Function at 0x36fba0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2f8
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x140], 0xfb6a111b
mov byte [esp + 0x144], 0xe0
mov dword [esp + 0x145], 0
mov word [esp + 0x149], 0
mov esi, 0x77aebda9
mov edi, 0x8514256
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x77aebc69]
mov eax, edi
or eax, edx
lea ebx, [edi - 0x8514200]
and ebx, edx
xor ebx, eax
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xbd
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0xb3
mov byte [esp + esi - 0x77aebc69], al
inc esi
dec edi
cmp esi, 0x77aebdb4
jne 0x36fc00
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
movzx eax, byte [esp + 0x140]
test al, al
je 0x36fc7b
lea ecx, [esp + 0x141]
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x36fc70
mov byte [esi], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
lea eax, [esp + 0x48]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x34]
xor ebx, ebx
push eax
push ecx
push edx
mov eax, dword [ebp + 0x14]
push dword [eax + 0x10]
push dword [ebp + 0x10]
push dword [eax + 0xc]
call fcn.00372520
add esp, 0x18
test al, al
je 0x371014
mov dword [esp + 0x140], 0x4911e3e0
mov byte [esp + 0x144], 0x6c
mov dword [esp + 0x145], 0
xor eax, eax
xor edi, edi
nop
nop
nop
mov dword [esp + 0xc], edi
movzx ecx, byte [esp + eax + 0x140]
mov ebx, dword [esp + 0xc]
and ebx, 0x18
mov edx, eax
xor edx, 0x52e7f2ec
add edx, ebx
mov ebx, ecx
not ebx
and ebx, edx
mov edi, edx
xor edi, ecx
or edx, ecx
sub ecx, edi
add ecx, ebx
mov edi, dword [esp + 0xc]
not ecx
and ecx, edx
mov edx, ecx
not edx
and edx, 0x7f
and ecx, 0x80
sub ecx, edx
add cl, 0xe3
mov byte [esp + eax + 0x140], cl
inc eax
add edi, 2
cmp eax, 9
jne 0x36fcf0
movzx eax, byte [esp + 0x140]
test al, al
je 0x36fd6b
lea ecx, [esp + 0x141]
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x36fd60
mov byte [esi], 0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x134], edx
mov dword [esp + 0x130], ecx
mov dword [esp + 0x138], eax
mov dword [esp + 0x140], 0x1e061229
mov dword [esp + 0x144], 0x35321738
mov dword [esp + 0x148], 0x333f260d
mov dword [esp + 0x14c], 0x30313233
mov dword [esp + 0x150], 0x2e274500
mov dword [esp + 0x154], 0x352a241e
mov dword [esp + 0x158], 0xc4c5c6c7
mov dword [esp + 0x15c], 0xccb9f1f6
mov dword [esp + 0x160], 0xe6dbf6db
mov dword [esp + 0x164], 0xf0f0d2c3
mov dword [esp + 0x168], 0xf2a9fcdc
mov dword [esp + 0x16c], 0xabc0f5ea
mov dword [esp + 0x170], 0xa4f6e6a0
mov dword [esp + 0x174], 0xe4e5a6a2
mov dword [esp + 0x178], 0x23e99edf
mov dword [esp + 0x17c], 0xe0e1e2e3
mov dword [esp + 0x180], 0xdec3c5db
mov dword [esp + 0x184], 0xe895cce5
mov dword [esp + 0x188], 0xf4ffdde8
mov dword [esp + 0x18c], 0x89f1f2f3
mov dword [esp + 0x190], 0xfcfdfeea
mov dword [esp + 0x194], 0x3ee782fb
mov dword [esp + 0x198], 0xfffa9afe
mov dword [esp + 0x19c], 0x9dfe9d92
mov dword [esp + 0x1a0], 0x8c8d8e8f
mov dword [esp + 0x1a4], 0xa6f6f2bf
mov dword [esp + 0x1a8], 0xa19ba697
mov dword [esp + 0x1ac], 0x90edbceb
mov dword [esp + 0x1b0], 0x9c9d9e9f
mov dword [esp + 0x1b4], 0x8c999a9b
mov dword [esp + 0x1b8], 0xaa979adb
mov dword [esp + 0x1bc], 0xa0a1a2a3
mov dword [esp + 0x1c0], 0x87b1809d
mov dword [esp + 0x1c4], 0xd39ad6ab
mov byte [esp + 0x1c8], 0xf8
mov dword [esp + 0x1cc], 0
mov dword [esp + 0x1c9], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x140]
lea ecx, [eax + 0x1746f7e8]
mov edi, 0x28b90817
sub edi, eax
and edi, 0x90d
and ecx, 0x104226f2
or ecx, edi
xor ecx, edx
mov edx, ecx
xor edx, 0x2072
mov edi, ecx
xor edi, 0xc704d90d
xor ecx, 0xf3660e85
or edx, 0x3cfbd788
add edx, edi
add edx, 0xcb9d2878
or edi, 0xc3042877
and edi, ecx
mov ecx, edi
and ecx, edx
xor edi, edx
lea ecx, [edi + ecx*2]
inc cl
mov byte [esp + eax + 0x140], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x90
jb 0x36ff30
mov dword [esp + 0x60], 0xd486969a
mov dword [esp + 0x64], 0xcd97b3c
mov dword [esp + 0x68], 0x3118dc9c
mov dword [esp + 0x6c], 0x5d5a5b58
mov dword [esp + 0x70], 0x69aa5edb
mov dword [esp + 0x74], 0xd11e8a8
mov dword [esp + 0x78], 0x69666764
mov dword [esp + 0x7c], 0xa51ae0a0
mov dword [esp + 0x80], 0x90462be9
mov dword [esp + 0x84], 0x393e36ae
mov dword [esp + 0x88], 0x353a3b38
mov dword [esp + 0x8c], 0x31363734
mov dword [esp + 0x90], 0x84b6a6aa
mov dword [esp + 0x94], 0x8eca3b6c
mov dword [esp + 0x98], 0xe8bcf4a
mov dword [esp + 0x9c], 0xd0a0b08
mov dword [esp + 0xa0], 0xd96e3cc4
mov dword [esp + 0xa4], 0x1536d79b
mov dword [esp + 0xa8], 0x19ed98dc
mov dword [esp + 0xac], 0x351a1b18
mov dword [esp + 0xb0], 0x211e1f74
mov dword [esp + 0xb4], 0xe3afeb20
mov dword [esp + 0xb8], 0xe7abef04
mov dword [esp + 0xbc], 0xbba7e300
mov dword [esp + 0xc0], 0x312e2f2c
mov dword [esp + 0xc4], 0x11f6bcfc
mov dword [esp + 0xc8], 0x29bdfc34
mov dword [esp + 0xcc], 0x3dbc72f0
mov dword [esp + 0xd0], 0xc13e3f3c
mov dword [esp + 0xd4], 0xdc2c3c0
mov dword [esp + 0xd8], 0xdec7bd4f
mov dword [esp + 0xdc], 0xcdcacbc8
mov dword [esp + 0xe0], 0xf5024204
mov dword [esp + 0xe4], 0xb6e11bd0
mov byte [esp + 0xe8], 0xd4
mov byte [esp + 0xeb], 0
mov word [esp + 0xe9], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x60]
mov edi, eax
and edi, 0x1a
mov ebx, ecx
xor ebx, 0xd
add ebx, edi
lea edi, [edx + edx]
not edi
add edi, edx
and edi, 0x1d
and edx, 0xffffffe2
or edx, edi
xor edx, ebx
xor dl, 0x1d
add dl, 0xbf
mov byte [esp + ecx + 0x60], dl
inc ecx
add eax, 2
cmp ecx, 0x8c
jne 0x370130
lea eax, [esp + 0x140]
lea edx, [esp + 0x60]
lea ecx, [esp + 0x130]
push eax
push 0x88
push edx
lea ebx, [esp + 0x40]
push ebx
call fcn.0038fc90
mov dword [esp + 0x12c], edx
mov dword [esp + 0x128], eax
or eax, edx
je 0x371012
mov dword [esp + 0x140], 0x7b14eb18
mov byte [esp + 0x144], 0x60
mov dword [esp + 0x145], 0
mov dword [esp + 0x148], 0
mov eax, 0x77cf9de9
mov ecx, 0x16
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x77cf9ca9]
mov edi, ecx
xor edi, eax
and edi, edx
xor edi, eax
mov edx, edi
and edx, 0x72
xor edi, 0x72
lea edx, [edi + edx*2]
inc dl
mov byte [esp + eax - 0x77cf9ca9], dl
inc eax
dec ecx
cmp eax, 0x77cf9df5
jne 0x3701e0
movzx eax, byte [esp + 0x140]
test al, al
je 0x37022b
lea ecx, [esp + 0x141]
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x370220
mov byte [esi], 0
lea eax, [esp + 0x128]
lea ecx, [esp + 0x130]
push 0
push 8
push eax
push ebx
call fcn.0038fc90
mov dword [esp + 0x124], edx
mov dword [esp + 0x120], eax
or eax, edx
je 0x371012
mov dword [esp + 0x140], 0xc96c6c62
mov byte [esp + 0x144], 0xec
mov dword [esp + 0x145], 0
mov word [esp + 0x149], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add al, 0x2c
xor al, byte [esp + ecx + 0x140]
add al, 0x24
mov byte [esp + ecx + 0x140], al
inc ecx
cmp ecx, 0xb
jne 0x370290
movzx eax, byte [esp + 0x140]
test al, al
je 0x3702cb
lea ecx, [esp + 0x141]
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x3702c0
mov byte [esi], 0
lea eax, [esp + 0x120]
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x34]
push 0
push 8
push eax
push edx
call fcn.0038f020
mov eax, dword [esp + 0x4c]
cmp eax, dword [esp + 0x50]
je 0x371012
mov dword [esp + 0x140], 0x39a73baf
mov dword [esp + 0x144], 0x258a2793
mov dword [esp + 0x148], 0x2189238d
mov dword [esp + 0x14c], 0x2d852ff2
mov dword [esp + 0x150], 0x29812bb4
lea eax, [esp + 0x154]
mov word [esp + 0x154], 0x1728
mov dword [esp + 0x156], 0
mov word [esp + 0x15a], 0
mov ecx, 0xcb
mov edx, 0x34
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x75]
mov edi, ecx
or edi, ebx
not ebx
or ebx, edx
and ebx, edi
add bl, 9
mov byte [esp + ecx + 0x75], bl
inc ecx
dec edx
cmp ecx, 0xe7
jne 0x370360
lea edi, [esp + 0x2de]
lea edx, [esp + 0x140]
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x2f2]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x140], 0x31d2d5e9
mov byte [esp + 0x144], 0x4c
mov dword [esp + 0x145], 0
mov word [esp + 0x149], 0
mov eax, 0xfc266d72
mov ecx, 0x3d9928d
nop
nop
nop
nop
mov dword [esp + 4], ecx
movzx edx, byte [esp + eax + 0x3d993ce]
mov edi, eax
and edi, edx
add edi, edi
sub edi, edx
add edi, ecx
or edi, ecx
add edi, eax
inc edi
mov ecx, edi
and ecx, 2
mov ebx, edi
or edi, 2
imul edi, ecx
xor ecx, 2
and ebx, 0xfffffffd
imul ebx, ecx
add edi, ebx
mov ecx, edi
not ecx
and ecx, eax
and edi, dword [esp + 4]
sub ecx, edi
lea edi, [ecx + edx]
add edx, ecx
add edx, 0xc5
mov ecx, 0x3a
sub ecx, edi
or edx, 1
add edx, edi
or ecx, 1
add edx, ecx
mov ecx, dword [esp + 4]
add dl, 0xc6
mov byte [esp + eax + 0x3d993ce], dl
inc eax
dec ecx
cmp eax, 0xfc266d7d
jne 0x3703e0
movzx eax, byte [esp + 0x140]
test al, al
je 0x37047b
lea ecx, [esp + 0x141]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x370470
mov byte [esi], 0
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x108], ecx
cmp eax, ecx
je 0x371012
mov dword [esp + 0xc], 0
lea ebx, [esp + 0x34]
jmp 0x3704cf
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10c]
add eax, 8
cmp eax, dword [esp + 0x108]
je 0x3710cd
mov ecx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 0x10c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
push 0x198
push 0
invalid
test byte [eax + ecx*2], ah