Function at 0x43b665
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x298
mov edx, dword [esp + 0x2b8]
mov dword [esp + 0x7f], 0xe48040
mov dword [esp + 0x7c], 0x4010ec83
mov dword [esp + 0x78], 0x48e78948
mov dword [esp + 0x74], 0xce8948fc
lea edi, [esp + 0x98]
lea eax, [esp + 0x74]
mov ecx, 3
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xa4]
lea eax, [esp + 0x80]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x82]
mov byte [esp + 0xa6], al
mov ebp, edx
cmp edx, 4
jb 0x43b638
mov ebp, 4
lea esi, [esp + 0xa7]
test edx, edx
je 0x43ba82
xor eax, eax
mov dword [esp], ebp
jmp 0x43b659
inc eax
cmp eax, ebp
je 0x43b867
cmp eax, 3
ja case.default.0x43b65e
jmp dword [eax*4 + 0x4406c8]
mov dword [esp + 0xc], 0x231c9ad8
lea ecx, [esp + 0x10]
mov byte [ecx + 2], 0
mov word [ecx], 0
xor ecx, ecx
nop
nop
nop
nop
movzx edi, byte [esp + ecx + 0xc]
lea ebx, [ecx + 0xf8]
mov ebp, ecx
xor ebp, 7
xor ebx, ebp
and ebx, edi
xor ebx, ebp
mov dl, 0x27
sub dl, bl
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 7
jne 0x43b680
lea ebx, [esp + 0xc]
mov edx, ebx
mov edi, esi
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
mov ecx, 1
mov edi, esi
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0xe]
mov byte [esi + 2], cl
add esi, 3
mov ebp, dword [esp]
jmp case.default.0x43b65e
mov dword [esp + 0xc], 0x19509e58
mov byte [esp + 0x10], 8
lea ecx, [esp + 0x10]
mov byte [ecx + 5], 0
mov dword [ecx + 1], 0
mov ecx, 3
mov edi, 0xfc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 9]
mov ebx, edi
xor ebx, ecx
and ebx, edx
xor ebx, ecx
add bl, 0xf1
mov byte [esp + ecx + 9], bl
inc ecx
dec edi
cmp ecx, 0xd
jne 0x43b710
lea edx, [esp + 0xc]
mov ecx, 1
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add esi, 4
lea edx, [esp + 0x10]
xor ecx, ecx
mov edi, esi
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp case.default.0x43b65e
mov dword [esp + 0xc], 0xc1084e08
mov byte [esp + 0x10], 0xf8
mov dword [esp + 0x11], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xab
xor dl, byte [esp + ecx + 0xc]
add dl, 0xa9
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 9
jne 0x43b780
lea edx, [esp + 0xc]
mov ecx, 1
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add esi, 4
lea edx, [esp + 0x10]
mov edi, esi
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp case.default.0x43b65e
mov dword [esp + 4], esi
mov dword [esp + 0xc], 0x8150067c
mov byte [esp + 0x10], 0xb8
lea ecx, [esp + 0x10]
mov byte [ecx + 5], 0
mov dword [ecx + 1], 0
mov esi, 0xdf
mov ebp, 0x6a808f20
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0xd3]
mov edx, ebp
or edx, ebx
mov edi, ebp
xor edi, ebx
add edi, ebx
sub edi, edx
lea edx, [ebp - 0x6a808f00]
and edx, 0x21
mov ecx, esi
and ecx, 0xde
or ecx, edx
xor ecx, 0xde
not ebx
and ebx, ecx
or ebx, edi
mov cl, 0xa4
sub cl, bl
mov byte [esp + esi - 0xd3], cl
inc esi
dec ebp
cmp esi, 0xe9
jne 0x43b7f0
lea edx, [esp + 0xc]
mov ecx, 1
mov esi, dword [esp + 4]
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add esi, 4
lea edx, [esp + 0x10]
mov edi, esi
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov ebp, dword [esp]
jmp case.default.0x43b65e
mov eax, dword [esp + 0x2b8]
cmp eax, 3
jbe 0x43ba82
test al, 1
je 0x43b8a5
mov eax, 0x440be2
mov edx, 0x440be2
mov edi, esi
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, 1
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x2b8]
add esi, 2
mov ecx, esi
mov edx, eax
lea eax, [eax*8]
mov esi, 0xffffffff
mov edi, 0xffffffff
cmp eax, 0x7ffffffe
ja 0x43bf81
dec edx
cmp edx, 4
jb 0x43ba80
mov eax, edx
mov esi, ecx
jmp 0x43b8ed
mov eax, dword [esp]
dec eax
cmp eax, 3
jbe 0x43ba82
mov ebp, esi
lea ecx, [eax*8]
mov dword [esp + 4], ecx
cmp ecx, 0x7e
mov dword [esp], eax
ja 0x43b9c0
mov dword [esp + 0xc], 0x176cae60
mov word [esp + 0x10], 0x3564
lea eax, [esp + 0x14]
mov byte [eax + 2], 0
mov dword [eax - 2], 0
mov ecx, 0xf16333b6
mov esi, 0xe9ccc49
nop
nop
movzx eax, byte [esp + ecx + 0xe9ccc56]
mov edi, ecx
and edi, eax
add edi, edi
sub edi, eax
add edi, esi
and edi, ecx
mov edx, edi
and edx, 0xf16333fd
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
xor ebx, 2
imul ebx, edx
add edi, ebx
lea edx, [esi - 0xe9ccc00]
and edx, edi
mov ebx, edi
not ebx
and ebx, ecx
sub ebx, edx
add bl, al
add bl, 0x72
mov byte [esp + ecx + 0xe9ccc56], bl
inc ecx
dec esi
cmp ecx, 0xf16333c1
jne 0x43b930
lea eax, [esp + 0xc]
mov esi, ebp
mov edi, ebp
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebp + 4]
lea eax, [esp + 0x10]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x10]
mov byte [ebp + 4], al
mov eax, dword [esp + 4]
mov byte [ebp + 3], al
add esi, 5
jmp 0x43b8e0
mov dword [esp + 0xc], 0xa9a0a66c
mov dword [esp + 0x10], 0x7d2e2f28
mov byte [esp + 0x14], 0x2c
lea eax, [esp + 0x14]
mov byte [eax + 5], 0
mov dword [eax + 1], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0xc]
lea edi, [ecx - 0x21971179]
mov esi, pe_nt_image_headers32
sub esi, ecx
and esi, 0x54
lea ebx, [eax + eax]
not ebx
add ebx, eax
and ebx, edi
and edi, 0xb
or edi, esi
xor edi, 0x2b
and edi, eax
or ebx, edi
add bl, 0x5d
mov byte [esp + ecx + 0xc], bl
mov eax, ecx
not eax
or eax, 1
add eax, ecx
inc eax
mov edx, eax
and edx, 0xfffffffd
mov esi, eax
and esi, 2
or eax, 2
imul eax, esi
xor esi, 2
imul esi, edx
lea edx, [ecx + ecx]
and edx, 2
neg edx
add ecx, edx
inc ecx
add ecx, eax
add ecx, esi
cmp ecx, 0xe
jb 0x43b9f0
lea eax, [esp + 0xc]
mov edi, ebp
mov ecx, 2
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea esi, [ebp + 8]
lea eax, [esp + 0x14]
xor ecx, ecx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 4]
mov dword [ebp + 3], eax
jmp 0x43b8e0
mov esi, ecx
mov dword [esp + 0xc], 0x21f28a4c
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov eax, 0xbcbffa01
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x4340060b]
xor ecx, eax
mov edx, ecx
xor edx, 0xafbfe206
and ecx, 0x100018f9
add ecx, ecx
sub ecx, edx
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x4340060b], cl
inc eax
cmp eax, 0xbcbffa0c
jne 0x43bab0
lea eax, [esp + 0xc]
mov edx, eax
mov edi, esi
mov ecx, 1
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea ebp, [esi + 4]
mov edi, ebp
xor ecx, ecx
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov dword [esp + 0x93], 0xc3fc8948
mov dword [esp + 0x90], 0x48d2ff41
mov dword [esp + 0x84], 0xba49c031
mov ecx, dword [esp + 0x2ac]
mov dword [esp + 0x88], ecx
mov ecx, dword [esp + 0x2b0]
mov dword [esp + 0x8c], ecx
lea edx, [esp + 0x84]
mov edi, ebp
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esi + 0x14]
lea edx, [esp + 0x94]
mov ecx, 1
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x96]
mov byte [esi + 0x16], cl
lea edx, [esp + 0x98]
mov ecx, edx
neg ecx
add ecx, esi
add ecx, 0x17
mov dword [esp], ecx
sub esi, edx
mov dword [esp + 8], 0
add esi, 0x71
mov dword [esp + 0x70], esi
mov dword [esp + 0xc], 0xf4f5fafb
mov dword [esp + 0x10], 0
mov ecx, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [eax]
lea edx, [ecx - 0xe2ca200]
or edx, esi
and esi, ecx
not edx
or edx, esi
mov ebx, edx
and ebx, 0x51
add ebx, ebx
xor edx, 0x2e
sub ebx, edx
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0x21
jne 0x43bbc0
mov esi, dword [esp + 0xc]
mov eax, dword [0x44a598]
test eax, eax
je 0x43bc40
xor ecx, ecx
mov edx, dword [0x44a59c]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x3e416e49
je 0x43bc10
inc ecx
cmp eax, ecx
jne 0x43bc00
jmp 0x43bc40
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x43bc40
lea ecx, [esp + 0x70]
lea edx, [esp + 8]
push 0x40
push 0x3000
push ecx
push 0
push edx
push 0xffffffffffffffff
push 0x18
push eax
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x24
mov esi, eax
test esi, esi
js 0x43bf50
mov dword [esp + 0xc], 0x53c1a45f
mov dword [esp + 0x10], 0x25b5a251
mov dword [esp + 0x14], 0xb95e20a1
mov dword [esp + 0x18], 0x55565750
mov dword [esp + 0x1c], 0x779ade2c
mov dword [esp + 0x20], 0xd256b3dd
mov dword [esp + 0x24], 0x45048aba
mov dword [esp + 0x28], 0x45464715
mov dword [esp + 0x2c], 0x7ba24dcb
mov dword [esp + 0x30], 0x274e4f48
mov dword [esp + 0x34], 0x86c08cc0
mov dword [esp + 0x38], 0x1442b3f5
mov dword [esp + 0x3c], 0x71bc1816
mov dword [esp + 0x40], 0x5922f278
mov dword [esp + 0x44], 0x362a4d7d
mov dword [esp + 0x48], 0x9f671ea0
mov dword [esp + 0x4c], 0x2da31b05
mov dword [esp + 0x50], 0x6d4b6b4c
mov dword [esp + 0x54], 0xcd1d936c
mov dword [esp + 0x58], 0x5319dfb4
mov dword [esp + 0x5c], 0x5ed25bb3
mov dword [esp + 0x60], 0xb19fbf76
lea edx, [esp + 0x64]
mov word [esp + 0x64], 0x83b8
mov byte [esp + 0x68], 0
mov word [esp + 0x66], 0
mov eax, 0x37
mov ecx, 0x5d216fc8
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2b]
lea esi, [eax - 0x5d217000]
mov ebx, ecx
and ebx, 0x4100294a
mov ebp, esi
and ebp, 0xa20000b5
or ebp, ebx
xor ebp, edi
xor ebp, 0x4a
mov ebx, eax
and ebx, edi
or ebx, ebp
and esi, edi
sub ebx, esi
add bl, 0xed
mov byte [esp + eax - 0x2b], bl
inc eax
dec ecx
cmp eax, 0x94
jne 0x43bd20
mov eax, dword [esp + 8]
lea ebp, [esp + 0xc]
mov esi, ebp
mov ecx, 0x16
mov edi, eax
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [eax + 0x58]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x64]
mov byte [eax + 0x58], cl
mov eax, dword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0xf10e0fb7
mov byte [esp + 0x10], 0
mov ecx, 0x472b3a7d
mov edx, 0x82
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x472b3a71]
mov esi, ecx
or esi, ebx
not ebx
or ebx, edx
and ebx, esi
mov esi, ebx
and esi, 0x8c
mov eax, ebx
and eax, 2
mov edi, eax
xor edi, 2
imul edi, esi
or esi, 2
imul esi, eax
xor ebx, 0x8e
add ebx, edi
add ebx, esi
inc bl
mov byte [esp + ecx - 0x472b3a71], bl
inc ecx
dec edx
cmp ecx, 0x472b3a82
jne 0x43bdb0
mov esi, dword [esp + 4]
add esi, dword [esp + 0xc]
mov ebx, dword [esp]
mov ecx, ebx
shr ecx, 2
lea eax, [esp + 0x98]
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, ebx
and eax, 0xfffffffc
add esi, eax
lea edx, [esp + eax]
add edx, 0x98
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
test bl, 1
je 0x43be46
and ebx, 2
movzx eax, byte [edx + ebx]
mov byte [esi + ebx], al
mov eax, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 0xc], 0x313e3f57
mov word [esp + 0x10], 0
xor ecx, ecx
nop
nop
movzx esi, byte [esp + ecx + 0xc]
lea edx, [ecx + esi]
mov edi, 0x1478e0ca
sub edi, ecx
or edi, esi
add edi, ecx
add edi, 0xeb871f36
mov eax, edi
and eax, 2
mov ebx, edi
or ebx, 0xfffffffd
inc ebx
mov esi, edi
and esi, 0xfffffffd
imul esi, ebx
or edi, 2
imul edi, eax
sub esi, edi
lea eax, [esi + edx]
add eax, 0xeb871f35
mov edx, eax
and edx, 0x76
xor eax, 0xf6
lea eax, [eax + edx*2]
inc al
mov byte [esp + ecx + 0xc], al
mov eax, ecx
and eax, 1
xor ecx, 1
lea ecx, [ecx + eax*2]
cmp ecx, 6
jb 0x43be60
mov eax, dword [esp + 0xc]
mov ecx, dword [esp]
add eax, ecx
push dword [esp + 0x2b4]
push eax
call ecx
mov esi, eax
mov edi, edx
mov dword [esp + 0x6c], 0
mov dword [esp + 0xc], 0xf4f5fafb
mov dword [esp + 0x10], 0
mov eax, 0x29
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebp]
lea ecx, [eax - 0xe2ca200]
or ecx, edx
and edx, eax
not ecx
or ecx, edx
mov edx, ecx
and edx, 0x51
add edx, edx
xor ecx, 0x2e
sub edx, ecx
mov byte [ebp], dl
inc ebp
dec eax
cmp eax, 0x21
jne 0x43bf00
mov eax, dword [0x44a598]
test eax, eax
je 0x43bf81
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ebx, dword [0x44a59c]
nop
nop
nop
cmp dword [ebx + edx*8], 0x16194952
je 0x43bf57
inc edx
cmp eax, edx
jne 0x43bf40
jmp 0x43bf81
mov edi, esi
sar edi, 0x1f
jmp 0x43bf81
mov eax, dword [ebx + edx*8 + 4]
cmp eax, ecx
je 0x43bf81
lea ecx, [esp + 0x6c]
lea edx, [esp + 8]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
push 0x10
push eax
push dword [0x44a5a0]
call fcn.004391b0
add esp, 0x1c
mov eax, esi
mov edx, edi
add esp, 0x298
pop esi
pop edi
pop ebx
pop ebp
ret 0x10