Function at 0x404dc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
and esp, 0xfffffff8
sub esp, 0x148
mov eax, dword [ebp + 8]
mov byte [esp + 0x133], 0x63
mov dword [esp + 0x12c], 0x5570f2b9
mov dword [esp + 0x11c], 0
mov dword [esp + 0x118], 0x57c1f6c6
mov ecx, dword [0x427858]
mov edx, dword [0x427854]
xor edx, ecx
mov ecx, dword [0x4277e8]
mov esi, dword [0x4277e4]
xor esi, ecx
mov ecx, dword [0x427774]
mov edi, dword [0x427778]
xor ecx, edi
mov edi, dword [0x427704]
mov ebx, dword [0x427708]
xor edi, ebx
mov dword [esp + 0xd0], eax
mov eax, dword [0x427740]
mov dword [esp + 0xcc], eax
mov eax, dword [0x42773c]
mov dword [esp + 0xc8], ecx
mov ecx, dword [esp + 0xcc]
xor eax, ecx
add eax, edi
mov ecx, dword [esp + 0xc8]
add ecx, eax
mov eax, dword [0x4277ac]
mov edi, dword [0x4277b0]
xor eax, edi
add eax, ecx
add esi, eax
mov eax, dword [0x42781c]
mov ecx, dword [0x427820]
xor eax, ecx
add eax, esi
add edx, eax
mov eax, dword [0x4278fc]
mov ecx, dword [0x427a14]
mov esi, dword [0x427a18]
xor ecx, esi
mov esi, dword [0x4279dc]
mov edi, dword [0x4279e0]
xor esi, edi
mov edi, dword [0x427900]
xor eax, edi
mov edi, dword [0x42788c]
mov dword [esp + 0xc4], eax
mov eax, dword [0x427890]
xor edi, eax
add edi, edx
mov eax, dword [0x4278c4]
mov edx, dword [0x4278c8]
xor eax, edx
add eax, edi
mov edx, dword [esp + 0xc4]
add edx, eax
mov eax, dword [0x427934]
mov edi, dword [0x427938]
xor eax, edi
add eax, edx
mov edx, dword [0x42796c]
mov edi, dword [0x427970]
xor edx, edi
add edx, eax
mov eax, dword [0x4279a8]
mov edi, dword [0x4279a4]
xor edi, eax
add edi, edx
add esi, edi
add ecx, esi
mov al, byte [esp + 0x141]
mov edx, dword [esp + 0x12c]
add edx, 0x2962c353
mov esi, dword [esp + 0x11c]
mov edi, dword [esp + 0x118]
mov byte [esp + 0xc3], al
mov eax, edi
sub eax, 0x7601716c
mov dword [esp + 0xbc], eax
mov eax, esi
sbb eax, 0
mov dword [esp + 0xb8], eax
mov eax, dword [0x427a4c]
mov dword [esp + 0xb4], eax
mov eax, dword [0x427a50]
mov dword [esp + 0x124], edx
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xa8], eax
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa0], esi
jb 0x4051b9
jmp 0x40507d
xor eax, eax
mov ecx, 0x5572a2b9
mov edx, dword [esp + 0xfc]
sub ecx, dword [esp + 0x12c]
add edx, 0x2f48
mov esi, dword [esp + 0xd0]
mov dword [esi + 0x18], edx
mov di, word [esp + 0x142]
mov word [esp + 0x142], di
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0xfc]
add ecx, 0xcce
mov dword [esi + 4], ecx
mov dword [esi + 0xc], 0x2020
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov al, 0x20
mov ecx, dword [esp + 0xfc]
mov edx, dword [esp + 0x104]
mov esi, dword [esp + 0x12c]
xor esi, 0x5570f2a6
mov edi, edx
and edi, esi
mov ah, byte [ecx + edx]
sub al, byte [edi + 0x408128]
add al, ah
mov byte [ecx + edx], al
mov ecx, dword [esp + 0xac]
imul esi, ecx, 0x1b97516
add edx, 0x20
mov dword [esp + 0x134], esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0x104], edx
cmp edx, esi
jb 0x404ff1
jmp 0x405191
mov ax, word [esp + 0x142]
mov cx, word [esp + 0x142]
mov edx, dword [esp + 0x110]
add ax, cx
mov word [esp + 0x142], ax
mov dword [esp + 0x100], edx
jmp 0x405797
mov eax, dword [esp + 0x124]
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0xf8]
mov eax, dword [eax*4 + 0x40814c]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
cmp eax, dword [esp + 0x114]
jb 0x4057e2
jmp 0x405191
mov eax, dword [esp + 0x114]
and eax, 0xffffffe0
mov dword [esp + 0xf4], eax
mov dword [esp + 0x10c], 0
jmp 0x40511d
mov eax, dword [esp + 0x114]
mov dword [esp + 0x110], 0
cmp eax, 0x20
jb 0x40504f
jmp 0x4050b9
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf4]
mov edx, dword [esp + 0x114]
mov dword [esp + 0x110], ecx
cmp edx, eax
je 0x404f9a
jmp 0x40504f
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0xfc]
movaps xmm0, xmmword [0x4080f0]
movups xmm1, xmmword [ecx + eax]
movups xmm2, xmmword [ecx + eax + 0x10]
paddb xmm1, xmm0
paddb xmm2, xmm0
movups xmmword [ecx + eax], xmm1
mov byte [esp + 0x141], 0x35
movups xmmword [ecx + eax + 0x10], xmm2
add eax, 0x20
mov ecx, dword [esp + 0xf4]
mov edx, dword [esp + 0xa4]
xor edx, 0xf8684b0
mov esi, dword [esp + 0xa0]
mov dword [esp + 0x13c], esi
mov dword [esp + 0x138], edx
mov dword [esp + 0x10c], eax
cmp eax, ecx
je 0x4050f4
jmp 0x40511d
mov eax, dword [esp + 0x12c]
add eax, 0xaa8f0d48
add eax, dword [esp + 0xf8]
mov dword [esp + 0x124], eax
cmp eax, 0x20
je 0x4057f5
jmp 0x40507d
mov ax, 0x9339
mov cl, 0x27
lea edx, [esp + 0xd4]
mov esi, dword [0x427a84]
mov edi, dword [esp + 0xb4]
mov ebx, dword [esp + 0xa8]
xor edi, ebx
mov ebx, dword [esp + 0xb0]
add edi, ebx
mov ebx, dword [0x427a88]
mov byte [esp + 0x9f], cl
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0x138], ecx
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x13c], ecx
xor esi, ebx
add esi, edi
mov dword [esp + 0x114], esi
mov dword [esp + 0x128], edx
mov edx, dword [esp + 0x128]
mov byte [edx], 0x56
mov cl, byte [esp + 0x9f]
sub cl, byte [esp + 0x133]
mov byte [esp + 0xd5], 0x69
mov byte [esp + 0xd6], 0x72
mov byte [esp + 0xd7], 0x74
mov byte [esp + 0xd8], 0x75
mov byte [esp + 0xd9], 0x61
mov byte [esp + 0xda], 0x6c
mov byte [esp + 0xdb], 0x41
mov byte [esp + 0xdc], 0x6c
mov byte [esp + 0xdd], 0x6c
mov byte [esp + 0xde], 0x6f
mov byte [esp + 0xdf], 0x63
sub ax, word [esp + 0x142]
mov word [esp + 0x142], ax
mov byte [esp + 0xe0], 0
mov byte [esp + 0xe1], cl
mov edx, dword [esp + 0x128]
mov dword [esp], edx
call fcn.00404850
xor edx, edx
mov esi, 0x1000
mov edi, 4
mov ebx, dword [esp + 0x114]
mov dword [esp], 0
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 4
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], edx
mov dword [esp + 0x90], esi
call eax
sub esp, 0x10
mov byte [esp + 0x141], 0x10
mov dword [esp + 0xfc], eax
mov cl, byte [esp + 0xc3]
and cl, 0x88
mov byte [esp + 0x141], cl
mov eax, dword [0x427704]
xor eax, dword [0x427708]
mov edx, dword [0x42770c]
mov esi, dword [esp + 0xfc]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0x8c], eax
call fcn.00404790
mov eax, dword [0x427744]
mov cl, 0x1c
mov ch, byte [esp + 0xc3]
mov dword [esp + 0x88], eax
mov al, ch
mul cl
mov edx, dword [0x427740]
mov byte [esp + 0x141], al
xor edx, dword [0x42773c]
mov esi, dword [esp + 0x8c]
add esi, dword [esp + 0xfc]
mov dword [esp], esi
mov esi, dword [esp + 0x88]
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp + 0x84], edx
call fcn.00404790
mov edx, dword [0x42777c]
mov esi, dword [esp + 0xfc]
mov edi, dword [esp + 0x84]
mov ebx, dword [esp + 0x8c]
add edi, ebx
add esi, edi
mov eax, dword [0x427778]
xor eax, dword [0x427774]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], edi
call fcn.00404790
mov eax, dword [0x4277b0]
mov edx, dword [esp + 0xfc]
mov esi, dword [esp + 0x80]
mov edi, dword [esp + 0x7c]
add esi, edi
xor eax, dword [0x4277ac]
mov ebx, dword [0x4277b4]
add edx, esi
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], esi
call fcn.00404790
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
add eax, edx
mov esi, dword [0x4277ec]
mov edi, dword [esp + 0xfc]
mov ebx, dword [0x4277e4]
xor ebx, dword [0x4277e8]
add edi, eax
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], ebx
call fcn.00404790
mov eax, dword [0x427820]
xor eax, dword [0x42781c]
mov edx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
add edx, esi
mov edi, edx
add edi, dword [esp + 0xfc]
mov ebx, dword [0x427824]
mov dword [esp], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], edx
call fcn.00404790
mov al, byte [esp + 0xc3]
mov cl, byte [esp + 0xc3]
mul cl
mov byte [esp + 0x141], al
mov edx, dword [0x42785c]
mov esi, dword [0x427858]
xor esi, dword [0x427854]
mov edi, dword [esp + 0x68]
mov ebx, dword [esp + 0x64]
add edi, ebx
mov eax, edi
add eax, dword [esp + 0xfc]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], edi
call fcn.00404790
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
add eax, edx
mov esi, dword [0x427894]
mov di, word [esp + 0x142]
imul di, word [esp + 0x142]
mov ebx, dword [0x427890]
mov word [esp + 0x142], di
xor ebx, dword [0x42788c]
mov edx, eax
add edx, dword [esp + 0xfc]
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], ebx
call fcn.00404790
mov eax, dword [0x4278c8]
mov edx, dword [esp + 0xac]
xor edx, 0xffffffff
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x58]
add esi, ebx
mov edi, dword [0x4278cc]
mov dword [esp + 0x134], edx
xor eax, dword [0x4278c4]
mov edx, esi
add edx, dword [esp + 0xfc]
mov dword [esp], edx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], esi
call fcn.00404790
mov eax, dword [0x427900]
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
add edx, esi
mov edi, edx
add edi, dword [esp + 0xfc]
xor eax, dword [0x4278fc]
mov ebx, dword [0x427904]
mov dword [esp], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], edx
call fcn.00404790
mov eax, dword [0x427938]
mov edx, dword [0x427934]
mov esi, dword [0x42793c]
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
add edi, ebx
mov ebx, edi
add ebx, dword [esp + 0xfc]
xor edx, eax
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], edi
call fcn.00404790
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
add eax, edx
mov esi, dword [0x427974]
mov edi, dword [0x42796c]
xor edi, dword [0x427970]
mov ebx, eax
add ebx, dword [esp + 0xfc]
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edi
call fcn.00404790
mov eax, dword [0x4279a4]
mov edx, dword [0x4279ac]
xor eax, dword [0x4279a8]
mov esi, dword [esp + 0xfc]
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
add edi, ebx
add esi, edi
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], eax
call fcn.00404790
mov eax, dword [0x4279e0]
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
add edx, esi
mov word [esp + 0x142], 0xe5aa
xor eax, dword [0x4279dc]
mov edi, edx
add edi, dword [esp + 0xfc]
mov ebx, dword [0x4279e4]
mov dword [esp], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], eax
call fcn.00404790
mov eax, dword [0x427a18]
mov edx, dword [esp + 0xfc]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esi, edi
add edx, esi
xor eax, dword [0x427a14]
mov ebx, dword [0x427a1c]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], esi
call fcn.00404790
mov eax, dword [esp + 0xfc]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
add edx, esi
add eax, edx
mov edi, dword [0x427a54]
mov ebx, dword [0x427a4c]
xor ebx, dword [0x427a50]
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
call fcn.00404790
mov eax, dword [0x427a8c]
mov edx, dword [esp + 0xfc]
mov esi, dword [0x427a88]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
add edi, ebx
add edx, edi
xor esi, dword [0x427a84]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call fcn.00404790
mov dword [esp + 0x124], 0
jmp 0x40507d
mov al, 0x43
mov byte [esp + 0x141], 0xc7
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0xfc]
mov dword [esp + 0x134], 0x733719aa
sub al, byte [esp + 0x133]
add al, byte [edx + ecx]
mov byte [edx + ecx], al
add ecx, 1
mov edx, dword [esp + 0x114]
mov dword [esp + 0x100], ecx
cmp ecx, edx
je 0x404f9a
jmp 0x405797
mov eax, dword [esp + 0x108]
mov dword [esp + 0x104], eax
jmp 0x404ff1
cmp dword [esp + 0x114], 0
je 0x404f9a
jmp 0x4050d7