Function at 0x4433ad
Capabilities:
Encode data using xor

Disassembly:
push 0x3d0
mov eax, 0x463a5d
call fcn.00460852
and dword [ebp - 0x38c], 0
push 0
push 2
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x3b4], 0x104
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x380], 0x128
test eax, eax
je 0x4440d2
mov al, 0x35
mov dword [ebp - 0x128], 0x50595061
movsx ecx, al
mov byte [ebp - 0x150], al
mov dword [ebp - 0x124], 0x58544752
mov dword [ebp - 0x120], 0x504d501b
mov byte [ebp - 0x11c], 0
call fcn.0043cd89
push 8
mov dword [ebp - 0x384], eax
xor edx, edx
pop edi
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x14c], eax
inc edx
pop ecx
cmp edx, edi
jl 0x443439
push 0xc
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0043d0e5
movsx ecx, byte [ebp - 0x150]
mov dword [ebp - 0x12c], eax
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x14c], eax
inc edx
pop ecx
cmp edx, edi
jl 0x443481
push dword [0x4769d8]
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x12c]
call fcn.0043d15b
test eax, eax
je 0x4434cb
mov dl, byte [ebp - 0x150]
xor ecx, ecx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 0xc
jb 0x4434be
mov byte [eax + 0xc], 0
movaps xmm0, xmmword [0x470580]
mov dword [ebp - 0x258], eax
push 8
pop eax
movsx ecx, al
mov byte [ebp - 0x154], al
movups xmmword [ebp - 0x12c], xmm0
mov byte [ebp - 0x11c], 0
call fcn.0043cd89
push 8
mov dword [ebp - 0x384], eax
xor edx, edx
pop edi
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x150], eax
inc edx
pop ecx
cmp edx, edi
jl 0x443502
push 0x10
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0043d0e5
movsx ecx, byte [ebp - 0x154]
mov dword [ebp - 0x130], eax
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x150], eax
inc edx
pop ecx
cmp edx, edi
jl 0x44354a
push dword [0x4769d8]
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x130]
call fcn.0043d15b
mov ecx, eax
test ecx, ecx
je 0x4435a7
movsx eax, byte [ebp - 0x154]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
movups xmm0, xmmword [ecx]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
mov byte [ecx + 0x10], 0
mov al, 0x60
mov dword [ebp - 0x254], ecx
movsx ecx, al
mov byte [ebp - 0x14c], al
mov dword [ebp - 0x124], 0x50c0534
mov dword [ebp - 0x120], 0xd011207
mov word [ebp - 0x11c], 0x3b3c
mov byte [ebp - 0x11a], 0
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x148], eax
inc edx
pop ecx
cmp edx, edi
jl 0x4435e9
push 0xa
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0043d0e5
movsx ecx, byte [ebp - 0x14c]
mov dword [ebp - 0x128], eax
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x148], eax
inc edx
pop ecx
cmp edx, edi
jl 0x443631
push dword [0x4769d8]
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x128]
call fcn.0043d15b
test eax, eax
je 0x44367b
mov dl, byte [ebp - 0x14c]
xor ecx, ecx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 0xa
jb 0x44366e
mov byte [eax + 0xa], 0
movaps xmm0, xmmword [0x4706e0]
mov dword [ebp - 0x250], eax
mov al, 0x2c
movsx ecx, al
mov byte [ebp - 0x154], al
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x11c], 0x706f14
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x150], eax
inc edx
pop ecx
cmp edx, edi
jl 0x4436b1
push 0x13
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0043d0e5
movsx ecx, byte [ebp - 0x154]
mov dword [ebp - 0x130], eax
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x150], eax
inc edx
pop ecx
cmp edx, edi
jl 0x4436f9
push dword [0x4769d8]
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x130]
call fcn.0043d15b
