Function at 0x43c230
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebp, ecx
mov eax, dword [esp + 0x78]
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0x100000
mov dword [esp + 0x1c], 0
mov dword [esp + 0x38], 0x8c8d8a8b
mov word [esp + 0x3c], 0
mov byte [esp + 0x3e], 0
mov eax, 0xc6563362
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x39a9ccd6]
xor ecx, eax
mov edx, 0xea
sub edx, ecx
not ecx
and ecx, 1
or edx, 1
sub ecx, edx
mov byte [esp + eax + 0x39a9ccd6], cl
inc eax
cmp eax, 0xc6563369
jne 0x43c290
mov eax, dword [esp + 0x38]
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x43c30e
xor edx, edx
mov esi, dword [0x44e1cc]
cmp dword [esi + edx*8], 0x98d5a07f
je 0x43c2e0
inc edx
cmp ecx, edx
jne 0x43c2d0
jmp 0x43c30e
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43c30e
lea eax, [esp + 0x20]
lea edx, [esp + 0x1c]
push 4
push 0x3000
push eax
push 0
push edx
push 0xffffffffffffffff
push 0x18
push ecx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x24
test eax, eax
js 0x43caca
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp], 0xf10d0f0c
mov byte [esp + 4], 0
mov eax, 0x173502fd
nop
movzx ecx, byte [esp + eax - 0x173502fd]
lea edx, [eax - 0x17350200]
mov esi, ecx
not esi
or esi, edx
mov edx, eax
or edx, ecx
add esi, ecx
mov ecx, SysReAllocString
sub ecx, esi
and ecx, edx
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
add cl, 0xe
mov byte [esp + eax - 0x173502fd], cl
inc eax
cmp eax, 0x17350302
jne 0x43c360
mov eax, dword [esp]
mov dword [esp + 0x24], eax
cmp eax, 0x7ffffffe
ja 0x43ca30
xor edi, edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], ebp
jmp 0x43c3ef
mov ebp, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
mov edi, esi
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x44]
add eax, dword [esp + 0x38]
mov dword [esp + 0x24], eax
cmp eax, 0x7fffffff
jae 0x43ca30
mov ecx, dword [ebp]
mov dword [esp], 0x8c8d8a8b
lea eax, [esp + 4]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0xc6563362
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x39a9cc9e]
xor edx, eax
mov esi, 0xea
sub esi, edx
not edx
and edx, 1
or esi, 1
sub edx, esi
mov byte [esp + eax + 0x39a9cc9e], dl
inc eax
cmp eax, 0xc6563369
jne 0x43c410
mov eax, dword [esp]
mov edx, dword [0x44e1c8]
test edx, edx
je 0x43c4b0
mov ebx, edi
xor esi, esi
mov edi, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xc18bc4ba
je 0x43c480
inc esi
cmp edx, esi
jne 0x43c460
mov edi, ebx
jmp 0x43c4b0
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
mov edi, ebx
je 0x43c4b0
push 0
push 0x1c
lea eax, [esp + 0x40]
push eax
push 0
push dword [esp + 0x34]
push ecx
push 0x18
push edx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x24
nop
nop
nop
nop
nop
cmp eax, 0xbfffffff
ja 0x43ca30
test eax, eax
js 0x43c3d8
cmp dword [esp + 0x48], 0x1000
jne 0x43c3d8
test byte [esp + 0x4c], 0x66
je 0x43c3d8
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jbe 0x43c65a
mov dword [esp], 0x8c8d8a8b
lea ecx, [esp + 4]
mov byte [ecx + 2], 0
mov word [ecx], 0
mov ecx, 0xc6563362
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x39a9cc9e]
xor edx, ecx
mov esi, 0xea
sub esi, edx
not edx
and edx, 1
or esi, 1
sub edx, esi
mov byte [esp + ecx + 0x39a9cc9e], dl
inc ecx
cmp ecx, 0xc6563369
jne 0x43c510
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x43c5a2
mov ebx, edi
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x44e1cc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x6dbc3610
je 0x43c572
inc esi
cmp ecx, esi
jne 0x43c560
mov edi, ebx
jmp 0x43c5a2
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
mov edi, ebx
je 0x43c5a2
push 0x8000
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 0x10
push ecx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x1c
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp], 0x8c8d8a8b
lea eax, [esp + 4]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0xc6563362
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x39a9cc9e]
xor ecx, eax
mov edx, 0xea
sub edx, ecx
not ecx
and ecx, 1
or edx, 1
sub ecx, edx
mov byte [esp + eax + 0x39a9cc9e], cl
inc eax
cmp eax, 0xc6563369
jne 0x43c5d0
mov eax, dword [esp]
mov ecx, dword [0x44e1c8]
test ecx, ecx
je 0x43c64e
xor edx, edx
mov esi, dword [0x44e1cc]
nop
cmp dword [esi + edx*8], 0x98d5a07f
je 0x43c620
inc edx
cmp ecx, edx
jne 0x43c610
jmp 0x43c64e
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43c64e
push 4
push 0x3000
lea eax, [esp + 0x28]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
push 0x18
push ecx
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x24
test eax, eax
js 0x43ca30
mov ecx, dword [esp + 0x20]
mov esi, edi
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp]
mov dword [esp + 0x18], eax
mov dword [esp], 0x8c8d8a8b
lea eax, [esp + 4]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0xc6563362
movzx ebx, byte [esp + eax + 0x39a9cc9e]
xor ebx, eax
mov edi, 0xea
sub edi, ebx
not ebx
and ebx, 1
or edi, 1
sub ebx, edi
mov byte [esp + eax + 0x39a9cc9e], bl
inc eax
cmp eax, 0xc6563369
jne 0x43c680
mov eax, dword [esp]
mov edi, dword [0x44e1c8]
test edi, edi
je 0x43c700
xor ebx, ebx
mov ebp, dword [0x44e1cc]
nop
cmp dword [ebp + ebx*8], 0xe6c7f7c6
je 0x43c6d1
inc ebx
cmp edi, ebx
jne 0x43c6c0
jmp 0x43c700
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43c700
lea eax, [esp + 0x60]
push eax
push ecx
push edx
push dword [esp + 0x30]
push dword [esp + 0x28]
push 0x14
push edi
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
test eax, eax
jns 0x43c70f
cmp eax, 0x8000000d
jne 0x43c3ca
push dword [esp + 0x84]
push dword [esp + 0x84]
push dword [esp + 0x84]
push dword [esp + 0x6c]
push dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
call fcn.0043cae0
add esp, 0x18
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp + 0x30], ecx
cmp eax, ecx
mov edi, esi
je 0x43ca0a
mov dword [esp + 0x54], eax
mov ebx, eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
jmp 0x43c792
push eax
push esi
push edx
call fcn.00408560
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x58]
mov dword [edx + ebx], eax
add ecx, 4
mov ebx, dword [esp + 0x5c]
add ebx, 4
cmp ebx, dword [esp + 0x30]
je 0x43c9cb
mov ebp, ecx
mov eax, ecx
not eax
and eax, edx
mov esi, edx
not esi
and esi, ecx
sub esi, eax
mov eax, dword [ebx]
add eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
mov dword [esp + 0x58], eax
cmp ecx, edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x5c], ebx
je 0x43c7d0
mov ebx, ebp
sub ebx, edx
mov ecx, ebp
cmp ebx, esi
jae 0x43c777
jmp 0x43c944
mov eax, esi
sar eax, 2
inc eax
mov ecx, ebp
sub ecx, edx
mov dword [esp + 0x14], ecx
sar ecx, 2
mov edi, ecx
shr edi, 1
add edi, ecx
cmp edi, eax
ja 0x43c7ed
mov edi, eax
lea eax, [edi*4]
push eax
call fcn.004084d0
add esp, 4
mov edx, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43c931
mov dword [esp + 0xc], edi
cmp edx, eax
mov dword [esp + 0x10], edx
jbe 0x43c8cf
cmp ebp, edx
jbe 0x43c8cf
cmp dword [esp + 0x14], 0
je 0x43c91d
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add eax, edx
dec eax
mov ecx, dword [esp + 0x10]
add ecx, edx
dec ecx
mov edi, edx
and edi, 7
je 0x43c864
neg edi
xor edx, edx
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp edi, edx
jne 0x43c850
add eax, edx
add ecx, edx
add edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
sub edi, ebp
cmp edi, 0xfffffff8
ja 0x43c91d
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x43c880
jmp 0x43c91d
mov ecx, dword [esp + 0x14]
shr ecx, 2
mov ebx, dword [esp + 0x18]
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov ecx, dword [esp + 0x14]
mov eax, ecx
and eax, 0xfffffffc
lea edi, [ebx + eax]
add eax, edx
mov ebx, ecx
shr ecx, 1
and ecx, 1
mov dword [esp + 0x2c], edi
mov edx, edi
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
test bl, 1
je 0x43c91d
mov ecx, dword [esp + 0x14]
and ecx, 2
mov edx, dword [esp + 0x2c]
movzx edx, byte [edx + ecx]
mov byte [eax + ecx], dl
push dword [esp + 0x18]
call fcn.004084e0
add esp, 4
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
lea edi, [edx + edi*4]
mov ecx, edx
add ecx, esi
mov ebx, dword [esp + 0x14]
cmp ebx, esi
jae 0x43c777
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x18]
add eax, esi
sub eax, ebp
lea esi, [edx + ebx]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
add edx, ebx
add edx, 4
cmp eax, 4
jg 0x43c760
mov ecx, eax
shr ecx, 2
mov ebp, esi
mov dword [esp + 0x2c], edi
mov edi, edx
xchg esi, ebp
rep movsd dword es:[edi], dword [esi]
xchg esi, ebp
mov ebp, eax
and ebp, 0xfffffffc
add esi, ebp
add ebp, edx
mov ecx, eax
shr ecx, 1
and ecx, 1
mov edx, esi
mov edi, ebp
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
test al, 1
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
je 0x43c777
mov eax, dword [esp + 0x18]
and eax, 2
movzx ecx, byte [esi + eax]
mov byte [ebp + eax], cl
mov ecx, dword [esp + 0xc]
jmp 0x43c777
mov eax, dword [esp + 0x78]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], edi
mov eax, dword [esp + 0x54]
test eax, eax
mov ebp, dword [esp + 0x28]
je 0x43ca27
mov dword [esp + 0xc], ecx
cmp eax, dword [esp + 0x30]
je 0x43c3d4
push eax
mov esi, edx
call fcn.004084e0
mov edx, esi
add esp, 4
mov dword [esp], 0
jmp 0x43c3d4
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov dword [eax + 8], edi
mov ebp, dword [esp + 0x28]
jmp 0x43c3d4
mov dword [esp + 0xc], ecx
jmp 0x43c3d4
mov dword [esp], 0x8c8d8a8b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xc6563362
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x39a9cc9e]
xor ecx, eax
mov edx, 0xea
sub edx, ecx
not ecx
and ecx, 1
or edx, 1
sub ecx, edx
mov byte [esp + eax + 0x39a9cc9e], cl
inc eax
cmp eax, 0xc6563369
jne 0x43ca50
mov eax, dword [0x44e1c8]
test eax, eax
je 0x43caca
mov ecx, dword [esp]
xor edx, edx
mov esi, dword [0x44e1cc]
nop
nop
cmp dword [esi + edx*8], 0x6dbc3610
je 0x43caa0
inc edx
cmp eax, edx
jne 0x43ca90
jmp 0x43caca
mov eax, dword [esi + edx*8 + 4]
cmp eax, ecx
je 0x43caca
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
push 0x10
push eax
push dword [0x44e1d0]
call fcn.0043e5b0
add esp, 0x1c
mov eax, dword [esp + 0x78]
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret 0x10