Function at 0x440010
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x298
mov edx, dword [esp + 0x2b8]
mov dword [esp + 0x7f], 0xe48040
mov dword [esp + 0x7c], 0x4010ec83
mov dword [esp + 0x78], 0x48e78948
mov dword [esp + 0x74], 0xce8948fc
lea edi, [esp + 0x98]
lea eax, [esp + 0x74]
mov ecx, 3
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xa4]
lea eax, [esp + 0x80]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x82]
mov byte [esp + 0xa6], al
mov ebx, edx
cmp edx, 4
jb 0x440088
mov ebx, 4
lea ebp, [esp + 0xa7]
test edx, edx
je 0x440491
xor eax, eax
mov dword [esp + 8], ebx
jmp 0x4400a9
inc eax
cmp eax, ebx
je 0x4402c8
cmp eax, 3
ja case.default.0x4400ae
jmp dword [eax*4 + 0x444b00]
mov dword [esp + 0xc], 0x5948c61c
mov word [esp + 0x10], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
and edx, 5
mov edi, ecx
and edi, 2
mov ebx, ecx
or ebx, 2
imul ebx, edi
xor edi, 2
imul edi, edx
mov edx, ecx
xor edx, 0x6f
add edx, ebx
add edx, edi
xor dl, byte [esp + ecx + 0xc]
add dl, 0xd5
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 6
jne 0x4400d0
lea esi, [esp + 0xc]
mov edx, esi
xor ecx, ecx
mov edi, ebp
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
mov edi, ebp
mov ecx, 1
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0xe]
mov byte [ebp + 2], cl
add ebp, 3
mov ebx, dword [esp + 8]
jmp case.default.0x4400ae
mov dword [esp + 0xc], 0x23fcbae4
mov byte [esp + 0x10], 0x3c
mov dword [esp + 0x11], 0
mov ecx, 0x74
mov edi, 0xb
nop
mov esi, edi
and esi, 0x19
mov edx, ecx
and edx, 0xe6
or edx, esi
xor dl, byte [esp + ecx - 0x68]
xor dl, 0x19
add dl, 0xbc
mov byte [esp + ecx - 0x68], dl
inc ecx
dec edi
cmp ecx, 0x7d
jne 0x440160
lea edx, [esp + 0xc]
mov edi, ebp
mov ecx, 1
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add ebp, 4
lea edx, [esp + 0x10]
xor ecx, ecx
mov edi, ebp
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp case.default.0x4400ae
mov dword [esp + 0xc], 0x2b64ba64
mov byte [esp + 0x10], 0x3c
lea ecx, [esp + 0x10]
mov byte [ecx + 5], 0
mov dword [ecx + 1], 0
mov ecx, 0x34
mov edi, 0xcb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x28]
mov esi, ecx
or esi, edx
not edx
or edx, edi
and edx, esi
add dl, 0xfc
mov byte [esp + ecx - 0x28], dl
inc ecx
dec edi
cmp ecx, 0x3e
jne 0x4401e0
lea edx, [esp + 0xc]
mov edi, ebp
mov ecx, 1
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add ebp, 4
lea edx, [esp + 0x10]
xor ecx, ecx
mov edi, ebp
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
jmp case.default.0x4400ae
mov dword [esp], ebp
mov dword [esp + 0xc], 0xd9984284
mov byte [esp + 0x10], 0xd0
lea ecx, [esp + 0x10]
mov byte [ecx + 5], 0
mov dword [ecx + 1], 0
xor ebp, ebp
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi + 0xc]
mov ecx, ebp
and ecx, 0x1a
mov edx, edi
xor edx, 0xf08395cd
add ecx, edx
and edx, 1
and ecx, 0x9000903e
or ecx, edx
mov edx, ecx
xor edx, 1
mov esi, ebx
xor esi, 1
xor ecx, 0xfe
or ecx, esi
xor ebx, 0x3e
or ebx, edx
and ebx, ecx
mov cl, 0xfe
sub cl, bl
mov byte [esp + edi + 0xc], cl
inc edi
add ebp, 2
cmp edi, 0xa
jne 0x440250
lea edx, [esp + 0xc]
mov ebp, dword [esp]
mov edi, ebp
mov ecx, 1
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add ebp, 4
lea edx, [esp + 0x10]
xor ecx, ecx
mov edi, ebp
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov ebx, dword [esp + 8]
jmp case.default.0x4400ae
mov ebx, dword [esp + 0x2b8]
cmp ebx, 3
jbe 0x440491
test bl, 1
je 0x440300
mov eax, 0x445035
mov edx, 0x445035
mov edi, ebp
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edi, ebp
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
add ebp, 2
mov eax, ebx
and eax, 0xfffffff7
mov ecx, ebx
and ecx, 8
mov edx, ebx
or edx, 8
imul edx, ecx
xor ecx, 8
imul ecx, eax
add edx, ecx
mov esi, 0xffffffff
mov edi, 0xffffffff
cmp edx, 0x7ffffffe
ja 0x440971
mov dword [esp], ebp
dec ebx
cmp ebx, 4
jae 0x44034f
jmp 0x440494
mov dword [esp], esi
mov ebx, ebp
dec ebx
cmp ebx, 3
jbe 0x440494
mov ebp, ebx
lea eax, [ebx*8]
cmp eax, 0x7e
ja 0x440410
mov dword [esp + 0xc], 0x29d09ed4
mov word [esp + 0x10], 0x7d8
mov dword [esp + 0x12], 0
mov ecx, 0x7c686ac3
mov esi, 0x3c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx - 0x7c686ab7]
mov edx, esi
and edx, 0x39
mov ebx, ecx
and ebx, 0xc6
or ebx, edx
xor ebx, 0x39
and ebx, edi
or edi, ecx
lea edx, [ebx + ebx]
not edx
add edx, ebx
and edx, edi
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
add dl, 0x30
mov byte [esp + ecx - 0x7c686ab7], dl
inc ecx
dec esi
cmp ecx, 0x7c686acd
jne 0x440390
lea edx, [esp + 0xc]
mov esi, dword [esp]
mov edi, esi
mov ecx, 1
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esi + 4]
lea edx, [esp + 0x10]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x10]
mov byte [esi + 4], cl
mov byte [esi + 3], al
add esi, 5
jmp 0x440340
mov dword [esp + 0xc], 0xbfb4b6f0
mov dword [esp + 0x10], 0x93223d3c
mov byte [esp + 0x14], 0x20
mov dword [esp + 0x15], 0
xor ecx, ecx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, esi
xor edi, 0xb6
mov edx, ecx
and edx, 0x12
sub edx, edi
xor dl, byte [esp + esi + 0xc]
add dl, 0x8e
mov byte [esp + esi + 0xc], dl
inc esi
add ecx, 2
cmp esi, 0xd
jne 0x440440
lea edx, [esp + 0xc]
mov ecx, 2
mov ebx, dword [esp]
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea esi, [ebx + 8]
lea edx, [esp + 0x14]
mov edi, esi
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [ebx + 3], eax
jmp 0x440340
mov dword [esp], ebp
mov dword [esp + 0xc], 0x17628640
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov byte [esp + 0x10], 0x74
mov word [esp + 0x11], 0
mov byte [esp + 0x13], 0
mov ecx, 0x28eacb41
mov esi, 0x571534bd
nop
movzx eax, byte [esp + esi - 0x571534b1]
lea ebx, [esi + 1]
mov edx, ecx
and edx, 0x20a00914
mov edi, ebx
and edi, 0x170020eb
or edi, edx
xor edi, eax
xor edi, 0x1f4ae2eb
and edi, ebx
mov edx, edi
and edx, 2
mov ebp, edi
or edi, 2
imul edi, edx
xor edx, 2
and ebp, 0x170020fd
imul ebp, edx
add edi, ebp
mov edx, esi
sub edx, edi
add edi, ecx
add edi, 0x80000001
and edx, eax
not eax
and eax, edi
sub edx, eax
add dl, 0x4a
mov byte [esp + esi - 0x571534b1], dl
dec ecx
mov esi, ebx
cmp ecx, 0x28eacb39
jne 0x4404c0
lea eax, [esp + 0xc]
mov edx, dword [esp]
mov edi, edx
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea esi, [edx + 4]
mov edi, esi
xor ecx, ecx
mov eax, dword [esp + 8]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x93], 0xc3fc8948
mov dword [esp + 0x90], 0x48d2ff41
mov dword [esp + 0x84], 0xba49c031
mov eax, dword [esp + 0x2ac]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x2b0]
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x84]
mov edi, esi
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [edx + 0x14]
lea eax, [esp + 0x94]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x96]
mov byte [edx + 0x16], al
lea ecx, [esp + 0x98]
mov eax, ecx
neg eax
lea ebx, [edx + eax]
add ebx, 0x17
sub edx, ecx
add edx, 0x71
mov dword [esp + 0x70], edx
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0x888b8a8d
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc]
mov edx, eax
and edx, 5
xor edx, 0x4266571d
mov esi, eax
and esi, 2
sub esi, edx
xor esi, ecx
mov ecx, esi
and ecx, 1
xor esi, 1
lea ecx, [esi + ecx*2]
add cl, 0x90
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 7
jne 0x440600
mov esi, dword [esp + 0xc]
mov eax, dword [0x44da9c]
test eax, eax
je 0x440690
xor ecx, ecx
mov edx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x3e416e49
