Function at 0x43b35b
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x29c
mov edx, dword [esp + 0x2bc]
mov dword [esp + 0x83], 0xe48040
mov dword [esp + 0x80], 0x4010ec83
mov dword [esp + 0x7c], 0x48e78948
mov dword [esp + 0x78], 0xce8948fc
lea edi, [esp + 0x9c]
lea eax, [esp + 0x78]
mov ecx, 3
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xa8]
lea eax, [esp + 0x84]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x86]
mov byte [esp + 0xaa], al
mov eax, edx
cmp edx, 4
jb 0x43b31e
mov eax, 4
lea esi, [esp + 0xab]
test edx, edx
je 0x43b5fc
lea ebp, [esp + 0xc]
xor ecx, ecx
mov dword [esp + 0x68], eax
jmp 0x43b34c
mov ecx, dword [esp]
inc ecx
cmp ecx, eax
je 0x43b59e
cmp ecx, 3
ja case.default.0x43b354
mov dword [esp], ecx
jmp dword [ecx*4 + 0x4406c8]
mov dword [esp + 8], 0xb1800244
mov dword [esp + 0xc], 0
xor ecx, ecx
nop
nop
nop
movzx edi, byte [esp + ecx + 8]
lea ebx, [ecx - 0x2462ff23]
mov ebp, 0x2462ff22
sub ebp, ecx
and ebp, 0x24403d31
and ebx, 0x9101000e
or ebx, ebp
xor ebx, edi
mov edi, ebx
xor edi, 0x6edc3df1
mov ebp, ebx
xor ebp, 0x24cd39a0
and ebp, edi
xor ebx, 0xdb32c65f
lea edi, [ebx + ebp*2]
and ebx, 1
not edi
or edi, 1
sub ebx, edi
mov byte [esp + ecx + 8], bl
mov edi, ecx
and edi, 1
xor ecx, 1
lea ecx, [ecx + edi*2]
cmp ecx, 8
jb 0x43b370
lea ebp, [esp + 8]
mov ebx, ebp
mov edi, esi
xor ecx, ecx
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
mov ebx, ebp
mov edi, esi
mov ecx, 1
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
movzx ecx, byte [esp + 0xa]
mov byte [esi + 2], cl
add esi, 3
lea ebp, [esp + 0xc]
jmp 0x43b340
mov dword [esp + 8], 0x9c086b8
mov byte [esp + 0xc], pe_nt_image_headers32
mov byte [ebp + 3], 0
mov word [ebp + 1], 0
mov ecx, 0xcacae9bf
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x35351649]
xor ebx, ecx
mov edi, 0x15
sub edi, ebx
add ebx, 0x6a
and edi, 0xa6
and ebx, 0x59
sub ebx, edi
inc bl
mov byte [esp + ecx + 0x35351649], bl
inc ecx
cmp ecx, 0xcacae9c7
jne 0x43b420
lea ebx, [esp + 8]
mov edi, esi
mov ecx, 1
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
add esi, 4
lea ebx, [esp + 0xc]
mov edi, esi
xor ecx, ecx
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
jmp 0x43b340
mov dword [esp + 0x6c], esi
mov dword [esp + 8], 0xe7bc76b4
mov byte [esp + 0xc], 0xcc
mov byte [ebp + 5], 0
mov dword [ebp + 1], 0
mov ecx, 0xfe9001d2
mov edi, 0x7f4800d2
mov eax, 0x80b7ff2d
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x16ffe36]
mov edx, ecx
and edx, esi
mov ebp, eax
and ebp, 0x8000cf12
mov ebx, edi
and ebx, 0xc0800ad
or ebx, ebp
xor ebx, 0xf340cf52
or ebx, esi
xor ebx, edx
add ebx, 0xab3216af
mov edx, ebx
xor edx, 0xca
and ebx, 0x35
add ebx, ebx
sub ebx, edx
inc bl
mov byte [esp + ecx + 0x16ffe36], bl
inc ecx
inc edi
dec eax
cmp ecx, 0xfe9001dc
jne 0x43b4b0
lea eax, [esp + 8]
mov esi, dword [esp + 0x6c]
mov edi, esi
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add esi, 4
lea ebp, [esp + 0xc]
mov eax, ebp
mov edi, esi
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edx, dword [esp + 0x2bc]
mov eax, dword [esp + 0x68]
jmp 0x43b340
mov dword [esp + 8], 0x1bec9ad8
mov byte [esp + 0xc], 0x1c
mov word [ebp + 5], 0
mov dword [ebp + 1], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, ecx
add bl, 0xc4
xor bl, byte [esp + ecx + 8]
add bl, 0x2c
mov byte [esp + ecx + 8], bl
inc ecx
cmp ecx, 0xb
jne 0x43b560
lea ebx, [esp + 8]
mov edi, esi
mov ecx, 1
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
add esi, 4
lea ebx, [esp + 0xc]
mov edi, esi
xor ecx, ecx
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
jmp 0x43b340
cmp edx, 3
jbe 0x43b5fc
test dl, 1
je 0x43b5d2
mov eax, 0x440be2
mov edx, 0x440be2
mov edi, esi
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, dword [esp + 0x2bc]
mov edi, esi
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
add esi, 2
mov ecx, esi
lea eax, [edx*8]
mov esi, 0xffffffff
mov edi, 0xffffffff
cmp eax, 0x7ffffffe
ja 0x43bc11
dec edx
mov esi, ecx
cmp edx, 4
jae 0x43b79d
mov ebx, esi
mov dword [esp + 8], 0xc112bafc
lea ebp, [esp + 0xc]
mov byte [esp + 0xc], 0x20
mov dword [esp + 0xd], 0
mov ecx, 0x49
mov esi, 0xb6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x41]
mov edi, ecx
and edi, edx
lea eax, [edx + edx]
not eax
add eax, edx
and eax, esi
lea edx, [edi + edi]
not edx
add edx, edi
not eax
and eax, edx
add al, 0x93
mov byte [esp + ecx - 0x41], al
inc ecx
dec esi
cmp ecx, 0x52
jne 0x43b630
lea eax, [esp + 8]
mov edi, ebx
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea esi, [ebx + 4]
mov edi, esi
xor ecx, ecx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov dword [esp + 0x97], 0xc3fc8948
mov dword [esp + 0x94], 0x48d2ff41
mov dword [esp + 0x88], 0xba49c031
mov eax, dword [esp + 0x2b0]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x2b4]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x88]
mov edi, esi
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebx + 0x14]
lea eax, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x9a]
mov byte [ebx + 0x16], al
lea ecx, [esp + 0x9c]
mov eax, ecx
neg eax
lea ebp, [ebx + eax]
add ebp, 0x17
sub ebx, ecx
mov dword [esp + 4], 0
add ebx, 0x71
mov dword [esp + 0x74], ebx
mov dword [esp + 8], 0x101f1e1d
mov word [esp + 0xc], 0
mov eax, 0xb2cef8c5
mov ecx, 0x3a
movzx esi, byte [esp + eax + 0x4d310743]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add edx, 0x81f52426
mov ebx, edx
xor ebx, 0xfe
or edx, 1
and ebx, edx
add ebx, edx
mov byte [esp + eax + 0x4d310743], bl
inc eax
dec ecx
cmp eax, 0xb2cef8cb
jne 0x43b720
mov esi, dword [esp + 8]
mov eax, dword [0x44a8e4]
test eax, eax
je 0x43b915
xor ecx, ecx
mov edx, dword [0x44a8e8]
nop
nop
cmp dword [edx + ecx*8], 0x3e416e49
je 0x43b8e5
inc ecx
cmp eax, ecx
jne 0x43b770
jmp 0x43b915
mov edx, dword [esp]
dec edx
cmp edx, 3
jbe 0x43b5fc
lea eax, [edx*8]
mov ebp, eax
cmp eax, 0x7e
mov dword [esp], edx
ja 0x43b850
mov edi, esi
mov dword [esp + 8], 0x2f74b670
mov word [esp + 0xc], 0xcd7c
lea eax, [esp + 0x10]
mov word [eax + 2], 0
mov dword [eax - 2], 0
xor ecx, ecx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi + 8]
mov eax, ecx
and eax, 4
mov edx, esi
xor edx, eax
and eax, esi
xor edx, 0x36cbcb32
lea eax, [edx + eax*2]
mov edx, ebx
and edx, eax
add edx, edx
sub eax, edx
add al, bl
add al, 6
mov byte [esp + esi + 8], al
inc esi
add ecx, 2
cmp esi, 0xc
jne 0x43b7e0
lea eax, [esp + 8]
mov esi, edi
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esi + 4]
lea eax, [esp + 0xc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0xc]
mov byte [esi + 4], al
mov eax, ebp
mov byte [esi + 3], al
add esi, 5
jmp 0x43b790
mov dword [esp + 8], 0x176c6e20
mov dword [esp + 0xc], 0x23929594
mov byte [esp + 0x10], 0x90
lea eax, [esp + 0x10]
mov dword [eax + 4], 0
mov dword [eax + 1], 0
mov ecx, 0xa6
nop
nop
nop
nop
movzx eax, byte [esp + ecx - 0x9e]
lea ebx, [ecx - 0x71147600]
mov edx, ecx
and edx, eax
or ebx, eax
xor ebx, edx
add ebx, 0x35664ac1
mov eax, ebx
or eax, 1
or ebx, 0xfe
add ebx, eax
add bl, 2
mov byte [esp + ecx - 0x9e], bl
inc ecx
cmp ecx, 0xb6
jne 0x43b880
lea eax, [esp + 8]
mov edi, esi
mov ecx, 2
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, esi
add esi, 8
lea eax, [esp + 0x10]
xor ecx, ecx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [edx + 3], ebp
jmp 0x43b790
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x43b915
lea ecx, [esp + 0x74]
lea edx, [esp + 4]
push 0x40
push 0x3000
push ecx
push 0
push edx
push 0xffffffffffffffff
push 6
push eax
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x24
mov esi, eax
test esi, esi
js 0x43bbe0
mov dword [esp + 8], 0x6ddfb86d
mov dword [esp + 0xc], 0x3743b663
mov dword [esp + 0x10], 0xd32e6cb3
mov dword [esp + 0x14], 0x47464544
mov dword [esp + 0x18], 0x6982c218
mov dword [esp + 0x1c], 0xc646b9cf
mov dword [esp + 0x20], 0x470886aa
mov dword [esp + 0x24], 0x57565567
mov dword [esp + 0x28], 0x45ba53d9
mov dword [esp + 0x2c], 0x315e5d5c
mov dword [esp + 0x30], 0x8acc80cc
mov dword [esp + 0x34], 0x7aa9e7
mov dword [esp + 0x38], 0x6ba00406
mov dword [esp + 0x3c], 0x432ae66c
mov dword [esp + 0x40], 0x5a22436f
mov dword [esp + 0x44], 0xa9712ab4
mov dword [esp + 0x48], 0x3fbd2117
mov dword [esp + 0x4c], 0x7f5d7150
mov dword [esp + 0x50], 0x3ff37978
mov dword [esp + 0x54], 0x450fcda8
mov dword [esp + 0x58], 0x42ca41a1
mov dword [esp + 0x5c], 0xbb89ad66
lea esi, [esp + 0x60]
mov word [esp + 0x60], 0x89a4
mov byte [esp + 0x64], 0
mov word [esp + 0x62], 0
mov eax, 0x171c19b4
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x171c19ac]
xor ecx, eax
lea edx, [ecx + 0x7b]
mov edi, ecx
not edi
and edi, 1
and ecx, 1
and edx, 0xfe
or edx, ecx
lea ecx, [edx + edi*2]
mov byte [esp + eax - 0x171c19ac], cl
inc eax
cmp eax, 0x171c1a11
jne 0x43b9f0
mov eax, dword [esp + 4]
lea edx, [esp + 8]
mov ecx, 0x16
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [eax + 0x58]
xor edx, edx
xor ecx, ecx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
movzx ecx, byte [esp + 0x60]
mov byte [eax + 0x58], cl
mov eax, dword [esp + 4]
mov dword [esp + 8], 0x9f9e99c1
mov byte [esp + 0xc], 0
nop
nop
nop
movzx esi, byte [esp + edx + 8]
mov edi, 0xe5
sub edi, edx
and edi, esi
mov ecx, 0x186e3ee5
sub ecx, edx
or ecx, esi
not ecx
add ecx, edi
mov ebx, ecx
and ebx, 0x7d
add ebx, ebx
xor ecx, 0x82
sub ebx, ecx
mov byte [esp + edx + 8], bl
mov ecx, edx
and ecx, 1
xor edx, 1
lea edx, [edx + ecx*2]
cmp edx, 5
jb 0x43ba60
add eax, dword [esp + 8]
mov ebx, ebp
mov ecx, ebp
shr ecx, 2
lea edx, [esp + 0x9c]
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebp
and ecx, 0xfffffffc
add eax, ecx
lea edx, [esp + ecx]
add edx, 0x9c
mov ecx, ebp
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x43bae9
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [eax + ebx], cl
mov eax, dword [esp + 4]
mov dword [esp + 8], 0x2126278f
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov ecx, 0x88ff1709
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x7700e8ff]
xor esi, ecx
mov edx, esi
and edx, 0x52
mov edi, esi
xor edi, 0xd2
lea edx, [edi + edx*2]
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + ecx + 0x7700e8ff], dl
inc ecx
cmp ecx, 0x88ff1710
jne 0x43bb10
mov ecx, dword [esp + 8]
add ecx, eax
push dword [esp + 0x2b8]
push ecx
call eax
mov esi, eax
mov edi, edx
mov dword [esp + 0x70], 0
mov dword [esp + 8], 0x101f1e1d
mov word [esp + 0xc], 0
mov eax, 0xb2cef8c5
mov ecx, 0x3a
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x4d310743]
mov edx, ecx
xor edx, eax
and edx, ebx
xor edx, eax
add edx, 0x81f52426
mov ebx, edx
xor ebx, 0xfe
or edx, 1
and ebx, edx
add ebx, edx
mov byte [esp + eax + 0x4d310743], bl
inc eax
dec ecx
cmp eax, 0xb2cef8cb
jne 0x43bb80
mov eax, dword [0x44a8e4]
test eax, eax
je 0x43bc11
mov ecx, dword [esp + 8]
xor edx, edx
mov ebx, dword [0x44a8e8]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x16194952
je 0x43bbe7
inc edx
cmp eax, edx
jne 0x43bbd0
jmp 0x43bc11
mov edi, esi
sar edi, 0x1f
jmp 0x43bc11
mov eax, dword [ebx + edx*8 + 4]
cmp eax, ecx
je 0x43bc11
lea ecx, [esp + 0x70]
lea edx, [esp + 4]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
push 4
push eax
push dword [0x44a8ec]
call fcn.004390d0
add esp, 0x1c
mov eax, esi
mov edx, edi
add esp, 0x29c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10