Function at 0x443670
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x294
mov edx, dword [esp + 0x2b4]
mov dword [esp + 0x7b], 0xe48040
mov dword [esp + 0x78], 0x4010ec83
mov dword [esp + 0x74], 0x48e78948
mov dword [esp + 0x70], 0xce8948fc
lea edi, [esp + 0x94]
lea eax, [esp + 0x70]
mov ecx, 3
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xa0]
lea eax, [esp + 0x7c]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x7e]
mov byte [esp + 0xa2], al
mov ebx, edx
cmp edx, 4
jb 0x4436e2
mov ebx, 4
lea ebp, [esp + 0xa3]
test edx, edx
je 0x443afa
xor eax, eax
lea esi, [esp + 0xc]
mov dword [esp], ebx
jmp 0x44370c
mov ebx, dword [esp]
inc eax
cmp eax, ebx
je 0x44390e
cmp eax, 3
ja case.default.0x443711
jmp dword [eax*4 + 0x448af0]
mov dword [esp + 0xc], 0x3948ce74
mov byte [esp + 0x10], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x8b
xor dl, byte [esp + ecx + 0xc]
add dl, 0x49
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 5
jne 0x443730
mov edx, esi
xor ecx, ecx
mov edi, ebp
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
mov ecx, 1
mov edi, ebp
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0xe]
mov byte [ebp + 2], cl
add ebp, 3
jmp case.default.0x443711
mov dword [esp + 0xc], 0x39f0bef8
mov byte [esp + 0x10], 0x48
lea ecx, [esp + 0x10]
mov byte [ecx + 5], 0
mov dword [ecx + 1], 0
mov ecx, 0xc
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edi]
mov edx, ecx
or edx, esi
and esi, ecx
not edx
add edx, esi
add dl, 0x41
mov byte [edi], dl
inc edi
dec ecx
cmp ecx, 2
jne 0x4437a0
lea esi, [esp + 0xc]
mov edx, esi
mov edi, ebp
mov ecx, 1
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add ebp, 4
lea edx, [esp + 0x10]
mov edi, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp case.default.0x443711
mov dword [esp + 0xc], 0x8bdc1adc
mov byte [esp + 0x10], 0x64
mov dword [esp + 0x11], 0
mov ecx, 0x2f4c5c98
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x2f4c5c8c]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 8
mov byte [esp + ecx - 0x2f4c5c8c], dl
inc ecx
cmp ecx, 0x2f4c5ca1
jne 0x443810
mov edx, esi
mov edi, ebp
mov ecx, 1
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add ebp, 4
lea edx, [esp + 0x10]
mov edi, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp 0x443700
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 0x11609e54
mov byte [esp + 0x10], 8
lea ecx, [esp + 0x10]
mov word [ecx + 5], 0
mov dword [ecx + 1], 0
mov ecx, 0x7c
mov edi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi]
lea esi, [ecx - 0x18343f00]
or esi, edx
and edx, ecx
mov ebx, edx
not ebx
lea ebp, [edx + ebx*2]
lea ebx, [edx + ebx*2]
inc ebx
or ebx, esi
add ebp, esi
sub ebx, ebp
lea esi, [ebx + 0x6e]
mov ebp, 0x79053891
sub ebp, ebx
and ebx, 1
mov edx, ebp
not edx
and ebp, 0xa5
and esi, 0x5a
or esi, ebp
and edx, 1
or edx, esi
xor edx, 0xa4
add edx, ebx
mov byte [edi], dl
inc edi
dec ecx
cmp ecx, 0x71
jne 0x443890
lea esi, [esp + 0xc]
mov edx, esi
mov ebp, dword [esp + 8]
mov edi, ebp
mov ecx, 1
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add ebp, 4
lea edx, [esp + 0x10]
mov edi, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp 0x443700
mov eax, dword [esp + 0x2b4]
cmp eax, 3
jbe 0x443afa
test al, 1
je 0x44394c
mov eax, 0x449025
mov edx, 0x449025
mov edi, ebp
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, 1
mov edi, ebp
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 0x2b4]
add ebp, 2
mov ecx, eax
lea eax, [eax*8]
mov esi, 0xffffffff
mov edx, 0xffffffff
cmp eax, 0x7ffffffe
ja 0x443fc4
dec ecx
cmp ecx, 4
jb 0x443afa
mov eax, ecx
jmp 0x44398d
mov eax, dword [esp]
dec eax
cmp eax, 3
jbe 0x443afa
mov edx, ebp
lea ecx, [eax*8]
mov dword [esp + 8], ecx
cmp ecx, 0x7e
mov dword [esp], eax
ja 0x443a40
mov dword [esp + 0xc], 0x69501e54
mov word [esp + 0x10], 0x8758
mov dword [esp + 0x12], 0
xor ecx, ecx
nop
movzx eax, byte [esp + ecx + 0xc]
mov esi, ecx
and esi, 1
mov edi, ecx
and edi, 2
mov ebp, edi
xor ebp, 2
imul ebp, esi
or esi, 2
imul esi, edi
mov ebx, ecx
xor ebx, 0x82dbc563
add ebx, ebp
add ebx, esi
mov esi, eax
and esi, ebx
add esi, esi
sub ebx, esi
add bl, al
add bl, 0x11
mov byte [esp + ecx + 0xc], bl
inc ecx
cmp ecx, 0xa
jne 0x4439c0
lea eax, [esp + 0xc]
mov ebp, edx
mov edi, edx
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [edx + 4]
lea eax, [esp + 0x10]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x10]
mov byte [edx + 4], al
mov eax, dword [esp + 8]
mov byte [edx + 3], al
add ebp, 5
jmp 0x443980
mov dword [esp + 0xc], 0xd7dcde80
mov dword [esp + 0x10], 0x83525554
mov byte [esp + 0x14], 0x50
lea eax, [esp + 0x14]
mov byte [eax + 5], 0
mov dword [eax + 1], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0xc]
mov eax, ecx
and eax, 0xc
mov edi, ecx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, eax
or eax, 2
imul eax, edi
mov edi, ecx
xor edi, 0x19ea130e
add edi, ebx
add edi, eax
mov eax, edi
and eax, esi
mov ebx, eax
and ebx, 0xfffffffd
mov ebp, eax
and ebp, 2
or eax, 2
imul eax, ebp
xor ebp, 2
imul ebp, ebx
add eax, ebp
add edi, esi
mov esi, edi
not esi
and esi, eax
not eax
and eax, edi
sub eax, esi
add al, 0xba
mov byte [esp + ecx + 0xc], al
inc ecx
cmp ecx, 0xe
jne 0x443a70
lea eax, [esp + 0xc]
mov edi, edx
mov ecx, 2
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea ebp, [edx + 8]
lea eax, [esp + 0x14]
xor ecx, ecx
mov edi, ebp
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, dword [esp + 8]
mov dword [edx + 3], eax
jmp 0x443980
mov ebx, ebp
mov dword [esp + 0xc], 0x61b20a4c
lea edx, [esp + 0x10]
mov byte [esp + 0x10], 0x80
mov dword [esp + 0x11], 0
mov byte [esp + 0x15], 0
lea ecx, [esp + 0xc]
xor esi, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, esi
and ebp, 0x3e
mov eax, edi
xor eax, 0x60
sub eax, ebp
inc al
xor al, byte [ecx]
add al, 0x1b
mov byte [ecx], al
inc ecx
dec edi
add esi, 0xfffffffe
cmp edi, 0xfffffff6
jne 0x443b30
lea eax, [esp + 0xc]
mov edi, ebx
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea esi, [ebx + 4]
mov edi, esi
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [esp + 0x8f], 0xc3fc8948
mov dword [esp + 0x8c], 0x48d2ff41
mov dword [esp + 0x80], 0xba49c031
mov eax, dword [esp + 0x2a8]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x2ac]
mov dword [esp + 0x88], eax
lea eax, [esp + 0x80]
mov edi, esi
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [ebx + 0x14]
lea eax, [esp + 0x90]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x92]
mov byte [ebx + 0x16], al
lea ecx, [esp + 0x94]
mov eax, ecx
neg eax
add eax, ebx
add eax, 0x17
mov dword [esp], eax
sub ebx, ecx
mov dword [esp + 4], 0
add ebx, 0x71
mov dword [esp + 0x6c], ebx
mov dword [esp + 0xc], 0x8c8d8a8b
mov word [esp + 0x10], 0
mov eax, 0x1888ee2
mov ecx, 0x77711d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1888ed6]
mov edi, ecx
and edi, 0x417117
mov esi, eax
and esi, 0x10004a8
or esi, edi
xor esi, edx
lea edx, [esi + esi]
mov ebx, esi
xor ebx, 0xc2
mov edi, edx
and edi, 2
and esi, 1
or edx, 0xd5
sub edx, ebx
and edx, 0xfe
or edx, esi
not edx
add edx, edi
mov byte [esp + eax - 0x1888ed6], dl
inc eax
dec ecx
cmp eax, 0x1888ee8
jne 0x443c20
mov esi, dword [esp + 0xc]
mov eax, dword [0x451b44]
test eax, eax
je 0x443cd0
xor ecx, ecx
mov edx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x3e416e49
je 0x443ca0
inc ecx
cmp eax, ecx
jne 0x443c90
jmp 0x443cd0
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x443cd0
lea ecx, [esp + 0x6c]
lea edx, [esp + 4]
push 0x40
push 0x3000
push ecx
push 0
push edx
push 0xffffffffffffffff
push 6
push eax
push dword [0x451b4c]
call fcn.00441940
add esp, 0x24
mov esi, eax
test esi, esi
js 0x443f90
mov dword [esp + 0xc], 0x3914c07
mov dword [esp + 0x10], 0xed7d5201
mov dword [esp + 0x14], 0x89d61051
mov dword [esp + 0x18], 0xedeeefe0
mov dword [esp + 0x1c], 0x3faa6614
mov dword [esp + 0x20], 0x229e8365
mov dword [esp + 0x24], 0x9d5cdafa
mov dword [esp + 0x28], 0x9d9e9f4d
mov dword [esp + 0x2c], 0xabf2952b
mov dword [esp + 0x30], 0x6f868798
mov dword [esp + 0x34], 0xfe30e430
mov dword [esp + 0x38], 0x6cb2c30d
mov dword [esp + 0x3c], 0x81c4686e
mov dword [esp + 0x40], 0x99720288
mov dword [esp + 0x44], 0x6e7a65b5
mov dword [esp + 0x48], 0xc7bf46f0
mov dword [esp + 0x4c], 0x75f34b5d
mov dword [esp + 0x50], 0xa58bab94
mov dword [esp + 0x54], 0x6515a3a4
mov dword [esp + 0x58], 0xe319678c
mov dword [esp + 0x5c], 0xe662eb83
mov dword [esp + 0x60], 0x815777be
lea edx, [esp + 0x64]
mov dword [esp + 0x64], 0x5378
mov eax, 0xd650deab
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x29af2161]
xor ecx, eax
mov esi, ecx
not esi
and esi, 0xbb
and ecx, 0x44
sub ecx, esi
add cl, 0x64
mov byte [esp + eax + 0x29af2161], cl
inc eax
cmp eax, 0xd650df07
jne 0x443da0
mov eax, dword [esp + 4]
lea esi, [esp + 0xc]
mov edi, eax
mov ecx, 0x16
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [eax + 0x58]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x64]
mov byte [eax + 0x58], cl
mov eax, dword [esp + 4]
mov dword [esp + 0xc], 0x7f7e7901
mov ecx, 0x95
mov edx, 0x6a
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx - 0x5e]
mov edi, edx
or edi, esi
mov ebx, edi
sub ebx, esi
add ebx, ecx
and ebx, edi
add bl, 0xee
mov byte [esp + edx - 0x5e], bl
dec ecx
inc edx
cmp edx, 0x6e
jne 0x443e10
add eax, dword [esp + 0xc]
mov ebx, dword [esp]
mov ecx, ebx
shr ecx, 2
lea edx, [esp + 0x94]
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
and ecx, 0xfffffffc
add eax, ecx
lea edx, [esp + ecx]
add edx, 0x94
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x443e7b
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [eax + ebx], cl
mov eax, dword [esp + 4]
mov dword [esp + 0xc], 0x797a7b1b
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov ecx, 0xc5d59deb
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x3a2a6221]
xor esi, ecx
mov edi, esi
xor edi, 0x17
mov edx, esi
or edx, 0x68
and edx, edi
xor esi, 0x97
add edx, edx
sub edx, esi
mov byte [esp + ecx + 0x3a2a6221], dl
inc ecx
cmp ecx, 0xc5d59df2
jne 0x443ea0
mov ecx, dword [esp + 0xc]
add ecx, eax
push dword [esp + 0x2b0]
push ecx
call eax
mov esi, eax
mov dword [esp], edx
mov dword [esp + 0x68], 0
mov dword [esp + 0xc], 0x8c8d8a8b
mov word [esp + 0x10], 0
mov eax, 0x1888ee2
mov ecx, 0x77711d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x1888ed6]
mov ebp, ecx
and ebp, 0x417117
mov ebx, eax
and ebx, 0x10004a8
or ebx, ebp
xor ebx, edx
lea edx, [ebx + ebx]
mov edi, ebx
xor edi, 0xc2
mov ebp, edx
and ebp, 2
and ebx, 1
or edx, 0xd5
sub edx, edi
and edx, 0xfe
or edx, ebx
not edx
add edx, ebp
mov byte [esp + eax - 0x1888ed6], dl
inc eax
dec ecx
cmp eax, 0x1888ee8
jne 0x443f10
mov eax, dword [0x451b44]
test eax, eax
je 0x443fc1
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ebx, dword [0x451b48]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x16194952
je 0x443f97
inc edx
cmp eax, edx
jne 0x443f80
jmp 0x443fc1
mov edx, esi
sar edx, 0x1f
jmp 0x443fc4
mov eax, dword [ebx + edx*8 + 4]
cmp eax, ecx
je 0x443fc1
lea ecx, [esp + 0x68]
lea edx, [esp + 4]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
push 4
push eax
push dword [0x451b4c]
call fcn.00441940
add esp, 0x1c
mov edx, dword [esp]
mov eax, esi
add esp, 0x294
pop esi
pop edi
pop ebx
pop ebp
ret 0x10