Function at 0x40f490
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x438
mov ebx, dword [esp + 0x464]
mov edi, dword [esp + 0x44c]
mov dword [esp + 0x38], 0x1785196d
mov dword [esp + 0x3c], 0x138b1592
mov dword [esp + 0x40], 0xf9a1184
mov dword [esp + 0x44], 0xb590d6d
mov dword [esp + 0x48], 0x7540945
mov dword [esp + 0x4c], 0x3220554
mov dword [esp + 0x50], 0x3f550158
mov dword [esp + 0x54], 0x3ba83da5
mov dword [esp + 0x58], 0x37a539a4
mov dword [esp + 0x5c], 0x33bd35bf
mov dword [esp + 0x60], 0x2f5c3110
mov dword [esp + 0x64], 0x2b0a2d40
mov dword [esp + 0x68], 0x27762979
mov dword [esp + 0x6c], 0x23722576
mov dword [esp + 0x70], 0x5f7e2167
mov dword [esp + 0x74], 0x5bc35d37
mov dword [esp + 0x78], 0x571c59ca
mov dword [esp + 0x7c], 0x53155518
mov dword [esp + 0x80], 0x4fc65170
mov dword [esp + 0x84], 0x4b064d06
mov dword [esp + 0x88], 0x47664911
mov dword [esp + 0x8c], 0x43d24505
mov dword [esp + 0x90], 0x7fea41d0
mov dword [esp + 0x94], 0x7b117de1
mov dword [esp + 0x98], 0x77e879e5
mov dword [esp + 0x9c], 0x73eb7503
mov dword [esp + 0xa0], 0x6f3d71fc
mov dword [esp + 0xa4], 0x6b256d21
mov dword [esp + 0xa8], 0x67346923
mov dword [esp + 0xac], 0x6328652b
mov dword [esp + 0xb0], 0x9fc66140
mov dword [esp + 0xb4], 0x9be29deb
mov dword [esp + 0xb8], 0x97e399f4
mov dword [esp + 0xbc], 0x93c695e0
mov dword [esp + 0xc0], 0x8f1a91b0
mov dword [esp + 0xc4], 0x8b1d8d15
mov dword [esp + 0xc8], 0x87a68915
mov dword [esp + 0xcc], 0x831f85ff
mov dword [esp + 0xd0], 0xbf29811f
mov dword [esp + 0xd4], 0xbbe3bd2f
mov dword [esp + 0xd8], 0xb7c9b998
mov dword [esp + 0xdc], 0xb33cb52c
mov dword [esp + 0xe0], 0xaf3bb123
mov dword [esp + 0xe4], 0xabf9ad31
mov dword [esp + 0xe8], 0xa7f7a9f9
mov dword [esp + 0xec], 0xa3f0a5ed
mov dword [esp + 0xf0], 0xdf8ca1f0
mov dword [esp + 0xf4], 0xdb88dd8c
mov dword [esp + 0xf8], 0xd7f6d988
mov dword [esp + 0xfc], 0xd3b3d5bb
mov dword [esp + 0x100], 0xcfafd14a
mov dword [esp + 0x104], 0xcb53cd42
mov dword [esp + 0x108], 0xc78bc99b
mov dword [esp + 0x10c], 0xc389c58b
mov dword [esp + 0x110], 0xffb1c192
mov dword [esp + 0x114], 0xfbfafdb6
mov eax, dword [0x45182c]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x86
xor dl, byte [esp + ecx + 0x38]
add dl, 0x62
mov byte [esp + ecx + 0x38], dl
inc ecx
cmp ecx, 0xe0
jne case.default.0x40f723
lea esi, [esp + 0x38]
push 0
push 0
push 0
push 0
push esi
call eax
xor ecx, ecx
mov dword [esp + 4], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44bb34]
xor edi, edi
xor eax, eax
mov ecx, dword [esp + 0x460]
test ecx, ecx
setne al
xor ebp, ebp
jmp dword [eax*4 + 0x44bba4]
push edi
call fcn.0043f710
add esp, 4
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x44bbbc]
mov eax, dword [0x451830]
mov dword [esp + 0x38], 0x41464401
mov dword [esp + 0x3c], 0
mov ecx, 0x38b2376e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esi]
mov edx, ecx
or edx, ebx
lea ebp, [ecx - 0x38b23700]
and ebp, ebx
not edx
or edx, ebp
lea ebx, [edx + 0x18]
mov ebp, 0xe7
sub ebp, edx
and ebp, 0xee
and ebx, 0x11
sub ebx, ebp
and edx, 1
xor ebx, 1
lea edx, [ebx + edx*2]
mov byte [esi], dl
inc esi
dec ecx
cmp ecx, 0x38b23766
jne 0x40f780
movzx ecx, word [esp + 0x38]
push 0
push ecx
push edi
push dword [esp + 0x10]
call eax
xor ecx, ecx
mov dword [esp], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44bb3c]
xor ebp, ebp
xor edi, edi
jmp 0x40fb16
mov eax, dword [0x451834]
mov dword [esp + 8], 0x119e1f1c
mov ecx, 5
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 3]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
