Function at 0x431e50
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push str.client.dll
mov ebx, eax
push esi
mov dword [ebp - 0x54], ebx
call fcn.00431d50
test eax, eax
jne 0x431ea6
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x3e8
call edi
push str.client.dll
push esi
call fcn.00431d50
test eax, eax
je 0x431e90
mov dword [ebp - 0x14], 0x1c035c47
xor ecx, ecx
mov dword [ebp - 0x10], 0x504c56
mov byte [ebp - 0xc], 1
nop word [eax + eax]
lea eax, [ecx + 0x2f]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 7
jb 0x431ec0
lea eax, [ebp - 0x14]
mov byte [ebp - 0xc], 0
push eax
push esi
call fcn.00431d50
movaps xmm0, xmmword [0x438de0]
mov esi, eax
mov dword [ebp - 0x50], esi
xor ecx, ecx
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0xf0f1f2f3
mov dword [ebp - 0x1c], 0xabaaa9a8
mov dword [ebp - 0x18], 0x100adac
lea eax, [ecx - 0x44]
xor byte [ebp + ecx - 0x30], al
inc ecx
cmp ecx, 0x1a
jb 0x431f02
movaps xmm0, xmmword [0x438ca0]
xor ecx, ecx
mov byte [ebp - 0x15], 0
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0xcfcecdcc
mov dword [ebp - 0x38], 0xdbab1155
mov dword [ebp - 0x34], 0x100ddbe
lea eax, [ecx - 0x44]
xor byte [ebp + ecx - 0x4c], al
inc ecx
cmp ecx, 0x1a
jb 0x431f35
push 0x40
push 0x1000
push 0x4000
push 0
mov byte [ebp - 0x31], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0x4000
mov edi, eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x431fc4
mov bl, byte [ebp - 0x30]
xor esi, esi
mov bh, byte [ebp - 0x4c]
cmp byte [esi + edi], bh
lea edx, [esi + edi]
jne 0x431f85
cmp bl, 0x78
je 0x431f8a
cmp bl, 0x3f
jne 0x431fa8
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x30]
cmp al, 0x78
jne 0x432067
mov al, byte [edx]
cmp al, byte [ebp + ecx - 0x4c]
je 0x43206b
lea ecx, [ebp - 0x30]
inc esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431fb0
sub ecx, edx
mov eax, 0x4000
sub eax, ecx
cmp esi, eax
jbe 0x431f78
xor eax, eax
inc eax
push 0xff
mov dword [ebp - 8], eax
call fcn.0043231e
mov ebx, dword [ebp - 0x54]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, eax
lea eax, [ebp - 8]
push 0
push 4
push eax
push dword [ebp - 8]
push ebx
call edi
push 0
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
call edi
push 0
push 0xff
push esi
push dword [ebp - 8]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0xd9df9894
xor ecx, ecx
mov dword [ebp - 0x10], 0xced9dccb
mov dword [ebp - 0xc], 0x100d8ce
nop word [eax + eax]
lea eax, [ecx - 0x4c]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 0xa
jb 0x432030
lea eax, [ebp - 0x14]
mov byte [ebp - 9], 0
push eax
push esi
call dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ecx, dword [ebp - 4]
add esp, 8
test eax, eax
setne al
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043207c
mov esp, ebp
pop ebp
ret 4
test al, al
je 0x432072
inc edx
inc ecx
jmp 0x431f90
mov eax, dword [ebp - 0x50]
add eax, esi
jmp 0x431fc6