Function at 0x4336f0
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
sub esp, 0x1cc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], bx
mov ebp, dword [esp + 0x1e4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x68]
mov dword [esp + 0x64], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1e0]
mov esi, 0x56b730
cmp eax, ebx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], esi
mov dword [ebp], ebx
je 0x433978
push 3
push bind
push eax
lea ecx, [esp + 0x1c]
call fcn.00412c80
test al, al
jne 0x43378b
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], esi
cmp eax, 0xffffffff
je 0x433978
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1cc
ret 8
lea eax, [esp + 0x24]
push 0x40
push eax
lea ecx, [esp + 0x18]
call fcn.00412cf0
cmp eax, 0x40
jne 0x43394b
cmp word [esp + 0x24], 0x5a4d
jne 0x43394b
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ecx
push edx
call edi
lea eax, [esp + 0x64]
push 0xf8
push eax
lea ecx, [esp + 0x18]
call fcn.00412cf0
cmp eax, 0xf8
jne 0x43390f
cmp dword [esp + 0x64], 0x4550
jne 0x43390f
mov eax, dword [esp + 0x6c]
cmp eax, ebx
mov esi, eax
je 0x43380f
cmp eax, dword [esp + 0x18]
ja 0x43380f
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push eax
push ecx
call edi
cmp eax, esi
je 0x433827
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x433928
jmp 0x43391e
lea edx, [esp + 0x1c]
push 8
push edx
lea ecx, [esp + 0x18]
call fcn.00412cf0
cmp eax, 8
jne 0x43380f
cmp dword [esp + 0x1c], 0x12d84cb
jne 0x43380f
lea eax, [esp + 0x15c]
push 0x80
push eax
lea ecx, [esp + 0x18]
call fcn.00412cf0
cmp eax, 0x80
jne 0x43380f
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004c2e90
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x43380f
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push edx
push esi
call fcn.00412cf0
mov edi, dword [esp + 0x20]
cmp eax, edi
je 0x43389b
push esi
call fcn.004c2eb0
add esp, 4
jmp 0x43380f
mov ecx, dword [esp + 0x14]
cmp ecx, 0xffffffff
je 0x4338b6
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
or ecx, 0xffffffff
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
cmp edi, ebx
mov dword [esp + 0x18], ebx
mov dword [ebp], edi
jbe 0x4338ec
mov cl, byte [eax + esi]
mov ebx, eax
and ebx, 0x7f
movsx edi, cl
mov bl, byte [esp + ebx + 0x15c]
add bl, dl
mov edx, edi
xor bl, cl
mov byte [eax + esi], bl
mov ecx, dword [ebp]
inc eax
cmp eax, ecx
jb 0x4338c5
mov ecx, dword [esp + 0x14]
cmp ecx, 0xffffffff
mov dword [esp + 0x10], 0x56b730
je 0x433900
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1cc
ret 8
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x433928
push eax
call esi
or eax, 0xffffffff
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 0x56b730
je 0x433978
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1cc
ret 8
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x433964
push eax
call esi
or eax, 0xffffffff
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 0x56b730
je 0x433978
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1cc
ret 8