Function at 0x40a380
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x43dd48]
mov dword [esp + 0x10], 0xeb2b951f
mov dword [esp + 0x14], 0xef50e958
mov dword [esp + 0x18], 0xe358ed5a
mov dword [esp + 0x1c], 0xe792e152
mov dword [esp + 0x20], 0xfb58e542
mov dword [esp + 0x24], 0xfff8f946
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1f
ja 0x40a431
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
mov esi, 0xc2
sub esi, ecx
add ecx, 0xea5c853d
xor esi, ecx
and esi, edx
xor esi, ecx
mov dword [esp + 0x114], esi
mov ecx, dword [esp + 0x114]
add cl, 0x55
mov edx, dword [esp]
mov byte [esp + edx + 0x10], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x20
jb 0x40a3f0
lea edi, [esp + 0x10]
push 0x800
push 0
push edi
call eax
mov ecx, 0x43dd10
push eax
call fcn.00432170
xor ebx, ebx
test al, al
je 0x40ab28
push 0xd16c9e6b
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd18], eax
push 0x2b39326b
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd1c], eax
push 0x20eddf4
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd20], eax
push 0x6f420210
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd24], eax
push 0xbb4ac2a9
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd28], eax
push 0xe03c21ff
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd2c], eax
push 0xb35fc6e6
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd30], eax
push 0xe3a9b6db
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd34], eax
push 0xe81e9fc0
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd38], eax
push 0x70f53c13
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd3c], eax
push 0xb54b293a
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd40], eax
push 0x9b73555b
push dword [0x43dd10]
call fcn.00433e40
add esp, 8
mov dword [0x43dd44], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [esp + 0x114]
push eax
push dword [ebx + 0x4375ec]
call fcn.0042e230
add esp, 8
lea esi, [esp + 0x113]
nop
nop
nop
cmp byte [esi + 1], 0
lea esi, [esi + 1]
jne 0x40a5a0
mov dword [esp], 0
mov eax, edi
lea ecx, [esp + 0x114]
cmp ecx, esi
jae 0x40a61e
mov dword [esp + 4], ebx
xor ebx, ebx
lea edi, [esp + 0x114]
nop
nop
nop
nop
nop
nop
cmp byte [edi], 0
je 0x40a610
mov eax, esp
push eax
push esi
push edi
call fcn.0040cb00
add esp, 0xc
movzx edx, word [esp]
lea ecx, [ebx + 2]
mov word [esp + ebx + 0x10], dx
cmp ebx, 0xfb
ja 0x40a5fe
add edi, eax
mov ebx, ecx
cmp edi, esi
jb 0x40a5d0
lea eax, [esp + ecx]
add eax, 0x10
jmp 0x40a616
lea eax, [esp + ebx]
add eax, 0x10
mov ebx, dword [esp + 4]
lea edi, [esp + 0x10]
mov word [eax], 0
push edi
call fcn.0040ab40
add esp, 4
test al, al
jne 0x40a8b4
add ebx, 4
cmp ebx, 0x24
jne 0x40a580
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0xb338b52e
mov dword [esp + 0x14], 0xaf20b13e
mov dword [esp + 0x18], 0xab6aad23
mov dword [esp + 0x1c], 0xa779a97b
mov dword [esp + 0x20], 0xa328a52b
mov dword [esp + 0x24], 0x5f3fa139
mov dword [esp + 0x28], 0x5bc15dcd
mov dword [esp + 0x2c], 0x57cb59cb
mov dword [esp + 0x30], 0x53df55c5
mov dword [esp + 0x34], 0x4fc751c0
mov dword [esp + 0x38], 0x4bcb4dc2
mov dword [esp + 0x3c], 0x47d54998
mov dword [esp + 0x40], 0x43d745d7
mov dword [esp + 0x44], 0x7fd04193
mov dword [esp + 0x48], 0x7bed7df0
mov dword [esp + 0x4c], 0x77ef79e0
mov dword [esp + 0x50], 0x73ef75e2
mov dword [esp + 0x54], 0x6fa171ff
mov dword [esp + 0x58], 0x6ba66da7
mov dword [esp + 0x5c], 0x67a269a1
mov dword [esp + 0x60], 0x63ab65a9
mov dword [esp + 0x64], 0x1fa761a5
mov dword [esp + 0x68], 0x1bd21dd7
mov dword [esp + 0x6c], 0x17d519d6
mov dword [esp + 0x70], 0x13db15db
mov dword [esp + 0x74], 0xfc011d5
mov dword [esp + 0x78], 0xb0c0dde
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x73
ja 0x40a79f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, 0x16
sub edx, eax
add eax, 0x5299ace9
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x114], edx
mov eax, dword [esp + 0x114]
add al, 0xa1
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x74
jb 0x40a760
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
lea edi, [esp + 0x10]
push eax
push ecx
push edi
call fcn.0040b180
add esp, 0xc
test al, al
je 0x40a8ed
mov dword [esp + 0x10], 0x6a7a0248
mov dword [esp + 0x14], 0x7379a97a
mov dword [esp + 0x18], 0x460d0a65
mov dword [esp + 0x1c], 0x136160be
mov dword [esp + 0x20], 0x786e7c11
mov dword [esp + 0x24], 0x18186468
mov dword [esp + 0x28], 0x70736767
mov dword [esp + 0x2c], 0x525b7062
mov word [esp + 0x30], 0x6f92
mov byte [esp + 0x32], 0xaa
mov dword [esp + 0x33], 0
mov byte [esp + 0x37], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x27
ja 0x40a86f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, 0x3d
sub edx, eax
add eax, 0x4096bcc2
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x114], edx
mov eax, dword [esp + 0x114]
add al, 0xb2
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x28
jb 0x40a830
mov ecx, dword [esp + 8]
movzx ebx, byte [esp + 0x10]
test bl, bl
je 0x40a8f4
mov edx, edi
mov esi, ecx
jmp 0x40a897
movzx ebx, byte [edx]
test bl, bl
je 0x40a8f6
mov bh, byte [ecx]
test bh, bh
je 0x40ab1a
inc edx
inc ecx
lea eax, [esi + 1]
cmp bh, bl
je 0x40a8ae
mov esi, eax
mov ecx, eax
je 0x40a890
mov edx, edi
jmp 0x40a890
movzx ecx, word [esp + 0x10]
mov eax, 0x43dd4c
test cx, cx
je 0x40a8e1
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x40a8d0
mov word [eax], 0
mov bl, 1
jmp 0x40ab28
xor ebx, ebx
jmp 0x40ab28
mov esi, ecx
test esi, esi
je 0x40ab1a
mov dword [esp + 0x10], 0x93955e60
mov dword [esp + 0x14], 0x27649381
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xf
ja 0x40a96f
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, 0xf9
sub edx, eax
add eax, 0xffdcf06
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 0x114], edx
mov eax, dword [esp + 0x114]
add al, 0xd6
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x10
jb 0x40a930
movzx ebx, byte [esp + 0x10]
mov dword [esp + 4], esi
mov ecx, esi
test bl, bl
je 0x40a9b4
lea edx, [esp + 0x10]
mov esi, edx
mov ecx, dword [esp + 4]
mov edi, ecx
jmp 0x40a997
movzx ebx, byte [esi]
test bl, bl
je 0x40a9b4
mov bh, byte [edi]
test bh, bh
je 0x40ab1a
inc esi
inc edi
lea eax, [ecx + 1]
cmp bh, bl
je 0x40a9ae
mov ecx, eax
mov edi, eax
je 0x40a990
mov esi, edx
jmp 0x40a990
test ecx, ecx
je 0x40ab1a
mov byte [ecx], 0
mov edi, 0xffffffff
mov esi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [esi + edi + 0x23], 0
lea edi, [edi + 1]
jne 0x40a9d0
test edi, edi
je 0x40aa53
xor edx, edx
jmp 0x40aa06
mov byte [esp + edx + 0x114], bh
mov eax, edx
and eax, 1
xor edx, 1
lea edx, [edx + eax*2]
cmp edx, edi
jae 0x40aa53
mov bh, byte [esi + edx + 0x22]
mov bl, bh
add bl, 0x9f
cmp bl, 0x19
ja 0x40a9f0
mov eax, ebx
xor al, 0xf4
add bl, bl
and bl, 0x28
add bl, al
add bl, 0x1b
movsx eax, bl
imul eax, eax, 0x4f
movzx ecx, ax
shr eax, 0xb
shr ecx, 0xf
add cl, al
movzx ecx, cl
lea esi, [ecx + ecx*4]
lea eax, [esi + esi*4]
mov esi, dword [esp + 4]
add eax, ecx
sub bl, al
mov eax, ebx
add al, bl
and al, 0xc2
xor bl, 0x61
add bl, al
mov bh, bl
jmp 0x40a9f0
mov byte [esp + edi + 0x114], 0
lea ebx, [esp + 0x113]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x40aa70
mov dword [esp], 0
lea ecx, [esp + 0x10]
lea esi, [esp + 0x114]
mov eax, ecx
cmp esi, ebx
jae 0x40aad0
xor edi, edi
cmp byte [esi], 0
je 0x40aac6
mov eax, esp
push eax
push ebx
push esi
call fcn.0040cb00
add esp, 0xc
movzx edx, word [esp]
lea ecx, [edi + 2]
mov word [esp + edi + 0x10], dx
cmp edi, 0x7b
ja 0x40aabe
add esi, eax
mov edi, ecx
cmp esi, ebx
jb 0x40aa93
lea eax, [esp + ecx]
add eax, 0x10
jmp 0x40aacc
lea eax, [esp + edi]
add eax, 0x10
lea ecx, [esp + 0x10]
mov word [eax], 0
push ecx
call fcn.0040ab40
add esp, 4
test al, al
je 0x40ab1a
movzx ecx, word [esp + 0x10]
mov eax, 0x43dd4c
test cx, cx
je 0x40ab11
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x40ab00
mov word [eax], 0
mov bl, 1
jmp 0x40ab1c
xor ebx, ebx
push dword [esp + 8]
call fcn.00430e10
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret