Function at 0x40e5b2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x198
mov eax, dword [0x44d160]
mov dword [esp + 4], eax
mov dword [esp + 0x118], 0x3020900
mov byte [esp + 0x11c], 0
mov ecx, 0xbe679c40
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x419864d8]
xor edx, ecx
neg edx
mov esi, edx
and esi, 0x41
xor edx, 0x41
lea edx, [edx + esi*2]
mov bl, 1
sub bl, dl
mov byte [esp + ecx + 0x419864d8], bl
inc ecx
cmp ecx, 0xbe679c45
jne 0x40e2f0
mov ecx, dword [esp + 0x118]
mov dword [esp + 0x18], 0x33ab31bf
mov dword [esp + 0x1c], 0x2fb62dba
mov dword [esp + 0x20], 0x2ba629a4
mov dword [esp + 0x24], 0x27f025b4
mov dword [esp + 0x28], 0x23b621bc
mov dword [esp + 0x2c], 0x1f1e1d88
mov word [esp + 0x30], 0
mov byte [esp + 0x32], 0
xor edx, edx
movzx esi, byte [esp + edx + 0x18]
lea edi, [edx - 0x2e041d34]
lea ebx, [edx + 0xcc]
or edi, ebx
and edi, esi
mov ebx, edi
and ebx, 2
mov ebp, edi
or ebp, 0xfffffffd
inc ebp
mov eax, edi
and eax, 0xfffffffd
imul eax, ebp
or edi, 2
imul edi, ebx
sub eax, edi
add esi, edx
add esi, 0xd1fbe2cc
add esi, eax
mov ebx, esi
and ebx, 3
add ebx, ebx
xor esi, 0xfc
sub ebx, esi
mov byte [esp + edx + 0x18], bl
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, 0x1b
jb case.default.0x40e3d7
lea esi, [esp + 0x18]
push ecx
push 0
push esi
call dword [esp + 0x10]
mov ecx, 0x44d128
push eax
call fcn.0043e820
movzx eax, al
jmp dword [eax*4 + 0x447ac4]
xor ebx, ebx
jmp 0x40ea35
push 0xf2ffbc90
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d130], eax
push 0x5c21b65e
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d134], eax
push 0xc2eb3b71
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d138], eax
push 0xa645cf1f
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d13c], eax
push 0xf379b9d8
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d140], eax
push 0xd225aa76
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d144], eax
push 0xa373434b
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d148], eax
push 0xce21043e
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d14c], eax
push 0x7eecc3d7
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d150], eax
push 0x2c692ac4
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d154], eax
push 0xf13635ff
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d158], eax
push 0x8040f1d2
push dword [0x44d128]
call fcn.00442130
add esp, 8
mov dword [0x44d15c], eax
xor ebx, ebx
xor eax, eax
cmp ebx, 0x24
setne al
xor ebp, ebp
jmp dword [eax*4 + 0x447acc]
lea edi, [esp + 0x118]
push edi
push dword [ebp + 0x4459a4]
call fcn.0043a260
add esp, 8
push 0
push edi
push 0x80
push esi
call fcn.0040ea50
add esp, 0x10
push esi
call fcn.0040ecd0
add esp, 4
movzx ecx, al
mov eax, 1
jmp dword [ecx*4 + 0x447ad4]
movzx ecx, word [esp + 0x18]
mov eax, 0x44d164
test cx, cx
je 0x40e591
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x40e580
mov word [eax], 0
mov ecx, dword [case.0x40e3d7.4]
nop
nop
nop
nop
xor eax, eax
mov bl, 1
jmp ecx
mov ecx, dword [case.0x40e3d7.13]
nop
nop
nop
nop
jmp ecx
jmp dword [eax*4 + 0x447afc]
add ebp, 4
xor eax, eax
cmp ebp, 0x24
setne al
jmp dword [eax*4 + 0x447acc]
mov eax, ebx
and al, 1
movzx eax, al
jmp dword [eax*4 + 0x447b04]
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x23b621b8
mov dword [esp + 0x1c], 0x27b625b0
mov dword [esp + 0x20], 0xdb10d94b
mov dword [esp + 0x24], 0xdf01dd03
mov dword [esp + 0x28], 0xd346d143
mov dword [esp + 0x2c], 0xd737d531
mov dword [esp + 0x30], 0xcb29c955
mov dword [esp + 0x34], 0xcf53cd53
mov dword [esp + 0x38], 0xc357c15d
mov dword [esp + 0x3c], 0xc75fc55a
mov dword [esp + 0x40], 0xfb73f96c
mov dword [esp + 0x44], 0xff1dfd22
mov dword [esp + 0x48], 0xf36ff16f
mov dword [esp + 0x4c], 0xf766f52b
mov dword [esp + 0x50], 0xeb75e97a
mov dword [esp + 0x54], 0xef77ed0a
mov dword [esp + 0x58], 0xe307e17c
mov dword [esp + 0x5c], 0xe739e577
mov dword [esp + 0x60], 0x9b4c994f
mov dword [esp + 0x64], 0x9f489d49
mov dword [esp + 0x68], 0x93439141
mov dword [esp + 0x6c], 0x975f955d
mov dword [esp + 0x70], 0x8b58895f
mov dword [esp + 0x74], 0x8f5d8d58
mov dword [esp + 0x78], 0x83538153
mov dword [esp + 0x7c], 0x8756854d
mov dword [esp + 0x80], 0xbbbab968
mov byte [esp + 0x84], 0
mov eax, 0x24f69a87
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esi]
mov ecx, eax
or ecx, edx
lea edi, [eax - 0x24f69a00]
and edi, edx
not ecx
or ecx, edi
add ecx, 0xb8d104a7
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esi], cl
inc esi
dec eax
cmp eax, 0x24f69a1a
jne 0x40e6e0
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
lea edi, [esp + 0x18]
push eax
push ecx
push edi
call fcn.0040f250
add esp, 0xc
movzx eax, al
jmp dword [eax*4 + 0x447b0c]
mov dword [esp + 0x18], 0x7666760c
mov dword [esp + 0x1c], 0x677d3566
mov dword [esp + 0x20], 0x1a616e71
mov dword [esp + 0x24], 0x67757c32
mov dword [esp + 0x28], 0x4127865
mov dword [esp + 0x2c], 0x1c1c0814
mov dword [esp + 0x30], 0xc0f1313
mov dword [esp + 0x34], 0x61f0c1e
mov word [esp + 0x38], 0x6b46
mov byte [esp + 0x3a], 0xb6
mov dword [esp + 0x3b], 0
mov eax, 0x2e
mov ebp, 0xd1
nop
nop
movzx esi, byte [esp + eax - 0x16]
mov edx, eax
xor edx, ebp
and edx, esi
xor edx, ebp
mov cl, 0x19
sub cl, dl
mov byte [esp + eax - 0x16], cl
inc eax
dec ebp
cmp eax, 0x55
jne 0x40e790
mov ebp, dword [esp + 8]
movzx eax, byte [esp + 0x18]
mov dword [esp], ebp
test al, al
je 0x40e7f2
mov ecx, edi
mov ebp, dword [esp]
mov edx, ebp
jmp 0x40e7d7
movzx eax, byte [ecx]
test al, al
je 0x40e7f2
mov ah, byte [edx]
test ah, ah
je 0x40e7f0
inc edx
inc ecx
lea esi, [ebp + 1]
cmp ah, al
je 0x40e7ea
mov ebp, esi
mov edx, esi
je 0x40e7d0
mov ecx, edi
jmp 0x40e7d0
xor ebp, ebp
xor eax, eax
test ebp, ebp
setne al
jmp dword [eax*4 + 0x447b14]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], 0xf1ebb6a0
mov dword [esp + 0x1c], 0x5da4f5c3
mov word [esp + 0x20], 0
mov ecx, 0x3a296c19
mov esi, 0xc5d693e8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x3a296c01]
mov dword [esp + 4], edx
mov eax, ecx
and eax, edx
mov edi, eax
and edi, 0x3d
mov edx, eax
and edx, 2
mov ebp, eax
or ebp, 0xfffffffd
inc ebp
imul ebp, edi
or eax, 2
imul eax, edx
mov edx, dword [esp + 4]
lea edi, [edx + ebp]
sub edi, eax
add edi, ecx
and edi, 1
sub eax, ebp
sub eax, edx
lea edx, [esi + eax]
add eax, esi
add eax, 0x7c
and eax, 0xfe
or edx, 0xfe
xor edx, eax
lea eax, [edx + edi*2]
mov byte [esp + ecx - 0x3a296c01], al
inc ecx
dec esi
cmp ecx, 0x3a296c23
jne 0x40e830
movzx eax, byte [esp + 0x18]
mov ebp, dword [esp + 0xc]
mov ecx, ebp
test al, al
je 0x40e8d6
lea edx, [esp + 0x18]
mov esi, edx
mov edi, ebp
mov ecx, ebp
jmp 0x40e8b7
movzx eax, byte [esi]
test al, al
je 0x40e8d6
mov ah, byte [edi]
test ah, ah
je 0x40e8d4
inc edi
inc esi
lea ebp, [ecx + 1]
cmp ah, al
je 0x40e8ca
mov ecx, ebp
mov edi, ebp
mov ebp, dword [esp + 0xc]
je 0x40e8b0
mov esi, edx
jmp 0x40e8b0
xor ecx, ecx
xor eax, eax
test ecx, ecx
setne al
jmp dword [eax*4 + 0x447b1c]
mov byte [ecx], 0
mov ecx, 0xffffffff
nop
nop
nop
nop
mov eax, ecx
cmp byte [ebp + ecx + 0x23], 0
lea ecx, [ecx + 1]
jne 0x40e8f0
mov ebp, dword [case.0x40e3d7.26]
mov esi, dword [0x447b5c]
xor edx, edx
mov edi, dword [0x447b78]
mov dword [esp + 0x10], ecx
jmp case.0x40e3d7.24
jmp ebp
xor eax, eax
cmp edx, ecx
setb al
jmp dword [eax*4 + 0x447b34]
push dword [esp]
call fcn.0043cf50
add esp, 4
mov eax, dword [case.0x40e3d7.17]
nop
jmp eax
and bl, 1
mov eax, ebx
add esp, 0x198
pop esi
pop edi
pop ebx
pop ebp
ret