Function at 0x40b0d0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x18]
cmp eax, 0xc
mov dword [ebp - 0x10], eax
jne 0x40b059
mov eax, dword [0x501004]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 2
jne 0x40b045
lea eax, [0x501009]
lea ecx, [ebp - 0x28]
push ebx
push edi
push esi
push eax
push ecx
call 0x40b0d0
add esp, 0x14
mov edi, dword [ebp - 0x28]
cmp edi, 0x80000000
je 0x40b079
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
push ebx
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.004e1f50
add esp, 0xc
cmp dword [ebp - 0x28], 0
jne 0x40b093
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x501004
push 0x501004
call fcn.0040c5e0
add esp, 8
jmp 0x40aff7
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x10]
push 0x536594
push eax
push 0x536524
push ecx
push 0
call fcn.00409310
lea eax, [ebp - 0x10]
push 0x536514
push 0x536484
push eax
push 0x2b
push 0x536494
call fcn.004dc7d0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
push 0x536514
push 0x5364c0
lea eax, [ebp - 0x28]
push eax
push 0x2b
push 0x536494
call fcn.004dc7d0
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffe0
sub esp, 0x600
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x40b135
js 0x40b42f
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 1
push ebx
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x40b438
mov edi, eax
push ebx
push dword [ebp + 0x14]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp ebx, 0xf
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebx
ja 0x40b140
mov dword [esi], 0x80000000
jmp 0x40b3e8
mov dword [esi], 0x80000000
jmp 0x40b41b
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xcc], 0x6b206574
mov dword [esp + 0xc8], 0x79622d32
mov dword [esp + 0xc4], 0x3320646e
mov dword [esp + 0xc0], 0x61707865
lea edx, [ebx - 0x10]
mov dword [esp + 0x24], edx
movsd xmm1, qword [ecx + 8]
movsd xmm0, qword [ecx]
movsd xmm2, qword [ecx + 0x18]
movsd qword [esp + 0xd8], xmm1
movsd xmm1, qword [ecx + 0x10]
movsd qword [esp + 0xd0], xmm0
movsd qword [esp + 0xe8], xmm2
movsd qword [esp + 0xe0], xmm1
movsd xmm1, qword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0x3a8], eax
lea eax, [edi + ebx - 0x10]
movsd qword [esp + 0x3a0], xmm1
mov dword [esp + 0x34], eax
mov eax, dword [0x5010bc]
movzx eax, byte [eax]
cmp al, 0xff
je 0x40b425
movsd xmm0, qword [esp + 0xe8]
movsd xmm1, qword [esp + 0xc8]
mov eax, dword [esp + 0x3a8]
mov ebx, esp
lea ecx, [esp + 0x38]
mov edx, ebx
movsd qword [esp + 0x60], xmm0
movsd xmm0, qword [esp + 0xe0]
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x58], xmm0
movsd xmm0, qword [esp + 0xd8]
movsd qword [esp + 0x50], xmm0
movsd xmm0, qword [esp + 0xd0]
movsd qword [esp + 0x48], xmm0
movsd xmm0, qword [esp + 0xc0]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [esp + 0x3a0]
mov dword [esp + 0x68], 0
mov dword [esp + 0x74], eax
movsd qword [esp + 0x6c], xmm0
xorps xmm0, xmm0
mov byte [esp + 0xb8], 0
movsd qword [esp + 0x78], xmm0
movsd qword [esp + 0x80], xmm0
movsd qword [esp + 0x88], xmm0
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0x98], xmm0
movsd qword [esp + 0xa0], xmm0
movsd qword [esp + 0xa8], xmm0
movsd qword [esp + 0xb0], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push 0x20
call fcn.00408190
add esp, 4
lea eax, [esp + 0x3a0]
push ebx
push eax
call fcn.00453720
add esp, 8
mov byte [esp], 0
mov byte [esp + 1], 0
mov byte [esp + 2], 0
mov byte [esp + 3], 0
mov byte [esp + 4], 0
mov byte [esp + 5], 0
mov byte [esp + 6], 0
mov byte [esp + 7], 0
mov byte [esp + 8], 0
mov byte [esp + 9], 0
mov byte [esp + 0xa], 0
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0
mov byte [esp + 0xd], 0
mov byte [esp + 0xe], 0
mov byte [esp + 0xf], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1f], 0
mov dword [esp + 0x68], 1
mov byte [esp + 0xb8], 0
lea eax, [esp + 0x300]
push 0x84
lea ecx, [esp + 0x3c]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ebx, [esp + 0xc0]
push 0x240
lea eax, [esp + 0x3a4]
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [esp + 0x34]
push dword [esp + 0x28]
push edi
push 0
push 1
push ebx
call fcn.00407850
add esp, 0x18
test al, al
je 0x40b3f9
mov ebx, dword [esp + 0x28]
mov dword [esi], 0x80000000
test ebx, ebx
je 0x40b41b
push 1
push ebx
push dword [esp + 0x34]
call fcn.0040d1e0
add esp, 0xc
jmp 0x40b41b
lea eax, [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.004589e0
add esp, 8
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x28]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00452e80
jmp 0x40b1df
xor eax, eax
push ebx
push eax
call fcn.004d09f0
mov eax, 1
push ebx
push eax
call fcn.004d09f0
nop word cs:[eax + eax]
nop