Function at 0x409570
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 8]
mov dword [esp + 0x7c], ecx
add ebx, dword [ecx + 0x60]
mov dword [esp + 0x80], 0xd7ecee9b
mov dword [esp + 0x84], 0xa2dae3e9
mov dword [esp + 0x88], 0xeee2d8fc
mov dword [esp + 0x8c], 0xa38fcde6
mov dword [esp + 0x90], 0x938988a4
mov dword [esp + 0x94], 0xab909891
mov dword [esp + 0x98], 0x94d7a9d7
mov dword [esp + 0x9c], 0x9c83879e
mov dword [esp + 0xa0], 0x2e202cb4
mov word [esp + 0xa4], 0x352e
mov dword [esp + 0xa6], 0
mov dword [esp + 0xaa], 0
mov dword [esp + 0xae], 0
mov dword [esp + 0xb2], 0
mov dword [esp + 0xb6], 0
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x39
ja 0x40968b
nop
nop
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx ecx, byte [esp + ecx + 0x80]
lea esi, [eax + 0x1cbe38b4]
lea edx, [eax + 0xb4]
mov edi, edx
and edi, esi
and edi, ecx
or edx, esi
and edx, ecx
add edx, edi
add eax, ecx
add eax, 0x1cbe38b4
sub eax, edx
add al, 0x14
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x80], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 0x3a
jb 0x409640
mov dword [esp + 0xd7], 0
mov dword [esp + 0xd4], 0
mov dword [esp + 0xd0], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc0], 0x435a5664
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 0x1a
ja 0x409738
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx ecx, byte [esp + ecx + 0xc0]
lea edx, [eax + ecx]
add edx, 0xc8b7778b
add eax, 0xc8b7778b
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
add al, 0x33
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0xc0], al
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 0x1b
jb 0x4096f0
mov dword [esp + 0x10], 0xc6c4f8f9
mov dword [esp + 0x14], 0x3a3af4f0
mov dword [esp + 0x18], 0x3f423c09
mov dword [esp + 0x1c], 0x32373e43
mov dword [esp + 0x20], 0xa374342
mov dword [esp + 0x24], 0x5409efed
mov dword [esp + 0x28], 0x512f5956
mov dword [esp + 0x2c], 0x2602145c
mov dword [esp + 0x30], 0x54595d53
mov dword [esp + 0x34], 0x641f5521
mov dword [esp + 0x38], 0x19d23366
mov dword [esp + 0x3c], 0x2a6b6f63
mov dword [esp + 0x40], 0x1a661c10
mov dword [esp + 0x44], 0x674d93f
mov dword [esp + 0x48], 0xcd270871
mov dword [esp + 0x4c], 0x27a080a
mov dword [esp + 0x50], 0x1ca2ac2
mov dword [esp + 0x54], 0x57b7d01
mov dword [esp + 0x58], 0x567f0075
mov word [esp + 0x5c], 0x91be
mov dword [esp + 0x61], 0
mov dword [esp + 0x5e], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x54
ja 0x409838
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 0x5c41947a
add ecx, 0x5c41947a
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0xaa
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x55
jb 0x409800
mov eax, dword [ebp + 0xc]
movzx ecx, byte [esp + 0x10]
mov edx, ebx
test cl, cl
je 0x40985b
lea esi, [esp + 0x11]
mov edx, ebx
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409850
mov byte [edx], 0
movzx ecx, byte [eax]
test cl, cl
je 0x40987b
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x409870
mov byte [edx], 0
movzx eax, byte [esp + 0xc0]
test al, al
mov dword [esp + 0x78], ebx
je 0x4098ab
lea ecx, [esp + 0xc1]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4098a0
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov byte [edx], 0
movzx eax, byte [esp + 0x80]
test al, al
je 0x4098db
lea ecx, [esp + 0x81]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x4098d0
mov byte [edx], 0
mov ecx, esi
shr ecx, 2
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, esi
and eax, 0xfffffffc
lea ecx, [edx + eax]
mov dword [esp + 0xc], ecx
add eax, ebx
mov ebx, esi
and ebx, 3
mov ecx, ebx
shr ecx, 1
mov dword [esp + 0x74], eax
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x74]
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov edi, dword [esp + 0xc]
mov ecx, ebx
xor ecx, 0xfffffffe
or ebx, 1
and ebx, ecx
je 0x40994e
mov esi, dword [ebp + 0x14]
and esi, 2
movzx ecx, byte [eax + esi]
mov byte [edi + esi], cl
cmp ebx, 1
je 0x40994e
movzx ecx, byte [eax + esi + 1]
mov byte [edi + esi + 1], cl
cmp ebx, 2
je 0x40994e
movzx eax, byte [eax + esi + 2]
mov byte [edi + esi + 2], al
mov dword [esp + 0x10], 0xd4d73339
mov dword [esp + 0x14], 0xc8c49a98
mov dword [esp + 0x18], 0xa8f7a69a
mov dword [esp + 0x1c], 0xa2b5a1b2
mov dword [esp + 0x20], 0xb9baaead
mov dword [esp + 0x24], 0x503fead
mov word [esp + 0x28], 0x1b01
mov byte [esp + 0x2a], 0x10
mov dword [esp + 0x2b], 0
mov dword [esp + 0x2f], 0
mov dword [esp + 0x32], 0
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x80]
cmp eax, 0x25
ja 0x409a05
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x80]
movzx eax, byte [esp + eax + 0x10]
lea esi, [ecx + 0x57]
and esi, eax
mov edi, 0xa8
sub edi, ecx
or edi, eax
add edi, esi
sub eax, edi
add al, 0x9e
mov ecx, dword [esp + 0x80]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 0x80]
mov eax, dword [esp + 0x80]
cmp eax, 0x26
jb 0x4099c0
add edx, dword [ebp + 0x14]
movzx eax, byte [esp + 0x10]
test al, al
mov esi, dword [esp + 0x78]
je 0x409a2b
lea ecx, [esp + 0x11]
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x409a20
mov byte [edx], 0
sub edx, esi
mov eax, dword [esp + 0x7c]
add dword [eax + 0x60], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10