Function at 0x409970
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov dword [esp + 0x3c], ecx
mov eax, dword [ecx + 0x80]
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0x6b6c6a5f
mov dword [esp + 0x14], 0x8e566f79
mov dword [esp + 0x18], 0x42565874
mov dword [esp + 0x1c], 0x5f4b859a
mov dword [esp + 0x20], 0x4749485c
mov dword [esp + 0x24], 0x47404841
mov dword [esp + 0x28], 0x449b4983
mov dword [esp + 0x2c], 0x5c5f5b52
mov dword [esp + 0x30], 0xb2b0b44c
mov word [esp + 0x34], 0xbdb2
mov dword [esp + 0x36], 0
mov edi, 0x5a
mov ebp, 0x65a068a5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edi - 0x4a]
mov esi, ebp
or esi, ebx
lea edx, [ebp - 0x65a06800]
and edx, ebx
xor edx, esi
and edx, edi
add dl, dl
sub bl, dl
movzx edx, bl
add edx, edi
add dl, 0x3e
mov byte [esp + edi - 0x4a], dl
inc edi
dec ebp
cmp edi, 0x84
jne 0x4099f0
mov dword [esp + 8], 0x5144406e
mov word [esp + 0xc], 0
mov edi, 0x79b4198d
mov ebp, 0x864be672
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi - 0x79b41985]
lea esi, [edi - 0x79b41900]
and esi, edx
add esi, esi
lea eax, [edi + edx]
mov ebx, ebp
sub ebx, edx
and ebx, esi
not esi
and esi, eax
sub ebx, esi
mov eax, ebx
and eax, 0x42
add eax, eax
xor ebx, 0x3d
sub ebx, eax
add bl, 2
mov byte [esp + edi - 0x79b41985], bl
inc edi
dec ebp
cmp edi, 0x79b41993
jne 0x409a40
mov dword [esp + 0x40], 0xa08b4543
mov dword [esp + 0x44], 0xbbb5a7be
mov dword [esp + 0x48], 0xb29278a0
mov dword [esp + 0x4c], 0xa8ababad
mov dword [esp + 0x50], 0x90b5abb7
mov dword [esp + 0x54], 0x8342598e
mov dword [esp + 0x58], 0x46899595
mov dword [esp + 0x5c], 0x8e9e888c
mov dword [esp + 0x60], 0x92804f51
mov dword [esp + 0x64], 0x574d949f
mov dword [esp + 0x68], 0x9e9a9c92
mov dword [esp + 0x6c], 0x9b5a465a
mov dword [esp + 0x70], 0xef999397
mov dword [esp + 0x74], 0x3ae5ece3
mov dword [esp + 0x78], 0x726
mov esi, 0x57bf440d
mov ebp, 0x2840bbf2
mov ecx, dword [esp + 0x90]
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0x57bf43cd]
mov eax, ebp
and eax, 0x28400386
mov edi, esi
and edi, 0x3b04479
or edi, eax
mov eax, edi
xor eax, 0x86
lea edx, [ebp - 0x2840bb00]
xor edi, 6
or edi, edx
not edi
add edi, eax
and edi, ebx
or ebx, esi
xor ebx, edi
mov edi, 2
sub edi, ebx
sub edi, ebx
not edi
and edi, 2
mov edx, ebx
or edx, 1
and ebx, 1
sub edx, ebx
add edx, edi
add dl, 0xbe
mov byte [esp + esi - 0x57bf43cd], dl
inc esi
dec ebp
cmp esi, 0x57bf4449
jne 0x409b10
add ecx, dword [esp + 4]
mov dword [esp], 0x4e2023
xor edx, edx
mov eax, edx
add al, 0x6d
xor al, byte [esp + edx]
add al, 0xdf
mov byte [esp + edx], al
inc edx
cmp edx, 4
jne 0x409b80
movzx ebx, byte [esp]
mov edx, ecx
test bl, bl
mov ebp, dword [esp + 0x3c]
je 0x409bbb
lea edi, [esp + 1]
mov edx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [edi]
inc edi
test bl, bl
jne 0x409bb0
mov byte [edx], 0
movzx ebx, byte [ebp + 0x60]
test bl, bl
mov eax, dword [esp + 0x94]
je 0x409bdb
lea edi, [ebp + 0x61]
mov byte [edx], bl
inc edx
movzx ebx, byte [edi]
inc edi
test bl, bl
jne 0x409bd0
mov byte [edx], 0
movzx ebx, byte [esp + 0x40]
test bl, bl
je 0x409bfb
lea edi, [esp + 0x41]
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [edi]
inc edi
test bl, bl
jne 0x409bf0
mov byte [edx], 0
movzx ebx, byte [eax]
test bl, bl
mov dword [esp + 4], ecx
je 0x409c1b
inc eax
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [eax]
inc eax
test bl, bl
jne 0x409c10
mov byte [edx], 0
movzx ecx, byte [esp + 8]
test cl, cl
je 0x409c3b
lea edi, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [edi]
inc edi
test cl, cl
jne 0x409c30
mov byte [edx], 0
movzx ecx, byte [esp + 0x10]
test cl, cl
je 0x409c5b
lea edi, [esp + 0x11]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [edi]
inc edi
test cl, cl
jne 0x409c50
mov byte [edx], 0
mov ebx, dword [esp + 0x9c]
mov ecx, ebx
shr ecx, 2
mov esi, dword [esp + 0x98]
mov eax, esi
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, ebx
and ebx, 0xfffffffc
add edx, ebx
add ebx, esi
mov ecx, eax
mov esi, eax
shr ecx, 1
and ecx, 1
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esi
mov ecx, esi
and ecx, 2
add edx, ecx
test al, 1
je 0x409ca8
movzx eax, byte [ebx + ecx]
mov byte [edx], al
inc edx
mov dword [esp + 0x40], 0x27192517
mov byte [esp + 0x44], 0x28
mov dword [esp + 0x45], 0
mov word [esp + 0x49], 0
mov ecx, 0x1d70f0b7
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx - 0x1d70f077]
mov esi, ecx
and esi, eax
add eax, ecx
add esi, esi
mov ebx, eax
sub ebx, esi
and eax, 1
or ebx, 1
add ebx, eax
add bl, 0x6c
mov byte [esp + ecx - 0x1d70f077], bl
inc ecx
cmp ecx, 0x1d70f0c2
jne 0x409cd0
mov dword [esp + 0x10], 0x6e6f4b4d
mov byte [esp + 0x14], 0x44
mov dword [esp + 0x15], 0
mov word [esp + 0x19], 0
xor ecx, ecx
nop
nop
nop
movzx eax, byte [esp + ecx + 0x10]
mov esi, ecx
or esi, 0xfc450f10
and esi, eax
add eax, ecx
add eax, 0xfc450f10
add esi, esi
sub eax, esi
mov esi, eax
and esi, 0x2f
xor eax, 0xaf
lea eax, [eax + esi*2]
inc al
mov byte [esp + ecx + 0x10], al
mov eax, ecx
and eax, 1
or ecx, 0xe8bcb8d1
add ecx, eax
add ecx, 0x17434730
cmp ecx, 0xb
jb 0x409d20
movzx ecx, byte [esp + 0x10]
test cl, cl
je 0x409d8b
lea edi, [esp + 0x11]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [edi]
inc edi
test cl, cl
jne 0x409d80
mov byte [edx], 0
movzx ecx, byte [ebp + 0x60]
test cl, cl
je 0x409dab
lea edi, [ebp + 0x61]
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [edi]
inc edi
test cl, cl
jne 0x409da0
mov byte [edx], 0
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x409dcb
lea edi, [esp + 0x41]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [edi]
inc edi
test cl, cl
jne 0x409dc0
mov byte [edx], 0
sub edx, dword [esp + 4]
add dword [ebp + 0x80], edx
add esp, 0x7c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10