Function at 0x43f250
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x29c
mov edx, dword [esp + 0x2bc]
mov dword [esp + 0x83], 0xe48040
mov dword [esp + 0x80], 0x4010ec83
mov dword [esp + 0x7c], 0x48e78948
mov dword [esp + 0x78], 0xce8948fc
lea edi, [esp + 0x9c]
lea eax, [esp + 0x78]
mov ecx, 3
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xa8]
lea eax, [esp + 0x84]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x86]
mov byte [esp + 0xaa], al
mov ebp, edx
cmp edx, 4
jb 0x43f2ce
mov ebp, 4
lea ebx, [esp + 0xab]
test edx, edx
je 0x43f5d2
xor esi, esi
mov dword [esp + 0x68], ebp
jmp 0x43f303
mov edx, dword [esp + 0x2bc]
mov esi, dword [esp]
inc esi
cmp esi, ebp
je 0x43f577
cmp esi, 3
ja case.default.0x43f308
jmp dword [esi*4 + 0x444b00]
mov dword [esp + 8], 0x2938a6ec
lea eax, [esp + 0xc]
mov byte [eax + 2], 0
mov word [eax], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x47
xor cl, byte [esp + eax + 8]
add cl, 0x9d
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 7
jne 0x43f330
lea ebp, [esp + 8]
mov eax, ebp
mov edi, ebx
xor ecx, ecx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edi, ebx
mov ecx, 1
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
movzx eax, byte [esp + 0xa]
mov byte [ebx + 2], al
add ebx, 3
mov ebp, dword [esp + 0x68]
jmp case.default.0x43f308
mov dword [esp], esi
mov dword [esp + 0x6c], ebx
mov dword [esp + 8], 0xe3dc1a24
mov byte [esp + 0xc], 0x9c
lea eax, [esp + 0xc]
mov byte [eax + 3], 0
mov word [eax + 1], 0
xor ecx, ecx
lea edi, [esp + 8]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xfffffff8
add esi, ebp
movzx ebx, byte [edi]
mov eax, esi
xor eax, 0x97ca1da4
lea edx, [eax + eax]
not edx
add edx, eax
and edx, 0x61e4692c
xor esi, 0xf62e7488
or eax, 0x960a1483
and eax, esi
mov esi, ebx
and esi, 0x2c
or esi, 0x1e129243
and ebx, 0xffffffd3
xor ebx, esi
mov esi, edx
xor esi, eax
not eax
and eax, edx
add esi, edx
sub esi, eax
xor esi, ebx
lea edx, [esi + esi]
and edx, 0x121ad796
xor edx, 0x96
mov eax, esi
xor eax, 0xa4
add eax, edx
and esi, 1
xor eax, 1
or eax, esi
add eax, esi
mov byte [edi], al
inc ebp
inc edi
add ecx, 2
cmp ecx, 0x10
jne 0x43f3b0
lea eax, [esp + 8]
mov ebx, dword [esp + 0x6c]
mov edi, ebx
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add ebx, 4
lea eax, [esp + 0xc]
mov edi, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edx, dword [esp + 0x2bc]
mov ebp, dword [esp + 0x68]
jmp 0x43f2f7
mov dword [esp], esi
mov dword [esp + 8], 0x19d092d0
lea eax, [esp + 0xc]
mov word [eax + 4], 0
mov dword [eax], 0
xor ecx, ecx
xor edi, edi
nop
movzx edx, byte [esp + edi + 8]
mov esi, ecx
and esi, 2
mov eax, edi
xor eax, 0x8e13bbc1
add eax, esi
xor eax, edx
mov edx, eax
and edx, 1
or eax, 1
add eax, edx
add al, 0x3a
mov byte [esp + edi + 8], al
inc edi
add ecx, 2
cmp edi, 0xa
jne 0x43f480
lea eax, [esp + 8]
mov edi, ebx
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add ebx, 4
lea eax, [esp + 0xc]
mov edi, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
jmp 0x43f2f0
mov dword [esp], esi
mov dword [esp + 8], 0x91400e54
mov byte [esp + 0xc], 0x98
lea eax, [esp + 0xc]
mov word [eax + 5], 0
mov dword [eax + 1], 0
mov ecx, 0x7af823db
mov edi, 0x24
nop
nop
nop
movzx eax, byte [esp + ecx - 0x7af823d3]
mov edx, ecx
or edx, eax
not eax
or eax, edi
and eax, edx
mov edx, eax
mov esi, eax
and esi, 0xb8
xor esi, 0xe7dfffff
add esi, eax
add esi, 0x99274cb9
xor eax, 0x66d8b347
or edx, 0x182000b8
and edx, eax
mov eax, esi
and eax, edx
xor edx, esi
lea eax, [edx + eax*2]
inc al
mov byte [esp + ecx - 0x7af823d3], al
inc ecx
dec edi
cmp ecx, 0x7af823e6
jne 0x43f500
lea eax, [esp + 8]
mov edi, ebx
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add ebx, 4
lea eax, [esp + 0xc]
mov edi, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
jmp 0x43f2f0
cmp edx, 3
jbe 0x43f5d2
test dl, 1
je 0x43f5ab
mov eax, 0x445035
mov edx, 0x445035
mov edi, ebx
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, dword [esp + 0x2bc]
mov edi, ebx
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
add ebx, 2
lea ecx, [edx*8]
mov eax, 0xffffffff
mov edi, 0xffffffff
cmp ecx, 0x7ffffffe
ja 0x43fca5
dec edx
cmp edx, 4
jae 0x43f79d
mov ebp, ebx
mov dword [esp + 8], 0xd92eb6f4
lea esi, [esp + 0xc]
mov byte [esp + 0xc], 0x38
mov dword [esp + 0xd], 0
mov byte [esp + 0x11], 0
mov edi, 0xf3f0004b
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi + 0xc0fffbd]
mov edx, ebx
not edx
or edx, edi
add edx, ebx
inc dl
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0xfd
mul cl
mov ecx, eax
add cl, bl
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, edi
add al, 0x89
mov byte [esp + edi + 0xc0fffbd], al
inc edi
cmp edi, 0xf3f00055
jne 0x43f600
lea eax, [esp + 8]
mov edi, ebp
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea eax, [ebp + 4]
mov edi, eax
xor ecx, ecx
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov dword [esp + 0x97], 0xc3fc8948
mov dword [esp + 0x94], 0x48d2ff41
mov dword [esp + 0x88], 0xba49c031
mov ecx, dword [esp + 0x2b0]
mov dword [esp + 0x8c], ecx
mov ecx, dword [esp + 0x2b4]
mov dword [esp + 0x90], ecx
lea edx, [esp + 0x88]
mov edi, eax
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp + 0x14]
lea eax, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x9a]
mov byte [ebp + 0x16], al
lea ecx, [esp + 0x9c]
mov eax, ecx
neg eax
lea edi, [eax + ebp]
add edi, 0x17
sub ebp, ecx
mov dword [esp + 4], 0
add ebp, 0x71
mov dword [esp + 0x74], ebp
mov dword [esp + 8], 0x181b1a1d
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov edx, 0x45
mov eax, 0xbb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0xb3]
lea ecx, [edx - 1]
mov esi, ecx
or esi, ebx
or ebx, eax
not esi
add ebx, edx
or ebx, esi
add bl, 0x59
mov byte [esp + eax - 0xb3], bl
inc eax
mov edx, ecx
cmp ecx, 0x3e
jne 0x43f720
mov eax, dword [esp + 8]
mov ecx, dword [0x44cf90]
test ecx, ecx
je 0x43f927
xor edx, edx
mov esi, dword [0x44cf94]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x3e416e49
je 0x43f8f9
inc edx
cmp ecx, edx
jne 0x43f770
jmp 0x43f927
mov edx, dword [esp]
dec edx
cmp edx, 3
jbe 0x43f5d2
lea eax, [edx*8]
mov ebp, eax
cmp eax, 0x7e
mov dword [esp], edx
ja 0x43f850
mov esi, ebx
mov dword [esp + 8], 0x23448a48
mov word [esp + 0xc], 0x554
