Function at 0x438d80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x254
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
push ebx
xor ecx, ecx
push ebp
mov eax, dword [eax*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov ebp, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
imul eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
sar eax, 6
mov dword [esp + 0x1c], eax
or eax, reloc.KERNEL32.dll_GetProcessHeap
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
push esi
cmp eax, ecx
push edi
mov word [esp + 0x18], cx
mov word [esp + 0x1a], cx
mov dword [esp + 0x50], 0x1000
mov dword [esp + 0x1c], ecx
je 0x438e18
mov ebx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov edi, 0x8000
mov esi, edi
push ebp
call dword [0x50bc74]
imul eax, ebx
mov ecx, esi
add esp, 4
imul ecx, esi
shl eax, 1
cmp ecx, eax
jbe 0x438e04
xor esi, edi
shr edi, 1
je 0x438e0c
or esi, edi
jmp 0x438dea
lea eax, [esi + 0x30]
shr eax, 6
mov dword [esp + 0x4c], eax
jmp 0x438e1c
mov dword [esp + 0x4c], ecx
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
test eax, eax
mov dword [esp + reloc.KERNEL32.dll_GetProcessHeap], 0x1000
jl 0x438e65
mov ecx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
lea ecx, [ecx + eax*2]
xor esi, esi
mov si, word [ecx]
cmp word [edx + esi*2], 0
jne 0x438e59
dec eax
sub ecx, 2
test eax, eax
jge 0x438e43
jmp 0x438e65
cmp eax, 3
mov dword [esp + reloc.KERNEL32.dll_GetProcessHeap], eax
jge 0x438e71
mov eax, 3
mov dword [esp + reloc.KERNEL32.dll_GetProcessHeap], eax
test eax, eax
mov dword [esp + 0x10], 0
jl 0x4395a7
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [edx + eax*2]
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
xor eax, eax
mov ax, word [edx + ecx*2]
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
imul eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
sar eax, 4
movsx ebx, word [edx + ecx*2]
lea edi, [eax - 1]
lea ebp, [eax + eax]
or edi, 1
lea eax, [edi + ebp]
mov dword [esp + 0x20], eax
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
movsx edx, word [eax + ecx*2]
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x3c], edx
test eax, eax
je 0x438f7a
movsx esi, word [ecx*2 + 0x47ef80]
mov eax, dword [esp + 0x4c]
and eax, 0xffff
imul esi, eax
movsx eax, bx
cdq
xor eax, edx
add esi, 0x20
sub eax, edx
sar esi, 7
shl eax, 4
cmp esi, 0x10000
jb 0x438f15
mov esi, 0xffff
cmp ax, si
ja 0x438f1e
xor eax, eax
jmp 0x438f20
sub eax, esi
xor edx, edx
and eax, 0xffff
mov dx, word [ecx*2 + 0x47f080]
add edx, eax
xor eax, eax
mov ax, word [ecx*2 + 0x47f000]
imul edx, eax
sar edx, 0x10
and edx, 0xffff
movsx eax, bx
mov esi, edx
imul esi, edx
mov edx, eax
imul esi, dword [esp + 0x24]
imul edx, eax
imul edx, dword [esp + 0x24]
sar esi, 4
mov eax, 0x66666667
lea edx, [esi + edx*4]
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x54], edx
jmp 0x438f88
mov eax, ebx
imul eax, ebx
imul eax, dword [esp + 0x24]
mov dword [esp + 0x54], eax
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 0x1c]
add esi, edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0xf0000000
lea esi, [edx + 1]
cmp esi, 3
jae 0x439161
mov eax, dword [esp + 0x10]
test ebx, ebx
lea ebp, [eax*4]
lea eax, [esp + ebp + 0x5e]
mov dword [esp + 0x3c], eax
jge 0x438fd2
mov edx, dword [esp + 0x20]
mov word [eax], 0xffff
add ebx, edx
jmp 0x438fdf
mov word [eax], 1
mov eax, dword [esp + 0x20]
sub eax, ebx
mov ebx, eax
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x439083
movsx esi, word [ecx*2 + 0x47ef80]
mov edx, dword [esp + 0x4c]
and edx, 0xffff
imul esi, edx
movsx edi, bx
mov eax, edi
add esi, 0x20
cdq
xor eax, edx
sub eax, edx
sar esi, 7
shl eax, 4
cmp esi, 0x10000
jb 0x439023
mov esi, 0xffff
cmp ax, si
ja 0x43902c
xor eax, eax
jmp 0x43902e
sub eax, esi
xor edx, edx
and eax, 0xffff
mov dx, word [ecx*2 + 0x47f080]
add edx, eax
xor eax, eax
mov ax, word [ecx*2 + 0x47f000]
imul edx, eax
sar edx, 0x10
and edx, 0xffff
mov eax, dword [esp + 0x24]
mov ecx, edx
imul ecx, edx
mov edx, edi
imul ecx, eax
imul edx, edi
imul edx, eax
sar ecx, 4
mov eax, 0x66666667
lea ecx, [ecx + edx*4]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ebx, edx
jmp 0x43908b
imul ebx, ebx
imul ebx, dword [esp + 0x24]
mov ecx, dword [0x47f680]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x34]
lea eax, [esp + ebp + 0x5c]
mov ebp, dword [esp + ebp + reloc.KERNEL32.dll_GetProcessHeap]
and ecx, 0xff
mov dword [esp + 0x44], eax
mov word [eax], 1
shl ecx, 0xb
mov eax, edx
add ebp, ecx
sub eax, esi
add ebp, ebx
test eax, eax
mov dword [esp + 0x28], ebp
jle 0x439140
sub edx, eax
mov ecx, 0x47f780
dec ecx
lea edx, reloc.KERNEL32.dll_GetProcessHeap
mov dword [esp + 0x14], edx
mov edx, 0x47f680
sub edx, ecx
lea edi, [ecx + eax]
dec edx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov esi, dword [ecx]
xor ecx, ecx
mov cl, byte [edx + edi]
xor edx, edx
mov dl, byte [edi]
add esi, ebx
shl ecx, 0xb
shl edx, 0xb
add ecx, esi
add edx, esi
cmp ecx, ebp
jae 0x439114
mov ebp, ecx
mov ecx, dword [esp + 0x44]
mov word [ecx], ax
cmp edx, dword [esp + 0x1c]
jae 0x43912b
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov word [esp + 0x18], ax
mov dword [esp + 0x40], edx
mov esi, dword [esp + 0x14]
dec eax
add esi, 4
dec edi
test eax, eax
mov dword [esp + 0x14], esi
jg 0x4390e8
mov dword [esp + 0x28], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x40]
cmp ecx, eax
jne 0x439518
mov ecx, dword [esp + 0x3c]
mov dx, word [ecx]
mov word [esp + 0x1a], dx
jmp 0x439518
lea eax, [edx + 0x19]
cmp eax, 0x33
jae 0x4394ba
cmp edx, 1
mov eax, edx
jle 0x4391ef
imul eax, ebp
sub eax, ebx
lea esi, [edx - 1]
add eax, edi
mov dword [esp + 0x20], esi
mov edi, eax
sub edi, ebp
cmp edx, 0x18
mov dword [esp + 0x2c], edi
jg 0x4391a1
mov edi, dword [edx*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x38], edi
mov edi, 0x47f180
jmp 0x4391aa
mov edi, 0x47f180
mov dword [esp + 0x38], edi
cmp esi, 0x18
jg 0x4391bc
mov ebx, dword [esi*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x48], ebx
jmp 0x4391c0
mov dword [esp + 0x48], edi
cmp edx, 6
jg 0x4391d2
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x30], edx
jmp 0x4391d6
mov dword [esp + 0x30], edi
cmp esi, 6
jg 0x43926b
mov edx, dword [esi*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], edx
jmp 0x43926f
imul eax, ebp
sub eax, ebx
mov dword [esp + 0x20], esi
sub eax, edi
cmp edx, 0xffffffe8
lea edi, [eax + ebp]
mov dword [esp + 0x2c], edi
jl 0x43921c
mov edi, edx
not edi
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x38], edi
mov edi, 0x47f180
jmp 0x439225
mov edi, 0x47f180
mov dword [esp + 0x38], edi
cmp esi, 0xffffffe8
jl 0x43923b
mov ebx, esi
not ebx
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x48], ebx
jmp 0x43923f
mov dword [esp + 0x48], edi
cmp edx, 0xfffffffa
jl 0x439253
not edx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x30], edx
jmp 0x439257
mov dword [esp + 0x30], edi
cmp esi, 0xfffffffa
jl 0x43926b
not esi
mov edx, dword [esi*4 + reloc.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], edx
jmp 0x43926f
mov dword [esp + 0x14], edi
mov edx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
test edx, edx
je 0x43939a
mov ebx, dword [esp + 0x4c]
movsx esi, word [ecx*2 + 0x47ef80]
and ebx, 0xffff
imul esi, ebx
movsx edi, ax
mov eax, edi
add esi, 0x20
cdq
xor eax, edx
sub eax, edx
sar esi, 7
shl eax, 4
cmp esi, 0x10000
jb 0x4392b3
mov esi, 0xffff
cmp ax, si
ja 0x4392bc
xor eax, eax
jmp 0x4392be
sub eax, esi
xor edx, edx
and eax, 0xffff
mov dx, word [ecx*2 + 0x47f080]
mov ebp, dword [esp + 0x24]
add edx, eax
xor eax, eax
mov ax, word [ecx*2 + 0x47f000]
imul edx, eax
sar edx, 0x10
and edx, 0xffff
mov eax, edx
imul eax, edx
mov edx, edi
imul eax, ebp
imul edx, edi
imul edx, ebp
sar eax, 4
movsx esi, word [ecx*2 + 0x47ef80]
lea edx, [eax + edx*4]
mov eax, 0x66666667
imul edx
imul esi, ebx
movsx edi, word [esp + 0x2c]
sar edx, 1
mov eax, edx
add esi, 0x20
shr eax, 0x1f
add edx, eax
mov eax, edi
mov dword [esp + 0x44], edx
cdq
xor eax, edx
sub eax, edx
sar esi, 7
shl eax, 4
cmp esi, 0x10000
jb 0x439340
mov esi, 0xffff
cmp ax, si
ja 0x439349
xor eax, eax
jmp 0x43934b
sub eax, esi
xor edx, edx
and eax, 0xffff
mov dx, word [ecx*2 + 0x47f080]
add edx, eax
xor eax, eax
mov ax, word [ecx*2 + 0x47f000]
imul edx, eax
sar edx, 0x10
and edx, 0xffff
mov eax, 0x66666667
mov ecx, edx
imul ecx, edx
mov edx, edi
imul ecx, ebp
imul edx, edi
imul edx, ebp
sar ecx, 4
lea ecx, [ecx + edx*4]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
jmp 0x4393b4
mov ecx, eax
mov edx, dword [esp + 0x2c]
imul ecx, eax
imul edx, edx
mov eax, dword [esp + 0x24]
imul ecx, eax
imul edx, eax
mov dword [esp + 0x44], ecx
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
sub edx, esi
mov esi, dword [esp + 0x10]
sub esi, ecx
mov ebx, edx
test esi, esi
mov dword [esp + 0x58], ebx
jle 0x439518
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x48]
mov edx, ebp
sub edx, esi
lea eax, [ecx - 1]
lea ecx, reloc.KERNEL32.dll_GetProcessHeap
lea edi, [eax + esi]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
sub ecx, eax
dec ecx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x30]
sub ecx, eax
dec ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x14]
sub ecx, eax
dec ecx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x38]
mov edx, dword [edx]
add edx, ecx
xor ecx, ecx
mov cl, byte [eax + edi]
xor eax, eax
mov al, byte [edi]
shl eax, 0xb
shl ecx, 0xb
add eax, edx
add ecx, edx
add eax, ebx
cmp eax, ecx
jae 0x439441
mov ecx, eax
mov eax, dword [esp + 0x20]
jmp 0x439445
mov eax, dword [esp + 0x3c]
cmp ecx, dword [esp + 0x28]
jae 0x439459
mov word [esp + ebp*4 + 0x5c], si
mov dword [esp + 0x28], ecx
mov word [esp + ebp*4 + 0x5e], ax
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x14]
xor eax, eax
mov al, byte [ecx + edi]
xor ecx, ecx
mov cl, byte [ebx + edi]
mov ebx, dword [esp + 0x58]
shl ecx, 0xb
shl eax, 0xb
add ecx, edx
add eax, edx
add ecx, ebx
cmp ecx, eax
jae 0x439487
mov eax, ecx
mov ecx, dword [esp + 0x20]
jmp 0x43948b
mov ecx, dword [esp + 0x3c]
cmp eax, dword [esp + 0x1c]
jae 0x4394a3
mov dword [esp + 0x1c], eax
mov word [esp + 0x18], si
mov word [esp + 0x1a], cx
mov dword [esp + 0x40], ebp
mov edx, dword [esp + 0x2c]
dec esi
add edx, 4
dec edi
test esi, esi
mov dword [esp + 0x2c], edx
jg 0x439410
jmp 0x439518
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x34]
mov ecx, edi
sub ecx, esi
test ecx, ecx
jle 0x439518
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, edi
sub eax, ecx
lea ebx, reloc.KERNEL32.dll_GetProcessHeap
mov eax, dword [ebx]
add eax, 0xf000
cmp eax, esi
jae 0x4394f4
mov word [esp + edi*4 + 0x5c], cx
mov esi, eax
mov word [esp + edi*4 + 0x5e], dx
cmp eax, ebp
jae 0x439508
mov ebp, eax
mov word [esp + 0x18], cx
mov word [esp + 0x1a], dx
mov dword [esp + 0x40], edi
dec ecx
add ebx, 4
test ecx, ecx
jg 0x4394dd
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], esi
mov edi, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x10]
lea ebx, [edi + ecx]
cmp eax, ebx
mov dword [esp + esi*4 + reloc.KERNEL32.dll_GetProcessHeap], eax
jae 0x439540
mov dword [esp + 0x50], eax
mov dword [esp + 0x34], esi
jmp 0x43958b
mov edx, dword [esp + 0x34]
add ecx, 0x800
mov ebp, dword [esp + edx*4 + reloc.KERNEL32.dll_GetProcessHeap]
lea eax, reloc.KERNEL32.dll_GetProcessHeap
cmp ebp, ecx
jbe 0x43956b
mov ebp, dword [eax + 4]
add eax, 4
inc edx
cmp ebp, ecx
ja 0x43955c
mov dword [esp + 0x34], edx
cmp edx, esi
jge 0x439587
mov ecx, esi
lea eax, reloc.KERNEL32.dll_GetProcessHeap
sub ecx, edx
mov edx, dword [eax]
add eax, 4
add edx, edi
dec ecx
mov dword [eax - 4], edx
jne 0x43957a
mov dword [esp + 0x50], ebx
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
inc esi
cmp esi, eax
mov dword [esp + 0x10], esi
jle 0x438e81
mov edx, dword [esp + 0x40]
test edx, edx
jge 0x4395b9
mov eax, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov ebx, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov ecx, 0x20
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + reloc.KERNEL32.dll_GetProcessHeap]
mov ax, word [esp + 0x1a]
xor ecx, ecx
mov cx, word [edi + edx*2]
mov word [ebx + ecx*2], ax
movsx ecx, word [esp + 0x18]
movsx eax, ax
sub edx, ecx
mov ecx, edx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
test ecx, ecx
jl 0x43961a
mov ax, word [esp + ecx*4 + 0x5e]
xor edx, edx
mov dx, word [edi + ecx*2]
mov word [ebx + edx*2], ax
movsx eax, ax
cdq
xor eax, edx
sub eax, edx
add esi, eax
movsx eax, word [esp + ecx*4 + 0x5c]
sub ecx, eax
jns 0x4395f8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret