Function at 0x409ab0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov edi, dword [ebp + 8]
mov dword [esp + 0x74], ecx
add edi, dword [ecx + 0x60]
mov dword [esp + 0x78], 0xcfc6c823
mov dword [esp + 0x7c], 0xc8c3dd
mov dword [esp + 0x80], 0xd4c0fa2a
mov dword [esp + 0x84], 0xc3d71538
mov dword [esp + 0x88], 0xf3edeac2
mov dword [esp + 0x8c], 0xfbf2eaf5
mov dword [esp + 0x90], 0xf23fc93f
mov dword [esp + 0x94], 0xe2e3ffe0
mov dword [esp + 0x98], 0x444246f2
mov word [esp + 0x9c], 0x5d40
mov dword [esp + 0x9e], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x29
ja 0x409ba0
nop
nop
nop
nop
mov edx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx esi, byte [esp + eax + 0x78]
lea eax, [edx - 0x7729e4b1]
lea ecx, [edx + esi]
add ecx, 0x88d61b4f
add edx, 0x4f
and edx, esi
and eax, esi
add eax, edx
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0xd7
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x78], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x2a
jb 0x409b50
mov dword [esp + 8], 0x3b323614
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x409c0a
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0xa7]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add eax, 0xef03ea7
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add al, 0x6f
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x409bd0
mov dword [esp + 0x18], 0x56506c6d
mov dword [esp + 0x1c], 0x5252607c
mov dword [esp + 0x20], 0x4f3a307d
mov dword [esp + 0x24], 0x4a374e33
mov dword [esp + 0x28], 0x72473332
mov dword [esp + 0x2c], 0x38659f99
mov dword [esp + 0x30], 0xc5bfcdc6
mov dword [esp + 0x34], 0xc69a80c8
mov dword [esp + 0x38], 0xc0cdc1c3
mov dword [esp + 0x3c], 0xc8cfc1cd
mov dword [esp + 0x40], 0xad6a83d6
mov dword [esp + 0x44], 0x92d3dfd3
mov dword [esp + 0x48], 0xa2d6a0a4
mov dword [esp + 0x4c], 0xa6d8658f
mov dword [esp + 0x50], 0x59b79ce5
mov dword [esp + 0x54], 0x9ae2e49a
mov dword [esp + 0x58], 0x9552ba52
mov dword [esp + 0x5c], 0xe993e9ed
mov dword [esp + 0x60], 0xa68ff489
mov dword [esp + 0x64], 0x6d4e
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x4f
ja 0x409d0c
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x18]
lea edx, [eax + 0x553e5be8]
and edx, ecx
add eax, ecx
add eax, 0x553e5be8
add edx, edx
sub eax, edx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xa8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 4]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp eax, 0x50
jb 0x409cc0
mov eax, dword [ebp + 0xc]
movzx ecx, byte [esp + 0x18]
mov edx, edi
test cl, cl
je 0x409d2b
lea esi, [esp + 0x19]
mov edx, edi
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409d20
mov byte [edx], 0
movzx ecx, byte [eax]
test cl, cl
je 0x409d4b
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x409d40
mov byte [edx], 0
movzx eax, byte [esp + 8]
test al, al
je 0x409d6b
lea ecx, [esp + 9]
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409d60
mov ebx, dword [ebp + 0x10]
mov byte [edx], 0
movzx eax, byte [esp + 0x78]
test al, al
mov dword [esp + 0x70], edi
je 0x409d9b
lea ecx, [esp + 0x79]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409d90
mov byte [edx], 0
mov esi, dword [ebp + 0x14]
mov ecx, esi
shr ecx, 2
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov ecx, esi
mov eax, esi
and eax, 0xfffffffc
lea esi, [edx + eax]
add eax, ebx
mov ebx, ecx
and ebx, 3
mov ecx, ebx
shr ecx, 1
mov edi, eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], esi
mov edi, esi
mov esi, dword [esp + 0x6c]
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov ecx, dword [ebp + 0x14]
test cl, 1
je 0x409df5
xor ebx, 1
and ebx, ecx
and ecx, 2
movzx eax, byte [eax + ebx]
mov esi, dword [esp + 0x68]
mov byte [esi + ecx], al
mov dword [esp + 0x18], 0xa4a7c3f9
mov dword [esp + 0x1c], 0xa8b49a98
mov dword [esp + 0x20], 0x68a7969a
mov dword [esp + 0x24], 0x92659162
mov dword [esp + 0x28], 0x797a8e6d
mov dword [esp + 0x2c], 0xd5d3be8d
mov word [esp + 0x30], 0xdbd1
mov byte [esp + 0x32], 0xe0
mov dword [esp + 0x33], 0
mov dword [esp + 0x37], 0
mov word [esp + 0x3b], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x24
mov edi, dword [esp + 0x70]
ja 0x409e9f
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x18]
lea esi, [eax + 0xdf]
and esi, ecx
add eax, ecx
add esi, esi
sub eax, esi
add eax, 0xe5f72edf
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x78]
add al, 0xe7
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x25
jb 0x409e60
add edx, dword [ebp + 0x14]
movzx eax, byte [esp + 0x18]
test al, al
je 0x409ebb
lea ecx, [esp + 0x19]
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409eb0
mov byte [edx], 0
sub edx, edi
mov eax, dword [esp + 0x74]
add dword [eax + 0x60], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10