Function at 0x409df0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10c
cmp dword [ecx + 0x20], 0
je 0x40a2a9
mov esi, ecx
lea eax, [ecx + 0x10]
push eax
call fcn.004064d0
add esp, 4
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x48]
mov dword [esp + 8], eax
movzx eax, byte [esi]
imul ecx, eax, 0xcd
shr ecx, 0xa
and ecx, 0xfffffffe
lea ecx, [ecx + ecx*4]
sub al, cl
movzx eax, al
movzx eax, byte [eax + 0x343b78]
mov byte [esp + 2], al
mov byte [esp + 3], 0
mov eax, edx
and eax, 0x400
mov dword [esp + 0xc], edx
mov ecx, edx
xor ecx, 0x400
lea eax, [ecx + eax*2]
push eax
call fcn.004086e0
add esp, 4
mov dword [esp + 0x70], 0x8b8f9280
mov byte [esp + 0x74], 0x14
mov dword [esp + 0x75], 0
mov dword [esp + 0x78], 0
mov edi, 0x46
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edi + 0x2a]
lea edx, [edi - 0x17b41200]
or edx, ecx
and ecx, edi
sub edx, ecx
add edx, 0xe6b1b071
mov ecx, edx
and ecx, 1
xor edx, 1
lea ecx, [edx + ecx*2]
add cl, 0x30
mov byte [esp + edi + 0x2a], cl
inc edi
cmp edi, 0x52
jne 0x409e90
lea ebx, [esp + 0x70]
mov dword [esp + 0x10], esi
mov ecx, esi
push 0x34ba58
push ebx
mov dword [esp + 0xc], eax
push eax
call fcn.00409670
mov dword [esp + 0x70], 0x51aaa4bc
mov dword [esp + 0x74], 0
mov eax, 0x20e54073
mov ecx, 0x8d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ecx - 0x1d]
mov edx, ecx
and edx, ebp
mov edi, edx
and edi, 2
mov esi, edx
or edx, 2
imul edx, edi
xor edi, 2
and esi, 0xffffff9d
imul esi, edi
add edx, esi
lea esi, [eax + edx]
xor esi, ebp
not edx
add edx, ecx
and edx, ebp
add edx, edx
sub edx, esi
add dl, 0x3f
mov byte [esp + ecx - 0x1d], dl
dec eax
inc ecx
cmp ecx, 0x95
jne 0x409f00
lea eax, [esp + 2]
mov ebp, dword [esp + 0x10]
mov ecx, ebp
push eax
push ebx
mov edi, dword [esp + 0xc]
push edi
call fcn.00409670
mov eax, dword [0x345680]
mov dword [esp + 0x70], 0x13aea8a4
mov byte [esp + 0x74], 0
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x3c
xor dl, byte [esp + ecx + 0x70]
add dl, 0xd4
mov byte [esp + ecx + 0x70], dl
inc ecx
cmp ecx, 5
jne 0x409f70
mov ecx, ebp
push eax
push ebx
push edi
call fcn.00409670
mov dword [esp + 0x70], 0x676c6473
mov dword [esp + 0x74], 0x7463685b
mov dword [esp + 0x78], 0x6e6d687b
mov byte [esp + 0x7c], 0xc
mov word [esp + 0x7d], 0
mov byte [esp + 0x7f], 0
xor eax, eax
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x70]
lea edx, [eax + 0x80]
and edx, ecx
or ecx, eax
or ecx, 0x56b0f880
lea esi, [edx + edx]
not esi
add esi, edx
mov edx, ecx
not edx
or edx, esi
add edx, ecx
add dl, 0x81
mov byte [esp + eax + 0x70], dl
inc eax
cmp eax, 0x10
jne 0x409fc0
mov dword [esp + 0x14], 0x1faabeb9
xor eax, eax
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x14]
lea edx, [eax - 0x6edc7306]
xor edx, ecx
mov ecx, edx
and ecx, 0x1d
xor edx, 0x1d
lea ecx, [edx + ecx*2]
inc cl
mov byte [esp + eax + 0x14], cl
mov ecx, eax
and ecx, 1
or eax, 0xfffffffd
add eax, ecx
add eax, 4
cmp eax, 4
jb 0x40a000
lea eax, [esp + 0x14]
