Function at 0x443c43
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 8
push 0x3d8
mov eax, 0x46db81
call fcn.0046c6db
xor edi, edi
mov dword [ebp - 0x3a4], 1
push edi
push 2
mov dword [ebp - 0x39c], edi
mov dword [ebp - 0x3cc], 0x104
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x390], 0x128
test eax, eax
je 0x444940
mov al, 0x5e
mov dword [ebp - 0x138], 0x3b323b0a
movsx ecx, al
mov byte [ebp - 0x160], al
mov dword [ebp - 0x134], 0x333f2c39
mov dword [ebp - 0x130], 0x3b263b70
mov byte [ebp - 0x12c], 0
call fcn.0043cfd7
push 8
mov dword [ebp - 0x394], eax
xor edx, edx
pop esi
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x15c], eax
inc edx
pop ecx
cmp edx, esi
jl 0x443cd1
push 0xc
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0043d333
movsx ecx, byte [ebp - 0x160]
mov dword [ebp - 0x13c], eax
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x15c], eax
inc edx
pop ecx
cmp edx, esi
jl 0x443d19
push dword [0x487200]
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x13c]
call fcn.0043d3a9
test eax, eax
je 0x443d63
mov dl, byte [ebp - 0x160]
xor ecx, ecx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 0xc
jb 0x443d56
mov byte [eax + 0xc], 0
movaps xmm0, xmmword [str._TT_T_PVP___3_7r7_1__76_r_]
mov dword [ebp - 0x268], eax
mov al, 0x63
movsx ecx, al
mov byte [ebp - 0x164], al
movups xmmword [ebp - 0x13c], xmm0
mov byte [ebp - 0x12c], 0
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x160], eax
inc edx
pop ecx
cmp edx, esi
jl 0x443d96
push 0x10
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0043d333
movsx ecx, byte [ebp - 0x164]
mov dword [ebp - 0x140], eax
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x160], eax
inc edx
pop ecx
cmp edx, esi
jl 0x443dde
push dword [0x487200]
lea eax, [ebp - 0x160]
push eax
push dword [ebp - 0x140]
call fcn.0043d3a9
mov ecx, eax
test ecx, ecx
je 0x443e3b
movsx eax, byte [ebp - 0x164]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
movups xmm0, xmmword [ecx]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
mov byte [ecx + 0x10], 0
mov al, 0x3a
mov dword [ebp - 0x264], ecx
movsx ecx, al
mov byte [ebp - 0x15c], al
mov dword [ebp - 0x134], 0x5f565f6e
mov dword [ebp - 0x130], 0x575b485d
mov word [ebp - 0x12c], 0x6166
mov byte [ebp - 0x12a], 0
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x158], eax
inc edx
pop ecx
cmp edx, esi
jl 0x443e7d
push 0xa
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.0043d333
movsx ecx, byte [ebp - 0x15c]
mov dword [ebp - 0x138], eax
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x158], eax
inc edx
pop ecx
cmp edx, esi
jl 0x443ec5
push dword [0x487200]
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x138]
call fcn.0043d3a9
test eax, eax
je 0x443f0f
mov dl, byte [ebp - 0x15c]
xor ecx, ecx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 0xa
jb 0x443f02
mov byte [eax + 0xa], 0
movaps xmm0, xmmword [0x47f480]
mov dword [ebp - 0x260], eax
push 0x1e
pop eax
movsx ecx, al
mov byte [ebp - 0x164], al
movups xmmword [ebp - 0x13c], xmm0
mov dword [ebp - 0x12c], 0x425d26
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x160], eax
inc edx
pop ecx
cmp edx, esi
jl 0x443f46
push 0x13
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0043d333
movsx ecx, byte [ebp - 0x164]
mov dword [ebp - 0x140], eax
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x160], eax
inc edx
pop ecx
cmp edx, esi
jl 0x443f8e
push dword [0x487200]
lea eax, [ebp - 0x160]
push eax
push dword [ebp - 0x140]
call fcn.0043d3a9
test eax, eax
je 0x443fd8
mov dl, byte [ebp - 0x164]
xor ecx, ecx
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0x13
jb 0x443fcb
mov byte [eax + 0x13], 0
mov dword [ebp - 0x25c], eax
mov al, 0x4d
movsx ecx, al
mov byte [ebp - 0x15c], al
mov dword [ebp - 0x134], 0x12342826
mov dword [ebp - 0x130], 0x2c392c29
mov word [ebp - 0x12c], 0x3e
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x158], eax
inc edx
pop ecx
cmp edx, esi
jl 0x444013
push 9
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.0043d333
movsx ecx, byte [ebp - 0x15c]
mov dword [ebp - 0x138], eax
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x158], eax
inc edx
pop ecx
cmp edx, esi
jl 0x44405b
push dword [0x487200]
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x138]
call fcn.0043d3a9
test eax, eax
je 0x4440a5
mov dl, byte [ebp - 0x15c]
xor ecx, ecx
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 9
jb 0x444098
mov byte [eax + 9], 0
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x258], eax
push ecx
lea eax, [ebp - 0x254]
push eax
push ecx
lea ecx, [ebp - 0x3b4]
call fcn.0044b0cf
and dword [ebp - 4], 0
and dword [ebp - 0x17c], 0
lea eax, [ebp - 0x36c]
and dword [ebp - 0x16c], 0
lea ecx, [ebp - 0x17c]
push eax
mov dword [ebp - 0x168], 0xf
call fcn.0044b945
mov eax, dword [ebp - 0x3b4]
push ecx
lea ecx, [ebp - 0x17c]
push dword [eax]
call fcn.0044b37c
lea ecx, [ebp - 0x17c]
mov esi, eax
call fcn.0044b89e
cmp esi, 0xffffffff
je 0x44490e
push dword [ebp - 0x388]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x44490e
lea ecx, [ebp - 0x3cc]
push ecx
lea ecx, [ebp - 0x128]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x44490e
mov al, 0x4b
mov dword [ebp - 0x130], 0x2a2f3f17
movsx ecx, al
mov byte [ebp - 0x158], al
mov dword [ebp - 0x12c], 0x172a3f
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x154], eax
inc edx
pop ecx
cmp edx, 8
jl 0x444183
push 7
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.0043d333
movsx ecx, byte [ebp - 0x158]
mov dword [ebp - 0x134], eax
call fcn.0043cfd7
mov dword [ebp - 0x394], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x394]
call fcn.0043d016
mov dword [ebp + edx*4 - 0x154], eax
inc edx
pop ecx
cmp edx, 8
jl 0x4441cc
push dword [0x487200]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 0x134]
call fcn.0043d3a9
mov esi, eax
test esi, esi
je 0x444219
mov cl, byte [ebp - 0x158]
xor eax, eax
xor byte [esi + eax], cl
inc eax
cmp eax, 7
jb 0x44420c
mov byte [esi + 7], 0
and dword [ebp - 0x17c], 0
lea eax, [ebp - 0x128]
and dword [ebp - 0x16c], 0
lea ecx, [ebp - 0x17c]
push eax
mov dword [ebp - 0x168], 0xf
mov byte [ebp - 0x17c], 0
call fcn.0044b945
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 1
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x444257
sub ecx, edx
lea eax, [ecx - 0xd]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x17c]
call fcn.0044b2f0
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0044b441
push eax
lea ecx, [ebp - 0x1c4]
call fcn.0044b4e8
or edi, 1
mov dword [ebp - 0x39c], edi
lea ecx, [ebp - 0x20c]
call fcn.0044b89e
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 5
call fcn.0044b89e
push ecx
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x194]
call fcn.0044c02b
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 6
call fcn.0043e4dc
lea ecx, [ebp - 0x194]
mov byte [ebp - 0x395], al
call fcn.0044b6d9
cmp byte [ebp - 0x395], 0
je 0x4448e2
push ecx
lea eax, [ebp - 0x1c4]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x194]
call fcn.0044c02b
push ecx
lea eax, [ebp - 0x194]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x3d8]
call fcn.0043e195
lea ecx, [ebp - 0x194]
call fcn.0044b6d9
lea eax, [ebp - 0x3d8]
push eax
lea ecx, [ebp - 0x3c0]
call fcn.0044070c
mov eax, dword [ebp - 0x3c0]
mov esi, dword [ebp - 0x3bc]
and dword [ebp - 0x3c0], 0
and dword [ebp - 0x3bc], 0
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], esi
lea eax, [ebp - 0x3d8]
push eax
lea ecx, [ebp - 0x3e8]
call fcn.0044070c
mov ecx, dword [ebp - 0x3e4]
xor edx, edx
xorps xmm0, xmm0
mov dword [ebp - 0x394], edx
movlpd qword [ebp - 0x3e0], xmm0
and dword [ebp - 0x3e0], 0
and dword [ebp - 0x3dc], edx
test ecx, ecx
je 0x4443b1
call fcn.0042a587
mov edx, dword [ebp - 0x394]
mov eax, dword [ebp - 0x3a0]
cmp eax, edx
je 0x444891
lea esi, [eax + 0x20]
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x254]
mov dword [ebp - 0x3a0], esi
push eax
mov ecx, esi
call fcn.0043d919
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0xe
push ecx
mov ecx, eax
call fcn.0043d8ed
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0x10
call fcn.0044b6d9
mov eax, dword [ebp - 0x3b4]
lea ecx, [ebp - 0x1ac]
push dword [eax + 0x10]
call fcn.0044cae0
test al, al
jne 0x44443e
cmp dword [ebp - 0x19c], 0x11
jne 0x444849
cmp dword [ebp - 0x198], 0x10
lea eax, [ebp - 0x1ac]
cmovae eax, dword [ebp - 0x1ac]
cmp byte [eax + 0x10], 0x73
jne 0x444849
lea eax, [ebp - 0x1f4]
mov ecx, esi
push eax
call fcn.0043d8ed
mov esi, eax
mov byte [ebp - 4], 0x11
cmp dword [esi + 0x14], 0x10
jb 0x44445a
mov esi, dword [esi]
mov ecx, dword [ebp - 0x3a0]
lea eax, [ebp - 0x23c]
push eax
call fcn.0043d919
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.0043d8ed
mov dword [ebp - 0x3a0], eax
mov edx, dword [ebp - 0x3a4]
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x13
call fcn.0042a666
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x3b4]
mov edx, dword [eax + 8]
call fcn.0044bd0e
pop ecx
push 0x47ee58
mov ecx, eax
mov byte [ebp - 4], 0x15
call fcn.0044b441
push eax
lea ecx, [ebp - 0x194]
call fcn.0044b4e8
or edi, 2
mov dword [ebp - 0x39c], edi
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x194]
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x17c]
push eax
push dword [ebp - 0x3a8]
call fcn.0044cb1e
or edi, 4
mov dword [ebp - 0x39c], edi
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0x17c]
cmp dword [ebp - 0x168], 0x10
mov ecx, dword [0x486fbc]
cmovae edx, dword [ebp - 0x17c]
push 2
push 0
push esi
call fcn.0042e156
add esp, 0xc
lea ecx, [ebp - 0x17c]
call fcn.0044b89e
lea ecx, [ebp - 0x194]
call fcn.0044b89e
lea ecx, [ebp - 0x20c]
call fcn.0044b89e
lea ecx, [ebp - 0x224]
call fcn.0044b89e
lea ecx, [ebp - 0x1dc]
call fcn.0044b89e
lea ecx, [ebp - 0x23c]
call fcn.0044b6d9
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 0x10
call fcn.0044b89e
cmp dword [ebp - 0x19c], 0x11
jne 0x444849
push 0x10
push 0
lea eax, [ebp - 0x1f4]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.0044b2f0
lea ecx, [ebp - 0x1ac]
cmp ecx, eax
je 0x4445bf
mov byte [ebp - 0x3d0], 0
push dword [ebp - 0x3d0]
push eax
call fcn.0044ba6a
lea ecx, [ebp - 0x1f4]
call fcn.0044b89e
push 0x47eda0
lea edx, [ebp - 0x1c4]
lea ecx, [ebp - 0x1f4]
call fcn.0044bd40
pop ecx
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0x18
push ecx
mov ecx, eax
call fcn.0044b462
push eax
lea ecx, [ebp - 0x1dc]
call fcn.0044b4e8
or edi, 8
mov dword [ebp - 0x39c], edi
