Function at 0xebda80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa4
cmp dword [ecx + 0x20], 0
je 0xebdf42
mov esi, ecx
movzx eax, byte [ecx]
lea ecx, [esp + 0xa0]
push 0xa
push 4
push ecx
push eax
call fcn.00ebdf60
add esp, 0x10
mov ebx, eax
lea eax, [esi + 0x10]
push eax
call fcn.00eba720
add esp, 4
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp], ecx
lea eax, [ecx + 0x400]
push eax
call fcn.00ebc880
add esp, 4
mov edi, eax
mov dword [esp + 0x18], 0xcbcfb2c0
mov byte [esp + 0x1c], 0x34
mov dword [esp + 0x1d], 0
mov dword [esp + 0x20], 0
mov eax, 0x76
mov ebp, 0x89
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebp
and ecx, 0x98
mov edx, eax
and edx, 0x67
or edx, ecx
xor dl, byte [esp + eax - 0x5e]
xor dl, 0x98
add dl, 0xb2
mov byte [esp + eax - 0x5e], dl
inc eax
dec ebp
cmp eax, 0x82
jne 0xebdb10
lea ebp, [esp + 0x18]
mov ecx, esi
push 0xeff000
push ebp
push edi
call fcn.00ebd490
mov dword [esp + 0x18], 0x37cac0c8
mov dword [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xf6
xor cl, byte [esp + eax + 0x18]
add cl, 0x32
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 8
jne 0xebdb60
mov ecx, esi
push ebx
push ebp
push edi
call fcn.00ebd490
mov eax, dword [0xef9660]
mov dword [esp + 0x18], 0xd7baa0bc
mov word [esp + 0x1c], 0
mov byte [esp + 0x1e], 0
mov ecx, 0xf085c3ce
nop
nop
movzx edx, byte [esp + ecx + 0xf7a3c4a]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0xfa
mov byte [esp + ecx + 0xf7a3c4a], dl
inc ecx
cmp ecx, 0xf085c3d5
jne 0xebdba0
mov ecx, esi
push eax
push ebp
push edi
call fcn.00ebd490
mov dword [esp + 0x18], 0x7d686071
mov dword [esp + 0x1c], 0x68656c79
mov dword [esp + 0x20], 0x6a6b7469
mov byte [esp + 0x24], 0xd0
mov dword [esp + 0x25], 0
mov eax, 0xaf
mov ecx, 0x62c4e550
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x97]
mov ebx, eax
xor ebx, ecx
and ebx, edx
xor ebx, ecx
mov edx, 0xca574a52
sub edx, ebx
mov ebx, edx
and ebx, 0x42
xor edx, 0x42
lea edx, [edx + ebx*2]
mov byte [esp + eax - 0x97], dl
inc eax
dec ecx
cmp eax, 0xc0
jne 0xebdc10
mov dword [esp + 4], 0x61ea1a07
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov eax, 0xe9
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xe5]
lea ecx, [eax - 0x59787300]
mov ebx, eax
and ebx, edx
or ecx, edx
xor ecx, ebx
add ecx, 0x4696c68e
mov edx, ecx
xor edx, 0x1c
and ecx, 0x63
add ecx, ecx
sub ecx, edx
inc cl
mov byte [esp + eax - 0xe5], cl
inc eax
cmp eax, 0xf0
jne 0xebdc60
lea eax, [esp + 4]
mov ecx, esi
push ebp
push eax
push edi
call fcn.00ebd490
mov dword [esp + 0x18], 0xbab2b0b2
mov byte [esp + 0x1c], 0x1c
mov word [esp + 0x1d], 0
mov byte [esp + 0x1f], 0
mov eax, 0x3b
mov ecx, 0xc5
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x23]
mov ebp, edx
not ebp
or ebp, ecx
add ebp, eax
and edx, ecx
or edx, ebp
add dl, 0xde
mov byte [esp + eax - 0x23], dl
inc eax
dec ecx
cmp eax, 0x43
jne 0xebdcd0
mov ecx, esi
push dword [esp]
push dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00ebd770
mov eax, dword [esi + 0x60]
mov dword [esp], eax
mov dword [esp + 0x18], 0x23bd2163
mov dword [esp + 0x1c], 0x27b225ba
mov dword [esp + 0x20], 0x5bc4593d
mov dword [esp + 0x24], 0x5f035dc8
mov dword [esp + 0x28], 0x53db5124
mov dword [esp + 0x2c], 0x573355c4
mov dword [esp + 0x30], 0x4b6a4902
mov dword [esp + 0x34], 0x4fdb4dd1
mov dword [esp + 0x38], 0x43d641dc
mov dword [esp + 0x3c], 0x47d645dd
mov dword [esp + 0x40], 0x7be87919
mov dword [esp + 0x44], 0x7f217de8
mov dword [esp + 0x48], 0x73ed7116
mov dword [esp + 0x4c], 0x77eb75e6
mov dword [esp + 0x50], 0x6b0e6935
mov dword [esp + 0x54], 0x6ffa6d0d
mov dword [esp + 0x58], 0x63296101
mov dword [esp + 0x5c], 0x67046544
mov dword [esp + 0x60], 0x9b0f9907
mov dword [esp + 0x64], 0x9ffa9d02
mov dword [esp + 0x68], 0x930091f1
mov dword [esp + 0x6c], 0x97db951d
mov dword [esp + 0x70], 0x8bef89ea
mov dword [esp + 0x74], 0x8fdb8dc4
mov dword [esp + 0x78], 0x83e781e4
mov dword [esp + 0x7c], 0x871f85d1
mov dword [esp + 0x80], 0xbbdeb928
mov dword [esp + 0x84], 0xbfddbd23
mov dword [esp + 0x88], 0xb3d7b129
mov dword [esp + 0x8c], 0xb724b526
mov dword [esp + 0x90], 0xabfba9cd
mov dword [esp + 0x94], 0xaf94ad91
mov word [esp + 0x98], 0xa1a0
mov word [esp + 0x9e], 0
mov dword [esp + 0x9a], 0
mov ecx, 0x496665b8
mov edx, 0x36999a47
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x496665a0]
mov eax, ecx
or eax, 0x26980117
mov ebp, ecx
and ebp, 0x117
xor ebp, 0x37b9dbff
or ebp, edx
and ebp, eax
xor ebp, ebx
mov eax, ebp
not eax
and eax, 1
xor ebp, 0x16
lea eax, [eax*2]
add eax, ebp
add al, 0x67
mov byte [esp + ecx - 0x496665a0], al
inc ecx
dec edx
cmp ecx, 0x49666640
jne 0xebde50
mov dword [esp + 4], 0x6303615f
mov dword [esp + 8], 0x671f6514
mov word [esp + 0xc], 0x7978
mov dword [esp + 0xe], 0
mov word [esp + 0x12], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 4]
mov edx, ecx
and edx, 8
mov ebx, ecx
or ebx, 0xd746f7e8
add ebx, edx
lea edx, [eax + ebx]
add edx, 0xcb9d2877
and ebx, eax
add ebx, ebx
mov eax, edx
sub eax, ebx
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
mov byte [esp + ecx + 4], al
inc ecx
cmp ecx, 0x10
jne 0xebded0
push 0x493e0
push dword [esp + 4]
push edi
push 0
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00ec0460
add esp, 0x1c
mov ebx, eax
push edi
call fcn.00ebc890
add esp, 4
mov eax, dword [esi + 0x60]
add dword [esi + 4], eax
mov dword [esi + 0x60], 0
jmp 0xebdf44
mov bl, 1
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret