Function at 0x409510
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x78
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
mov edx, dword [ecx + 0x80]
mov dword [esp + 0x10], 0x3d3036c9
mov dword [esp + 0x14], 0xfa3e352f
mov dword [esp + 0x18], 0x263e34d0
mov dword [esp + 0x1c], 0x2929ebf2
mov dword [esp + 0x20], 0x393b3428
mov dword [esp + 0x24], 0x21243c27
mov dword [esp + 0x28], 0x28e927ed
mov dword [esp + 0x2c], 0x4835313a
mov dword [esp + 0x30], 0xf6ecf058
mov dword [esp + 0x34], 0xe3ea
mov esi, 0x21
mov edi, 0xde
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + esi - 0x11]
mov eax, edi
xor eax, esi
and eax, ebx
xor eax, esi
add al, 0x5b
mov byte [esp + esi - 0x11], al
inc esi
dec edi
cmp esi, 0x49
jne 0x409590
mov dword [esp + 4], 0x29243842
mov esi, 0x87
mov edi, pe_nt_image_headers32
nop
nop
nop
nop
mov ebx, edi
and ebx, 0x68
mov eax, esi
and eax, 0x87
or eax, ebx
xor al, byte [esp + esi - 0x83]
xor al, 0x68
add al, 0x5d
mov byte [esp + esi - 0x83], al
inc esi
dec edi
cmp esi, 0x8b
jne 0x4095c0
mov dword [esp + 0x38], 0x7ca19b9d
mov dword [esp + 0x3c], 0x7943717a
mov dword [esp + 0x40], 0x429e844c
mov dword [esp + 0x44], 0x4c414d4f
mov dword [esp + 0x48], 0x4c4b4549
mov dword [esp + 0x4c], 0x71b69f4a
mov dword [esp + 0x50], 0x96575b57
mov dword [esp + 0x54], 0x6e5a6c68
mov dword [esp + 0x58], 0x625ca18b
mov dword [esp + 0x5c], 0xa58b6059
mov dword [esp + 0x60], 0x9ea6a09e
mov dword [esp + 0x64], 0x995e765e
mov dword [esp + 0x68], 0xad97ada9
mov dword [esp + 0x6c], 0x7a93a895
mov dword [esp + 0x70], 0x294a
mov byte [esp + 0x74], 0
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi + 0x38]
lea ebx, [esi + 0x54742058]
and ebx, edi
mov eax, ebx
and eax, 2
mov ebp, ebx
or ebx, 2
imul ebx, eax
xor eax, 2
and ebp, 0xfffffffd
imul ebp, eax
add ebx, ebp
lea eax, [esi + edi]
add eax, 0x54742058
mov edi, eax
not edi
and edi, ebx
not ebx
and ebx, eax
sub ebx, edi
add bl, 0x48
mov byte [esp + esi + 0x38], bl
lea eax, [esi + esi]
and eax, 2
mov edi, eax
and edi, esi
xor eax, esi
xor eax, 1
lea esi, [eax + edi*2]
cmp esi, 0x3d
jb 0x409670
add dword [esp], edx
mov dword [esp + 8], 0xcee0e3
lea edx, [esp + 8]
mov esi, 0x32
nop
nop
nop
nop
nop
movzx eax, byte [edx]
lea edi, [esi - 0x61160300]
or edi, eax
and eax, esi
not edi
or edi, eax
lea ebx, [edi + 0x1a91f1fe]
mov eax, ebx
xor eax, 0xfffffffe
or ebx, 1
and ebx, eax
mov eax, ebx
and eax, 0xfd
mov ebp, ebx
and ebp, 2
or ebx, 2
imul ebx, ebp
xor ebp, 2
imul ebp, eax
mov eax, edi
not eax
add eax, eax
or eax, 0xfd
add eax, edi
add eax, ebx
add eax, ebp
mov byte [edx], al
inc edx
dec esi
cmp esi, 0x2e
jne 0x4096e0
movzx ebx, byte [esp + 8]
mov edx, dword [esp]
test bl, bl
je 0x40975b
lea esi, [esp + 9]
mov edx, dword [esp]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x409750
mov byte [edx], 0
mov eax, ecx
movzx ebx, byte [ecx + 0x60]
test bl, bl
je 0x40978d
lea esi, [eax + 0x61]
mov ecx, dword [esp + 0x90]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x409780
jmp 0x409794
mov ecx, dword [esp + 0x90]
mov byte [edx], 0
movzx ebx, byte [esp + 0x38]
test bl, bl
je 0x4097bb
lea esi, [esp + 0x39]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x4097b0
mov byte [edx], 0
movzx ebx, byte [ecx]
test bl, bl
je 0x4097db
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edx], bl
inc edx
movzx ebx, byte [ecx]
inc ecx
test bl, bl
jne 0x4097d0
mov byte [edx], 0
movzx ecx, byte [esp + 4]
test cl, cl
je 0x4097fb
lea esi, [esp + 5]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x4097f0
mov byte [edx], 0
movzx ecx, byte [esp + 0x10]
test cl, cl
mov dword [esp + 0xc], eax
je 0x40981b
lea esi, [esp + 0x11]
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409810
mov byte [edx], 0
mov eax, dword [esp + 0x98]
mov ecx, eax
mov esi, eax
shr ecx, 2
mov ebp, dword [esp + 0x94]
mov eax, ebp
mov edi, edx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov eax, esi
mov ebx, esi
and ebx, 0xfffffffc
lea esi, [edx + ebx]
add ebx, ebp
mov ecx, eax
mov ebp, eax
shr ecx, 1
and ecx, 1
mov eax, ebx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, ebp
test al, 1
je 0x409870
mov eax, dword [esp + 0x98]
and eax, 2
movzx ecx, byte [ebx + eax]
mov byte [esi + eax], cl
mov dword [esp + 0x38], 0x47494557
mov byte [esp + 0x3c], 0x58
mov dword [esp + 0x3d], 0
mov ecx, 0xfffffff7
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x41]
lea esi, [ecx - 0x6f85ff88]
lea edi, [ecx + 0x20f40178]
and edi, eax
or esi, eax
sub esi, edi
mov eax, 1
sub eax, esi
not eax
or eax, esi
and eax, 1
xor esi, 1
lea eax, [esi + eax*2]
add al, 0xd4
mov byte [esp + ecx + 0x41], al
inc ecx
jne 0x409890
mov dword [esp + 0x10], 0xeae9c5d7
mov byte [esp + 0x14], 0xd8
mov dword [esp + 0x15], 0
mov ecx, 0xe8fe64cf
nop
nop
movzx eax, byte [esp + ecx + 0x17019b41]
xor eax, ecx
mov esi, eax
and esi, 1
or eax, 1
add eax, esi
add al, 0xf4
mov byte [esp + ecx + 0x17019b41], al
inc ecx
cmp ecx, 0xe8fe64d8
jne 0x4098e0
add edx, dword [esp + 0x98]
movzx ecx, byte [esp + 0x10]
test cl, cl
je 0x40992d
lea esi, [esp + 0x11]
mov eax, dword [esp + 0xc]
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409920
jmp 0x409931
mov eax, dword [esp + 0xc]
mov byte [edx], 0
movzx ecx, byte [eax + 0x60]
test cl, cl
je 0x40994b
lea esi, [eax + 0x61]
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409940
mov byte [edx], 0
movzx ecx, byte [esp + 0x38]
test cl, cl
je 0x40996b
lea esi, [esp + 0x39]
nop
nop
nop
nop
nop
mov byte [edx], cl
inc edx
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x409960
mov byte [edx], 0
sub edx, dword [esp]
add dword [eax + 0x80], edx
add esp, 0x78
pop esi
pop edi
pop ebx
pop ebp
ret 0x10