Function at 0x409b50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x110
cmp dword [ecx + 0x20], 0
je 0x409fd8
mov esi, ecx
lea eax, [ecx + 0x10]
push eax
call fcn.00406580
add esp, 4
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x48]
mov dword [esp + 0xc], eax
movzx eax, byte [esi]
imul ecx, eax, 0xcd
shr ecx, 0xa
and ecx, 0xfffffffe
lea ecx, [ecx + ecx*4]
sub al, cl
movzx eax, al
movzx eax, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov byte [esp + 2], al
mov byte [esp + 3], 0
mov dword [esp + 0x10], edx
lea eax, [edx + 0x400]
push eax
call fcn.004084c0
add esp, 4
mov edi, eax
mov dword [esp + 0x74], 0xabd7c2d0
mov byte [esp + 0x78], 0x4c
mov word [esp + 0x79], 0
mov byte [esp + 0x7b], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x12
xor cl, byte [esp + eax + 0x74]
add cl, 0xa6
mov byte [esp + eax + 0x74], cl
inc eax
cmp eax, 8
jne 0x409be0
lea ebx, [esp + 0x74]
mov ecx, esi
push 0x4484e4
push ebx
push edi
call fcn.004093f0
mov dword [esp + 0x74], 0xd7baa0b8
mov word [esp + 0x78], 0
mov eax, 0xb1
nop
nop
nop
nop
movzx ebp, byte [ebx]
lea ecx, [ebp*2]
not ecx
add ecx, ebp
mov edx, eax
and edx, ebp
and ebp, 0x1a
and ecx, 0x798feae5
or ecx, ebp
xor ecx, 0xe5
or ecx, eax
not ecx
or ecx, edx
add cl, 0x7a
mov byte [ebx], cl
inc ebx
dec eax
cmp eax, 0xab
jne 0x409c20
lea eax, [esp + 2]
lea ebx, [esp + 0x74]
mov ecx, esi
push eax
push ebx
push edi
call fcn.004093f0
mov ebp, dword [str.tLYMe5__222new]
mov dword [esp + 0x74], 0x690e0408
mov ecx, 0x8d0f2ae7
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x72f0d58d]
mov edx, eax
and edx, ecx
add dl, dl
sub al, dl
movzx eax, al
add eax, ecx
add al, 0x7d
mov byte [esp + ecx + 0x72f0d58d], al
inc ecx
cmp ecx, 0x8d0f2aeb
jne 0x409c80
mov dword [esp + 8], esi
mov ecx, esi
push ebp
push ebx
mov dword [esp + 0xc], edi
push edi
call fcn.004093f0
mov dword [esp + 0x74], 0x676c6453
mov dword [esp + 0x78], 0x5463687b
mov dword [esp + 0x7c], 0x6e6d685b
mov byte [esp + 0x80], 0xcc
mov word [esp + 0x81], 0
mov byte [esp + 0x83], 0
mov eax, 0xff0282b0
movzx ecx, byte [esp + eax + 0xfd7dc4]
xor ecx, eax
add ecx, 0x4f3728f
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0xfd7dc4], cl
inc eax
cmp eax, 0xff0282c0
jne 0x409cf0
mov dword [esp + 0x14], 0x930e3231
mov byte [esp + 0x18], 0
lea eax, [esp + 0x14]
xor esi, esi
xor ebp, ebp
nop
movzx edi, byte [eax]
mov ecx, esi
and ecx, 0x84543ab8
mov edx, ebp
xor edx, 0x3dd5e2a3
sub edx, ecx
inc edx
xor edx, edi
mov ecx, edx
xor ecx, 0x35
and edx, 0x4a
add edx, edx
sub edx, ecx
inc dl
mov byte [eax], dl
inc eax
dec ebp
add esi, 0xfffffffe
cmp ebp, 0xfffffffb
jne 0x409d30
lea ebp, [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, esi
push ebx
push ebp
mov edi, dword [esp + 0xc]
push edi
call fcn.004093f0
mov dword [esp + 0x74], 0xc6fef8c6
mov byte [esp + 0x78], 0x64
mov dword [esp + 0x79], 0
mov byte [esp + 0x7d], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x98
xor cl, byte [esp + eax + 0x74]
add cl, 8
mov byte [esp + eax + 0x74], cl
inc eax
cmp eax, 0xa
jne 0x409da0
mov ecx, esi
push dword [esp + 0x10]
push dword [esp + 0x10]
push ebx
push edi
call fcn.004096d0
mov dword [esp + 0x14], 0x23bd2163
mov dword [esp + 0x18], 0x27b225ba
mov dword [esp + 0x1c], 0x5bc4593d
mov dword [esp + 0x20], 0x5f035dc8
mov dword [esp + 0x24], 0x53db5124
mov dword [esp + 0x28], 0x573355c4
mov dword [esp + 0x2c], 0x4b6a4902
mov dword [esp + 0x30], 0x4fdb4dd1
mov dword [esp + 0x34], 0x43d641dc
mov dword [esp + 0x38], 0x47d645dd
mov dword [esp + 0x3c], 0x7be87919
mov dword [esp + 0x40], 0x7f217de8
mov dword [esp + 0x44], 0x73ed7116
mov dword [esp + 0x48], 0x77eb75e6
mov dword [esp + 0x4c], 0x6b0e6935
mov dword [esp + 0x50], 0x6ffa6d0d
mov dword [esp + 0x54], 0x63296101
mov dword [esp + 0x58], 0x67046544
mov dword [esp + 0x5c], 0x9b0f9907
mov dword [esp + 0x60], 0x9ffa9d02
mov dword [esp + 0x64], 0x930091f1
mov dword [esp + 0x68], 0x97db951d
mov word [esp + 0x6c], 0x8988
mov byte [esp + 0x70], 0
mov word [esp + 0x6e], 0
mov eax, 0x91843f38
nop
movzx ecx, byte [esp + eax + 0x6e7bc0dc]
xor ecx, eax
mov edx, ecx
and edx, 0xe5
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
xor ecx, 0xe7
add ecx, edi
add ecx, edx
inc cl
mov byte [esp + eax + 0x6e7bc0dc], cl
inc eax
cmp eax, 0x91843f95
jne 0x409e90
movzx eax, word [esp + 0x14]
test ax, ax
je 0x409f01
lea ebx, [esp + 0x74]
lea ecx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409ef0
mov word [ebx], 0
mov edi, dword [esp + 8]
movzx ecx, byte [edi + 0x60]
test cl, cl
je 0x409f31
lea eax, [edi + 0x61]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, cl
mov word [ebx], cx
add ebx, 2
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x409f20
mov dword [ebx], 0xa000d
mov word [ebx + 4], 0
mov eax, dword [edi + 0x80]
mov dword [esp + 0x14], 0xff1ff92b
mov dword [esp + 0x18], 0xe30bfd6c
mov word [esp + 0x1c], 0xe1e0
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
mov ecx, 0x2a
mov edx, 0xd5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x16]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x2e
mov byte [esp + ecx - 0x16], bl
inc ecx
dec edx
cmp ecx, 0x39
jne 0x409f80
lea ecx, [esp + 0x74]
push 0x493e0
push eax
mov esi, dword [esp + 0xc]
push esi
push 0
push 0
push ecx
push ebp
call fcn.0040c670
add esp, 0x1c
mov ebx, eax
push esi
call fcn.004084d0
add esp, 4
mov eax, dword [edi + 0x80]
add dword [edi + 4], eax
mov dword [edi + 0x80], 0
jmp 0x409fda
mov bl, 1
mov eax, ebx
add esp, 0x110
pop esi
pop edi
pop ebx
pop ebp
ret