Function at 0x43cf20
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x2c], 0x100000
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0x7c7d7a7b
mov byte [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 4
ja 0x43cfd9
nop
nop
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
movzx edx, byte [esp + ecx + 8]
mov ecx, eax
xor ecx, 0xd47f60ea
and eax, 0xd47f60ea
lea ecx, [ecx + eax*2]
lea eax, [ecx + edx]
and ecx, edx
mov edx, eax
not edx
and edx, ecx
mov esi, ecx
not esi
and eax, esi
sub eax, edx
mov edx, eax
not edx
and edx, ecx
and eax, esi
sub eax, edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
add al, 0x6e
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 8], al
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 5
jb 0x43cf80
mov eax, dword [esp + 8]
mov ecx, dword [0x44e4ac]
test ecx, ecx
je 0x43d02e
xor edx, edx
mov esi, dword [0x44e4b0]
nop
cmp dword [esi + edx*8], 0x633c81d
je 0x43d000
inc edx
cmp ecx, edx
jne 0x43cff0
jmp 0x43d02e
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43d02e
lea eax, [esp + 0x2c]
lea edx, [esp + 0x14]
push 4
push 0x3000
push eax
push 0
push edx
push 0xffffffffffffffff
push 6
push dword [0x44e4b4]
push ecx
call fcn.0043f3f0
add esp, 0x24
test eax, eax
js 0x43d6a2
cmp dword [ebx + 4], 0
je 0x43d630
xor edx, edx
cmp dword [ebx + 4], 2
mov esi, 0x7fff
je 0x43d052
mov esi, 0
mov dword [esp + 0x4c], 0xfffeffff
je 0x43d064
mov dword [esp + 0x4c], SysStringLen
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov edi, 0x10000
mov dword [esp + 0x48], esi
jmp 0x43d0be
mov edi, dword [esp + 0x18]
add edi, dword [esp + 0x38]
mov edx, dword [esp + 0x1c]
adc edx, dword [esp + 0x3c]
cmp edi, dword [esp + 0x4c]
mov eax, edx
sbb eax, esi
jae 0x43d589
mov dword [esp + 0x44], edx
mov ecx, ebx
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x44]
push eax
push edx
push edi
call fcn.0043c9e0
cmp eax, 0xbfffffff
ja 0x43d589
test eax, eax
js 0x43d0a0
cmp dword [esp + 0x58], 0x1000
jne 0x43d0a0
test byte [esp + 0x54], 0x66
je 0x43d0a0
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], eax
mov edx, dword [esp + 0x1c]
mov ecx, 0
sbb ecx, edx
jae 0x43d2e2
mov dword [esp + 8], 0x7c7d7a7b
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43d194
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 8]
mov ecx, eax
xor ecx, 0xd47f60ea
and eax, 0xd47f60ea
lea ecx, [ecx + eax*2]
lea eax, [ecx + edx]
and ecx, edx
mov edx, eax
not edx
and edx, ecx
mov esi, ecx
not esi
and eax, esi
sub eax, edx
mov edx, eax
not edx
and edx, ecx
and eax, esi
sub eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
add al, 0x6e
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43d140
mov eax, dword [0x44e4ac]
test eax, eax
je 0x43d1ea
mov ecx, dword [esp + 8]
xor edx, edx
mov esi, dword [0x44e4b0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x44caaeb6
je 0x43d1c0
inc edx
cmp eax, edx
jne 0x43d1b0
jmp 0x43d1ea
mov eax, dword [esi + edx*8 + 4]
cmp eax, ecx
je 0x43d1ea
push 0x8000
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push 4
push dword [0x44e4b4]
push eax
call fcn.0043f3f0
add esp, 0x1c
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 8], 0x7c7d7a7b
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43d274
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 8]
mov ecx, eax
xor ecx, 0xd47f60ea
and eax, 0xd47f60ea
lea ecx, [ecx + eax*2]
lea eax, [ecx + edx]
and ecx, edx
mov edx, eax
not edx
and edx, ecx
mov esi, ecx
not esi
and eax, esi
sub eax, edx
mov edx, eax
not edx
and edx, ecx
and eax, esi
sub eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
add al, 0x6e
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43d220
mov eax, dword [esp + 8]
mov ecx, dword [0x44e4ac]
test ecx, ecx
je 0x43d2ce
xor edx, edx
mov esi, dword [0x44e4b0]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x633c81d
je 0x43d2a0
inc edx
cmp ecx, edx
jne 0x43d290
jmp 0x43d2ce
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43d2ce
push 4
push 0x3000
lea eax, [esp + 0x34]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 6
push dword [0x44e4b4]
push ecx
call fcn.0043f3f0
add esp, 0x24
test eax, eax
mov esi, dword [esp + 0x48]
js 0x43d589
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x50], edi
lea edi, [esp + 0x30]
push edi
push edx
push eax
push dword [esp + 0x20]
push dword [esp + 0x54]
push dword [esp + 0x64]
call fcn.0043cce0
test eax, eax
jns 0x43d30f
cmp eax, 0x8000000d
jne 0x43d0a0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp eax, dword [ebp + 0x10]
sbb ecx, 0
jb 0x43d0a0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
call fcn.0043d6f0
add esp, 0x18
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
cmp ecx, edx
je 0x43d0a0
mov dword [esp + 0x64], ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov edi, dword [edi + 4]
mov dword [esp + 0x60], ecx
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x68], edx
jmp 0x43d3bc
push dword [esp + 4]
call fcn.0040c780
add esp, 4
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x6c]
lea eax, [esi + eax*8]
mov dword [esp + 4], eax
mov edi, esi
add edi, ebx
mov eax, esi
mov esi, ebx
mov ebx, dword [esp + 0x44]
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
mov dword [eax + esi], ecx
mov ecx, dword [esp + 0x74]
mov dword [eax + esi + 4], ecx
add edi, 8
mov ecx, dword [esp + 0x78]
add ecx, 4
cmp ecx, edx
je 0x43d548
mov dword [esp + 0x78], ecx
mov ecx, dword [ecx]
sub ecx, dword [esp + 0x14]
mov esi, ecx
sar esi, 0x1f
add ecx, dword [esp + 0x50]
adc esi, ebx
mov dword [esp + 0x74], esi
mov esi, edi
sub esi, eax
cmp edi, dword [esp + 4]
jne 0x43d39f
mov dword [esp + 0x70], ecx
mov dword [esp + 4], eax
mov ecx, esi
sar ecx, 3
lea eax, [ecx + 1]
mov edx, ecx
shr edx, 1
add edx, ecx
cmp edx, eax
mov ebx, esi
ja 0x43d3fd
mov edx, eax
mov eax, edx
and eax, 0xfffffff7
mov ecx, edx
and ecx, 8
mov esi, edx
mov dword [esp + 0x6c], edx
or edx, 8
imul edx, ecx
xor ecx, 8
imul ecx, eax
add edx, ecx
push edx
call fcn.0040c770
add esp, 4
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x43d380
cmp esi, eax
mov dword [esp + 0x28], ebx
jbe 0x43d4f2
cmp edi, esi
jbe 0x43d4f2
test ebx, ebx
je 0x43d370
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x28]
add eax, edx
dec eax
mov dword [esp + 0x24], esi
lea ecx, [esi + edx]
dec ecx
mov esi, edx
and esi, 7
je 0x43d484
neg esi
xor edx, edx
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp esi, edx
jne 0x43d470
add eax, edx
add ecx, edx
add edx, dword [esp + 0x28]
mov esi, dword [esp + 4]
sub esi, edi
cmp esi, 0xfffffff8
mov esi, dword [esp + 0x24]
ja 0x43d370
neg edx
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x43d4a0
jmp 0x43d370
mov ecx, ebx
shr ecx, 2
mov dword [esp + 0x24], esi
mov esi, dword [esp + 4]
mov eax, esi
mov edi, dword [esp + 0x24]
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
mov eax, dword [esp + 0x24]
add eax, edx
add edx, esi
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov esi, dword [esp + 0x24]
test bl, 1
je 0x43d370
mov ecx, dword [esp + 0x28]
and ecx, 2
movzx edx, byte [edx + ecx]
mov byte [eax + ecx], dl
jmp 0x43d370
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [ecx], eax
mov eax, dword [esp + 4]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x60]
test eax, eax
mov ebx, dword [esp + 0x64]
mov esi, dword [esp + 0x48]
je 0x43d0a0
cmp eax, edx
je 0x43d0a0
push eax
call fcn.0040c780
add esp, 4
mov dword [esp + 8], 0
jmp 0x43d0a0
mov dword [esp + 8], 0x7c7d7a7b
mov byte [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x43d604
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 8]
mov ecx, eax
xor ecx, 0xd47f60ea
and eax, 0xd47f60ea
lea ecx, [ecx + eax*2]
lea eax, [ecx + edx]
and ecx, edx
mov edx, eax
not edx
and edx, ecx
mov esi, ecx
not esi
and eax, esi
sub eax, edx
mov edx, eax
not edx
and edx, ecx
and eax, esi
sub eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
add al, 0x6e
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x43d5b0
mov eax, dword [0x44e4ac]
test eax, eax
je 0x43d6a2
mov ecx, dword [esp + 8]
xor edx, edx
mov esi, dword [0x44e4b0]
nop
nop
nop
cmp dword [esi + edx*8], 0x44caaeb6
je 0x43d678
inc edx
cmp eax, edx
jne 0x43d620
jmp 0x43d6a2
push 0xfb1631b0
push dword [0x44e4a0]
call fcn.00441e40
add esp, 8
test eax, eax
je 0x43d6af
mov ecx, dword [ebx]
test ecx, ecx
je 0x43d040
mov dword [esp + 8], 0
lea edx, [esp + 8]
push edx
push ecx
call eax
test eax, eax
je 0x43d6bb
cmp dword [esp + 8], 0
je 0x43d6bb
mov dword [ebx + 4], 3
jmp 0x43d040
mov eax, dword [esi + edx*8 + 4]
cmp eax, ecx
je 0x43d6a2
push 0x8000
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push 4
push dword [0x44e4b4]
push eax
call fcn.0043f3f0
add esp, 0x1c
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov dword [ebx + 4], 1
jmp 0x43d040
lea eax, [esp + 0x38]
push eax
call fcn.00442700
add esp, 4
test al, al
je 0x43d040
mov eax, dword [esp + 0x38]
mov ecx, 2
cmp eax, 3
je 0x43d6e0
mov ecx, eax
mov dword [ebx + 4], ecx
jmp 0x43d040