Function at 0xcda850
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1b8
mov eax, dword [ebp + 8]
mov byte [esp + 0x23], 0
mov al, byte [esp + 0x60]
mov byte [esp + 0x64], al
mov byte [esp + 0x128], 0xcd
mov byte [esp + 0x129], 0xf2
mov byte [esp + 0x12a], 0xe6
mov byte [esp + 0x12b], 0xae
mov byte [esp + 0x12c], 0xfc
mov byte [esp + 0x12d], 0xf0
mov byte [esp + 0x12e], 0xfc
mov byte [esp + 0x12f], 0xfa
mov byte [esp + 0x130], 0x64
mov dword [esp + 0x135], 0
mov dword [esp + 0x131], 0
mov word [esp + 0x139], 0
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x24]
cmp eax, 0x13
jae 0xcda93e
jmp 0xcda8ea
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
movzx ecx, byte [esp + ecx + 0x128]
mov edx, eax
add edx, 0x41644992
and edx, ecx
lea eax, [eax + ecx + 0x41644992]
add edx, edx
sub eax, edx
mov dword [esp + 0x178], eax
mov eax, dword [esp + 0x178]
add al, 2
mov ecx, dword [esp + 0x24]
mov byte [esp + ecx + 0x128], al
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, 0x13
jb 0xcda8ea
jmp 0xcda93e
lea eax, [esp + 0x197]
lea edx, [esp + 0x128]
mov edi, eax
mov ecx, 2
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x19f]
lea edx, [esp + 0x130]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov cl, byte [esp + 0x130]
mov byte [esp + 0x19f], cl
mov cl, byte [esp + 0x5c]
mov byte [esp + 0x68], cl
mov byte [esp + 0x80], 0x2b
mov byte [esp + 0x81], 0x6d
mov byte [esp + 0x82], 0xc1
mov byte [esp + 0x83], 0x73
mov byte [esp + 0x84], 0xc2
mov byte [esp + 0x85], 0x71
mov byte [esp + 0x86], 0xc2
mov byte [esp + 0x87], 0x77
mov byte [esp + 0x88], 0xd1
mov byte [esp + 0x89], 0x75
mov byte [esp + 0x8a], 0xc8
mov byte [esp + 0x8b], 0x7b
mov byte [esp + 0x8c], 0xcc
mov byte [esp + 0x8d], 0x79
mov byte [esp + 0x8e], 0x13
mov byte [esp + 0x8f], 0x7f
mov byte [esp + 0x90], 0x28
mov byte [esp + 0x91], 0x7d
mov byte [esp + 0x92], 0xfb
mov byte [esp + 0x93], 0x43
mov byte [esp + 0x94], 0xf0
mov byte [esp + 0x95], 0x41
mov byte [esp + 0x96], 0xe3
mov byte [esp + 0x97], 0x47
mov byte [esp + 0x98], 0x3a
mov byte [esp + 0x99], 0x45
mov byte [esp + 0x9a], 0x2a
mov byte [esp + 0x9b], 0x4b
mov byte [esp + 0x9c], 0xe9
mov byte [esp + 0x9d], 0x49
mov byte [esp + 0x9e], 0xfe
mov byte [esp + 0x9f], 0x4f
mov byte [esp + 0xa0], 0xfc
mov byte [esp + 0xa1], 0x4d
mov byte [esp + 0xa2], 0xfe
mov byte [esp + 0xa3], 0x53
mov byte [esp + 0xa4], 0xf9
mov byte [esp + 0xa5], 0x51
mov byte [esp + 0xa6], 0xf1
mov byte [esp + 0xa7], 0x57
mov byte [esp + 0xa8], 0xf5
mov byte [esp + 0xa9], 0x55
mov byte [esp + 0xaa], 0xee
mov byte [esp + 0xab], 0x5b
mov byte [esp + 0xac], 0xf1
mov byte [esp + 0xad], 0x59
mov byte [esp + 0xae], 0xed
mov byte [esp + 0xaf], 0x5f
mov byte [esp + 0xb0], 0xee
mov byte [esp + 0xb1], 0x5d
mov byte [esp + 0xb2], 0xd1
mov byte [esp + 0xb3], 0xa3
mov byte [esp + 0xb4], 0x18
mov byte [esp + 0xb5], 0xa1
mov byte [esp + 0xb6], 0xcb
mov byte [esp + 0xb7], 0xa7
mov byte [esp + 0xb8], 0x1f
mov byte [esp + 0xb9], 0xa5
mov byte [esp + 0xba], 0x11
mov byte [esp + 0xbb], 0xab
mov byte [esp + 0xbc], 0x13
mov byte [esp + 0xbd], 0xa9
mov byte [esp + 0xbe], 0xc3
mov byte [esp + 0xbf], 0xaf
mov byte [esp + 0xc0], 6
mov byte [esp + 0xc1], 0xad
mov byte [esp + 0xc2], 1
mov byte [esp + 0xc3], 0xb3
mov byte [esp + 0xc4], 6
mov byte [esp + 0xc5], 0xb1
mov byte [esp + 0xc6], 0x1b
mov byte [esp + 0xc7], 0xb7
mov byte [esp + 0xc8], 0xd9
mov byte [esp + 0xc9], 0xb5
mov byte [esp + 0xca], 0xf
mov byte [esp + 0xcb], 0xbb
mov byte [esp + 0xcc], 0xe
mov byte [esp + 0xcd], 0xb9
mov byte [esp + 0xce], 0x12
mov byte [esp + 0xcf], 0xbf
mov byte [esp + 0xd0], 0x19
mov byte [esp + 0xd1], 0xbd
mov byte [esp + 0xd2], 0x30
mov byte [esp + 0xd3], 0x83
mov byte [esp + 0xd4], 0x27
mov byte [esp + 0xd5], 0x81
mov byte [esp + 0xd6], 0x35
mov byte [esp + 0xd7], 0x87
mov byte [esp + 0xd8], 0x20
mov byte [esp + 0xd9], 0x85
mov byte [esp + 0xda], 0x2f
mov byte [esp + 0xdb], 0x8b
mov byte [esp + 0xdc], 0x2c
mov byte [esp + 0xdd], 0x89
mov byte [esp + 0xde], 0x83
mov byte [esp + 0xdf], 0x8f
mov byte [esp + 0xe0], 0x82
mov byte [esp + 0xe1], 0x8d
mov byte [esp + 0xe2], 0x92
mov byte [esp + 0xe3], 0x93
mov dword [esp + 0xe8], 0
mov dword [esp + 0xe4], 0
mov word [esp + 0xec], 0
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x28]
cmp ecx, 0x6e
jae 0xcdad43
jmp 0xcdacd9
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
movzx edi, byte [esp + ecx + 0x80]
mov ebx, esi
add ebx, 0xd1249c4e
lea ecx, [esi + edi - 0x2edb63b2]
add esi, 0x4e
mov edx, ebx
or edx, esi
and edx, edi
and ebx, edi
add edx, ebx
mov esi, ecx
not esi
mov edi, edx
and edi, esi
not edx
and ecx, edx
sub ecx, edi
mov dword [esp + 0x17c], ecx
mov ecx, dword [esp + 0x17c]
add cl, 0xde
mov edx, dword [esp + 0x28]
mov byte [esp + edx + 0x80], cl
mov ecx, dword [esp + 0x28]
inc ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
cmp ecx, 0x6e
jb 0xcdacd9
jmp 0xcdad43
mov cl, byte [esp + 0x58]
mov byte [esp + 0x6c], cl
mov byte [esp + 0x140], 0x2f
mov byte [esp + 0x141], 1
mov byte [esp + 0x142], 0x63
mov byte [esp + 0x143], 3
mov byte [esp + 0x144], 0x74
mov byte [esp + 0x145], 5
mov byte [esp + 0x146], 0x6f
mov byte [esp + 0x147], 7
mov byte [esp + 0x148], 8
mov byte [esp + 0x149], 9
mov dword [esp + 0x14e], 0
mov dword [esp + 0x14a], 0
mov dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x12
jae 0xcdae2c
jmp 0xcdadc4
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
movzx esi, byte [esp + edx + 0x140]
mov edx, ecx
sub edx, 0xffffff80
lea ecx, [ecx + esi - 0x29c3b80]
and edx, esi
add edx, edx
mov esi, ecx
not esi
mov edi, edx
and edi, esi
not edx
and ecx, edx
sub ecx, edi
mov dword [esp + 0x180], ecx
mov ecx, dword [esp + 0x180]
add cl, 0x80
mov edx, dword [esp + 0x2c]
mov byte [esp + edx + 0x140], cl
mov ecx, dword [esp + 0x2c]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x12
jb 0xcdadc4
jmp 0xcdae2c
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x140]
lea esi, [esp + 0x80]
lea edi, [esp + 0x44]
xor ebx, ebx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0
call fcn.00cdb380
test al, 1
jne 0xcdae74
jmp 0xcdb324
mov al, byte [esp + 0x54]
mov byte [esp + 0x70], al
mov byte [esp + 0x158], 0x5f
mov byte [esp + 0x159], 0xa2
mov byte [esp + 0x15a], 0xf2
mov dword [esp + 0x15f], 0
mov dword [esp + 0x15b], 0
mov word [esp + 0x163], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x30]
cmp eax, 0xd
jae 0xcdaf17
jmp 0xcdaec7
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
movzx ecx, byte [esp + ecx + 0x158]
mov edx, eax
add edx, 0x16ffe35e
add eax, 0x5e
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0x184], edx
mov eax, dword [esp + 0x184]
add al, 0x6e
mov ecx, dword [esp + 0x30]
mov byte [esp + ecx + 0x158], al
mov eax, dword [esp + 0x30]
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
cmp eax, 0xd
jb 0xcdaec7
jmp 0xcdaf17
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x158]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00cdcff0
cmp eax, 0
jne 0xcdaf3d
mov byte [esp + 0x23], 1
jmp 0xcdb318
mov al, byte [esp + 0x50]
mov byte [esp + 0x74], al
mov byte [esp + 0x110], 0xb
mov byte [esp + 0x111], 0x7e
mov byte [esp + 0x112], 0x7d
mov byte [esp + 0x113], 0xf
mov byte [esp + 0x114], 0x79
mov byte [esp + 0x115], 0xc
mov byte [esp + 0x116], 0xa
mov byte [esp + 0x117], 0x9f
mov dword [esp + 0x118], 0
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x34]
cmp eax, 0xc
jae 0xcdaff9
jmp 0xcdafa3
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x34]
movzx ecx, byte [esp + ecx + 0x110]
mov edx, eax
add edx, 0xb4b712c3
add eax, 0xc3
mov esi, edx
or esi, eax
and esi, ecx
or edx, ecx
sub edx, esi
mov dword [esp + 0x188], edx
mov eax, dword [esp + 0x188]
add al, 0xab
mov ecx, dword [esp + 0x34]
mov byte [esp + ecx + 0x110], al
mov eax, dword [esp + 0x34]
inc eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
cmp eax, 0xc
jb 0xcdafa3
jmp 0xcdaff9
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x110]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00cdd020
cmp eax, 0
je 0xcdb316
mov al, byte [esp + 0x4c]
mov byte [esp + 0x78], al
mov byte [esp + 0xf0], 0x8e
mov byte [esp + 0xf1], 0x90
mov byte [esp + 0xf2], 0x8f
mov byte [esp + 0xf3], 0x96
mov byte [esp + 0xf4], 0xf9
mov byte [esp + 0xf5], 0xd7
mov byte [esp + 0xf6], 0x97
mov byte [esp + 0xf7], 0x83
mov byte [esp + 0xf8], 0xb7
mov byte [esp + 0xf9], 0xb2
mov byte [esp + 0xfa], 0xe8
mov byte [esp + 0xfb], 0xeb
mov byte [esp + 0xfc], 0xba
mov byte [esp + 0xfd], 0xac
mov byte [esp + 0xfe], 0xb2
mov byte [esp + 0xff], 0xba
mov byte [esp + 0x100], 0xa5
mov byte [esp + 0x101], 0xcc
mov byte [esp + 0x102], 0xe0
mov byte [esp + 0x103], 3
mov dword [esp + 0x107], 0
