Function at 0x437900
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x449578]
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], 0x808f8e95
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa5
xor cl, byte [esp + eax + 0x50]
add cl, 0xd8
mov byte [esp + eax + 0x50], cl
inc eax
cmp eax, 4
jne 0x437930
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xa1a0bfb3
mov esi, 0x6f587fce
mov edx, 0x90a78031
movzx edi, byte [esp + esi - 0x6f587fca]
mov ebx, esi
and ebx, edi
add ebx, ebx
sub ebx, edi
add ebx, edx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xdd
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x90
mov byte [esp + esi - 0x6f587fca], al
inc esi
dec edx
cmp esi, 0x6f587fd2
jne 0x437960
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
mov dword [esp + 0xc], 0x11a32fcb
mov dword [esp + 0x10], 0x1587138b
mov dword [esp + 0x14], 0x19bd1782
mov dword [esp + 0x18], 0x1dd81bb7
mov dword [esp + 0x1c], 0x1a91f8c
mov dword [esp + 0x20], 0x5a10394
mov dword [esp + 0x24], 0x90807e3
xor ecx, ecx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xc]
mov ebx, ecx
and ebx, 0x3c
mov edx, eax
xor edx, 0x97d91de
add edx, ebx
xor edx, esi
add edx, 0xb413710f
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + eax + 0xc], dl
inc eax
add ecx, 2
cmp eax, 0x1c
jne 0x437a00
lea eax, [esp + 0x64]
lea ecx, [esp + 0x84]
lea ebx, [esp + 0xc]
push eax
push dword [esp + 0xc]
push ecx
push dword [esp + 0x54]
push ebx
push 0
call dword [esp + 0x5c]
test eax, eax
jns 0x437b26
mov word [esp + 0xc], 0x68b4
xor eax, eax
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xc]
lea edx, [eax - 0x233a89f1]
and edx, esi
mov edi, edx
and edi, 2
mov ebx, edx
or edx, 2
imul edx, edi
xor edi, 2
and ebx, 0x1d
imul ebx, edi
add edx, ebx
add esi, eax
add esi, 0xdcc5760f
mov edi, edx
xor edi, esi
not edx
and edx, esi
add edx, edx
sub edx, edi
add edx, 0xf75418a1
mov esi, edx
and esi, 7
xor edx, 0x87
lea edx, [edx + esi*2]
add dl, 0x60
mov byte [esp + eax + 0xc], dl
mov eax, 1
xor edx, edx
test cl, 1
mov ecx, 0
jne 0x437a70
movzx eax, word [esp + 0xc]
mov word [esp + 0x84], ax
mov word [esp + 0xc], 0xa469
mov al, 1
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx + 0xc]
lea esi, [edx + 0x7b]
and esi, ecx
add ecx, edx
add esi, esi
sub ecx, esi
add cl, 0xa3
mov byte [esp + edx + 0xc], cl
mov edx, 1
test al, 1
mov eax, 0
jne 0x437af0
movzx eax, word [esp + 0xc]
mov word [esp + 0x86], ax
lea ebx, [esp + 0xc]
mov word [esp + 0xc], 0x6a05
xor eax, eax
mov cl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xc]
mov edi, 0x733309e
sub edi, eax
or edi, esi
not edi
mov edx, 0x9e
sub edx, eax
and edx, esi
or edx, edi
mov esi, edx
xor esi, 9
and edx, 0x76
add edx, edx
sub edx, esi
inc dl
mov byte [esp + eax + 0xc], dl
mov eax, 1
test cl, 1
mov ecx, 0
jne 0x437b40
movzx eax, word [esp + 0xc]
mov word [esp + 0x88], ax
mov word [esp + 0x8a], 0
mov dword [esp + 0x70], 0x73e4c05d
mov dword [esp + 0x6c], 0xa539164a
mov dword [esp + 0x68], 0xa965b236
mov dword [esp + 0x64], 0x350cead3
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x44067c
push 1
push 0
push 0x44068c
call dword [0x440dd0]
test eax, eax
mov edi, dword [ebp + 8]
js 0x4380f2
mov dword [esp + 0xc], 0xdb15d90a
mov dword [esp + 0x10], 0xdf0add13
mov dword [esp + 0x14], 0xe321e13c
mov dword [esp + 0x18], 0xe72be52d
mov dword [esp + 0x1c], 0xebd8e93e
mov word [esp + 0x20], 0xedec
xor eax, eax
mov ecx, eax
add cl, 0x18
xor cl, byte [esp + eax + 0xc]
add cl, 0x40
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x16
jne 0x437c10
push ebx
call dword [0x440de8]
mov esi, eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x4380e1
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x68]
call dword [0x440ddc]
test eax, eax
js 0x4380d7
mov dword [esp + 0x48], esi
mov dword [esp + 0xc], 0xd08ede8a
mov dword [esp + 0x10], 0xd4d3d28d
mov eax, 0xa6027375
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x59fd8c97]
xor ecx, eax
lea edx, [ecx + 0x57]
not ecx
and ecx, 1
xor edx, 1
lea ecx, [edx + ecx*2]
mov byte [esp + eax + 0x59fd8c97], cl
inc eax
cmp eax, 0xa602737d
jne 0x437c90
push ebx
call dword [0x440de8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x602a6e3e
mov dword [esp + 0x10], 0x6426623d
mov dword [esp + 0x14], 0x78336626
mov dword [esp + 0x18], 0x7c017a19
mov dword [esp + 0x1c], 0x70397e1d
mov dword [esp + 0x20], 0x742c7223
mov dword [esp + 0x24], 0x48177628
mov dword [esp + 0x28], 0x4cf24a1e
mov dword [esp + 0x2c], 0x403c4ef3
mov dword [esp + 0x30], 0x44ec4233
mov dword [esp + 0x34], 0x581e4607
mov dword [esp + 0x38], 0x5c085a06
mov word [esp + 0x3c], 0x5e5d
mov eax, 0x571122ba
mov ecx, ebx
movzx edx, byte [ecx]
lea esi, [eax - 0x40000000]
and esi, 0x1100225d
mov edi, edx
and edi, 0x5d
or edi, 0x11082
and edx, 0xffffffa2
xor edx, edi
xor edx, 0x19efffdf
mov ebx, eax
and ebx, 0x461100a2
or ebx, esi
xor ebx, 0xe61110a2
mov esi, edx
and esi, ebx
add ebx, edx
add esi, esi
sub ebx, esi
add bl, 0xd8
mov byte [ecx], bl
inc ecx
dec eax
cmp eax, 0x57112288
jne 0x437d30
lea eax, [esp + 0xc]
push eax
call dword [0x440de8]
mov edi, eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x80]
push edx
push 0
push 0x30
push edi
push dword [esp + 0x18]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x4380bd
mov dword [esp + 0x44], edi
mov dword [esp + 0x78], 0
mov eax, dword [esp + 0x80]
mov ecx, dword [eax]
lea edx, [esp + 0x78]
lea edi, [esp + 0x7c]
push edx
push edi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x4380ac
cmp eax, 1
je 0x4380ac
cmp dword [esp + 0x78], 0
je 0x4380ac
lea eax, [esp + 0x50]
push eax
call dword [0x440df4]
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc], 0x892d8735
mov dword [esp + 0x10], 0x8d258b18
mov dword [esp + 0x14], 0xf15c8f2f
mov dword [esp + 0x18], 0xf561f3bc
mov dword [esp + 0x1c], 0xf95af75b
mov dword [esp + 0x20], 0xfd6efb5f
mov word [esp + 0x24], 0xfffe
mov ecx, 0x36
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x2a]
lea edx, [ecx - 0x52f27c00]
or edx, edi
and edi, ecx
sub edx, edi
mov ebx, edx
and ebx, 0x4d
mov esi, edx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, ebx
or ebx, 2
imul ebx, esi
xor edx, 0x4f
add edx, edi
add edx, ebx
inc dl
mov byte [esp + ecx - 0x2a], dl
inc ecx
cmp ecx, 0x50
jne 0x437e40
mov ecx, dword [eax]
push 0
push 0
lea edi, [esp + 0x58]
push edi
push 0
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x43809b
cmp word [esp + 0x50], 8
jne 0x43809b
mov esi, dword [esp + 0x58]
movzx ecx, word [esi]
test cx, cx
je 0x437ef3
lea eax, [esi + 2]
xor edx, edx
jmp 0x437ecc
inc edx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x437ef5
cmp cx, 0x7f
jbe 0x437ec0
mov edi, edx
movzx edx, cx
cmp edx, 0x7ff
ja 0x437ee6
mov edx, edi
add edx, 2
jmp 0x437ec1
cmp cx, 0xffff
mov edx, edi
je 0x437ec1
add edx, 3
jmp 0x437ec1
xor edx, edx
lea eax, [edx + 1]
push eax
mov ebx, edx
call fcn.00408bd0
add esp, 4
mov dword [esp + 0x40], eax
mov dword [esp + 0x74], ebx
test ebx, ebx
je 0x43803e
movzx ecx, word [esi]
mov eax, dword [esp + 0x40]
test cx, cx
je 0x43803e
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x40]
nop
nop
nop
nop
nop
movzx ebx, cx
mov edi, esi
add esi, 2
cmp bx, 0x7f
ja 0x437f50
lea ecx, [eax + 1]
mov byte [eax], bl
jmp 0x437fe0
