Function at 0x440910
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x29c
mov edx, dword [esp + 0x2bc]
mov dword [esp + 0x83], 0xe48040
mov dword [esp + 0x80], 0x4010ec83
mov dword [esp + 0x7c], 0x48e78948
mov dword [esp + 0x78], 0xce8948fc
lea edi, [esp + 0x9c]
lea eax, [esp + 0x78]
mov ecx, 3
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xa8]
lea eax, [esp + 0x84]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x86]
mov byte [esp + 0xaa], al
mov esi, edx
cmp edx, 4
jb 0x44098e
mov esi, 4
lea ebx, [esp + 0xab]
cmp dword [esp + 0x2bc], 0
je 0x440de8
lea ebp, [esp + 0x10]
xor edx, edx
mov dword [esp + 0x6c], esi
jmp 0x4409bd
mov edx, dword [esp + 4]
inc edx
cmp edx, esi
je 0x440c08
cmp edx, 3
ja case.default.0x4409c2
jmp dword [edx*4 + 0x445af0]
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 0xc], 0x2110925c
mov byte [esp + 0x10], 0
mov ecx, 0xb9
mov edi, 0xd176c6e4
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xad]
mov ebx, ecx
and ebx, esi
mov edx, ebx
and edx, 0xfffffffd
mov ebp, ebx
and ebp, 2
mov eax, ebx
or eax, 0xfffffffd
inc eax
imul eax, edx
or ebx, 2
imul ebx, ebp
lea ebp, [ecx + esi]
add ebp, 0xb45db100
lea edx, [eax + esi]
sub edx, ebx
add edx, ecx
add edx, 0xb45db162
and ebp, 1
sub ebx, eax
sub ebx, esi
add ebx, edi
mov eax, ebx
not eax
and ebx, 0x47
and edx, 0xb8
or edx, ebx
and eax, 1
or eax, edx
xor eax, 0x46
add eax, ebp
mov byte [esp + ecx - 0xad], al
inc ecx
dec edi
cmp ecx, 0xbe
jne 0x4409f0
lea edx, [esp + 0xc]
mov eax, edx
xor ecx, ecx
mov ebx, dword [esp]
mov edi, ebx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, edx
mov ecx, 1
mov edi, ebx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0xe]
mov byte [ebx + 2], al
add ebx, 3
mov esi, dword [esp + 0x6c]
lea ebp, [esp + 0x10]
jmp 0x4409b0
mov dword [esp + 4], edx
mov dword [esp + 0xc], 0xe1d86220
mov byte [esp + 0x10], 0x90
mov dword [ebp + 4], 0
mov dword [ebp + 1], 0
mov ecx, 0x71bbb5a5
mov edi, 0x5a
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx - 0x71bbb599]
mov edx, eax
not edx
or edx, edi
or eax, ecx
and eax, edx
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
add al, 0xc6
mov byte [esp + ecx - 0x71bbb599], al
inc ecx
dec edi
cmp ecx, 0x71bbb5b1
jne 0x440ad0
lea eax, [esp + 0xc]
mov ecx, 1
mov edi, ebx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add ebx, 4
lea eax, [esp + 0x10]
xor ecx, ecx
mov edi, ebx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
jmp 0x4409b0
mov dword [esp + 4], edx
mov dword [esp + 0xc], 0x3b0cca0c
mov byte [esp + 0x10], 0x44
mov word [ebp + 5], 0
mov dword [ebp + 1], 0
mov ecx, 0x8e52f670
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x71ad099c]
xor eax, ecx
add eax, 0x38612fcf
mov edx, eax
and edx, 1
or eax, 1
add eax, edx
mov byte [esp + ecx + 0x71ad099c], al
inc ecx
cmp ecx, 0x8e52f67b
jne 0x440b60
lea eax, [esp + 0xc]
mov ecx, 1
mov edi, ebx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add ebx, 4
mov eax, ebp
mov edi, ebx
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
jmp 0x4409b0
mov dword [esp + 0xc], 0x6fdceea0
mov byte [esp + 0x10], 0x74
mov word [ebp + 5], 0
mov dword [ebp + 1], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
add al, 0x96
xor al, byte [esp + ecx + 0xc]
add al, 0x12
mov byte [esp + ecx + 0xc], al
inc ecx
cmp ecx, 0xb
jne 0x440bd0
lea eax, [esp + 0xc]
mov ecx, 1
mov edi, ebx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
add ebx, 4
lea eax, [esp + 0x10]
xor ecx, ecx
mov edi, ebx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
jmp case.default.0x4409c2
mov eax, dword [esp + 0x2bc]
cmp eax, 3
jbe 0x440de8
test al, 1
je 0x440c3f
mov eax, 0x446025
mov edx, 0x446025
mov edi, ebx
xor ecx, ecx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, 1
mov edi, ebx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
add ebx, 2
mov ebp, dword [esp + 0x2bc]
lea eax, [ebp*8]
mov esi, 0xffffffff
mov edi, 0xffffffff
cmp eax, 0x7ffffffe
ja 0x441261
mov dword [esp], ebx
dec ebp
cmp ebp, 4
jae 0x440c7a
jmp 0x440deb
dec ebp
cmp ebp, 3
jbe 0x440deb
mov eax, ebp
and eax, 8
mov ecx, ebp
mov ebx, ebp
or ebx, 8
imul ebx, eax
xor eax, 8
and ecx, 0xfffffff7
imul ecx, eax
add ebx, ecx
cmp ebx, 0x7e
ja 0x440d40
mov dword [esp + 0xc], 0x735c1a58
mov word [esp + 0x10], 0x9d2c
mov dword [esp + 0x12], 0
mov ecx, 0xe319f764
mov esi, 0x9b
nop
nop
movzx eax, byte [esp + ecx + 0x1ce608a8]
mov edx, esi
xor edx, ecx
and edx, eax
xor edx, ecx
mov eax, edx
and eax, 0x18230b
xor edx, 0x907e2b0b
lea eax, [edx + eax*2]
mov edx, eax
and edx, 0x3f
xor eax, 0x3f
lea eax, [eax + edx*2]
add al, 0xc2
mov byte [esp + ecx + 0x1ce608a8], al
inc ecx
dec esi
cmp ecx, 0xe319f76e
jne 0x440cc0
lea eax, [esp + 0xc]
mov ecx, 1
mov edx, dword [esp]
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [edx + 4]
lea eax, [esp + 0x10]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x10]
mov byte [edx + 4], al
mov byte [edx + 3], bl
add edx, 5
mov dword [esp], edx
jmp 0x440c70
mov dword [esp + 0xc], 0x6118125c
mov dword [esp + 0x10], 0x6de2e3e0
mov byte [esp + 0x14], 0xdc
lea eax, [esp + 0x14]
mov byte [eax + 5], 0
mov dword [eax + 1], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0xc]
lea esi, [ecx + 0xf748e59]
mov edx, 0xa6
sub edx, ecx
xor edx, esi
and edx, eax
xor edx, esi
not edx
and edx, esi
add eax, ecx
add edx, edx
sub eax, edx
add eax, 0x8f748e59
mov edx, eax
not edx
and edx, 0x66
and eax, 0x99
sub eax, edx
add al, 0xa9
mov byte [esp + ecx + 0xc], al
mov eax, ecx
xor eax, 1
and ecx, 1
lea ecx, [eax + ecx*2]
cmp ecx, 0xe
jb 0x440d70
lea eax, [esp + 0xc]
mov edx, dword [esp]
mov edi, edx
mov ecx, 2
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea esi, [edx + 8]
lea eax, [esp + 0x14]
xor ecx, ecx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [edx + 3], ebx
mov dword [esp], esi
jmp 0x440c70
mov dword [esp], ebx
mov ebx, dword [esp + 0x2b0]
mov dword [esp + 0xc], 0x31029ae4
lea ebp, [esp + 0x10]
mov byte [esp + 0x10], 0x10
mov dword [esp + 0x11], 0
mov word [esp + 0x15], 0
mov eax, 0x1e5a02c5
mov esi, 0xe1a5fd3b
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x1e5a02b9]
mov edx, edi
not edx
or edx, 0xea5bdd32
add edx, edi
inc edx
and edi, 0xffffffcd
xor edi, 0x15a422cd
or edx, edi
mov edi, eax
or edi, 0x15a422cd
add edi, esi
mov ecx, eax
and ecx, 0xa5a0012
or ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0x26
xor ecx, 0x26
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x1e5a02b9], cl
inc eax
dec esi
cmp eax, 0x1e5a02d0
jne 0x440e20
lea eax, [esp + 0xc]
mov edx, dword [esp]
mov edi, edx
mov ecx, 1
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea esi, [edx + 4]
mov edi, esi
xor ecx, ecx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov dword [esp + 0x97], 0xc3fc8948
mov dword [esp + 0x94], 0x48d2ff41
mov dword [esp + 0x88], 0xba49c031
mov dword [esp + 0x8c], ebx
mov eax, dword [esp + 0x2b4]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x88]
mov edi, esi
mov ecx, 4
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [edx + 0x14]
lea eax, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
movzx eax, byte [esp + 0x9a]
mov byte [edx + 0x16], al
lea ecx, [esp + 0x9c]
mov eax, ecx
neg eax
lea ebx, [edx + eax]
add ebx, 0x17
sub edx, ecx
add edx, 0x71
mov dword [esp + 0x74], edx
xor eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x6c6d6e6f
mov dword [esp + 0x10], 0
nop
nop
mov ecx, eax
add cl, 0x68
xor cl, byte [esp + eax + 0xc]
add cl, 0xf8
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 8
jne 0x440f30
mov esi, dword [esp + 0xc]
mov eax, dword [0x44e804]
test eax, eax
je 0x440fa0
xor ecx, ecx
mov edx, dword [0x44e808]
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x3e416e49
je 0x440f70
inc ecx
cmp eax, ecx
jne 0x440f60
jmp 0x440fa0
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x440fa0
lea ecx, [esp + 0x74]
lea edx, [esp + 8]
push 0x40
push 0x3000
push ecx
push 0
push edx
push 0xffffffffffffffff
push 6
push eax
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x24
mov esi, eax
test esi, esi
js 0x441230
mov dword [esp + 0xc], 0x6dff986d
mov dword [esp + 0x10], 0x17839663
mov dword [esp + 0x14], 0xf32e6c93
mov dword [esp + 0x18], 0x7060504
mov dword [esp + 0x1c], 0x29c28278
mov dword [esp + 0x20], 0x8606198f
mov dword [esp + 0x24], 0x748c6ea
mov dword [esp + 0x28], 0x37363567
mov dword [esp + 0x2c], 0x5da33b9
mov dword [esp + 0x30], 0x513e3d3c
mov dword [esp + 0x34], 0xca8cc08c
mov dword [esp + 0x38], 0x401ae9a7
mov dword [esp + 0x3c], 0x2be04446
mov dword [esp + 0x40], 0x36aa62c
mov dword [esp + 0x44], 0x7a62032f
mov dword [esp + 0x48], 0xa9512a94
mov dword [esp + 0x4c], 0x1f9d2137
mov dword [esp + 0x50], 0x5f7d5170
mov dword [esp + 0x54], 0x1fd35958
mov dword [esp + 0x58], 0x85cf0d68
mov dword [esp + 0x5c], 0x820a8161
mov dword [esp + 0x60], 0x1b496da6
lea edx, [esp + 0x64]
mov word [esp + 0x64], 0x4964
mov byte [esp + 0x68], 0
mov word [esp + 0x66], 0
mov eax, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 8]
mov esi, eax
and esi, ecx
lea edi, [eax - 0x50943f00]
or edi, ecx
not edi
or edi, esi
lea ecx, [edi + edi]
not ecx
add ecx, edi
mov esi, ecx
xor esi, 0x5b
and ecx, 0x24
add ecx, ecx
sub ecx, esi
add cl, 0x47
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0x61
jne 0x441080
mov eax, dword [esp + 8]
lea esi, [esp + 0xc]
mov ebp, esi
mov edi, eax
mov ecx, 0x16
xchg esi, ebp
rep movsd dword es:[edi], dword [esi]
xchg esi, ebp
lea edi, [eax + 0x58]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
movzx ecx, byte [esp + 0x64]
mov byte [eax + 0x58], cl
mov eax, dword [esp + 8]
mov dword [esp + 0xc], 0x797a7b1b
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
xor ecx, ecx
nop
nop
nop
nop
mov edi, ebp
and edi, 6
mov edx, ecx
xor edx, 0xeb
add edx, edi
xor dl, byte [esp + ecx + 0xc]
add dl, 0x69
mov byte [esp + ecx + 0xc], dl
inc ecx
add ebp, 2
cmp ecx, 7
jne 0x441100
add eax, dword [esp + 0xc]
mov ecx, ebx
shr ecx, 2
lea edx, [esp + 0x9c]
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov ecx, ebx
not ecx
or ecx, 0xfffffffc
lea edi, [ebx + ecx]
lea edx, [ebx + ecx]
inc edx
add edx, eax
lea eax, [esp + edi]
add eax, 0x9d
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov ebp, eax
mov edi, edx
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x441174
and ebx, 2
movzx eax, byte [eax + ebx]
mov byte [edx + ebx], al
mov eax, dword [esp + 8]
mov dword [esp + 0xc], 0x83828159
mov dword [esp + 0x10], 0
mov ecx, 0x9f
nop
nop
nop
movzx edi, byte [esi]
lea edx, [ecx - 0x3ec23700]
or edx, edi
and edi, ecx
not edx
or edx, edi
add edx, 0xc634f01f
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
mov byte [esi], dl
inc esi
dec ecx
cmp ecx, 0x97
jne 0x441190
mov ecx, dword [esp + 0xc]
add ecx, eax
push dword [esp + 0x2b8]
push ecx
call eax
mov esi, eax
mov edi, edx
mov dword [esp + 0x70], 0
mov dword [esp + 0xc], 0x6c6d6e6f
mov dword [esp + 0x10], 0
xor eax, eax
nop
nop
nop
nop
mov ecx, eax
add cl, 0x68
xor cl, byte [esp + eax + 0xc]
add cl, 0xf8
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 8
jne 0x4411f0
mov eax, dword [0x44e804]
test eax, eax
je 0x441261
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ebx, dword [0x44e808]
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x16194952
je 0x441237
inc edx
cmp eax, edx
jne 0x441220
jmp 0x441261
mov edi, esi
sar edi, 0x1f
jmp 0x441261
mov eax, dword [ebx + edx*8 + 4]
cmp eax, ecx
je 0x441261
lea ecx, [esp + 0x70]
lea edx, [esp + 8]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
push 4
push eax
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x1c
mov eax, esi
mov edx, edi
add esp, 0x29c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10