Function at 0x409500
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
mov dword [esp + 4], ecx
mov eax, dword [ecx + 0x80]
mov dword [esp], eax
mov dword [esp + 0x18], 0x9fa4a653
mov dword [esp + 0x1c], 0x1ae2dbd1
mov dword [esp + 0x20], 0xd6dae0c4
mov dword [esp + 0x24], 0xebc7052e
mov dword [esp + 0x28], 0xdbc1c0ec
mov dword [esp + 0x2c], 0xf3c8c0c9
mov dword [esp + 0x30], 0xcc0ff10f
mov dword [esp + 0x34], 0xd4cbcfd6
mov dword [esp + 0x38], 0x666864fc
mov dword [esp + 0x3c], 0x4d56
mov byte [esp + 0x40], 0
xor edi, edi
xor ebp, ebp
movzx ebx, byte [esp + ebp + 0x18]
mov edx, edi
and edx, 0x78
mov esi, ebp
xor esi, 0xad51583c
add esi, edx
lea edx, [esi + esi]
not edx
add edx, esi
or edx, ebx
not ebx
or ebx, esi
and ebx, edx
mov esi, 0x9d6946d2
sub esi, ebx
mov eax, esi
xor eax, 0xfffffffe
mov edx, esi
or edx, 1
and edx, eax
mov eax, edx
and eax, 0xfd
mov ecx, edx
and ecx, 2
or edx, 2
imul edx, ecx
xor ecx, 2
imul ecx, eax
and esi, 1
lea eax, [ebx + esi*2]
sub edx, eax
add edx, ecx
add dl, 0xd3
mov byte [esp + ebp + 0x18], dl
inc ebp
add edi, 2
cmp ebp, 0x29
jne 0x409570
mov dword [esp + 0x10], 0xf10142e
mov byte [esp + 0x14], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edi + 0x10]
mov edx, edi
xor edx, 0xeb44423d
mov ecx, edi
or ecx, 0x14bbbdc2
and edx, ecx
add edx, ecx
mov ecx, edx
and ecx, eax
add edx, eax
add ecx, ecx
sub edx, ecx
add dl, 0x36
mov byte [esp + edi + 0x10], dl
inc edi
cmp edi, 5
jne 0x4095f0
mov dword [esp + 0x44], 0x78afe597
mov dword [esp + 0x48], 0x7f457b7a
mov dword [esp + 0x4c], 0x7e968078
mov dword [esp + 0x50], 0x40474745
mov dword [esp + 0x54], 0x48754f7b
mov dword [esp + 0x58], 0x77be814a
mov dword [esp + 0x5c], 0x9251554d
mov dword [esp + 0x60], 0x62526064
mov dword [esp + 0x64], 0x6e58ab99
mov dword [esp + 0x68], 0xab8d645b
mov dword [esp + 0x6c], 0x9a9e9c66
mov dword [esp + 0x70], 0x9f566a56
mov dword [esp + 0x74], 0xab91979b
mov dword [esp + 0x78], 0x7e95ac9f
mov word [esp + 0x7c], 0x235a
mov dword [esp + 0x7e], 0
mov word [esp + 0x82], 0
xor edi, edi
mov ebp, dword [esp + 4]
nop
movzx eax, byte [esp + edi + 0x44]
lea esi, [edi - 0x5d7258a9]
mov ecx, eax
not ecx
or ecx, 0xfff33680
add ecx, eax
inc ecx
and eax, 0x7f
xor eax, 0xcc97f
or ecx, eax
lea edx, [edi + 0xda757]
and esi, 0xa2812680
or edx, 0xfff33680
xor edx, esi
xor edx, ecx
mov ecx, 2
sub ecx, edx
sub ecx, edx
and ecx, 2
xor edx, 0xfe
add edx, ecx
add dl, 0x4c
mov byte [esp + edi + 0x44], dl
mov eax, edi
and eax, 1
xor edi, 1
lea edi, [edi + eax*2]
cmp edi, 0x40
jb 0x4096b0
mov ecx, dword [esp + 0x98]
add ecx, dword [esp]
mov word [esp + 8], 0x3435
mov byte [esp + 0xa], 0xe
mov dword [esp + 0xb], 0
mov byte [esp + 0xf], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
add al, 0x42
xor al, byte [esp + edx + 8]
add al, 0xb6
mov byte [esp + edx + 8], al
inc edx
cmp edx, 8
jne 0x409740
movzx ebx, byte [esp + 8]
mov edx, ecx
test bl, bl
je 0x40977b
lea esi, [esp + 9]
mov edx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x409770
mov byte [edx], 0
movzx ebx, byte [ebp + 0x60]
test bl, bl
mov eax, dword [esp + 0x9c]
je 0x40979b
lea esi, [ebp + 0x61]
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x409790
mov byte [edx], 0
movzx ebx, byte [esp + 0x44]
test bl, bl
je 0x4097bb
lea esi, [esp + 0x45]
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x4097b0
mov byte [edx], 0
movzx ebx, byte [eax]
test bl, bl
mov dword [esp], ecx
je 0x4097db
inc eax
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [eax]
inc eax
test bl, bl
jne 0x4097d0
mov byte [edx], 0
movzx ecx, byte [esp + 0x10]
test cl, cl
je 0x4097fb
lea esi, [esp + 0x11]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x4097f0
mov byte [edx], 0
movzx ecx, byte [esp + 0x18]
test cl, cl
je 0x40981b
lea esi, [esp + 0x19]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409810
mov byte [edx], 0
mov ebp, dword [esp + 0xa4]
mov ecx, ebp
shr ecx, 2
mov ebx, dword [esp + 0xa0]
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov esi, ebp
and esi, 0xfffffffc
add edx, esi
add esi, ebx
mov ebx, ebp
and ebx, 3
mov ecx, ebx
shr ecx, 1
mov eax, esi
mov edi, edx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor ebx, 1
mov eax, ebp
mov ecx, ebp
or ecx, 2
and ecx, ebx
add edx, ecx
test al, 1
je 0x40986d
movzx eax, byte [esi + ecx]
mov byte [edx], al
inc edx
mov edi, dword [esp + 4]
mov dword [esp + 0x44], 0x4f494d4f
mov byte [esp + 0x48], 0x38
mov dword [esp + 0x49], 0
mov ecx, 0x31d0650b
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx - 0x31d064c7]
xor eax, ecx
mov esi, eax
and esi, 1
xor eax, 1
lea eax, [eax + esi*2]
add al, 0xc8
mov byte [esp + ecx - 0x31d064c7], al
inc ecx
cmp ecx, 0x31d06514
jne 0x409890
mov dword [esp + 0x18], 0xeae985b7
mov byte [esp + 0x1c], 0xb8
mov dword [esp + 0x1d], 0
mov word [esp + 0x21], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add al, 0x9f
xor al, byte [esp + ecx + 0x18]
add al, 0xe5
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0xb
jne 0x4098e0
movzx ecx, byte [esp + 0x18]
test cl, cl
je 0x40991b
lea esi, [esp + 0x19]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409910
mov byte [edx], 0
movzx ecx, byte [edi + 0x60]
test cl, cl
je 0x40993b
lea esi, [edi + 0x61]
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409930
mov byte [edx], 0
movzx ecx, byte [esp + 0x44]
test cl, cl
je 0x40995b
lea esi, [esp + 0x45]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409950
mov byte [edx], 0
sub edx, dword [esp]
add dword [edi + 0x80], edx
add esp, 0x84
pop esi
pop edi
pop ebx
pop ebp
ret 0x10