lea esi, [ecx + edx]
add esi, 0xe8328fe6
mov edx, esi
xor edx, 0xfe
or esi, 1
and edx, esi
add edx, esi
mov byte [esp + ecx + 3], dl
inc ecx
cmp ecx, 9
jne 0x40f800
mov ecx, dword [esp + 8]
mov dword [esp + 0x38], 0x29db2bd4
mov dword [esp + 0x3c], 0x2dda2fdd
mov word [esp + 0x40], 0xd32c
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor ebp, ebp
xor esi, esi
nop
nop
nop
movzx edi, byte [esp + esi + 0x38]
mov edx, ebp
and edx, 0xe
mov ebx, esi
xor ebx, 0x22725077
add ebx, edx
mov edx, ebx
and edx, edi
add ebx, edi
add edx, edx
sub ebx, edx
add bl, 0xad
mov byte [esp + esi + 0x38], bl
inc esi
add ebp, 2
cmp esi, 0x10
jne case.default.0x40f8b4
lea esi, [esp + 0x38]
push ecx
push 0
push 0
push 0
push dword [esp + 0x460]
push esi
push dword [esp + 0x18]
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
xor ebp, ebp
xor edi, edi
jmp dword [eax*4 + 0x44bb44]
movzx eax, byte [0x451964]
jmp dword [eax*4 + 0x44bb4c]
mov dword [esp + 8], 0x69fb6ba1
mov dword [esp + 0xc], 0x6dc36ff9
mov dword [esp + 0x10], 0x51f953c3
mov dword [esp + 0x14], 0x55b6578e
mov dword [esp + 0x18], 0x59fb5bf5
mov dword [esp + 0x1c], 0x5df45ffd
mov dword [esp + 0x20], 0x41d143fd
mov dword [esp + 0x24], 0x45e747d9
mov dword [esp + 0x28], 0x49d54be2
mov dword [esp + 0x2c], 0x4d8d4fd8
mov word [esp + 0x30], 0x334c
mov dword [esp + 0x32], 0
mov word [esp + 0x36], 0
mov eax, 0xe9
mov ecx, 0x17
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
or edi, 0x4e
add edi, eax
mov edx, eax
neg edx
and edx, 0x31
or edx, edi
xor dl, byte [esp + ecx - 0xf]
xor dl, 0x4e
add dl, 0x8d
mov byte [esp + ecx - 0xf], dl
dec eax
inc ecx
cmp ecx, 0x47
jne 0x40f940
movzx eax, word [esp + 8]
test ax, ax
je 0x40f991
lea esi, [esp + 0x38]
lea ecx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi], ax
add esi, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f980
mov word [esi], 0
movzx eax, word [0x451966]
test ax, ax
je 0x40f9c5
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi + ecx], ax
movzx eax, word [ecx + 0x451968]
add ecx, 2
test ax, ax
jne 0x40f9b0
add esi, ecx
mov word [esi], 0
lea eax, [esp + 0x38]
push 0x20000000
push 0xffffffffffffffff
push eax
push ebx
call dword [0x451840]
xor ebp, ebp
mov ecx, dword [esp + 0x454]
mov eax, ecx
neg eax
mov eax, 0
sbb eax, eax
push 0
mov edx, dword [esp + 0x460]
push edx
push edx
push dword [esp + 0x464]
push eax
push ecx
push ebx
call dword [0x451844]
xor ecx, ecx
test eax, eax
setne cl
xor edi, edi
jmp dword [ecx*4 + 0x44bb54]
push 0
push ebx
call dword [0x451848]
xor ecx, ecx
test eax, eax
setne cl
xor ebp, ebp
xor edi, edi
jmp dword [ecx*4 + 0x44bb5c]
mov dword [esp + 0x38], 0
xor ebp, ebp
lea esi, [esp + 0x38]
xor edi, edi
jmp case.0x40f8b4.11
mov dword [esp + 8], 0
mov ecx, eax
add ecx, ebp
lea edx, [esp + 8]
push edx
push dword [esp + 0x3c]
push ecx
push ebx
mov edi, eax
call dword [0x451850]
add ebp, dword [esp + 8]
xor eax, eax
jmp dword [eax*4 + 0x44bb74]
push esi
push ebx
call dword [0x45184c]
test eax, eax
setne cl
mov eax, dword [esp + 0x38]
test eax, eax
setne dl
and dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x44bb64]
add eax, ebp
inc eax
push eax
push edi
call fcn.00442630
add esp, 8
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x44bb6c]
mov eax, 1
jmp dword [eax*4 + 0x44bb74]
mov eax, dword [case.0x40f8b4.15]
nop
nop
nop
nop
nop
nop
jmp eax
xor eax, eax
test edi, edi
setne al
jmp dword [eax*4 + 0x44bb8c]
mov byte [edi + ebp], 0
jmp dword [0x44bb98]
push ebx
call dword [0x451858]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
call dword [0x451858]
jmp dword [0x44bb9c]
push dword [esp]
call dword [0x451858]
mov ebx, dword [esp + 0x464]
push dword [esp + 4]
call dword [0x451858]
xor eax, eax
mov ecx, dword [esp + 0x460]
test ecx, ecx
setne al
jmp dword [eax*4 + 0x44bba4]
mov dword [ecx], edi
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x44bbbc]
mov dword [ebx], ebp
test edi, edi
setne al
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
int3
xor ebx, ebx
jmp 0x410342
mov eax, dword [0x451830]
mov dword [esp + 0x38], 0x710e0cd1
mov word [esp + 0x3c], 0
mov byte [esp + 0x3e], 0
mov ecx, 0x76d86f3d
nop
nop
movzx edx, byte [esp + ecx - 0x76d86f05]
xor edx, ecx
mov edi, edx
and edi, 0xcc
mov ebx, edx
and ebx, 2
mov ebp, ebx
xor ebp, 2
imul ebp, edi
or edi, 2
imul edi, ebx
xor edx, 0xce
add edx, ebp
add edx, edi
inc dl
mov byte [esp + ecx - 0x76d86f05], dl
inc ecx
cmp ecx, 0x76d86f44
jne 0x40fe20
movzx ecx, word [esp + 0x38]
push 0
push ecx
push 0x451860
push dword [esp + 0x40]
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
xor ebx, ebx
jmp dword [eax*4 + 0x44bbcc]
mov eax, dword [0x451834]
mov dword [esp], eax
mov dword [esp + 4], 0x1860704
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov ebp, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ebp + 3]
mov ecx, ebp
and ecx, ebx
mov eax, ecx
and eax, 0xd
mov edx, ecx
or edx, 0xfffffffd
inc edx
imul edx, eax
mov eax, ecx
and eax, 2
or ecx, 2
imul ecx, eax
add edx, ebx
sub edx, ecx
lea eax, [edx + ebp]
add eax, 0x8ab691ff
mov ecx, eax
and ecx, 0x7b
add ecx, ecx
xor eax, 4
sub ecx, eax
mov byte [esp + ebp + 3], cl
inc ebp
cmp ebp, 8
jne 0x40feb0
mov ecx, dword [esp + 4]
mov dword [esp + 0x38], 0xb1ff8ffc
mov dword [esp + 0x3c], 0xb5c6b3c5
mov word [esp + 0x40], 0xb7b4
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
xor edx, edx
mov eax, edx
add al, 0x1d
xor al, byte [esp + edx + 0x38]
add al, 0x6f
mov byte [esp + edx + 0x38], al
inc edx
cmp edx, 0x10
jne case.default.0x40ff51
push ecx
push 0
push 0
push 0
push dword [esp + 0x25c]
push esi
push edi
call dword [esp + 0x1c]
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
jmp dword [eax*4 + 0x44bbd4]
xor ebx, ebx
jmp dword [0x44bc28]
xor eax, eax
mov ecx, dword [esp + 0x264]
test ecx, ecx
setg al
jmp dword [eax*4 + 0x44bbdc]
movzx eax, byte [0x451964]
jmp dword [eax*4 + 0x44bbe4]
push ecx
push ecx
push ecx
push ecx
push ebp
call dword [0x45183c]
movzx eax, byte [0x451964]
jmp dword [eax*4 + 0x44bbe4]
mov dword [esp], ebp
jmp dword [0x44bbec]
mov dword [esp + 4], 0xf76509c7
mov dword [esp + 8], 0xf365f567
mov dword [esp + 0xc], 0xff53f159
mov dword [esp + 0x10], 0xfb1afd3a
mov dword [esp + 0x14], 0xe745f95b
mov dword [esp + 0x18], 0xe348e54b
mov dword [esp + 0x1c], 0xef7be143
mov dword [esp + 0x20], 0xeb49ed77
mov dword [esp + 0x24], 0xd74fe946
mov dword [esp + 0x28], 0xd317d544
mov word [esp + 0x2c], 0xd1d0
mov dword [esp + 0x2e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xfe
xor cl, byte [esp + eax + 4]
add cl, 0xa
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x2e
jne 0x410010
movzx eax, word [esp + 4]
test ax, ax
je 0x410051
lea esi, [esp + 0x38]
lea ecx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi], ax
add esi, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410040
mov word [esi], 0
movzx eax, word [0x451966]
test ax, ax
je 0x410085
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [esi + ecx], ax
movzx eax, word [ecx + 0x451968]
add ecx, 2
test ax, ax
jne 0x410070
add esi, ecx
mov word [esi], 0
mov eax, dword [0x451840]
mov dword [esp + 4], 0xd9fafbfc
mov ecx, 0x2b
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x27]
lea edx, [ecx - 0x663fcc00]
mov ebx, ecx
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, 0xc104d7
sub esi, edx
or esi, 1
add esi, edx
add esi, 0xff3efb29
mov ebp, esi
and ebp, 2
mov ebx, esi
or esi, 2
imul esi, ebp
xor ebp, 2
and ebx, 0xfd
imul ebx, ebp
lea ebp, [edx + edx]
and ebp, 2
sub edx, ebp
add edx, esi
add edx, ebx
add dl, 0x29
mov byte [esp + ecx - 0x27], dl
inc ecx
cmp ecx, 0x2f
jne 0x4100a0
lea ecx, [esp + 0x38]
push dword [esp + 4]
push 0xffffffffffffffff
push ecx
push dword [esp + 0xc]
call eax
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [esp + 6]
mov dword [esp + 4], 0xf76509c7
mov dword [esp + 8], 0xf365f567
mov dword [esp + 0xc], 0xff53f159
mov dword [esp + 0x10], 0xfb1afd3a
mov dword [esp + 0x14], 0xe745f95b
mov dword [esp + 0x18], 0xe348e54b
mov dword [esp + 0x1c], 0xef7be143
mov dword [esp + 0x20], 0xeb49ed77
mov dword [esp + 0x24], 0xd74fe946
mov dword [esp + 0x28], 0xd317d544
mov word [esp + 0x2c], 0xd1d0
mov dword [esp + 0x2e], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xfe
xor dl, byte [esp + ecx + 4]
add dl, 0xa
mov byte [esp + ecx + 4], dl
inc ecx
cmp ecx, 0x2e
jne 0x410180
movzx edx, word [esp + 4]
lea ecx, [esp + 0x38]
test dx, dx
je 0x4101c1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x4101b0
mov word [ecx], 0
movzx eax, word [0x451966]
test ax, ax
je 0x4101f5
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx + edx], ax
movzx eax, word [edx + 0x451968]
add edx, 2
test ax, ax
jne 0x4101e0
add ecx, edx
mov word [ecx], 0
mov eax, dword [0x451840]
mov dword [esp + 4], 0xd9fafbfc
mov ecx, 0x2b
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x27]
lea edx, [ecx - 0x663fcc00]
mov ebx, ecx
and ebx, esi
or edx, esi
xor edx, ebx
mov esi, 0xc104d7
sub esi, edx
or esi, 1
add esi, edx
add esi, 0xff3efb29
mov ebp, esi
and ebp, 2
mov ebx, esi
or esi, 2
imul esi, ebp
xor ebp, 2
and ebx, 0xfd
imul ebx, ebp
lea ebp, [edx + edx]
and ebp, 2
sub edx, ebp
add edx, esi
add edx, ebx
add dl, 0x29
mov byte [esp + ecx - 0x27], dl
inc ecx
cmp ecx, 0x2f
jne 0x410210
lea ecx, [esp + 0x38]
push dword [esp + 4]
push 0xffffffffffffffff
push ecx
mov ebp, dword [esp + 0xc]
push ebp
call eax
jmp dword [0x44bbf4]
xor eax, eax
mov edx, dword [esp + 0x250]
mov ecx, edx
neg ecx
sbb eax, eax
push 0
push dword [esp + 0x264]
push dword [esp + 0x260]
push dword [esp + 0x260]
push eax
push edx
push ebp
call dword [0x451844]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44bbfc]
xor ebx, ebx
jmp 0x410335
mov dword [esp + 0x38], 0
mov esi, dword [0x451854]
mov ebx, ebp
mov ebp, dword [esp + 0x25c]
jmp dword [0x44bc04]
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x264]
push ebp
push ebx
call esi
nop
nop
nop
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x264]
push ebp
push ebx
call esi
jmp dword [0x44bc10]
xor ecx, ecx
test eax, eax
setne cl
mov ebp, ebx
xor ebx, ebx
jmp dword [ecx*4 + 0x44bc14]
push 0
push ebp
call dword [0x451848]
xor ecx, ecx
test eax, eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x44bc1c]
jmp 0x410335
mov bl, 1
push ebp
call dword [0x451858]
jmp dword [0x44bc28]
mov eax, ebx
add esp, 0x238
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call dword [0x451858]
push edi
call dword [0x451858]
jmp dword [0x44bc2c]
push dword [esp + 0x34]
call dword [0x451858]
jmp 0x410342
test dword [eax], case.0x40f723.0
invalid