Function at 0x43367f8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
call fcn.43304d8c
xor eax, eax
push ebp
push 0x433682a9
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetActiveWindow
push edi
xor edi, 0x83
add edi, 0x11
push edi
pop edi
sub edi, 1
xchg edi, edi
or edi, 0xf6
nop
nop
pop edi
mov dl, 1
mov eax, dword [0x43312c10]
call fcn.43303a94
mov dword [ebp - 0x10], eax
push 1
call sub.user32.dll_IsIconic
push edx
push ecx
sub edx, 0xba
or edx, 0x98
mov edx, 0x171
nop
nop
sub ecx, 0x14e
add edx, 0x6a
pop ecx
pop edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 4]
call sub.user32.dll_GetActiveWindow
push edi
xor edi, 0x83
add edi, 0x11
push edi
pop edi
sub edi, 1
xchg edi, edi
or edi, 0xf6
nop
nop
pop edi
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.4331687c
call sub.user32.dll_GetActiveWindow
push edi
xor edi, 0x83
add edi, 0x11
push edi
pop edi
sub edi, 1
xchg edi, edi
or edi, 0xf6
nop
nop
pop edi
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.4331687c
push 1
call sub.user32.dll_GetDlgCtrlID
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4335f608]
call fcn.4335f994
mov dword [ebp - 0x18], eax
push 1
call sub.user32.dll_IsIconic
push edx
push ecx
sub edx, 0xba
or edx, 0x98
mov edx, 0x171
nop
nop
sub ecx, 0x14e
add edx, 0x6a
pop ecx
pop edx
xor eax, eax
push ebp
push 0x43368205
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_GetWindowTextLengthA
lea edx, [ebp - 0x42c]
mov ecx, 0x400
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x43368185
push 0x433682bc
call sub.kernel32.dll_AddAtomA
push ecx
inc ecx
or ecx, 0x156
inc ecx
inc ecx
xor ecx, 0xee
and ecx, 0x71
push ecx
pop ecx
sub ecx, 0x54
nop
nop
nop
pop ecx
lea edx, [ebp - 0x42c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.43316ac0
push 1
call sub.user32.dll_GetWindowTextLengthA
push eax
xor eax, 0x93
dec eax
mov eax, 0x2a
pop eax
lea edx, [ebp - 0x42c]
mov ecx, 0x400
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
push 1
call sub.user32.dll_GetWindowTextLengthA
call sub.user32.dll_GetKBCodePage
push edx
push esi
nop
nop
sub esi, 0x176
xor esi, 0x4d
xchg esi, esi
push edx
pop edx
sub esi, 0x160
sub esi, 0xbd
and esi, 0x89
pop esi
pop edx
cmp dword [ebp - 0x1c], 0
jg 0x433680e9
call sub.kernel32.dll_GetCurrentThreadId_1
push edi
push eax
mov eax, 0x55
or edi, 0x1c
mov eax, 0xcd
or eax, 0x12f
inc eax
nop
nop
nop
nop
dec edi
pop eax
pop edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4336820c
call sub.user32.dll_GetActiveWindow
push edi
xor edi, 0x83
add edi, 0x11
push edi
pop edi
sub edi, 1
xchg edi, edi
or edi, 0xf6
nop
nop
pop edi
mov eax, dword [ebp - 0x18]
call fcn.43303ac4
call sub.user32.dll_GetKBCodePage
push edx
push esi
nop
nop
sub esi, 0x176
xor esi, 0x4d
xchg esi, esi
push edx
pop edx
sub esi, 0x160
sub esi, 0xbd
and esi, 0x89
pop esi
pop edx
ret