Function at 0x439ff244
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.439a4d44
xor eax, eax
push ebp
push 0x439ff4d3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
push edx
dec edx
inc edx
push edx
pop edx
xor edx, 0x2d
push edx
pop edx
push edx
pop edx
push edx
pop edx
inc edx
xchg edx, edx
dec edx
pop edx
lea eax, [ebp - 0x10]
call fcn.439a4890
push 0x439ff4e0
call sub.kernel32.dll_AddAtomA
push ebx
nop
nop
mov ebx, 0x31
add ebx, 0x51
add ebx, 0x17b
sub ebx, 0x173
pop ebx
mov dl, 1
mov eax, dword [0x439b2900]
call fcn.439a3a4c
mov dword [ebp - 0x1c], eax
call sub.user32.dll_DestroyCaret
push ebx
inc ebx
and ebx, 0x77
or ebx, 0xd7
and ebx, 0xfc
sub ebx, 0x2b
push ebx
pop ebx
pop ebx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x20
call fcn.439ff168
push 1
call sub.gdi32.dll_DeleteEnhMetaFile
push ebx
push eax
inc eax
sub ebx, 0x10f
or eax, 0x12a
sub eax, 0xc6
xor eax, 0xe5
or ebx, 0x1ab
sub eax, 0x145
xchg ebx, eax
nop
nop
nop
sub ebx, 0x8a
dec eax
sub eax, 0x7c
pop eax
pop ebx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x439ff46c
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
call sub.user32.dll_GetActiveWindow
push edx
add edx, 0x16c
mov edx, 0x1a6
nop
nop
nop
nop
nop
mov edx, 0xe9
pop edx
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.439a8a60
mov dword [ebp - 0x18], eax
push esi
or esi, 0x78
mov esi, 0x36
add esi, 4
xchg esi, esi
or esi, 0xfd
mov esi, 0x22
xchg esi, esi
nop
nop
nop
mov esi, 0x25
or esi, 0x68
pop esi
push 1
call sub.gdi32.dll_DeleteEnhMetaFile
push ebx
push eax
inc eax
sub ebx, 0x10f
or eax, 0x12a
sub eax, 0xc6
xor eax, 0xe5
or ebx, 0x1ab
sub eax, 0x145
xchg ebx, eax
nop
nop
nop
sub ebx, 0x8a
dec eax
sub eax, 0x7c
pop eax
pop ebx
mov eax, dword [ebp - 8]
add dword [ebp - 0x18], eax
call sub.user32.dll_GetKBCodePage
push eax
xor eax, 0x3f
nop
nop
nop
nop
or eax, 0x121
add eax, 0xa5
nop
pop eax
lea eax, [ebp - 0x2c]
mov dl, byte [ebp - 0x18]
call fcn.439a4a78
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
call fcn.439a4b5c
push ecx
or ecx, 0x162
push ecx
pop ecx
sub ecx, 0xab
nop
nop
nop
nop
nop
add ecx, 0xfe
pop ecx
call sub.user32.dll_GetKBCodePage
push eax
xor eax, 0x3f
nop
nop
nop
nop
or eax, 0x121
add eax, 0xa5
nop
pop eax
call sub.user32.dll_DestroyCaret
push ebx
inc ebx
and ebx, 0x77
or ebx, 0xd7
and ebx, 0xfc
sub ebx, 0x2b
push ebx
pop ebx
pop ebx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x439ff345
call sub.user32.dll_GetKBCodePage
push eax
xor eax, 0x3f
nop
nop
nop
nop
or eax, 0x121
add eax, 0xa5
nop
pop eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.439a48e4
push ecx
push ecx
pop ecx
xchg ecx, ecx
inc ecx
add ecx, 0xdf
nop
nop
nop
nop
nop
xor ecx, 0x155
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439ff4da
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.439a48b4
lea eax, [ebp - 0x10]
call fcn.439a4890
lea eax, [ebp - 4]
call fcn.439a4890
ret