cmp ebx, 0x7ff
ja 0x437f75
cmp edx, 2
jb 0x437f75
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
lea ecx, [eax + 2]
jmp 0x437fe0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x438004
cmp edx, 4
jb 0x438004
mov esi, edi
movzx edi, word [edi + 2]
add esi, 4
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
add bl, 0xf0
mov byte [eax], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ecx, edi
and cl, 0x3f
or cl, 0x80
mov ebx, ecx
lea ecx, [eax + 4]
mov byte [eax + 3], bl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
xor ebx, eax
not eax
and eax, ecx
add ebx, edx
add eax, eax
sub ebx, eax
mov eax, ecx
mov edx, ebx
movzx ecx, word [esi]
test cx, cx
je 0x43803e
test edx, edx
jne 0x437f30
jmp 0x43803e
movzx ecx, cx
cmp ecx, 0xdc00
je 0x437ff2
cmp edx, 3
jb 0x43803a
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ecx, [eax + 3]
mov byte [eax + 2], bl
jmp 0x437fe0
mov ecx, eax
jmp 0x437fe0
mov byte [eax], 0
mov edi, dword [esp + 0x40]
mov eax, dword [edi]
mov dword [esp + 0x64], eax
mov ecx, dword [esp + 0x74]
mov eax, ecx
not eax
and eax, 4
and ecx, 0xfffffffb
sub ecx, eax
cmp ecx, 4
jb 0x43808e
mov eax, dword [edi + 4]
mov dword [esp + 0x68], eax
mov eax, ecx
not eax
and eax, 4
and ecx, 0xfffffffb
sub ecx, eax
cmp ecx, 4
jb 0x43808e
mov eax, dword [edi + 8]
mov dword [esp + 0x6c], eax
and ecx, 0xfffffffc
cmp ecx, 4
je 0x43808e
mov eax, dword [edi + 0xc]
mov dword [esp + 0x70], eax
push edi
call fcn.00408be0
add esp, 4
lea edi, [esp + 0x50]
push edi
call dword [0x440df0]
mov eax, dword [esp + 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [esp + 0x44]
mov esi, dword [0x440dec]
push dword [esp + 8]
call esi
push edi
call esi
mov edi, dword [ebp + 8]
lea ebx, [esp + 0xc]
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [0x440dec]
mov eax, dword [esp + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb65c016e
push dword [0x448570]
call fcn.0043dad0
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
lea ecx, [esp + 0xa0]
push ecx
call eax
test eax, eax
je 0x438128
mov eax, dword [esp + 0xc]
mov dword [esp + 0x64], eax
xor esi, esi
jmp 0x43813d
add edi, 8
inc esi
cmp esi, 4
je 0x438258
mov dword [esp + 8], edi
mov eax, 0
test esi, esi
je 0x438154
cmp dword [esp + esi*4 + 0x64], 1
mov eax, esi
sbb eax, 0
mov eax, dword [esp + eax*4 + 0x64]
mov dword [esp + 0x50], 0xa4894a64
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ecx + 0xe9]
mov edi, 6
sub edi, ecx
and edi, 5
and edx, 0xc2
or edx, edi
xor dl, byte [esp + ecx + 0x50]
xor dl, 0x2d
add dl, 0xb8
mov byte [esp + ecx + 0x50], dl
mov edx, ecx
and edx, 1
xor ecx, 0xffffffe1
lea ecx, [ecx + edx*2]
add ecx, 0x20
cmp ecx, 4
jb 0x438170
mov ecx, dword [esp + 0x50]
mov dword [esp + 0xc], 0x968271c9
mov dword [esp + 0x10], 0xe1e0fffe
mov edx, 0xe070d5aa
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx + 0x1f8f2a62]
xor edi, edx
mov ebx, edi
and ebx, 1
xor edi, 1
lea ebx, [edi + ebx*2]
add bl, 0xaf
mov byte [esp + edx + 0x1f8f2a62], bl
inc edx
cmp edx, 0xe070d5b2
jne 0x4381d0
imul ecx, eax
add ecx, dword [esp + 0xc]
mov dword [esp + esi*4 + 0x64], ecx
push 0x10
push 9
mov edi, dword [esp + 0x10]
push edi
push ecx
call fcn.0041df10
add esp, 0x10
lea ecx, [eax - 1]
mov edx, eax
nop
nop
nop
nop
nop
nop
inc ecx
cmp byte [edx], 0
lea edx, [edx + 1]
jne 0x438220
mov edx, ecx
xor edx, eax
mov ebx, eax
not ebx
and ebx, ecx
lea ecx, [edx + 8]
add ebx, ebx
sub ecx, ebx
je 0x438130
sub ebx, edx
add eax, ebx
add eax, 0xfffffff8
push ecx
push 0x30
push eax
call fcn.00408d60
add esp, 0xc
jmp 0x438130
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret