Function at 0x409fb0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffe0
sub esp, 0x600
mov esi, dword [ebp + 0x18]
test esi, esi
js 0x40a301
je 0x409feb
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 1
push esi
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x40a30a
mov edi, eax
jmp 0x409ff0
mov edi, 1
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0x14]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp esi, 0x10
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
jb 0x40a2b0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xcc], 0x6b206574
mov dword [esp + 0xc8], 0x79622d32
mov dword [esp + 0xc4], 0x3320646e
mov dword [esp + 0xc0], 0x61707865
lea edx, [esi - 0x10]
mov dword [esp + 0x34], edx
movsd xmm1, qword [ecx + 8]
movsd xmm0, qword [ecx]
movsd xmm2, qword [ecx + 0x18]
movsd qword [esp + 0xd8], xmm1
movsd xmm1, qword [ecx + 0x10]
movsd qword [esp + 0xd0], xmm0
movsd qword [esp + 0xe8], xmm2
movsd qword [esp + 0xe0], xmm1
movsd xmm1, qword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0x3a8], eax
lea eax, [edi + esi - 0x10]
movsd qword [esp + 0x3a0], xmm1
mov dword [esp + 0x30], eax
mov eax, dword [0x5000b0]
movzx eax, byte [eax]
cmp al, 0xff
je 0x40a2f7
movsd xmm0, qword [esp + 0xe8]
movsd xmm1, qword [esp + 0xc8]
mov eax, dword [esp + 0x3a8]
mov esi, esp
lea ecx, [esp + 0x38]
mov edx, esi
movsd qword [esp + 0x60], xmm0
movsd xmm0, qword [esp + 0xe0]
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x58], xmm0
movsd xmm0, qword [esp + 0xd8]
movsd qword [esp + 0x50], xmm0
movsd xmm0, qword [esp + 0xd0]
movsd qword [esp + 0x48], xmm0
movsd xmm0, qword [esp + 0xc0]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [esp + 0x3a0]
mov dword [esp + 0x68], 0
mov dword [esp + 0x74], eax
movsd qword [esp + 0x6c], xmm0
xorps xmm0, xmm0
mov byte [esp + 0xb8], 0
movsd qword [esp + 0x78], xmm0
movsd qword [esp + 0x80], xmm0
movsd qword [esp + 0x88], xmm0
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0x98], xmm0
movsd qword [esp + 0xa0], xmm0
movsd qword [esp + 0xa8], xmm0
movsd qword [esp + 0xb0], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push 0x20
call fcn.00408380
add esp, 4
lea ebx, [esp + 0x3a0]
push esi
push ebx
call fcn.00451030
add esp, 8
mov byte [esp], 0
mov byte [esp + 1], 0
mov byte [esp + 2], 0
mov byte [esp + 3], 0
mov byte [esp + 4], 0
mov byte [esp + 5], 0
mov byte [esp + 6], 0
mov byte [esp + 7], 0
mov byte [esp + 8], 0
mov byte [esp + 9], 0
mov byte [esp + 0xa], 0
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0
mov byte [esp + 0xd], 0
mov byte [esp + 0xe], 0
mov byte [esp + 0xf], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1f], 0
mov dword [esp + 0x68], 1
mov byte [esp + 0xb8], 0
lea eax, [esp + 0x300]
push 0x84
lea ecx, [esp + 0x3c]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea esi, [esp + 0xc0]
push 0x240
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [esp + 0x30]
mov ebx, dword [esp + 0x38]
push ebx
push edi
push 0
push 1
push esi
call fcn.00407ae0
add esp, 0x18
test al, al
je 0x40a2cb
mov esi, dword [esp + 0x24]
mov ebx, dword [ebp + 8]
test esi, esi
mov dword [ebx], 0x80000000
je 0x40a2ed
push 1
push esi
push dword [esp + 0x30]
call fcn.0040cd20
add esp, 0xc
jmp 0x40a2ed
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.00456230
add esp, 8
mov eax, dword [esp + 0x2c]
mov ebx, dword [ebp + 8]
movsd xmm0, qword [esp + 0x24]
mov dword [ebx + 8], eax
movsd qword [ebx], xmm0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00450790
jmp 0x40a0b4
xor eax, eax
push esi
push eax
call fcn.004cf340
mov eax, 1
push esi
push eax
call fcn.004cf340
nop word cs:[eax + eax]
push ebp
mov ebp, esp
push esi
push eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
lea esi, [ebp - 8]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0x14]
push edx
push ecx
push eax
push 0x57ae0c
push esi
call fcn.00480c10
add esp, 0x18
pop esi
pop ebp
ret