Function at 0x409120
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov esi, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [ecx + 0x80]
mov dword [esp + 0x18], eax
mov dword [esp], 0x4e7775
mov ebp, 0xec
mov ebx, 0x12
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + ebx - 0x12]
lea edx, [ebp + 1]
or edx, ecx
or ecx, ebx
mov eax, ebp
sub eax, edx
and eax, ecx
add al, 0xa6
mov byte [esp + ebx - 0x12], al
dec ebp
inc ebx
cmp ebx, 0x16
jne 0x409160
mov dword [esp + 0x10], 0xc2c0dce6
mov dword [esp + 0x14], 0xd5c2
mov ebx, 0xaa3f504e
mov ebp, 0xb1
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ebx + 0x55c0afc2]
mov ecx, edx
and ecx, ebx
mov eax, ecx
and eax, 2
mov edi, ecx
or ecx, 2
imul ecx, eax
xor eax, 2
and edi, 0x5d
imul edi, eax
add ecx, edi
mov eax, ecx
not eax
and eax, ebx
and ecx, ebp
sub eax, ecx
add al, dl
add al, 0x7a
mov byte [esp + ebx + 0x55c0afc2], al
inc ebx
dec ebp
cmp ebx, 0xaa3f5056
jne 0x4091a0
mov dword [esp + 0x20], 0xbce11b1d
mov dword [esp + 0x24], 0xb9c3b1ba
mov dword [esp + 0x28], 0x421e044c
mov dword [esp + 0x2c], 0x4c414d4f
mov dword [esp + 0x30], 0x4c4b4549
mov dword [esp + 0x34], 0x31f61f4a
mov dword [esp + 0x38], 0x16575b57
mov dword [esp + 0x3c], 0x2e5a2c28
mov dword [esp + 0x40], 0x225ce10b
mov dword [esp + 0x44], 0xe50b2059
mov byte [esp + 0x48], 0xf8
mov dword [esp + 0x49], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x78
xor cl, byte [esp + eax + 0x20]
add cl, 0xa8
mov byte [esp + eax + 0x20], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x2d
jb 0x409250
mov eax, dword [esp + 0x18]
add dword [esp + 0xc], eax
mov word [esp + 4], 3
mov byte [esp + 6], 0x3e
mov dword [esp + 7], 0
mov byte [esp + 0xb], 0
mov edi, 0xa60fd6f5
mov ebx, 0x59f0290a
nop
nop
nop
nop
nop
movzx eax, byte [esp + edi + 0x59f0290f]
mov ebp, edi
xor ebp, eax
or ebp, ebx
mov ecx, eax
and ecx, edi
not ebp
or ebp, ecx
mov ecx, ebp
and ecx, 2
mov edx, ebp
or ebp, 2
imul ebp, ecx
xor ecx, 2
and edx, 0xa60fd6fd
imul edx, ecx
add ebp, edx
lea edx, [ebx - 0x59f02900]
and edx, ebp
mov ecx, ebp
xor ecx, edi
add edx, edx
sub ecx, edx
add cl, al
add cl, 0x37
mov byte [esp + edi + 0x59f0290f], cl
inc edi
dec ebx
cmp edi, 0xa60fd6fd
jne 0x4092a0
movzx eax, byte [esp + 4]
mov ebx, dword [esp + 0xc]
mov edi, ebx
test al, al
je 0x40931b
lea ecx, [esp + 5]
mov edi, ebx
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409310
mov byte [edi], 0
mov edx, dword [esp + 0x1c]
movzx eax, byte [edx + 0x60]
test al, al
je 0x40933b
lea ecx, [edx + 0x61]
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409330
mov byte [edi], 0
movzx eax, byte [esp + 0x20]
test al, al
je 0x40935b
lea ecx, [esp + 0x21]
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409350
mov byte [edi], 0
movzx eax, byte [esi]
test al, al
je 0x40937b
inc esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [esi]
inc esi
test al, al
jne 0x409370
mov byte [edi], 0
movzx eax, byte [esp + 0x10]
test al, al
je 0x40939b
lea ecx, [esp + 0x11]
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409390
mov byte [edi], 0
mov ecx, dword [esp + 0x6c]
movzx eax, byte [ecx]
test al, al
je 0x4093bb
inc ecx
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4093b0
mov byte [edi], 0
movzx eax, byte [esp]
test al, al
je 0x4093db
lea ecx, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4093d0
mov byte [edi], 0
sub edi, ebx
add dword [edx + 0x80], edi
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret 0xc