Function at 0x40fe90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x440
mov eax, dword [0x44d024]
mov dword [esp + 0x40], 0xc157c773
mov dword [esp + 0x44], 0xcd69c35a
mov dword [esp + 0x48], 0xc95acf58
mov dword [esp + 0x4c], 0xb51bcb6b
mov dword [esp + 0x50], 0xb160b76b
mov dword [esp + 0x54], 0xbd52b360
mov dword [esp + 0x58], 0xb907bf54
mov dword [esp + 0x5c], 0xa52cbb13
mov dword [esp + 0x60], 0xa137a708
mov dword [esp + 0x64], 0xad3fa339
mov dword [esp + 0x68], 0xa918af4c
mov dword [esp + 0x6c], 0x954aab14
mov dword [esp + 0x70], 0x91469747
mov dword [esp + 0x74], 0x9d429346
mov dword [esp + 0x78], 0x997e9f59
mov dword [esp + 0x7c], 0x85319b21
mov dword [esp + 0x80], 0x81588712
mov dword [esp + 0x84], 0x8d47835c
mov dword [esp + 0x88], 0x89168f6c
mov dword [esp + 0x8c], 0x75568b56
mov dword [esp + 0x90], 0x7196779f
mov dword [esp + 0x94], 0x7de273b3
mov dword [esp + 0x98], 0x79ea7fec
mov dword [esp + 0x9c], 0x65c37bd7
mov dword [esp + 0xa0], 0x61c467cb
mov dword [esp + 0xa4], 0x6dc963d5
mov dword [esp + 0xa8], 0x69bf6ff0
mov dword [esp + 0xac], 0x55b76bb7
mov dword [esp + 0xb0], 0x5180578d
mov dword [esp + 0xb4], 0x5d8c538d
mov dword [esp + 0xb8], 0x59b65fbc
mov dword [esp + 0xbc], 0x45925bed
mov dword [esp + 0xc0], 0x41f147f8
mov dword [esp + 0xc4], 0x4d9643f4
mov dword [esp + 0xc8], 0x49da4fac
mov dword [esp + 0xcc], 0x35df4be3
mov dword [esp + 0xd0], 0x31d6379b
mov dword [esp + 0xd4], 0x3d9d33f9
mov dword [esp + 0xd8], 0x39ab3f91
mov dword [esp + 0xdc], 0x25d13ba9
mov dword [esp + 0xe0], 0x21eb27c4
mov dword [esp + 0xe4], 0x2db02388
mov dword [esp + 0xe8], 0x29b92fbd
mov dword [esp + 0xec], 0x15fb2b87
mov dword [esp + 0xf0], 0x11c517c7
mov dword [esp + 0xf4], 0x1dc413cb
mov dword [esp + 0xf8], 0x19c81fcc
mov dword [esp + 0xfc], 0x5cc1bc8
mov dword [esp + 0x100], 0x1e607d4
mov dword [esp + 0x104], 0xda103bd
mov dword [esp + 0x108], 0x9ad0fa2
mov dword [esp + 0x10c], 0xf5a10b9a
mov dword [esp + 0x110], 0xf129f725
mov dword [esp + 0x114], 0xfd2bf32d
mov dword [esp + 0x118], 0xf923ff2a
mov dword [esp + 0x11c], 0xe5fafb26
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xdf
ja 0x41014c
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x40]
mov esi, edx
xor esi, 0x80810c31
mov edi, edx
xor edi, 0x7f7ef3ce
or edx, 0x810c31
and edx, edi
add edx, edx
mov edi, edx
and edi, esi
xor edx, esi
lea edx, [edx + edi*2]
xor edx, ecx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov edx, ecx
xor edx, 0xf5
and ecx, 0xa
add ecx, ecx
sub ecx, edx
mov edx, dword [esp]
mov byte [esp + edx + 0x40], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xe0
jb 0x4100f0
mov edi, dword [esp + 0x46c]
mov ebp, dword [esp + 0x468]
lea ebx, [esp + 0x40]
push 0
push 0
push 0
push 0
push ebx
call eax
xor ecx, ecx
mov dword [esp + 0xc], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x447dfc]
xor ebx, ebx
xor eax, eax
test ebp, ebp
setne al
xor esi, esi
jmp dword [eax*4 + 0x447e7c]
mov dword [ebp], ebx
xor eax, eax
test edi, edi
setne al
jmp dword [eax*4 + 0x447e8c]
mov dword [edi], esi
jmp dword [0x447e9c]
test ebx, ebx
setne al
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x454]
mov eax, dword [0x44d028]
mov dword [esp + 0x40], 0x2322206b
mov word [esp + 0x44], 0
mov byte [esp + 0x46], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 6
ja 0x410246
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edx, dword [esp]
movzx edi, byte [esp + edx + 0x40]
mov ebp, esi
or ebp, 0x13feca37
mov edx, esi
not edx
or edx, 0xec0135c8
and edx, ebp
mov ebp, edx
not ebp
add esi, esi
and esi, 0xd8026b90
add ebp, esi
and ebp, edi
add esi, edi
sub edx, esi
add edx, ebp
not edx
sub edx, ebp
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
add dl, 0x18
mov esi, dword [esp]
mov byte [esp + esi + 0x40], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 7
jb 0x4101f0
movzx edx, word [esp + 0x40]
push 0
push edx
push ecx
push dword [esp + 0x18]
call eax
mov edi, eax
xor eax, eax
test edi, edi
setne al
xor esi, esi
mov dword [esp + 8], 0
jmp dword [eax*4 + 0x447e04]
mov eax, dword [0x44d02c]
mov dword [esp + 0x10], 0x4fce4948
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x410301
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
mov esi, ecx
or esi, 0xdb39f56d
mov ebp, ecx
not ebp
or ebp, 0x24c60a92
and ebp, esi
not ebp
and ecx, 0x24c60a92
lea esi, [ecx*2]
add esi, ebp
lea ecx, [esi + edx]
mov ebp, edx
not ebp
or ebp, esi
add edx, ebp
inc edx
mov esi, ecx
not esi
and esi, edx
mov ebp, edx
not ebp
and ecx, ebp
sub ecx, esi
mov esi, ecx
not esi
and esi, edx
and ecx, ebp
sub ecx, esi
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x40]
add cl, 0x26
mov edx, dword [esp]
mov byte [esp + edx + 0x10], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x410290
mov edx, dword [esp + 0x10]
mov dword [esp + 0x40], 0xfdd09d8
mov dword [esp + 0x44], 0x3d60ddb
mov word [esp + 0x48], 0x100
mov dword [esp + 0x4a], 0
mov dword [esp + 4], 0
mov esi, dword [esp + 4]
cmp esi, 0xd
ja 0x41038f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp + 4]
mov ebp, dword [esp + 4]
movzx ebp, byte [esp + ebp + 0x40]
mov ecx, esi
xor ecx, 0xbb04ab42
and esi, 0x3b04ab42
lea esi, [ecx + esi*2]
lea ecx, [esi + ebp]
and esi, ebp
mov ebp, ecx
xor ebp, esi
add ebp, esi
not esi
and esi, ecx
add esi, esi
sub esi, ebp
mov dword [esp], esi
mov ecx, dword [esp]
add cl, 0xb6
mov esi, dword [esp + 4]
mov byte [esp + esi + 0x40], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xe
jb 0x410340
push edx
push 0
push 0
push 0
push dword [esp + 0x468]
push ebx
push edi
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x447e0c]
mov dword [esp + 8], 0
xor esi, esi
jmp dword [0x447e6c]
mov ebp, eax
mov edx, dword [esp + 0x460]
mov ecx, dword [esp + 0x45c]
movzx eax, byte [0x44d15c]
jmp dword [eax*4 + 0x447e14]
mov esi, ecx
mov dword [esp + 0x10], 0x29bb2b61
mov dword [esp + 0x14], 0x2d432fb9
mov dword [esp + 0x18], 0x51395343
mov dword [esp + 0x1c], 0x5576570e
mov dword [esp + 0x20], 0x593b5b35
mov dword [esp + 0x24], 0x5d345f3d
mov dword [esp + 0x28], 0x41d1433d
mov dword [esp + 0x2c], 0x452747d9
mov dword [esp + 0x30], 0x49d54b22
mov dword [esp + 0x34], 0x4d0d4fd8
mov word [esp + 0x38], 0x734c
mov dword [esp + 0x3a], 0
mov byte [esp + 0x3e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x2e
ja 0x410499
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
xor edx, 0x3fb734b7
and eax, 0x3fb734b7
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
add al, 0x6d
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x2f
jb 0x410460
movzx eax, word [esp + 0x10]
test ax, ax
je 0x4104c1
lea ebx, [esp + 0x40]
lea ecx, [esp + 0x12]
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4104b0
mov word [ebx], 0
movzx eax, word [0x44d15e]
test ax, ax
je 0x4104f5
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + ecx], ax
movzx eax, word [ecx + 0x44d160]
add ecx, 2
test ax, ax
jne 0x4104e0
add ebx, ecx
mov word [ebx], 0
lea eax, [esp + 0x40]
push 0x20000000
push 0xffffffffffffffff
push eax
push ebp
call dword [0x44d038]
mov ecx, esi
mov edx, dword [esp + 0x460]
xor esi, esi
mov eax, ecx
neg eax
mov eax, 0
sbb eax, eax
push 0
mov ebx, dword [esp + 0x468]
push ebx
push ebx
push edx
push eax
push ecx
push ebp
call dword [0x44d03c]
xor ecx, ecx
test eax, eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x447e1c]
push 0
push ebp
call dword [0x44d040]
xor ecx, ecx
test eax, eax
setne cl
xor esi, esi
xor ebx, ebx
jmp dword [ecx*4 + 0x447e24]
mov dword [esp + 0x40], 0
xor esi, esi
xor ebx, ebx
nop
lea eax, [esp + 0x40]
push eax
push ebp
call dword [0x44d044]
test eax, eax
setne cl
mov eax, dword [esp + 0x40]
test eax, eax
setne dl
and dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x447e2c]
add eax, esi
inc eax
push eax
push ebx
call fcn.0043edf0
add esp, 8
xor edx, edx
test eax, eax
sete dl
mov ecx, 1
jmp dword [edx*4 + 0x447e34]
mov dword [esp + 0x10], 0
mov ebx, eax
add eax, esi
lea ecx, [esp + 0x10]
push ecx
push dword [esp + 0x44]
push eax
push ebp
call dword [0x44d048]
add esi, dword [esp + 0x10]
mov eax, dword [case.0x4103a8.11]
nop
nop
nop
nop
xor ecx, ecx
jmp eax
jmp dword [ecx*4 + 0x447e5c]
jmp 0x410570
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x447e64]
mov byte [ebx + esi], 0
mov dword [esp + 8], ebx
push ebp
call dword [0x44d050]
jmp dword [0x447e6c]
push edi
call dword [0x44d050]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push edi
call dword [0x44d050]
jmp dword [0x447e74]
push dword [esp + 0xc]
call dword [0x44d050]
xor eax, eax
mov ebp, dword [esp + 0x468]
test ebp, ebp
setne al
mov edi, dword [esp + 0x46c]
mov ebx, dword [esp + 8]
jmp dword [eax*4 + 0x447e7c]
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0x447e84]
xor eax, eax
test edi, edi
setne al
jmp dword [eax*4 + 0x447e8c]
push ebx
call fcn.0043bcc0
add esp, 4
xor eax, eax
test edi, edi
setne al
jmp dword [eax*4 + 0x447e8c]
add dword [ecx], eax
mov eax, 0x2d004101
push es
inc ecx
add byte [edi + 2], ch
inc ecx
add byte [edi - 0x40ffbefd], ch
add eax, dword [ecx]
push ss
add eax, 64815169
inc ecx
add bh, bh
add eax, 0x5480041
inc ecx
add bh, bh
add eax, 0x5630041
inc ecx
add ch, ch
add eax, 0x5960041
inc ecx
add byte [esi - 0x1bffbefb], dh
add eax, 0x5e00041
inc ecx
add al, ah
add eax, 0x5e00041
inc ecx
add ah, ah
add eax, 0x10041
add byte [eax], al
add dword [eax], eax
add byte [eax], al
in al, 5
inc ecx
add byte [ecx], al
add byte [eax], al
add bl, ch
add eax, 0x5ed0041
inc ecx
add bh, bh
add eax, 0x5fb0041
inc ecx
add byte [eax], ah
push es
inc ecx
add byte [eax], dl
push es
inc ecx
add byte [0x20004106], ch
push es
inc ecx
add byte [edi + 6], dl
inc ecx
add byte [ebp + 0x65004101], cl
push es
inc ecx
add byte [ebx + 6], dh
inc ecx
add byte [eax - 0x5fffbeff], ch
add dword [ecx], eax
mov al, byte [0xa0004101]
add dword [ecx], eax
test al, 1
inc ecx
add byte [eax + 0x4d004101], ah
or dword [ecx], eax
push esp
or dword [ecx], eax
loopne 0x447eb7
inc ecx
add bh, ah
or dword [ecx], eax
jmp 0x447ec0
add dl, dh
or al, byte [ecx]
pop es
or eax, dword [ecx]
adc eax, 0xca00410b
or al, 65
add byte [esi], ch
or eax, dword [ecx]
or byte [0xd0c0041], cl
inc ecx
add byte [edx + 0xd], ah
inc ecx
add byte [eax], bh
or eax, 0xd500041
inc ecx
add byte [eax + 0xd], dl
inc ecx
add byte [eax + 0xd], dl
inc ecx
add byte [edx + 0xd], dl
inc ecx
add byte [edx + 0xd], ah
inc ecx
add byte [ebp + ecx + 0x41], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bl, ah
adc al, 0x41
add byte [ecx], ah
cmovno eax, dword [eax]
invalid