Function at 0x433d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b848
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [edi], 0
test ecx, ecx
jle 0x433d5a
mov al, byte [edx + str.GUANGSU]
xor byte [ebx + esi], al
lea eax, [edx + 1]
xor edx, edx
inc esi
cmp eax, 7
cmovl edx, eax
cmp esi, ecx
jl 0x433d41
lea ecx, [ebp - 0x74]
call fcn.00438d60
push 1
push 0
push ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0
call fcn.0043b9f0
push str.TheQueryInfo
lea ecx, [ebp - 0x74]
call fcn.00439ae0
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x433ddd
test ebx, ebx
je 0x433d99
push 1
push ebx
call fcn.00437c26
add esp, 8
xor esi, esi
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x74], vtable.TiXmlDocument.0
cmp eax, 0x5e90b0
je 0x433db5
push eax
call fcn.00437c3d
add esp, 4
lea ecx, [ebp - 0x74]
call fcn.004391c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437c42
mov esp, ebp
pop ebp
ret 8
push str.IconOverlay
mov ecx, eax
call fcn.00439ae0
test eax, eax
je 0x433ee6
push str.UnInstall
mov ecx, eax
call fcn.00439ae0
mov esi, eax
test esi, esi
je 0x433ee6
push 0x57762c
mov ecx, esi
call fcn.00439ae0
test eax, eax
je 0x433eb0
mov ecx, eax
call fcn.00439b80
mov ecx, eax
test ecx, ecx
je 0x433eb0
mov edx, str.false
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x433e51
test bl, bl
je 0x433e4d
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x433e51
add eax, 2
add edx, 2
test bl, bl
jne 0x433e31
xor eax, eax
jmp 0x433e56
sbb eax, eax
or eax, 1
test eax, eax
jne 0x433e67
mov dword [edi + 0x110], eax
push 0x577630
jmp 0x433ea8
mov eax, str.true
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x433e90
test dl, dl
je 0x433e8c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x433e90
add ecx, 2
add eax, 2
test dl, dl
jne 0x433e70
xor eax, eax
jmp 0x433e95
sbb eax, eax
or eax, 1
test eax, eax
jne 0x433eb0
mov dword [edi + 0x110], 1
push str.UnInstall_IconOverlay_switch_is_on_n
call fcn.004b7492
add esp, 4
cmp dword [edi + 0x110], 0
je 0x433ee6
push str.Dependent
mov ecx, esi
call fcn.00439ae0
test eax, eax
je 0x433ed1
push eax
mov ecx, edi
call fcn.00433cb0
lea ecx, [edi + 0x94]
call fcn.004246f0
test eax, eax
jne 0x433ee6
mov dword [edi + 0x110], eax
mov ecx, dword [ebp - 0x2c]
push str.ServiceDllv1
call fcn.00439ae0
test eax, eax
je 0x433d99
push str.UnInstall
mov ecx, eax
call fcn.00439ae0
mov esi, eax
push 0x57762c
mov ecx, esi
call fcn.00439ae0
test eax, eax
je 0x433f5f
mov ecx, eax
call fcn.00439b80
test eax, eax
je 0x433f5f
mov ecx, str.true
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x433f50
test dl, dl
je 0x433f4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x433f50
add eax, 2
add ecx, 2
test dl, dl
jne 0x433f30
xor eax, eax
jmp 0x433f55
sbb eax, eax
or eax, 1
test eax, eax
jne 0x433f5f
mov dword [edi], 1
push str.SoftPath
mov ecx, esi
call fcn.00439ae0
test eax, eax
je 0x433fa5
mov ecx, eax
call fcn.00439b80
test eax, eax
je 0x433fa5
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004b6d44
add esp, 8
lea ecx, [edi + 4]
push eax
call fcn.004241f0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x433fa5
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00419e80
push str.ServiceName
mov ecx, esi
call fcn.00439ae0
test eax, eax
je 0x433feb
mov ecx, eax
call fcn.00439b80
test eax, eax
je 0x433feb
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004b6d44
add esp, 8
lea ecx, [edi + 0x1c]
push eax
call fcn.004241f0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x433feb
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00419e80
push str.ServiceDisplay
mov ecx, esi
call fcn.00439ae0
test eax, eax
je 0x434031
mov ecx, eax
call fcn.00439b80
test eax, eax
je 0x434031
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004b6d44
add esp, 8
lea ecx, [edi + 0x34]
push eax
call fcn.004241f0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x434031
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00419e80
push str.ServiceDescription
mov ecx, esi
call fcn.00439ae0
test eax, eax
je 0x434077
mov ecx, eax
call fcn.00439b80
test eax, eax
je 0x434077
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004b6d44
add esp, 8
lea ecx, [edi + 0x4c]
push eax
call fcn.004241f0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x434077
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00419e80
push str.Rand
mov ecx, esi
call fcn.00439ae0
test eax, eax
je 0x4340bd
mov ecx, eax
call fcn.00439b80
test eax, eax
je 0x4340bd
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004b6d44
add esp, 8
lea ecx, [edi + 0x64]
push eax
call fcn.004241f0
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4340bd
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00419e80
mov ecx, edi
call fcn.004334f0
test eax, eax
jne 0x4340da
push str.CheckInstall_false
call fcn.004b7492
add esp, 4
jmp 0x433d99
push str.Dependent
mov ecx, esi
call fcn.00439ae0
add edi, 0x94
mov esi, eax
mov ecx, edi
call fcn.00424870
test esi, esi
je 0x434119
push esi
mov ecx, edi
call fcn.00424dd0
push esi
mov ecx, edi
call fcn.00424cb0
push esi
mov ecx, edi
call fcn.00425290
push esi
mov ecx, edi
call fcn.00424d40
mov ecx, edi
call fcn.004246f0
mov esi, eax
jmp 0x433d9b