Function at 0x9fd770
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov edi, dword [esp + 0xa0]
mov ebp, dword [esp + 0x9c]
mov dword [esp + 0xc], ecx
mov edx, dword [ecx + 0x60]
mov dword [esp + 0x60], 0x1d181a21
mov dword [esp + 0x64], 0x5e1a1d03
mov dword [esp + 0x68], 0x1a020c38
mov dword [esp + 0x6c], 0x111574e
mov dword [esp + 0x70], 0x111f1c00
mov dword [esp + 0x74], 0x90c140b
mov dword [esp + 0x78], 0xf0b1fb4d
mov dword [esp + 0x7c], 0xe0ede9e6
mov dword [esp + 0x80], 0x9a8498f0
mov dword [esp + 0x84], 0x8f86
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x67
xor bl, byte [esp + eax + 0x60]
add bl, 0xfd
mov byte [esp + eax + 0x60], bl
inc eax
cmp eax, 0x28
jne 0x9fd7f0
mov dword [esp], 0x1f1014fe
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xfa
xor bl, byte [esp + eax]
add bl, 0x1e
mov byte [esp + eax], bl
inc eax
cmp eax, 6
jne 0x9fd820
mov dword [esp + 0x10], 0x3234f8ff
mov dword [esp + 0x14], 0x3e3accc0
mov dword [esp + 0x18], 0x3d3234cf
mov dword [esp + 0x1c], 0x26292231
mov dword [esp + 0x20], 0xd6211512
mov dword [esp + 0x24], 0x24cb818b
mov dword [esp + 0x28], 0x23291f26
mov dword [esp + 0x2c], 0x5ab29c1c
mov dword [esp + 0x30], 0x645b5b61
mov dword [esp + 0x34], 0x54516b5f
mov dword [esp + 0x38], 0x5b82a556
mov dword [esp + 0x3c], 0x8e4d7151
mov dword [esp + 0x40], 0x46764440
mov dword [esp + 0x44], 0x4a4497bd
mov dword [esp + 0x48], 0x8fb14847
mov dword [esp + 0x4c], 0x767a784a
mov dword [esp + 0x50], 0x73aa8eb2
mov dword [esp + 0x54], 0x777d737f
mov dword [esp + 0x58], 0x8279707b
mov dword [esp + 0x5c], 0xdfbe
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xa3
xor bl, byte [esp + eax + 0x10]
add bl, 0xd1
mov byte [esp + eax + 0x10], bl
inc eax
cmp eax, 0x50
jne 0x9fd8e0
add ebp, edx
movzx eax, byte [esp + 0x10]
mov edx, ebp
test al, al
je 0x9fd91b
lea esi, [esp + 0x11]
mov edx, ebp
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [esi]
inc esi
test al, al
jne 0x9fd910
mov byte [edx], 0
movzx eax, byte [edi]
test al, al
je 0x9fd93b
inc edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [edi]
inc edi
test al, al
jne 0x9fd930
mov byte [edx], 0
movzx eax, byte [esp]
test al, al
je 0x9fd95b
lea ecx, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x9fd950
mov byte [edx], 0
movzx eax, byte [esp + 0x60]
test al, al
mov dword [esp + 8], ebp
je 0x9fd97b
lea ecx, [esp + 0x61]
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x9fd970
mov byte [edx], 0
mov ebp, dword [esp + 0xa8]
mov ecx, ebp
shr ecx, 2
mov ebx, dword [esp + 0xa4]
mov eax, ebx
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, ebp
and eax, 0xfffffffc
lea esi, [edx + eax]
add eax, ebx
mov ecx, ebp
shr ecx, 1
and ecx, 1
mov ebx, eax
mov edi, esi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ecx, ebp
test cl, 1
je 0x9fd9cd
mov ecx, dword [esp + 0xa8]
and ecx, 2
movzx eax, byte [eax + ecx]
mov byte [esi + ecx], al
mov dword [esp + 0x10], 0xcec1e5e3
mov dword [esp + 0x14], 0xc2da3432
mov dword [esp + 0x18], 0x12c13030
mov dword [esp + 0x1c], 0x281b2f18
mov dword [esp + 0x20], 0x131c2817
mov dword [esp + 0x24], 0xfffdd027
mov word [esp + 0x28], 0xfdfb
mov byte [esp + 0x2a], 0x86
mov word [esp + 0x2b], 0
mov byte [esp + 0x2d], 0
xor eax, eax
mov esi, dword [esp + 8]
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa5
xor cl, byte [esp + eax + 0x10]
add cl, 0xc7
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x1e
jne 0x9fda20
add edx, dword [esp + 0xa8]
movzx eax, byte [esp + 0x10]
test al, al
je 0x9fda5b
lea ecx, [esp + 0x11]
nop
nop
nop
nop
nop
nop
mov byte [edx], al
inc edx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x9fda50
mov byte [edx], 0
sub edx, esi
mov eax, dword [esp + 0xc]
add dword [eax + 0x60], edx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret 0x10