lea eax, [esp + 0x10]
mov byte [eax + 2], 0
mov dword [eax - 2], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi + 8]
lea ebx, [edi + 0x80]
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x8d
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edi
mov byte [esp + edi + 8], al
inc edi
cmp edi, 0xb
jne 0x43f7e0
lea eax, [esp + 8]
mov ebx, esi
mov edi, esi
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esi + 4]
lea eax, [esp + 0xc]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0xc]
mov byte [esi + 4], al
mov eax, ebp
mov byte [esi + 3], al
add ebx, 5
jmp 0x43f790
mov dword [esp + 8], 0x43444a88
mov dword [esp + 0xc], 0xb7c6c5c4
mov byte [esp + 0x10], 0xc8
lea eax, [esp + 0x10]
mov word [eax + 5], 0
mov dword [eax + 1], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov ecx, eax
or ecx, 0xb327bb50
mov esi, edx
not esi
or esi, ecx
add esi, edx
lea ecx, [esi*2 + 2]
add edx, eax
add edx, 0xb327bb50
mov esi, edx
not esi
and esi, ecx
not ecx
and ecx, edx
sub ecx, esi
add cl, 0x70
mov byte [esp + eax + 8], cl
mov ecx, eax
not ecx
or ecx, 1
add ecx, eax
xor eax, 1
lea eax, [eax + ecx*2]
add eax, 2
cmp eax, 0xf
jb 0x43f880
lea eax, [esp + 8]
mov edi, ebx
mov ecx, 2
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea eax, [ebx + 8]
lea edx, [esp + 0x10]
xor ecx, ecx
mov edi, eax
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [ebx + 3], ebp
mov ebx, eax
jmp 0x43f790
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x43f927
lea eax, [esp + 0x74]
lea edx, [esp + 4]
push 0x40
push 0x3000
push eax
push 0
push edx
push 0xffffffffffffffff
push 6
push ecx
push dword [0x44cf98]
call fcn.0043d020
add esp, 0x24
test eax, eax
js 0x43fc70
mov dword [esp], edi
mov dword [esp + 8], 0x65eb905d
mov dword [esp + 0xc], 0x1b779267
mov dword [esp + 0x10], 0xff1a5c9f
mov dword [esp + 0x14], 0x1b1a0504
mov dword [esp + 0x18], 0x21de9e70
mov dword [esp + 0x1c], 0x8a0ae19b
mov dword [esp + 0x20], 0x1350caf6
mov dword [esp + 0x24], 0x2b2a1523
mov dword [esp + 0x28], 0x3dd62fb1
mov dword [esp + 0x2c], 0x59222d2c
mov dword [esp + 0x30], 0xf6b4c8bc
mov dword [esp + 0x34], 0x582ee1a3
mov dword [esp + 0x38], 0x27f8545a
mov dword [esp + 0x3c], 0x177ea23c
mov dword [esp + 0x40], 0x66e0f33
mov dword [esp + 0x44], 0xa1495ef4
mov dword [esp + 0x48], 0xb95192b
mov dword [esp + 0x4c], 0x43654968
mov dword [esp + 0x50], 0xbdf4140
mov dword [esp + 0x54], 0x9dc31d60
mov dword [esp + 0x58], 0x9e069979
mov dword [esp + 0x5c], 0x6f517da2
lea edx, [esp + 0x60]
mov word [esp + 0x60], 0x5174
mov byte [esp + 0x66], 0
mov dword [esp + 0x62], 0
mov eax, 0x328184fe
mov ecx, 0xcd7e7c01
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x32818407]
lea ebx, [ecx + 0x122c8401]
mov edi, ebx
and edi, esi
add edi, edi
sub edi, esi
add edi, eax
add edi, 0xedd37aff
and edi, ebx
mov ebx, edi
and ebx, 2
mov ebp, edi
or edi, 2
imul edi, ebx
xor ebx, 2
and ebp, 0xdfab00fd
imul ebp, ebx
add edi, ebp
lea ebp, [eax + edi]
xor ebp, esi
mov ebx, ecx
sub ebx, edi
and ebx, esi
add ebx, ebx
sub ebx, ebp
add bl, 0xf6
mov byte [esp + ecx + 0x32818407], bl
dec eax
inc ecx
cmp eax, 0x3281849f
jne 0x43fa10
mov eax, dword [esp + 4]
lea esi, [esp + 8]
mov edi, eax
mov ecx, 0x16
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [eax + 0x58]
xor esi, esi
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x60]
mov byte [eax + 0x58], cl
mov eax, dword [esp + 4]
mov dword [esp + 8], 0xe1e6e70f
mov dword [esp + 0xc], 0
nop
nop
nop
nop
movzx edx, byte [esp + esi + 8]
mov ecx, esi
xor ecx, 0x1f23aed6
mov edi, esi
or edi, 0xe0dc5129
and ecx, edi
add ecx, edi
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
add cl, 0x33
mov byte [esp + esi + 8], cl
inc esi
cmp esi, 8
jne 0x43fab0
add eax, dword [esp + 8]
mov esi, dword [esp]
mov ecx, esi
shr ecx, 2
lea edx, [esp + 0x9c]
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, esi
and ecx, 0xfffffffc
add eax, ecx
lea edx, [esp + ecx]
add edx, 0x9c
mov ecx, esi
and ecx, 3
mov esi, ecx
not esi
or esi, 1
add esi, ecx
shr ecx, 1
mov ebx, edx
mov edi, eax
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ebp, esi
inc ebp
je 0x43fbbd
mov ecx, dword [esp]
and ecx, 2
add edx, ecx
add eax, ecx
mov ebx, ebp
and ebx, 7
je 0x43fb62
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + edi]
mov byte [eax + edi], cl
inc edi
cmp ebx, edi
jne 0x43fb50
add edx, edi
add eax, edi
sub ebp, edi
cmp esi, 7
jb 0x43fbbd
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + esi]
mov byte [eax + esi], cl
movzx ecx, byte [edx + esi + 1]
mov byte [eax + esi + 1], cl
movzx ecx, byte [edx + esi + 2]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edx + esi + 3]
mov byte [eax + esi + 3], cl
movzx ecx, byte [edx + esi + 4]
mov byte [eax + esi + 4], cl
movzx ecx, byte [edx + esi + 5]
mov byte [eax + esi + 5], cl
movzx ecx, byte [edx + esi + 6]
mov byte [eax + esi + 6], cl
movzx ecx, byte [edx + esi + 7]
mov byte [eax + esi + 7], cl
add esi, 8
cmp ebp, esi
jne 0x43fb70
mov eax, dword [esp + 4]
mov dword [esp + 8], 0xf0e09e1
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xc2
xor dl, byte [esp + ecx + 8]
add dl, 0x36
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 4
jne 0x43fbd0
mov ecx, dword [esp + 8]
add ecx, eax
push dword [esp + 0x2b8]
push ecx
call eax
mov edi, edx
mov dword [esp + 0x70], 0
mov dword [esp + 8], 0x181b1a1d
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov esi, 0x45
mov ecx, 0xbb
nop
nop
movzx ebx, byte [esp + ecx - 0xb3]
lea edx, [esi - 1]
mov ebp, edx
or ebp, ebx
or ebx, ecx
not ebp
add ebx, esi
or ebx, ebp
add bl, 0x59
mov byte [esp + ecx - 0xb3], bl
inc ecx
mov esi, edx
cmp edx, 0x3e
jne 0x43fc20
mov ecx, dword [0x44cf90]
test ecx, ecx
je 0x43fca5
mov edx, dword [esp + 8]
xor esi, esi
mov ebx, dword [0x44cf94]
nop
cmp dword [ebx + esi*8], 0x16194952
je 0x43fc77
inc esi
cmp ecx, esi
jne 0x43fc60
jmp 0x43fca5
mov edi, eax
sar edi, 0x1f
jmp 0x43fca5
mov ecx, dword [ebx + esi*8 + 4]
cmp ecx, edx
je 0x43fca5
lea edx, [esp + 0x70]
lea esi, [esp + 4]
push 0x8000
push edx
push esi
push 0xffffffffffffffff
push 4
push ecx
push dword [0x44cf98]
mov esi, eax
call fcn.0043d020
mov eax, esi
add esp, 0x1c
mov edx, edi
add esp, 0x29c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10