push str.maps
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 0x19
call fcn.0044b441
push eax
lea ecx, [ebp - 0x17c]
call fcn.0044b4e8
or edi, 0x10
mov dword [ebp - 0x39c], edi
push ecx
lea eax, [ebp - 0x17c]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x194]
call fcn.0044c02b
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 0x1b
call fcn.0043e4dc
lea ecx, [ebp - 0x194]
mov byte [ebp - 0x395], al
call fcn.0044b6d9
lea ecx, [ebp - 0x17c]
call fcn.0044b89e
lea ecx, [ebp - 0x1dc]
call fcn.0044b89e
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 0x10
call fcn.0044b89e
cmp byte [ebp - 0x395], 0
je 0x444849
push 0x47eda0
lea edx, [ebp - 0x1c4]
lea ecx, [ebp - 0x140]
call fcn.0044bd40
pop ecx
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, eax
call fcn.0044b462
push eax
lea ecx, [ebp - 0x20c]
call fcn.0044b4e8
or edi, 0x20
mov dword [ebp - 0x39c], edi
push str.maps
lea ecx, [ebp - 0x20c]
mov byte [ebp - 4], 0x1d
call fcn.0044b441
push eax
lea ecx, [ebp - 0x194]
call fcn.0044b4e8
or edi, 0x40
mov dword [ebp - 0x39c], edi
mov edx, dword [ebp - 0x3a4]
lea esi, [ebp - 0x194]
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x23c]
cmp dword [ebp - 0x180], 0x10
cmovae esi, dword [ebp - 0x194]
call fcn.0042a666
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1f4]
push eax
mov eax, dword [ebp - 0x3b4]
mov edx, dword [eax + 8]
call fcn.0044bd0e
pop ecx
push 0x47ee58
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.0044b441
push eax
lea ecx, [ebp - 0x224]
call fcn.0044b4e8
or edi, 0x80
mov dword [ebp - 0x39c], edi
lea eax, [ebp - 0x1ac]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x224]
call fcn.0044b462
push eax
lea ecx, [ebp - 0x1dc]
call fcn.0044b4e8
or edi, 0x100
mov dword [ebp - 0x39c], edi
push str.maps
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 0x22
call fcn.0044b441
push eax
lea ecx, [ebp - 0x17c]
call fcn.0044b4e8
or edi, 0x200
mov dword [ebp - 0x39c], edi
mov byte [ebp - 4], 0x23
lea edx, [ebp - 0x17c]
cmp dword [ebp - 0x168], 0x10
push 2
cmovae edx, dword [ebp - 0x17c]
push 0
push esi
mov ecx, dword [0x486fbc]
call fcn.0042e156
add esp, 0xc
lea ecx, [ebp - 0x17c]
call fcn.0044b89e
lea ecx, [ebp - 0x1dc]
call fcn.0044b89e
lea ecx, [ebp - 0x224]
call fcn.0044b89e
lea ecx, [ebp - 0x1f4]
call fcn.0044b89e
lea ecx, [ebp - 0x23c]
call fcn.0044b89e
lea ecx, [ebp - 0x194]
call fcn.0044b89e
lea ecx, [ebp - 0x20c]
call fcn.0044b89e
lea ecx, [ebp - 0x140]
call fcn.0044b89e
lea ecx, [ebp - 0x1ac]
call fcn.0044b89e
jmp 0x444868
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 4], 0xc
call fcn.0043e1d8
mov esi, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x3c8]
mov edx, dword [ebp - 0x394]
jmp 0x4443b7
test esi, esi
je 0x44489c
mov ecx, esi
call fcn.0042a587
mov ecx, dword [ebp - 0x3d4]
test ecx, ecx
je 0x4448bf
call fcn.0042a587
jmp 0x4448bf
inc dword [ebp - 0x3a4]
mov dword [ebp - 4], 5
mov al, byte [0x486f8d]
movzx ecx, al
test al, al
push 1
pop eax
cmove ecx, eax
mov byte [0x486f8d], cl
cmp dword [ebp - 0x1b0], 0x10
lea eax, [ebp - 0x1c4]
cmovae eax, dword [ebp - 0x1c4]
xor ecx, ecx
mov dword [ebp - 0x1b4], ecx
mov byte [ebp - 4], cl
mov byte [eax], cl
lea ecx, [ebp - 0x1c4]
call fcn.0044b89e
lea eax, [ebp - 0x390]
push eax
push dword [ebp - 0x3a8]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4440c9
mov eax, dword [ebp - 0x3b4]
lea ecx, [ebp - 0x3b4]
mov dword [ebp - 0x3b0], eax
call fcn.0044b6b3
mov ecx, dword [ebp - 0x1c]
call fcn.0046c5ea
ret