Function at 0x409bb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb8
mov dword [esp + 0x78], ecx
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x18], eax
mov dword [esp + 0x80], 0xc7cccef3
mov dword [esp + 0x84], 0xac2cbd1
mov dword [esp + 0x88], 0x2e3a401c
mov dword [esp + 0x8c], 0x3b2fed06
mov dword [esp + 0x90], 0x3b212034
mov dword [esp + 0x94], 0x33382039
mov dword [esp + 0x98], 0x24e751e7
mov dword [esp + 0x9c], 0x3c3b273e
mov dword [esp + 0xa0], 0xcec8cc24
mov dword [esp + 0xa4], 0xd5ce
mov byte [esp + 0xa8], 0
mov ecx, 0x95794587
mov eax, 0x6a86ba7a
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], eax
mov dword [esp], ecx
movzx eax, byte [esp + eax - 0x6a86b9fa]
mov dword [esp + 0x1c], eax
not eax
lea ebx, [ecx + 0x6a86bb00]
or ebx, ecx
or ebx, eax
mov edx, ebx
not edx
mov edi, ebx
and edi, 2
mov ecx, edx
and ecx, 0xfffffffd
shr ebx, 1
and ebx, 1
imul ebx, ecx
mov esi, ecx
imul esi, edi
mov ecx, edx
and ecx, 2
or edx, 2
imul ecx, edx
add ecx, esi
mov esi, dword [esp]
add esi, ecx
inc esi
xor esi, dword [esp + 0x1c]
add ebx, dword [esp]
xor ecx, ecx
test edi, edi
sete cl
imul ecx, edx
add ecx, ebx
mov edx, dword [esp + 4]
lea edx, [edx + ecx*2]
or edx, eax
mov eax, edx
not eax
and edx, 2
mov ecx, eax
and ecx, 0xfffffffd
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 2
imul eax, edx
sub eax, esi
add eax, ecx
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x20]
mov ecx, edx
not ecx
lea eax, [edx + edx]
and eax, 0xd35e3290
neg eax
add eax, edx
add eax, 0xe9af1948
mov edi, edx
and edi, 0x1650e6b7
and edx, 0x1650e6b5
and ecx, 2
imul ecx, edx
mov edx, edi
xor edx, 0xfffffffd
or edi, 2
and edx, edi
imul edx, edi
add edx, ecx
mov ecx, edx
xor ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov ecx, dword [esp]
mov edx, dword [esp + 4]
mov byte [esp + edx - 0x6a86b9fa], al
mov eax, dword [esp + 4]
dec ecx
inc eax
cmp ecx, 0x9579455e
jne 0x409c50
mov dword [esp + 8], 0x3b323654
mov dword [esp + 0xc], 0
mov dword [esp + 0xf], 0
mov dword [esp + 0x20], 0x8a2489d3
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 8], al
movzx eax, byte [esp + 9]
xor eax, 0x75db7677
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 9], al
movzx eax, byte [esp + 0xa]
xor eax, 0x75db7676
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0xa], al
movzx eax, byte [esp + 0xb]
xor eax, 0x75db7675
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0xb], al
movzx eax, byte [esp + 0xc]
xor eax, 0x75db7674
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0xc], al
movzx eax, byte [esp + 0xd]
xor eax, 0x75db7673
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0xd], al
movzx eax, byte [esp + 0xe]
xor eax, 0x75db7672
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0xe], al
movzx eax, byte [esp + 0xf]
xor eax, 0x75db7671
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0xf], al
movzx eax, byte [esp + 0x10]
xor eax, 0x75db7670
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0x10], al
movzx eax, byte [esp + 0x11]
xor eax, 0x75db766f
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0x11], al
movzx eax, byte [esp + 0x12]
xor eax, 0x75db766e
lea ecx, [eax + eax]
not ecx
add ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add al, 0x4f
mov byte [esp + 0x12], al
mov dword [esp + 0x20], 0x6660acad
mov dword [esp + 0x24], 0x6262b0bc
mov dword [esp + 0x28], 0x6f7a60bd
mov dword [esp + 0x2c], 0x6a676e63
mov dword [esp + 0x30], 0xa2776362
mov dword [esp + 0x34], 0x78559f99
mov dword [esp + 0x38], 0x757f6d76
mov dword [esp + 0x3c], 0x765ab068
mov dword [esp + 0x40], 0x504d5153
mov dword [esp + 0x44], 0x484f514d
mov dword [esp + 0x48], 0x4d8a9346
mov dword [esp + 0x4c], 0x82435f43
mov dword [esp + 0x50], 0x52465054
mov dword [esp + 0x54], 0x5658958f
mov dword [esp + 0x58], 0x99875c55
mov dword [esp + 0x5c], 0x5a52545a
mov dword [esp + 0x60], 0xa5627a62
mov dword [esp + 0x64], 0xa9a3a9ad
mov dword [esp + 0x68], 0x76afa4a9
mov dword [esp + 0x6c], 0x4d6e
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
xor edx, 0xf0de53bf
mov ecx, eax
or ecx, 0xf21ac40
and ecx, edx
mov edx, ecx
and edx, 0x7ffffffd
mov esi, ecx
and esi, 2
or ecx, 2
imul ecx, esi
xor esi, 2
imul esi, edx
mov edx, eax
xor edx, 0xf21ac40
add ecx, edx
movzx edx, byte [esp + eax + 0x20]
add ecx, esi
mov esi, ecx
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x7c]
add cl, 0x40
mov byte [esp + eax + 0x20], cl
inc eax
cmp eax, 0x50
jne 0x409f50
mov edx, dword [ebp + 8]
add edx, dword [esp + 0x18]
movzx eax, byte [esp + 0x20]
mov esi, edx
test al, al
je 0x409fdb
lea ecx, [esp + 0x21]
mov esi, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409fd0
mov byte [esi], 0
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx]
test al, al
je 0x409ffb
inc ecx
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409ff0
mov byte [esi], 0
movzx eax, byte [esp + 8]
test al, al
je 0x40a01b
lea ecx, [esp + 9]
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40a010
mov byte [esi], 0
movzx eax, byte [esp + 0x80]
test al, al
mov dword [esp + 0x70], edx
je 0x40a04b
lea ecx, [esp + 0x81]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40a040
mov byte [esi], 0
mov edx, dword [ebp + 0x14]
mov ecx, edx
shr ecx, 2
mov eax, dword [ebp + 0x10]
mov ebx, esi
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, edx
mov ecx, edx
not ecx
mov esi, ecx
or esi, 3
add edx, esi
inc edx
not esi
mov dword [esp + 0x74], ebx
add esi, ebx
or ecx, 0xfffffffc
add eax, ecx
inc eax
add eax, dword [ebp + 0x10]
mov ecx, edx
shr ecx, 1
mov ebx, eax
mov edi, esi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
test dl, 1
je 0x40a09e
and edx, 0xfffffffe
movzx eax, byte [eax + edx]
mov byte [esi + edx], al
mov dword [esp + 0x20], 0xeeef130d
mov dword [esp + 0x24], 0x1a1e4846
mov dword [esp + 0x28], 0x4a1f4c4c
mov dword [esp + 0x2c], 0x4c59415c
mov dword [esp + 0x30], 0x59584441
mov dword [esp + 0x34], 0xfde30459
mov word [esp + 0x38], 0xfbe5
mov byte [esp + 0x3a], 0xf2
mov dword [esp + 0x3f], 0
mov dword [esp + 0x3b], 0
mov eax, 0x5ecc6802
mov ecx, 0x2f663401
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], ecx
mov dword [esp], eax
movzx edx, byte [esp + ecx - 0x2f6633e1]
mov eax, dword [esp]
and eax, 0x1fe007f8
mov ecx, dword [esp + 4]
xor ecx, 0xff003fc
add ecx, eax
mov eax, dword [esp]
and eax, 2
xor ecx, 1
add eax, ecx
add eax, 0xd099cbfe
mov dword [esp + 0x1c], eax
mov ebx, edx
not ebx
not eax
mov ecx, eax
or eax, ebx
and ebx, 2
mov edi, edx
and edi, 0xfffffffd
imul edi, ebx
mov ebx, edx
and ebx, 2
mov esi, edx
or esi, 2
imul esi, ebx
add esi, edi
mov dword [esp + 0x18], edx
lea edi, [edx + edx]
not edi
add edi, edx
not esi
add esi, edx
or esi, edi
mov edi, esi
not edi
sub ecx, esi
mov edx, dword [esp + 0x1c]
or edi, edx
lea ebx, [esi + edi]
inc ebx
or esi, edx
add ecx, esi
not ebx
and ebx, ecx
mov ecx, dword [esp + 0x18]
lea esi, [ecx + eax]
add eax, ecx
inc eax
mov ecx, eax
and ecx, 2
mov edx, eax
or eax, 2
imul eax, ecx
xor ecx, 2
and edx, 0xfffffffd
imul edx, ecx
add eax, edx
xor eax, 0xfffffffe
lea edx, [eax + esi]
inc edx
mov ecx, 0xfffffffe
sub ecx, edx
add eax, esi
add eax, 2
lea edi, [ebx + ebx]
dec ebx
mov edx, ebx
xor edx, edi
not edi
and edi, ebx
add edi, edi
sub edi, edx
mov edx, ecx
and edx, 0x93f9b85d
and eax, 0x6c0647a2
or eax, edx
xor eax, 0x6c0647a2
and eax, ecx
lea ecx, [eax + eax]
not ecx
add ecx, eax
and ecx, 0x542e21f0
mov edx, eax
and edx, 0xabd1de0f
or edx, ecx
mov ecx, dword [esp + 4]
xor edx, edi
and eax, edi
xor edx, 0x542e21f0
or eax, edx
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x80]
add al, 0x1c
mov byte [esp + ecx - 0x2f6633e1], al
mov eax, dword [esp]
add eax, 2
inc ecx
cmp eax, 0x5ecc6848
jne 0x40a100
mov esi, dword [esp + 0x74]
add esi, dword [ebp + 0x14]
movzx eax, byte [esp + 0x20]
test al, al
je 0x40a25d
lea ecx, [esp + 0x21]
mov edx, dword [esp + 0x70]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40a250
jmp 0x40a261
mov edx, dword [esp + 0x70]
mov byte [esi], 0
mov eax, esi
not eax
and eax, edx
not edx
and edx, esi
sub edx, eax
mov eax, dword [esp + 0x78]
add dword [eax + 0x60], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10