test eax, eax
je 0x443743
mov dl, byte [ebp - 0x154]
xor ecx, ecx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 0x13
jb 0x443736
mov byte [eax + 0x13], 0
mov dword [ebp - 0x24c], eax
mov al, 0x5c
movsx ecx, al
mov byte [ebp - 0x14c], al
mov dword [ebp - 0x124], 0x3253937
mov dword [ebp - 0x120], 0x3d283d38
mov word [ebp - 0x11c], 0x2f
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x148], eax
inc edx
pop ecx
cmp edx, edi
jl 0x44377e
push 9
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0043d0e5
movsx ecx, byte [ebp - 0x14c]
mov dword [ebp - 0x128], eax
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x148], eax
inc edx
pop ecx
cmp edx, edi
jl 0x4437c6
push dword [0x4769d8]
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x128]
call fcn.0043d15b
test eax, eax
je 0x443810
mov dl, byte [ebp - 0x14c]
xor ecx, ecx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 9
jb 0x443803
mov byte [eax + 9], 0
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x248], eax
push ecx
lea eax, [ebp - 0x244]
push eax
push ecx
lea ecx, [ebp - 0x39c]
call fcn.0044a960
and dword [ebp - 4], 0
and dword [ebp - 0x184], 0
lea ecx, [ebp - 0x35c]
and dword [ebp - 0x174], 0
lea edx, [ecx + 1]
and dword [ebp - 0x170], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x443852
sub ecx, edx
lea eax, [ebp - 0x35c]
push ecx
push eax
lea ecx, [ebp - 0x184]
call fcn.0044b919
mov eax, dword [ebp - 0x39c]
push ecx
lea ecx, [ebp - 0x184]
push dword [eax]
call fcn.0044ac9b
lea ecx, [ebp - 0x184]
mov esi, eax
call fcn.0044adca
cmp esi, 0xffffffff
je 0x444093
push dword [ebp - 0x378]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x444093
lea ecx, [ebp - 0x3b4]
push ecx
lea ecx, [ebp - 0x118]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x444093
mov cl, 0x75
mov byte [ebp - 0x120], 0x29
xor eax, eax
mov byte [ebp - 0x148], cl
inc eax
movsx ecx, cl
mov byte [ebp - 0x11f], al
mov word [ebp - 0x11e], 0x1411
mov byte [ebp - 0x11c], al
mov word [ebp - 0x11b], 0x2914
mov byte [ebp - 0x119], 0
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x144], eax
inc edx
pop ecx
cmp edx, edi
jl 0x443919
push 7
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0043d0e5
movsx ecx, byte [ebp - 0x148]
mov dword [ebp - 0x124], eax
call fcn.0043cd89
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043cdc8
mov dword [ebp + edx*4 - 0x144], eax
inc edx
pop ecx
cmp edx, edi
jl 0x443961
push dword [0x4769d8]
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x124]
call fcn.0043d15b
mov esi, eax
test esi, esi
je 0x4439ad
mov cl, byte [ebp - 0x148]
xor eax, eax
xor byte [esi + eax], cl
inc eax
cmp eax, 7
jb 0x4439a0
mov byte [esi + 7], 0
and dword [ebp - 0x16c], 0
lea ecx, [ebp - 0x118]
and dword [ebp - 0x15c], 0
lea edx, [ecx + 1]
and dword [ebp - 0x158], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4439cb
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x16c]
call fcn.0044b919
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4439f4
sub ecx, edx
lea eax, [ecx - 0xd]
push eax
push 0
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x16c]
call fcn.0044ac14
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x184]
call fcn.0044b2bc
pop ecx
lea ecx, [ebp - 0x1b4]
call fcn.0044adca
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x158]
cmp edx, 0x10
jb 0x443a4e
mov ecx, dword [ebp - 0x16c]
inc edx
call fcn.0044bc25
mov byte [ebp - 0x3b8], 0
lea edx, [ebp - 0x184]
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0x19c]
call fcn.0044c208
pop ecx
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.0043e398
lea ecx, [ebp - 0x19c]
mov byte [ebp - 0x385], al
call fcn.0044af6c
cmp byte [ebp - 0x385], 0
je 0x444067
mov byte [ebp - 0x3bc], 0
lea edx, [ebp - 0x184]
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 7
call fcn.0044c208
pop ecx
push ecx
lea eax, [ebp - 0x19c]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x3c8]
call fcn.0043e03b
lea ecx, [ebp - 0x19c]
call fcn.0044af6c
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.004400d4
mov edi, dword [ebp - 0x3a8]
mov esi, dword [ebp - 0x3a4]
and dword [ebp - 0x3a8], 0
and dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3b0], edi
mov dword [ebp - 0x3ac], esi
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x3d8]
call fcn.004400d4
mov ecx, dword [ebp - 0x3d4]
xor eax, eax
xorps xmm0, xmm0
mov dword [ebp - 0x384], eax
movlpd qword [ebp - 0x3d0], xmm0
and dword [ebp - 0x3d0], 0
and dword [ebp - 0x3cc], eax
test ecx, ecx
je 0x443b5e
call fcn.0042a65e
mov eax, dword [ebp - 0x384]
cmp edi, eax
je 0x444027
lea eax, [ebp - 0x244]
mov byte [ebp - 4], 0xd
add edi, 0x20
push eax
mov ecx, edi
call fcn.0043d65c
push ecx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0xe
push ecx
mov ecx, eax
call fcn.0044b2f0
mov esi, dword [ebp - 0x38c]
or esi, 1
mov dword [ebp - 0x38c], esi
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 0x10
call fcn.0044af6c
mov eax, dword [ebp - 0x39c]
lea ecx, [ebp - 0x16c]
push dword [eax + 0x10]
call fcn.0044bde4
test al, al
jne 0x443bef
cmp dword [ebp - 0x15c], 0x11
jne 0x443fed
cmp dword [ebp - 0x158], 0x10
lea eax, [ebp - 0x16c]
cmovae eax, dword [ebp - 0x16c]
cmp byte [eax + 0x10], 0x73
jne 0x443fed
push ecx
lea eax, [ebp - 0x19c]
mov ecx, edi
push eax
call fcn.0044b2f0
or esi, 0x40
mov dword [ebp - 0x38c], esi
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x1fc]
cmp dword [ebp - 0x188], 0x10
lea esi, [ebp - 0x19c]
push eax
cmovae esi, dword [ebp - 0x19c]
mov ecx, edi
call fcn.0043d65c
push ecx
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.0044b2f0
mov edi, dword [ebp - 0x38c]
or edi, 8
mov dword [ebp - 0x38c], edi
mov edx, dword [ebp - 0x390]
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x13
call fcn.0042a68b
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x39c]
push eax
mov edx, dword [ecx + 8]
lea ecx, [ebp - 0x22c]
call fcn.0044b238
pop ecx
push 2
push 0x4700a8
mov ecx, eax
mov byte [ebp - 4], 0x15
call fcn.0044b10e
push eax
lea ecx, [ebp - 0x1e4]
call fcn.0044ae38
or edi, 0x400
mov dword [ebp - 0x38c], edi
lea eax, [ebp - 0x1b4]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1e4]
push eax
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x1cc]
call fcn.0044be22
or edi, 0x200
mov dword [ebp - 0x38c], edi
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0x1cc]
cmp dword [ebp - 0x1b8], 0x10
mov ecx, dword [0x476790]
cmovae edx, dword [ebp - 0x1cc]
push 2
push 0
push esi
call fcn.0042e104
add esp, 0xc
lea ecx, [ebp - 0x1cc]
call fcn.0044adca
lea ecx, [ebp - 0x1e4]
call fcn.0044adca
lea ecx, [ebp - 0x22c]
call fcn.0044adca
lea ecx, [ebp - 0x214]
call fcn.0044adca
lea ecx, [ebp - 0x1b4]
call fcn.0044adca
lea ecx, [ebp - 0x1fc]
call fcn.0044af6c
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 0x10
call fcn.0044adca
cmp dword [ebp - 0x15c], 0x11
jne 0x443fed
push 0x10
push 0
lea eax, [ebp - 0x1fc]
push eax
lea ecx, [ebp - 0x16c]
call fcn.0044ac14
push eax
lea ecx, [ebp - 0x16c]
call fcn.0044aded
lea ecx, [ebp - 0x1fc]
call fcn.0044adca
push 0x46ffa4
lea edx, [ebp - 0x184]
lea ecx, [ebp - 0x214]
call fcn.0044b26b
pop ecx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x1fc]
call fcn.0044b5be
pop ecx
push 5
push str.maps
mov ecx, eax
mov byte [ebp - 4], 0x19
call fcn.0044b10e
push eax
lea ecx, [ebp - 0x1e4]
call fcn.0044ae38
or edi, 0x2000
mov dword [ebp - 0x38c], edi
mov byte [ebp - 0x3c0], 0
lea edx, [ebp - 0x1e4]
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 0x1a
call fcn.0044c208
pop ecx
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 0x1b
call fcn.0043e398
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 0x385], al
call fcn.0044af6c
lea ecx, [ebp - 0x1e4]
call fcn.0044adca
lea ecx, [ebp - 0x1fc]
call fcn.0044adca
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x10
call fcn.0044adca
cmp byte [ebp - 0x385], 0
je 0x443fed
push 0x46ffa4
lea edx, [ebp - 0x184]
lea ecx, [ebp - 0x130]
call fcn.0044b26b
pop ecx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x1c
push ecx
mov edx, eax
lea ecx, [ebp - 0x1e4]
call fcn.0044b5be
pop ecx
push 5
push str.maps
mov ecx, eax
mov byte [ebp - 4], 0x1d
call fcn.0044b10e
push eax
lea ecx, [ebp - 0x1cc]
call fcn.0044ae38
or edi, 0x40000
mov dword [ebp - 0x38c], edi
mov edx, dword [ebp - 0x390]
lea esi, [ebp - 0x1cc]
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x22c]
cmp dword [ebp - 0x1b8], 0x10
cmovae esi, dword [ebp - 0x1cc]
call fcn.0042a68b
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x39c]
push eax
mov edx, dword [ecx + 8]
lea ecx, [ebp - 0x214]
call fcn.0044b238
pop ecx
push 2
push 0x4700a8
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.0044b10e
push eax
lea ecx, [ebp - 0x1b4]
call fcn.0044ae38
or edi, 0x80000
mov dword [ebp - 0x38c], edi
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 0x21
push eax
lea edx, [ebp - 0x1b4]
lea ecx, [ebp - 0x1fc]
call fcn.0044b5be
pop ecx
push 5
push str.maps
mov ecx, eax
mov byte [ebp - 4], 0x22
call fcn.0044b10e
push eax
lea ecx, [ebp - 0x19c]
call fcn.0044ae38
or edi, 0x100000
mov dword [ebp - 0x38c], edi
mov byte [ebp - 4], 0x23
lea edx, [ebp - 0x19c]
cmp dword [ebp - 0x188], 0x10
mov ecx, dword [0x476790]
cmovae edx, dword [ebp - 0x19c]
push 2
push 0
push esi
call fcn.0042e104
add esp, 0xc
lea ecx, [ebp - 0x19c]
call fcn.0044adca
lea ecx, [ebp - 0x1fc]
call fcn.0044adca
lea ecx, [ebp - 0x1b4]
call fcn.0044adca
lea ecx, [ebp - 0x214]
call fcn.0044adca
lea ecx, [ebp - 0x22c]
call fcn.0044adca
lea ecx, [ebp - 0x1cc]
call fcn.0044adca
lea ecx, [ebp - 0x1e4]
call fcn.0044adca
lea ecx, [ebp - 0x130]
call fcn.0044adca
lea ecx, [ebp - 0x16c]
call fcn.0044adca
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 4], 0xc
call fcn.0043e07e
mov esi, dword [ebp - 0x3ac]
mov edi, dword [ebp - 0x3b0]
mov eax, dword [ebp - 0x384]
jmp 0x443b5e
test esi, esi
je 0x444032
mov ecx, esi
call fcn.0042a65e
mov ecx, dword [ebp - 0x3c4]
test ecx, ecx
je 0x444041
call fcn.0042a65e
inc dword [ebp - 0x390]
mov dword [ebp - 4], 5
mov al, byte [0x476761]
push 1
movzx ecx, al
test al, al
pop eax
cmove ecx, eax
push 8
mov byte [0x476761], cl
pop edi
cmp dword [ebp - 0x170], 0x10
lea eax, [ebp - 0x184]
cmovae eax, dword [ebp - 0x184]
xor ecx, ecx
mov dword [ebp - 0x174], ecx
mov byte [ebp - 4], cl
mov byte [eax], cl
lea ecx, [ebp - 0x184]
call fcn.0044adca
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0x3a0]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x443834
mov eax, dword [ebp - 0x398]
lea ecx, [ebp - 0x39c]
cmp dword [ebp - 0x39c], eax
cmovne eax, dword [ebp - 0x39c]
mov dword [ebp - 0x398], eax
call fcn.0044a93e
call fcn.004607a4
ret