je 0x440660
inc ecx
cmp eax, ecx
jne 0x440650
jmp 0x440690
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x440690
lea ecx, [esp + 0x70]
lea edx, [esp + 4]
push 0x40
push 0x3000
push ecx
push 0
push edx
push 0xffffffffffffffff
push 6
push eax
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x24
mov esi, eax
test esi, esi
js 0x440940
mov dword [esp + 0xc], 0x47e9047b
mov dword [esp + 0x10], 0xbd253e49
mov dword [esp + 0x14], 0xd1ba7839
mov dword [esp + 0x18], 0xbdbabbb8
mov dword [esp + 0x1c], 0x8bfe3a44
mov dword [esp + 0x20], 0x2eaacf25
mov dword [esp + 0x24], 0xad64eec6
mov dword [esp + 0x28], 0xadaaab7d
mov dword [esp + 0x2c], 0x5fc6ad27
mov dword [esp + 0x30], 0xb3525350
mov dword [esp + 0x34], 0x2ad82cd8
mov dword [esp + 0x38], 0xbc6e1fdd
mov dword [esp + 0x3c], 0x491ca0a2
mov dword [esp + 0x40], 0x619ece40
mov dword [esp + 0x44], 0x9a8e6d45
mov dword [esp + 0x48], 0x3b4bb208
mov dword [esp + 0x4c], 0xb507bfad
mov dword [esp + 0x50], 0x75577754
mov dword [esp + 0x54], 0xa5fd7774
mov dword [esp + 0x58], 0x3ff1b35c
mov dword [esp + 0x5c], 0x22b63f5f
mov dword [esp + 0x60], 0x4963430a
lea edx, [esp + 0x64]
mov word [esp + 0x64], 0x6740
mov dword [esp + 0x66], 0
mov eax, 0x5d
mov esi, 0xa2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x51]
mov ecx, esi
xor ecx, eax
and ecx, edi
xor ecx, eax
add cl, 0x2f
mov byte [esp + eax - 0x51], cl
inc eax
dec esi
cmp eax, 0xbb
jne 0x440770
mov eax, dword [esp + 4]
lea esi, [esp + 0xc]
mov edi, eax
mov ecx, 0x16
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [eax + 0x58]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x64]
mov byte [eax + 0x58], cl
mov eax, dword [esp + 4]
mov dword [esp + 0xc], 0x2126278f
mov ecx, 0xf598ee89
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0xa671183]
xor edx, ecx
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
add dl, 0x52
mov byte [esp + ecx + 0xa671183], dl
inc ecx
cmp ecx, 0xf598ee8d
jne 0x4407d0
add eax, dword [esp + 0xc]
mov ecx, ebx
shr ecx, 2
lea edx, [esp + 0x98]
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
and ecx, 0xfffffffc
add eax, ecx
lea edx, [esp + ecx]
add edx, 0x98
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x440841
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [eax + ebx], cl
mov edi, dword [esp + 4]
mov dword [esp + 0xc], 0x636261c9
mov dword [esp + 0x10], 0
mov esi, 0x3edda918
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x3edda90c]
mov ebx, edx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x1d
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0x88
mov byte [esp + esi - 0x3edda90c], al
inc esi
cmp esi, 0x3edda920
jne 0x440860
mov eax, dword [esp + 0xc]
add eax, edi
push dword [esp + 0x2b4]
push eax
call edi
mov esi, eax
mov edi, edx
mov dword [esp + 0x6c], 0
mov dword [esp + 0xc], 0x888b8a8d
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xc]
mov edx, eax
and edx, 5
xor edx, 0x4266571d
mov ebx, eax
and ebx, 2
sub ebx, edx
xor ebx, ecx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
add cl, 0x90
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 7
jne 0x4408e0
mov eax, dword [0x44da9c]
test eax, eax
je 0x440971
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ebx, dword [0x44daa0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x16194952
je 0x440947
inc edx
cmp eax, edx
jne 0x440930
jmp 0x440971
mov edi, esi
sar edi, 0x1f
jmp 0x440971
mov eax, dword [ebx + edx*8 + 4]
cmp eax, ecx
je 0x440971
lea ecx, [esp + 0x6c]
lea edx, [esp + 4]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
push 4
push eax
push dword [0x44daa4]
call fcn.0043e1f0
add esp, 0x1c
mov eax, esi
mov edx, edi
add esp, 0x298
pop esi
pop edi
pop ebx
pop ebp
ret 0x10