mov ecx, ebp
push ebx
push eax
push edi
call fcn.00409670
mov dword [esp + 0x70], 0x5a226062
mov byte [esp + 0x74], 0xb4
mov dword [esp + 0x75], 0
mov byte [esp + 0x79], 0
mov eax, 0xc9e3485e
nop
nop
nop
movzx edx, byte [esp + eax + 0x361cb812]
xor edx, eax
mov esi, edx
mov ecx, edx
xor ecx, 0x29
add ecx, edx
and edx, 0x29
and esi, 0xd6
sub ecx, esi
add ecx, edx
inc cl
mov byte [esp + eax + 0x361cb812], cl
inc eax
cmp eax, 0xc9e34868
jne 0x40a060
mov ecx, ebp
push dword [esp + 0xc]
push dword [esp + 0xc]
push ebx
push edi
call fcn.00409930
mov dword [esp + 0x14], 0x4fdd490f
mov dword [esp + 0x18], 0x43d64dde
mov dword [esp + 0x1c], 0x47d441e5
mov dword [esp + 0x20], 0xbbe745d0
mov dword [esp + 0x24], 0xbf37b90c
mov dword [esp + 0x28], 0xb317bd2c
mov dword [esp + 0x2c], 0xb7d6b1fe
mov dword [esp + 0x30], 0xab3fb529
mov dword [esp + 0x34], 0xaf3aa934
mov dword [esp + 0x38], 0xa332ad35
mov dword [esp + 0x3c], 0xa730a101
mov dword [esp + 0x40], 0x9bc9a530
mov dword [esp + 0x44], 0x9f0d9902
mov dword [esp + 0x48], 0x930f9d0a
mov dword [esp + 0x4c], 0x973291cd
mov dword [esp + 0x50], 0x8b1e9535
mov dword [esp + 0x54], 0x8fc18929
mov dword [esp + 0x58], 0x83248dec
mov dword [esp + 0x5c], 0x87138113
mov dword [esp + 0x60], 0xfb5e8516
mov dword [esp + 0x64], 0xff68f959
mov dword [esp + 0x68], 0xf3bffd75
mov dword [esp + 0x6c], 0xf1f0
xor eax, eax
nop
nop
nop
nop
mov ecx, eax
and ecx, 0x70
mov edx, eax
and edx, 2
mov esi, edx
xor esi, 2
imul esi, ecx
or ecx, 2
imul ecx, edx
mov edx, eax
xor edx, 0x72
add edx, esi
add edx, ecx
xor dl, byte [esp + eax + 0x14]
add dl, 0xc6
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x5c
jne 0x40a160
movzx eax, word [esp + 0x14]
test ax, ax
je 0x40a1c1
lea ebx, [esp + 0x70]
lea ecx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a1b0
mov word [ebx], 0
movzx ecx, byte [ebp + 0x60]
test cl, cl
je 0x40a1f1
lea eax, [ebp + 0x61]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, cl
mov word [ebx], cx
add ebx, 2
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x40a1e0
mov dword [ebx], 0xa000d
mov word [ebx + 4], 0
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x14], 0x294d2b75
mov dword [esp + 0x18], 0x2d412fb8
mov dword [esp + 0x1c], 0x532c
mov byte [esp + 0x20], 0
mov ecx, 0xd3bc9b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0xd3bc9a3]
xor edx, ecx
lea esi, [edx + 0x6c]
mov edi, 0x13
sub edi, edx
and edx, 1
and edi, 0x46
and esi, 0xb9
or esi, edi
xor esi, 0x47
lea edx, [esi + edx*2]
mov byte [esp + ecx - 0xd3bc9a3], dl
inc ecx
cmp ecx, 0xd3bc9c4
jne 0x40a230
lea ecx, [esp + 0x70]
push 0x493e0
push eax
mov esi, dword [esp + 0xc]
push esi
push 0
push 0
push ecx
lea eax, [esp + 0x2c]
push eax
call fcn.0040c8c0
add esp, 0x1c
mov ebx, eax
push esi
call fcn.004086f0
add esp, 4
mov eax, dword [ebp + 0x80]
add dword [ebp + 4], eax
mov dword [ebp + 0x80], 0
jmp 0x40a2ab
mov bl, 1
mov eax, ebx
add esp, 0x10c
pop esi
pop edi
pop ebx
pop ebp
ret