Function at 0x40ecd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov esi, dword [esp + 0x9c]
mov dword [esp + 8], 0x2e160201
mov dword [esp + 0xc], 0x2001c18
lea ebx, [esp + 0x10]
mov byte [esp + 0x10], pe_nt_image_headers32
mov dword [esp + 0x11], 0
mov dword [esp + 0x14], 0
xor eax, eax
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov edx, eax
and edx, 0xa
xor edx, 0x2fcb3a3a
mov edi, eax
and edi, 5
sub edi, edx
mov edx, 0x5d
sub edx, edi
add edi, 0xa2
xor edx, edi
and edx, ecx
xor edx, edi
add dl, 0xf8
mov byte [esp + eax + 8], dl
inc eax
cmp eax, 0x10
jne 0x40ed10
lea eax, [esp + 0x7f]
lea edx, [esp + 8]
mov edi, eax
mov ecx, 2
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x87]
xor ecx, ecx
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
movzx ecx, byte [esp + 0x10]
mov byte [esp + 0x87], cl
mov dword [esp + 8], 0x99eb9bd1
mov dword [esp + 0xc], 0xa5daa7ea
mov dword [esp + 0x10], 0xa1d0a3cf
mov dword [esp + 0x14], 0xad9dafdc
mov dword [esp + 0x18], 0xa92dabf0
mov dword [esp + 0x1c], 0xb5ddb7d8
mov dword [esp + 0x20], 0xb192b3f2
mov dword [esp + 0x24], 0xbdcebfdf
mov dword [esp + 0x28], 0xb9cebbcc
mov dword [esp + 0x2c], 0xc5abc7cf
mov dword [esp + 0x30], 0xc1bec3ab
mov dword [esp + 0x34], 0xcdbfcfb7
mov dword [esp + 0x38], 0xc9fbcbbe
mov dword [esp + 0x3c], 0xd5e5d7b0
mov dword [esp + 0x40], 0xd1abd3ad
mov dword [esp + 0x44], 0xddeddfa9
mov dword [esp + 0x48], 0xd9abdbb6
mov dword [esp + 0x4c], 0xe595e7a6
mov dword [esp + 0x50], 0xe199e3d7
mov dword [esp + 0x54], 0xed9aef9e
mov dword [esp + 0x58], 0xe998eb87
mov dword [esp + 0x5c], 0xf587f785
mov dword [esp + 0x60], 0xf199f398
mov dword [esp + 0x64], 0xfdedff9c
mov dword [esp + 0x68], 0xf9fafbea
mov ecx, 0x18d3a61b
mov edi, 0xe4
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x18d3a613]
mov edx, ecx
or edx, ebx
not ebx
or ebx, edi
and ebx, edx
mov edx, ebx
and edx, 1
mov ebp, 1
sub ebp, ebx
and ebp, 1
or ebx, 1
sub ebp, ebx
add ebp, 0x87
xor ebp, 0xfe
lea edx, [edx*2]
add edx, ebp
mov byte [esp + ecx - 0x18d3a613], dl
inc ecx
dec edi
cmp ecx, 0x18d3a67f
jne 0x40ee50
mov dword [esp + 0x70], 0xd9bddbf5
mov dword [esp + 0x74], 0xdda1dfa8
mov dword [esp + 0x78], 0xd3dc
xor ecx, ecx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi + 0x70]
mov ebx, edi
xor ebx, 0xbac534cf
add ebx, ecx
xor ebx, edx
mov edx, ebx
and edx, 0x1a0534f4
xor ebx, 0x5a25f7f4
lea ebx, [ebx + edx*2]
mov edx, ebx
or edx, 1
add edx, ebx
not ebx
or ebx, 1
add edx, ebx
inc dl
mov byte [esp + edi + 0x70], dl
inc edi
add ecx, 2
cmp edi, 0xc
jne 0x40eec0
lea ecx, [esp + 4]
lea edx, [esp + 0x70]
push 0
push ecx
push 8
push eax
lea eax, [esp + 0x18]
push eax
push edx
push esi
call fcn.0040f9f0
add esp, 0x1c
xor ebx, ebx
test al, al
je 0x40f1fd
mov dword [esp + 8], 0x4adedd
nop
nop
movzx eax, byte [esp + ebx + 8]
mov edx, ebx
and edx, 2
mov ecx, ebx
or ecx, 2
imul ecx, edx
xor edx, 2
mov esi, ebx
and esi, 1
neg esi
and esi, edx
mov edx, ebx
xor edx, 0xa0a28973
add edx, esi
add edx, ecx
xor edx, eax
mov eax, edx
and eax, 0x40
xor edx, 0xc0
lea eax, [edx + eax*2]
inc al
mov byte [esp + ebx + 8], al
inc ebx
cmp ebx, 4
jne 0x40ef30
xor eax, eax
mov esi, dword [esp + 4]
nop
nop
nop
nop
movzx ecx, byte [esi + eax]
movzx edx, byte [esp + eax + 8]
test cl, cl
je 0x40ef92
inc eax
cmp cl, dl
je 0x40ef80
mov dword [esp], esi
mov bl, 1
cmp cl, dl
je 0x40f1f2
mov dword [esp + 8], 0x57616453
mov dword [esp + 0xc], 0xc7686a6d
mov dword [esp + 0x10], 0
mov ebp, 0xbe9a1caf
mov ecx, 0x4165e350
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebp + 0x4165e359]
lea edi, [ebp + 1]
mov edx, edi
and edx, eax
add edx, edx
sub edx, eax
lea esi, [ecx + edx]
dec esi
and esi, edi
lea ebx, [ecx + esi*2]
add esi, esi
mov edx, ebp
sub edx, esi
and edx, eax
not eax
and eax, ebx
sub edx, eax
mov esi, edx
xor esi, 0xb9028f70
mov eax, edx
or eax, 0x46fd708f
and eax, esi
mov ebx, edx
and ebx, 2
mov esi, eax
or eax, 2
imul eax, ebx
xor ebx, 2
and esi, 0xfd
imul esi, ebx
xor edx, 0x8f
add edx, esi
add edx, eax
inc dl
mov byte [esp + ebp + 0x4165e359], dl
dec ecx
mov ebp, edi
cmp edi, 0xbe9a1cbb
jne 0x40efd0
movzx eax, byte [esp + 8]
mov ebx, dword [esp]
mov ecx, ebx
test al, al
lea ebp, [esp + 8]
je 0x40f084
mov edx, ebp
mov edi, ebx
mov ecx, ebx
jmp 0x40f067
movzx eax, byte [edx]
test al, al
je 0x40f084
mov ah, byte [edi]
test ah, ah
je 0x40f1f0
inc edi
inc edx
lea esi, [ecx + 1]
cmp ah, al
je 0x40f07e
mov ecx, esi
mov edi, esi
je 0x40f060
mov edx, ebp
jmp 0x40f060
xor eax, eax
test ecx, ecx
je 0x40f1f0
mov dword [esp + 8], 0x6e716472
mov dword [esp + 0xc], 0x71612147
mov dword [esp + 0x10], 0x292c7a7d
mov dword [esp + 0x14], 0x6a7e6876
mov dword [esp + 0x18], 0x1134507b
mov word [esp + 0x1c], 0
nop
nop
nop
lea ecx, [eax + 1]
movzx edx, byte [esp + eax + 8]
xor dl, cl
add dl, 0xfb
mov byte [esp + eax + 8], dl
mov eax, ecx
cmp ecx, 0x16
jne 0x40f0c0
movzx edx, byte [esp + 8]
mov ecx, ebx
test dl, dl
mov bl, 1
je 0x40f128
lea esi, [esp + 8]
mov eax, dword [esp]
mov ebp, eax
mov ecx, eax
jmp 0x40f107
movzx edx, byte [esi]
test dl, dl
je 0x40f128
movzx eax, byte [ebp]
test al, al
je 0x40f1f0
inc ebp
inc esi
lea edi, [ecx + 1]
cmp al, dl
je 0x40f120
mov ecx, edi
mov ebp, edi
je 0x40f100
lea esi, [esp + 8]
jmp 0x40f100
test ecx, ecx
je 0x40f1f0
mov edi, ecx
mov word [esp + 8], 0xdbc6
mov byte [esp + 0xa], 0x96
mov dword [esp + 0xb], 0
mov byte [esp + 0xf], 0
mov eax, 0x26
mov esi, 0xd9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x1e]
mov edx, esi
xor edx, eax
and edx, ecx
xor edx, eax
add dl, 0x42
mov byte [esp + eax - 0x1e], dl
inc eax
dec esi
cmp eax, 0x2e
jne 0x40f160
mov ecx, edi
add ecx, 0x13
movzx eax, byte [esp + 8]
test al, al
je 0x40f1c0
lea esi, [esp + 8]
mov edi, esi
mov edx, ecx
mov dword [esp + 0x6c], ecx
jmp 0x40f1a7
movzx eax, byte [edi]
test al, al
je 0x40f1c4
mov ah, byte [ecx]
test ah, ah
je 0x40f1f0
inc ecx
inc edi
lea ebp, [edx + 1]
cmp ah, al
je 0x40f1ba
mov edx, ebp
mov ecx, ebp
je 0x40f1a0
mov edi, esi
jmp 0x40f1a0
mov edx, ecx
jmp 0x40f1cc
test edx, edx
mov ecx, dword [esp + 0x6c]
je 0x40f1f0
mov byte [0x44d268], 1
push edx
push ecx
push 0x100
push 0x44d26a
call fcn.0040ea50
add esp, 0x10
mov eax, dword [esp + 4]
mov dword [esp], eax
jmp 0x40f1f2
xor ebx, ebx
push dword [esp]
call fcn.0043cf50
add esp, 4
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret