edx
jmp 0x4391d6
mov dword [esp + 0x30], edi
cmp esi, 6
jg 0x43926b
mov edx, dword [esi*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], edx
jmp 0x43926f
imul eax, ebp
sub eax, ebx
mov dword [esp + 0x20], esi
sub eax, edi
cmp edx, 0xffffffe8
lea edi, [eax + ebp]
mov dword [esp + 0x2c], edi
jl 0x43921c
mov edi, edx
not edi
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x38], edi
mov edi, 0x47f180
jmp 0x439225
mov edi, 0x47f180
mov dword [esp + 0x38], edi
cmp esi, 0xffffffe8
jl 0x43923b
mov ebx, esi
not ebx
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x48], ebx
jmp 0x43923f
mov dword [esp + 0x48], edi
cmp edx, 0xfffffffa
jl 0x439253
not edx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x30], edx
jmp 0x439257
mov dword [esp + 0x30], edi
cmp esi, 0xfffffffa
jl 0x43926b
not esi
mov edx, dword [esi*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], edx
jmp 0x43926f
mov dword [esp + 0x14], edi
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
test edx, edx
je 0x43939a
mov ebx, dword [esp + 0x4c]
movsx esi, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
and ebx, reloc.uxtheme.dll_HitTestThemeBackground
imul esi, ebx
movsx edi, ax
mov eax, edi
add esi, 0x20
cdq
xor eax, edx
sub eax, edx
sar esi, 7
shl eax, 4
cmp esi, 0x10000
jb 0x4392b3
mov esi, reloc.uxtheme.dll_HitTestThemeBackground
cmp ax, si
ja 0x4392bc
xor eax, eax
jmp 0x4392be
sub eax, esi
xor edx, edx
and eax, reloc.uxtheme.dll_HitTestThemeBackground
mov dx, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
mov ebp, dword [esp + 0x24]
add edx, eax
xor eax, eax
mov ax, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
imul edx, eax
sar edx, 0x10
and edx, reloc.uxtheme.dll_HitTestThemeBackground
mov eax, edx
imul eax, edx
mov edx, edi
imul eax, ebp
imul edx, edi
imul edx, ebp
sar eax, 4
movsx esi, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
lea edx, [eax + edx*4]
mov eax, 0x66666667
imul edx
imul esi, ebx
movsx edi, word [esp + 0x2c]
sar edx, 1
mov eax, edx
add esi, 0x20
shr eax, 0x1f
add edx, eax
mov eax, edi
mov dword [esp + 0x44], edx
cdq
xor eax, edx
sub eax, edx
sar esi, 7
shl eax, 4
cmp esi, 0x10000
jb 0x439340
mov esi, reloc.uxtheme.dll_HitTestThemeBackground
cmp ax, si
ja 0x439349
xor eax, eax
jmp 0x43934b
sub eax, esi
xor edx, edx
and eax, reloc.uxtheme.dll_HitTestThemeBackground
mov dx, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
add edx, eax
xor eax, eax
mov ax, word [ecx*2 + reloc.uxtheme.dll_HitTestThemeBackground]
imul edx, eax
sar edx, 0x10
and edx, reloc.uxtheme.dll_HitTestThemeBackground
mov eax, 0x66666667
mov ecx, edx
imul ecx, edx
mov edx, edi
imul ecx, ebp
imul edx, edi
imul edx, ebp
sar ecx, 4
lea ecx, [ecx + edx*4]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
jmp 0x4393b4
mov ecx, eax
mov edx, dword [esp + 0x2c]
imul ecx, eax
imul edx, edx
mov eax, dword [esp + 0x24]
imul ecx, eax
imul edx, eax
mov dword [esp + 0x44], ecx
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
sub edx, esi
mov esi, dword [esp + 0x10]
sub esi, ecx
mov ebx, edx
test esi, esi
mov dword [esp + 0x58], ebx
jle 0x439518
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x48]
mov edx, ebp
sub edx, esi
lea eax, [ecx - 1]
lea ecx, reloc.KERNEL32.dll_GetProcessHeap
lea edi, [eax + esi]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
sub ecx, eax
dec ecx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x30]
sub ecx, eax
dec ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x14]
sub ecx, eax
dec ecx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x38]
mov edx, dword [edx]
add edx, ecx
xor ecx, ecx
mov cl, byte [eax + edi]
xor eax, eax
mov al, byte [edi]
shl eax, 0xb
shl ecx, 0xb
add eax, edx
add ecx, edx
add eax, ebx
cmp eax, ecx
jae 0x439441
mov ecx, eax
mov eax, dword [esp + 0x20]
jmp 0x439445
mov eax, dword [esp + 0x3c]
cmp ecx, dword [esp + 0x28]
jae 0x439459
mov word [esp + ebp*4 + 0x5c], si
mov dword [esp + 0x28], ecx
mov word [esp + ebp*4 + 0x5e], ax
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x14]
xor eax, eax
mov al, byte [ecx + edi]
xor ecx, ecx
mov cl, byte [ebx + edi]
mov ebx, dword [esp + 0x58]
shl ecx, 0xb
shl eax, 0xb
add ecx, edx
add eax, edx
add ecx, ebx
cmp ecx, eax
jae 0x439487
mov eax, ecx
mov ecx, dword [esp + 0x20]
jmp 0x43948b
mov ecx, dword [esp + 0x3c]
cmp eax, dword [esp + 0x1c]
jae 0x4394a3
mov dword [esp + 0x1c], eax
mov word [esp + 0x18], si
mov word [esp + 0x1a], cx
mov dword [esp + 0x40], ebp
mov edx, dword [esp + 0x2c]
dec esi
add edx, 4
dec edi
test esi, esi
mov dword [esp + 0x2c], edx
jg 0x439410
jmp 0x439518
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x34]
mov ecx, edi
sub ecx, esi
test ecx, ecx
jle 0x439518
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, edi
sub eax, ecx
lea ebx, reloc.KERNEL32.dll_GetProcessHeap
mov eax, dword [ebx]
add eax, 0xf000
cmp eax, esi
jae 0x4394f4
mov word [esp + edi*4 + 0x5c], cx
mov esi, eax
mov word [esp + edi*4 + 0x5e], dx
cmp eax, ebp
jae 0x439508
mov ebp, eax
mov word [esp + 0x18], cx
mov word [esp + 0x1a], dx
mov dword [esp + 0x40], edi
dec ecx
add ebx, 4
test ecx, ecx
jg 0x4394dd
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], esi
mov edi, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x10]
lea ebx, [edi + ecx]
cmp eax, ebx
mov dword [esp + esi*4 + reloc.KERNEL32.dll_GetProcessHeap], eax
jae 0x439540
mov dword [esp + 0x50], eax
mov dword [esp + 0x34], esi
jmp 0x43958b
mov edx, dword [esp + 0x34]
add ecx, 0x800
mov ebp, dword [esp + edx*4 + reloc.KERNEL32.dll_GetProcessHeap]
lea eax, reloc.KERNEL32.dll_GetProcessHeap
cmp ebp, ecx
jbe 0x43956b
mov ebp, dword [eax + 4]
add eax, 4
inc edx
cmp ebp, ecx
ja 0x43955c
mov dword [esp + 0x34], edx
cmp edx, esi
jge 0x439587
mov ecx, esi
lea eax, reloc.KERNEL32.dll_GetProcessHeap
sub ecx, edx
mov edx, dword [eax]
add eax, 4
add edx, edi
dec ecx
mov dword [eax - 4], edx
jne 0x43957a
mov dword [esp + 0x50], ebx
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
inc esi
cmp esi, eax
mov dword [esp + 0x10], esi
jle 0x438e81
mov edx, dword [esp + 0x40]
test edx, edx
jge 0x4395b9
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov ebx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov ecx, 0x20
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov ax, word [esp + 0x1a]
xor ecx, ecx
mov cx, word [edi + edx*2]
mov word [ebx + ecx*2], ax
movsx ecx, word [esp + 0x18]
movsx eax, ax
sub edx, ecx
mov ecx, edx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
test ecx, ecx
jl 0x43961a
mov ax, word [esp + ecx*4 + 0x5e]
xor edx, edx
mov dx, word [edi + ecx*2]
mov word [ebx + edx*2], ax
movsx eax, ax
cdq
xor eax, edx
sub eax, edx
add esi, eax
movsx eax, word [esp + ecx*4 + 0x5c]
sub ecx, eax
jns 0x4395f8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret