Function at 0x4396d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov dword [esp + 0x20], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x34], 0x100000
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0x6c6d6e6f
mov byte [esp + 8], 0
xor eax, eax
mov ecx, 0xc1c6de16
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 4]
mov edx, eax
or edx, esi
or edx, 0x3e3921e8
lea edi, [ecx + 1]
or edi, esi
mov ebx, ecx
sub ebx, edi
lea esi, [eax + edi]
add esi, 0x3e3921e9
xor esi, edx
and ebx, edx
add ebx, ebx
sub ebx, esi
add bl, 0x78
mov byte [esp + eax + 4], bl
inc eax
dec ecx
cmp eax, 5
jne 0x439730
mov eax, dword [esp + 4]
mov ecx, dword [0x44ce80]
test ecx, ecx
je 0x4397be
xor edx, edx
mov esi, dword [0x44ce84]
nop
nop
nop
cmp dword [esi + edx*8], 0x3e416e49
je 0x439790
inc edx
cmp ecx, edx
jne 0x439780
jmp 0x4397be
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4397be
lea eax, [esp + 0x34]
lea edx, [esp + 0x14]
push 4
push 0x3000
push eax
push 0
push edx
push 0xffffffffffffffff
push 0x18
push ecx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x24
test eax, eax
mov esi, dword [esp + 0x20]
js 0x439ec2
cmp dword [esi + 4], 0
je 0x439e50
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 4], 0x41454744
mov dword [esp + 8], 0
mov esi, 0x669f24f2
mov edi, 0x9960db0e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x669f24ee]
lea ebx, [esi - 1]
and ebx, edx
add ebx, ebx
sub ebx, edx
add ebx, edi
or ebx, edi
add ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x4a
mov byte [esp + esi - 0x669f24ee], al
inc esi
dec edi
cmp esi, 0x669f24fa
jne 0x439830
mov edi, 0x7fff
cmp dword [esp + 0x1c], 2
je 0x439890
mov edi, 0
mov eax, 0xfffeffff
mov esi, dword [esp + 0x20]
je 0x4398a0
mov eax, SysReAllocString
mov edx, dword [esp + 4]
mov ecx, edx
sar ecx, 0x1f
mov dword [esp + 0x24], eax
cmp edx, eax
mov dword [esp + 0x1c], ecx
mov eax, ecx
sbb eax, edi
jae 0x439dd0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 0x38], edi
jmp 0x439904
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x48]
add edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
adc ecx, dword [esp + 0x54]
cmp edx, eax
mov dword [esp + 0x1c], ecx
mov eax, ecx
sbb eax, edi
jae 0x439dd0
mov dword [esp + 0x2c], edx
mov ecx, esi
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x2c]
push edx
call fcn.00439190
mov edx, dword [esp + 0x2c]
cmp eax, 0xbfffffff
ja 0x439dd0
test eax, eax
js 0x4398e0
cmp dword [esp + 0x60], 0x1000
mov eax, dword [esp + 0x24]
jne 0x4398e4
test byte [esp + 0x5c], 0x66
je 0x4398e4
mov eax, dword [esp + 0x48]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x34], eax
mov ecx, dword [esp + 0x4c]
mov eax, 0
mov dword [esp + 0x40], ecx
sbb eax, ecx
jae 0x439afe
mov dword [esp + 4], 0x6c6d6e6f
mov byte [esp + 8], 0
xor eax, eax
mov ecx, 0xc1c6de16
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 4]
mov edx, eax
or edx, ebx
or edx, 0x3e3921e8
lea esi, [ecx + 1]
or esi, ebx
mov ebx, ecx
sub ebx, esi
add esi, eax
add esi, 0x3e3921e9
xor esi, edx
and ebx, edx
add ebx, ebx
sub ebx, esi
add bl, 0x78
mov byte [esp + eax + 4], bl
inc eax
dec ecx
cmp eax, 5
jne 0x439990
mov eax, dword [0x44ce80]
test eax, eax
je 0x439a1a
mov ecx, dword [esp + 4]
xor edx, edx
mov ebx, dword [0x44ce84]
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x16194952
je 0x4399f0
inc edx
cmp eax, edx
jne 0x4399e0
jmp 0x439a1a
mov eax, dword [ebx + edx*8 + 4]
cmp eax, ecx
je 0x439a1a
push 0x8000
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push 0x10
push eax
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x1c
mov dword [esp + 0x44], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], eax
mov dword [esp + 4], 0x6c6d6e6f
mov byte [esp + 8], 0
xor eax, eax
mov ecx, 0xc1c6de16
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 4]
mov edx, eax
or edx, esi
or edx, 0x3e3921e8
lea edi, [ecx + 1]
or edi, esi
mov ebx, ecx
sub ebx, edi
lea esi, [eax + edi]
add esi, 0x3e3921e9
xor esi, edx
and ebx, edx
add ebx, ebx
sub ebx, esi
add bl, 0x78
mov byte [esp + eax + 4], bl
inc eax
dec ecx
cmp eax, 5
jne 0x439a50
mov eax, dword [esp + 4]
mov ecx, dword [0x44ce80]
test ecx, ecx
mov esi, dword [esp + 0x20]
je 0x439aee
xor edx, edx
mov ebx, dword [0x44ce84]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3e416e49
je 0x439ac0
inc edx
cmp ecx, edx
jne 0x439ab0
jmp 0x439aee
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x439aee
push 4
push 0x3000
lea eax, [esp + 0x3c]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 0x18
push ecx
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x24
test eax, eax
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x2c]
js 0x439dd0
mov ecx, esi
lea eax, [esp + 0x68]
push eax
push dword [esp + 0x44]
push dword [esp + 0x38]
push dword [esp + 0x20]
push dword [esp + 0x2c]
push edx
call fcn.00439540
test eax, eax
jns 0x439b26
cmp eax, 0x8000000d
jne 0x439b38
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov edx, dword [ebp + 0x10]
cmp eax, edx
sbb ecx, 0
jae 0x439b44
mov eax, dword [esp + 0x24]
mov edx, dword [esp]
jmp 0x439dc8
push dword [ebp + 0x14]
push edx
push dword [ebp + 0xc]
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
call fcn.00439f10
add esp, 0x18
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x58], ecx
cmp eax, ecx
je 0x439da0
mov dword [esp + 0x64], eax
mov esi, eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp]
jmp 0x439bd6
push dword [esp + 0x10]
call fcn.00408780
add esp, 4
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
lea eax, [ecx + eax*8]
mov dword [esp + 0x18], eax
mov edx, ecx
add edx, ebx
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov dword [ecx + ebx], edi
mov edi, dword [esp + 0x40]
mov dword [ecx + ebx + 4], edi
add edx, 8
add esi, 4
cmp esi, dword [esp + 0x58]
je 0x439d5c
mov edi, dword [esi]
sub edi, dword [esp + 0x14]
mov ebx, edi
sar ebx, 0x1f
add edi, eax
mov dword [esp + 0x30], edi
adc ebx, dword [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov ebx, edx
sub ebx, ecx
cmp edx, dword [esp + 0x18]
jne 0x439bb7
mov dword [esp], edx
mov dword [esp + 0x10], ecx
mov ecx, ebx
sar ecx, 3
lea eax, [ecx + 1]
mov edx, ecx
shr edx, 1
add edx, ecx
cmp edx, eax
ja 0x439c14
mov edx, eax
mov dword [esp + 0x18], edx
lea eax, [edx*8]
push eax
call fcn.00408770
add esp, 4
mov ecx, eax
mov edx, dword [esp + 0x10]
test edx, edx
je 0x439ba4
cmp ecx, edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x3c], ecx
jbe 0x439d02
cmp dword [esp], ecx
jbe 0x439d02
test ebx, ebx
je 0x439b90
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
add eax, edx
dec eax
mov ecx, dword [esp + 0x3c]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x439c94
neg edi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x439c80
add eax, edx
add ecx, edx
add edx, dword [esp + 0x28]
mov edi, dword [esp + 0x10]
sub edi, dword [esp]
cmp edi, 0xfffffff8
ja 0x439b90
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x439cb0
jmp 0x439b90
mov edi, ecx
mov ecx, ebx
shr ecx, 2
mov dword [esp], edx
mov eax, dword [esp]
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov ecx, edx
mov edx, ebx
and edx, 0xfffffffc
mov eax, dword [esp + 0x3c]
lea edi, [eax + edx]
add edx, ecx
mov ecx, ebx
xor ecx, 0xfffffffc
mov eax, ebx
or eax, 3
and eax, ecx
mov ecx, eax
shr ecx, 1
mov ebx, edx
mov dword [esp], edi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test byte [esp + 0x28], 1
je 0x439b90
and eax, 0xfffffffe
movzx ecx, byte [edx + eax]
mov edx, dword [esp]
mov byte [edx + eax], cl
jmp 0x439b90
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov dword [eax], ecx
mov esi, dword [esp + 0x18]
mov dword [eax + 8], esi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x439db8
mov dword [esp + 0x10], ecx
cmp eax, dword [esp + 0x58]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x38]
je 0x439dc4
push eax
mov dword [esp + 4], edx
call fcn.00408780
mov edx, dword [esp + 4]
add esp, 4
mov dword [esp + 4], 0
jmp 0x439dc4
mov eax, dword [ebp + 8]
mov edx, dword [esp]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
jmp 0x439dc4
mov dword [esp + 0x10], ecx
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov dword [esp], edx
jmp 0x4398e4
mov dword [esp + 4], 0x6c6d6e6f
mov byte [esp + 8], 0
xor eax, eax
mov ecx, 0xc1c6de16
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 4]
mov edx, eax
or edx, esi
or edx, 0x3e3921e8
lea edi, [ecx + 1]
or edi, esi
mov ebx, ecx
sub ebx, edi
lea esi, [eax + edi]
add esi, 0x3e3921e9
xor esi, edx
and ebx, edx
add ebx, ebx
sub ebx, esi
add bl, 0x78
mov byte [esp + eax + 4], bl
inc eax
dec ecx
cmp eax, 5
jne 0x439df0
mov eax, dword [0x44ce80]
test eax, eax
je 0x439ec2
mov ecx, dword [esp + 4]
xor edx, edx
mov esi, dword [0x44ce84]
cmp dword [esi + edx*8], 0x16194952
je 0x439e98
inc edx
cmp eax, edx
jne 0x439e40
jmp 0x439ec2
push 0xbbf966b4
push dword [0x44ce74]
call fcn.0043eaf0
add esp, 8
test eax, eax
je 0x439ecf
mov ecx, dword [esi]
test ecx, ecx
je 0x4397d4
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x439edb
cmp dword [esp + 4], 0
je 0x439edb
mov dword [esi + 4], 3
jmp 0x4397d4
mov eax, dword [esi + edx*8 + 4]
cmp eax, ecx
je 0x439ec2
lea ecx, [esp + 0x44]
lea edx, [esp + 0x14]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
push 0x10
push eax
push dword [0x44ce88]
call fcn.0043c030
add esp, 0x1c
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov dword [esi + 4], 1
jmp 0x4397d4
lea eax, [esp + 0x50]
push eax
call fcn.0043f2b0
add esp, 4
test al, al
je 0x4397d4
mov eax, dword [esp + 0x50]
mov ecx, 2
cmp eax, 3
je 0x439f00
mov ecx, eax
mov dword [esi + 4], ecx
jmp 0x4397d4