mov dword [esp + 0x104], 0
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x38]
cmp eax, 0x1b
jae 0xcdb149
jmp 0xcdb0ea
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
movzx ecx, byte [esp + ecx + 0xf0]
mov edx, eax
add edx, 0xfc4dfd8
lea eax, [eax + ecx + 0xfc4dfd8]
and edx, ecx
add edx, edx
sub eax, edx
mov dword [esp + 0x18c], eax
mov eax, dword [esp + 0x18c]
mov ecx, eax
xor ecx, 0x17
and eax, 0x17
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 0x38]
mov byte [esp + ecx + 0xf0], al
mov eax, dword [esp + 0x38]
inc eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
cmp eax, 0x1b
jb 0xcdb0ea
jmp 0xcdb149
lea eax, [esp + 0x1a0]
lea edx, [esp + 0xf0]
mov edi, eax
mov ecx, 5
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
add eax, 0x14
lea edx, [esp + 0xf0]
add edx, 0x14
mov edi, eax
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
lea eax, [esp + 0x1a0]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00cdd020
mov dword [esp + 0x40], eax
cmp dword [esp + 0x40], 0
je 0xcdb316
mov eax, dword [esp + 0x40]
add eax, 0x13
mov dword [esp + 0x40], eax
mov al, byte [esp + 0x48]
mov byte [esp + 0x7c], al
mov byte [esp + 0x168], 0x8a
mov byte [esp + 0x169], 0x6f
mov byte [esp + 0x16a], 0xa2
mov word [esp + 0x16f], 0
mov dword [esp + 0x16b], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x3c]
cmp eax, 9
jae 0xcdb247
jmp 0xcdb1f5
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
movzx ecx, byte [esp + ecx + 0x168]
mov edx, eax
add edx, 0x6b788ee6
add eax, 0xe6
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0x190], edx
mov eax, dword [esp + 0x190]
add al, 0xb6
mov ecx, dword [esp + 0x3c]
mov byte [esp + ecx + 0x168], al
mov eax, dword [esp + 0x3c]
inc eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
cmp eax, 9
jb 0xcdb1f5
jmp 0xcdb247
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x168]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00cdd020
mov dword [esp + 0x120], eax
cmp dword [esp + 0x120], 0
je 0xcdb314
mov byte [0xd19404], 1
mov edi, dword [esp + 0x120]
mov esi, dword [esp + 0x40]
cmp edi, 0
jne 0xcdb2a0
mov ecx, esi
jmp 0xcdb28e
mov eax, ecx
mov dl, byte [eax]
add ecx, 1
cmp dl, 0
jne 0xcdb28e
sub eax, esi
mov edi, esi
add edi, eax
mov dword [esp + 0x124], 0
lea eax, [0xd19406]
cmp edi, esi
jbe 0xcdb30a
lea ebx, [0xd19406]
jmp 0xcdb2bd
cmp byte [esi], 0
jne 0xcdb2c6
mov eax, ebx
jmp 0xcdb30a
lea eax, [esp + 0x124]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00cdf300
add esi, eax
mov cx, word [esp + 0x124]
mov eax, ebx
add eax, 2
mov word [ebx], cx
mov ecx, eax
sub ecx, 0xd19604
setb cl
mov edx, esi
sub edx, edi
setb dl
and cl, dl
test cl, 1
mov ebx, eax
jne 0xcdb2bd
mov word [eax], 0
mov byte [esp + 0x23], 1
jmp 0xcdb316
jmp 0xcdb318
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.00d05160
mov al, byte [esp + 0x23]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret