Function at 0x418140
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 0x18], 0
mov dword [esp], 0
mov ecx, dword [0x4452ac]
mov eax, 0xffffffff
test ecx, ecx
je 0x4181a3
xor edx, edx
mov esi, dword [0x4452b0]
cmp dword [esi + edx*8], 0xa896961c
je 0x418180
inc edx
cmp ecx, edx
jne 0x418170
jmp 0x4181a3
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x4181a3
mov eax, esp
push eax
push 0
push 0x28
push 0xfffffffffffffffe
push 0x10
push ecx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x1c
test eax, eax
jns 0x418241
mov dword [esp + 0x30], 0xe95ea6d1
xor ecx, ecx
mov dl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [esp + ecx*2 + 0x30]
lea edi, [ecx + 0x18745ef5]
lea ebx, [ecx + esi]
add ebx, 0x18745ef5
not esi
or edi, esi
sub esi, edi
lea esi, [ebx + esi*2]
add esi, 0x858
mov word [esp + ecx*2 + 0x30], si
mov ecx, 1
test dl, 1
mov edx, 0
jne 0x4181c0
cmp eax, dword [esp + 0x30]
jne 0x418241
mov eax, dword [0x4452ac]
test eax, eax
je 0x418241
xor ecx, ecx
mov edx, dword [0x4452b0]
nop
nop
cmp dword [edx + ecx*8], 0xb7c1bb11
je 0x418220
inc ecx
cmp eax, ecx
jne 0x418210
jmp 0x418241
mov eax, dword [edx + ecx*8 + 4]
cmp eax, 0xffffffff
je 0x418241
mov ecx, esp
push ecx
push 0x28
push 0xffffffffffffffff
push 0xc
push eax
push dword [0x4452b4]
call fcn.00437870
add esp, 0x18
mov ecx, dword [esp]
test ecx, ecx
je 0x41863e
mov edx, dword [0x4452ac]
mov eax, 0xffffffff
test edx, edx
je 0x4182a6
xor esi, esi
mov edi, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x6e83e51e
je 0x418280
inc esi
cmp edx, esi
jne 0x418270
jmp 0x4182a6
mov edx, dword [edi + esi*8 + 4]
cmp edx, 0xffffffff
je 0x4182a6
lea eax, [esp + 8]
push eax
push 0
push 0
push 1
push ecx
push 0x14
push edx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x20
mov dword [esp + 0x30], 0xf90a392a
xor ecx, ecx
mov dl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [ecx + 0xb101]
mov edi, 0xefe
sub edi, ecx
and edi, 0xada
and esi, 0x8101
or esi, edi
xor si, word [esp + ecx*2 + 0x30]
xor esi, 0x3ada
add esi, 0x77f8
mov word [esp + ecx*2 + 0x30], si
mov ecx, 1
test dl, 1
mov edx, 0
jne 0x4182c0
cmp eax, dword [esp + 0x30]
jne 0x4183ac
push dword [esp + 8]
call fcn.00435be0
add esp, 4
mov edi, dword [0x4452ac]
mov ecx, 0xffffffff
test edi, edi
je 0x41837b
mov esi, dword [esp + 8]
mov edx, dword [esp]
xor ebx, ebx
mov ebp, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x6e83e51e
je 0x418351
inc ebx
cmp edi, ebx
jne 0x418340
jmp 0x41837b
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, 0xffffffff
je 0x41837b
lea ecx, [esp + 8]
push ecx
push esi
push eax
push 1
push edx
push 0x14
push edi
push dword [0x4452b4]
mov esi, eax
call fcn.00437870
add esp, 0x20
mov ecx, eax
mov eax, esi
test ecx, ecx
js 0x4183a3
mov ecx, dword [eax]
test ecx, ecx
je 0x4183a3
cmp byte [ecx], 1
jne 0x4183a3
cmp byte [ecx + 1], 0xf
ja 0x4183a3
cmp byte [ecx + 7], 5
jne 0x4183a3
cmp byte [ecx + 8], 0x12
jne 0x4183a3
mov ecx, dword [esp]
mov dword [esp + 0x18], ecx
push eax
call fcn.00435c10
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x418640
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov eax, dword [0x443f84]
mov dword [esp + 0x30], 0x33553351
mov dword [esp + 0x34], 0x33523344
mov dword [esp + 0x38], 0x335c3344
mov dword [esp + 0x3c], 0x33053305
mov dword [esp + 0x40], 0x335d3316
mov dword [esp + 0x44], 0x33573356
mov word [esp + 0x48], 0x333c
xor ecx, ecx
mov edx, 0xf94f
nop
nop
nop
nop
nop
movzx esi, word [esp + ecx*2 + 0x30]
lea edi, [ecx + 0x5c2f06b0]
mov ebx, edx
xor ebx, edi
and ebx, esi
xor ebx, edi
not ebx
and ebx, edi
add ebx, ebx
xor edi, ebx
lea ebp, [edx - 0x8000]
and ebp, ebx
add ebp, ebp
sub edi, ebp
add esi, edi
add esi, 0xffffca80
mov word [esp + ecx*2 + 0x30], si
inc ecx
dec edx
cmp ecx, 0xd
jne 0x418410
lea edi, [esp + 0x30]
push 0x800
push 0
push edi
call eax
lea ecx, [esp + 0x70]
push eax
call fcn.00437180
test al, al
je 0x418570
mov dword [esp + 0x60], 1
mov dword [esp + 0x6c], 2
push 0x10a6c058
push dword [esp + 0x74]
call fcn.00439000
add esp, 8
mov dword [esp + 0x30], 0x58765861
mov dword [esp + 0x34], 0x5878585d
mov dword [esp + 0x38], 0x58725886
mov dword [esp + 0x3c], 0x588a588a
mov dword [esp + 0x40], 0x58755875
mov dword [esp + 0x44], 0x5889587d
mov dword [esp + 0x48], 0x586f587b
mov dword [esp + 0x4c], 0x58685892
mov dword [esp + 0x50], 0x586a5894
mov dword [esp + 0x54], 0x58605868
mov dword [esp + 0x58], 0x58625861
mov word [esp + 0x5c], 0x5808
mov ecx, 0xe64f9802
movzx edx, word [esp + ecx*2 + 0x3360d02c]
mov esi, ecx
and esi, edx
add esi, esi
sub edx, esi
add edx, ecx
mov esi, edx
and esi, 0x3fef
xor edx, 0x3fef
lea edx, [edx + esi*2]
inc edx
mov word [esp + ecx*2 + 0x3360d02c], dx
inc ecx
cmp ecx, 0xe64f9819
jne 0x4184f0
lea ecx, [esp + 0x64]
push ecx
push edi
push 0
call eax
test eax, eax
je 0x418610
mov edx, dword [0x4452ac]
mov eax, 0xffffffff
test edx, edx
je 0x4185cf
mov ecx, dword [esp]
xor esi, esi
mov edi, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x4b501129
je 0x4185a7
inc esi
cmp edx, esi
jne 0x418560
jmp 0x4185cf
mov eax, dword [0x4452ac]
test eax, eax
je 0x41863e
mov ecx, dword [esp]
xor edx, edx
mov esi, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xb430e561
je 0x41864b
inc edx
cmp eax, edx
jne 0x418590
jmp 0x41863e
mov edx, dword [edi + esi*8 + 4]
cmp edx, 0xffffffff
je 0x4185cf
lea eax, [esp + 0x60]
push 0
push 0
push 0x10
push eax
push 0
push ecx
push 0x18
push edx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x24
test eax, eax
js 0x418610
push dword [esp + 0x70]
call dword [0x444098]
mov ecx, dword [0x4452ac]
test ecx, ecx
je 0x418687
mov eax, dword [esp]
xor edx, edx
mov esi, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xb430e561
je 0x41866c
inc edx
cmp ecx, edx
jne 0x418600
jmp 0x418687
push dword [esp + 0x70]
call dword [0x444098]
mov eax, dword [0x4452ac]
test eax, eax
je 0x41863e
mov ecx, dword [esp]
xor edx, edx
mov esi, dword [0x4452b0]
nop
nop
cmp dword [esi + edx*8], 0xb430e561
je 0x41864b
inc edx
cmp eax, edx
jne 0x418630
xor eax, eax
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esi + edx*8 + 4]
xor eax, eax
cmp edx, 0xffffffff
je 0x418640
push ecx
push 4
push edx
push dword [0x4452b4]
call fcn.00437870
xor eax, eax
add esp, 0x10
jmp 0x418640
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x418687
push eax
push 4
push ecx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x10
mov dword [esp + 0x2c], 0
mov ecx, dword [0x4452ac]
mov eax, 0xffffffff
test ecx, ecx
je 0x4186e5
xor edx, edx
mov esi, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x67f3d776
je 0x4186c0
inc edx
cmp ecx, edx
jne 0x4186b0
jmp 0x4186e5
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x4186e5
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 5
push 0x10
push ecx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x1c
mov dword [esp + 0x30], 0x10dd50d8
xor ecx, ecx
mov dl, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [esp + ecx*2 + 0x30]
mov esi, 0x2c1c66c3
sub esi, ecx
or esi, edi
mov ebx, 0x66c3
sub ebx, ecx
and ebx, edi
not esi
or esi, ebx
mov ebx, esi
and ebx, 0x361d
and edi, 2
mov ebp, edi
xor ebp, 2
imul ebp, ebx
or ebx, 2
imul ebx, edi
xor esi, 0x361f
add esi, ebp
add esi, ebx
inc esi
mov word [esp + ecx*2 + 0x30], si
mov ecx, 1
test dl, 1
mov edx, 0
jne 0x418700
cmp eax, dword [esp + 0x30]
jne 0x418c96
push dword [esp + 0x2c]
call fcn.00435be0
add esp, 4
mov dword [esp + 0x24], eax
mov ecx, dword [0x4452ac]
test ecx, ecx
je 0x418c8a
mov eax, dword [esp + 0x2c]
xor edx, edx
mov esi, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x67f3d776
je 0x4187a3
inc edx
cmp ecx, edx
jne 0x418790
jmp 0x418c8a
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x418c8a
push 0
push eax
push dword [esp + 0x2c]
push 5
push 0x10
push ecx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x1c
test eax, eax
js 0x418c8a
mov esi, dword [esp + 0x24]
mov ebx, dword [esi]
lea edi, [esp + 0x7c]
mov eax, dword [esi + ebx + 0x44]
mov dword [esp + 0x88], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov ecx, edi
push 0
push eax
call fcn.00435f90
mov ecx, edi
push 0x1000
call fcn.00435fb0
test eax, eax
js 0x418c70
mov edx, dword [0x4452ac]
mov eax, 0xffffffff
test edx, edx
je 0x418883
mov ecx, dword [esp + 0x7c]
xor edi, edi
mov ebp, dword [0x4452b0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + edi*8], 0xb7c1bb11
je 0x418861
inc edi
cmp edx, edi
jne 0x418850
jmp 0x418883
mov edx, dword [ebp + edi*8 + 4]
cmp edx, 0xffffffff
je 0x418883
lea eax, [esp + 0x14]
push eax
push 0xa
push ecx
push 0xc
push edx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x18
test eax, eax
js 0x418c6c
mov edx, dword [0x4452ac]
mov eax, 0xffffffff
test edx, edx
je 0x4188dd
mov ecx, dword [esp + 0x14]
xor edi, edi
mov ebp, dword [0x4452b0]
cmp dword [ebp + edi*8], 0x6e83e51e
je 0x4188b7
inc edi
cmp edx, edi
jne 0x4188a6
jmp 0x4188dd
mov edx, dword [ebp + edi*8 + 4]
cmp edx, 0xffffffff
je 0x4188dd
lea eax, [esp + 8]
push eax
push 0
push 0
push 1
push ecx
push 0x14
push edx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x20
cmp eax, 0xc0000023
jne 0x418c2b
push dword [esp + 8]
call fcn.00435be0
add esp, 4
mov edx, dword [0x4452ac]
mov ecx, 0xffffffff
test edx, edx
je 0x41895c
mov edi, dword [esp + 8]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], edi
xor edi, edi
mov ebp, dword [0x4452b0]
cmp dword [ebp + edi*8], 0x6e83e51e
je 0x41892c
inc edi
cmp edx, edi
jne 0x41891b
jmp 0x41895c
mov edx, dword [ebp + edi*8 + 4]
cmp edx, 0xffffffff
je 0x41895c
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x24]
push eax
push 1
push dword [esp + 0x14]
push 0x14
push edx
push dword [0x4452b4]
mov edi, eax
call fcn.00437870
add esp, 0x20
mov ecx, eax
mov eax, edi
test ecx, ecx
js 0x418c22
mov ecx, dword [eax]
test ecx, ecx
je 0x418c22
cmp byte [ecx], 1
jne 0x418c22
cmp byte [ecx + 1], 0xf
ja 0x418c22
cmp byte [ecx + 7], 5
jne 0x418c22
cmp byte [ecx + 8], 0x12
jne 0x418c22
mov edi, dword [0x4452ac]
mov ecx, 0xffffffff
test edi, edi
je 0x4189f4
mov edx, dword [esp + 0x14]
mov dword [esp + 4], edx
xor edx, edx
mov ebp, dword [0x4452b0]
cmp dword [ebp + edx*8], 0x6e83e51e
je 0x4189c5
inc edx
cmp edi, edx
jne 0x4189b4
jmp 0x4189f4
mov edi, dword [ebp + edx*8 + 4]
cmp edi, 0xffffffff
je 0x4189f4
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 3
push dword [esp + 0x14]
push 0x14
push edi
push dword [0x4452b4]
mov edi, eax
call fcn.00437870
add esp, 0x20
mov ecx, eax
mov eax, edi
cmp ecx, 0xc0000023
jne 0x418c22
mov dword [esp + 0x78], eax
push dword [esp + 0x28]
call fcn.00435be0
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, dword [0x4452ac]
mov eax, 0xffffffff
test edi, edi
je 0x418a72
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
xor ecx, ecx
mov ebp, dword [0x4452b0]
cmp dword [ebp + ecx*8], 0x6e83e51e
je 0x418a48
inc ecx
cmp edi, ecx
jne 0x418a37
jmp 0x418a72
mov edi, dword [ebp + ecx*8 + 4]
cmp edi, 0xffffffff
je 0x418a72
lea eax, [esp + 0x28]
push eax
push edx
push dword [esp + 0x24]
push 3
push dword [esp + 0x14]
push 0x14
push edi
push dword [0x4452b4]
call fcn.00437870
add esp, 0x20
test eax, eax
js 0x418c12
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x418c12
movzx eax, byte [esp + 0x64]
mov byte [esp + 0x20], al
mov ah, byte [esp + 0x65]
mov al, byte [esp + 0x66]
mov byte [esp + 0x13], al
mov al, byte [esp + 0x67]
mov byte [esp + 0x12], al
mov al, byte [esp + 0x68]
mov byte [esp + 0x11], al
mov al, byte [esp + 0x69]
mov byte [esp + 0x10], al
mov al, byte [esp + 0x6a]
mov byte [esp + 0xf], al
mov al, byte [esp + 0x6b]
mov byte [esp + 0xe], al
mov edx, dword [esp + 0x1c]
add edx, 0xb
mov dword [esp + 4], ecx
mov ch, byte [edx - 7]
mov cl, byte [esp + 0x20]
mov al, cl
cmp ch, cl
jne 0x418b33
mov ch, byte [edx - 6]
mov al, ah
cmp ch, ah
jne 0x418b33
mov ch, byte [edx - 5]
mov cl, byte [esp + 0x13]
mov al, cl
cmp ch, cl
jne 0x418b33
mov ch, byte [edx - 4]
mov cl, byte [esp + 0x12]
mov al, cl
cmp ch, cl
jne 0x418b33
mov ch, byte [edx - 3]
mov cl, byte [esp + 0x11]
mov al, cl
cmp ch, cl
jne 0x418b33
mov ch, byte [edx - 2]
mov cl, byte [esp + 0x10]
mov al, cl
cmp ch, cl
jne 0x418b33
mov ch, byte [edx - 1]
mov cl, byte [esp + 0xf]
mov al, cl
cmp ch, cl
jne 0x418b33
mov ch, byte [edx]
mov cl, byte [esp + 0xe]
mov al, cl
cmp ch, cl
je 0x418b5a
movzx edi, ch
movzx ecx, al
mov ebp, ecx
xor ebp, edi
not ecx
and ecx, edi
add ecx, ecx
cmp ecx, ebp
je 0x418b5a
add edx, 0xc
mov ecx, dword [esp + 4]
dec ecx
jne 0x418acc
jmp 0x418c12
mov dword [esp + 0x8c], 0xc
mov dword [esp + 0x90], 2
mov word [esp + 0x94], 1
mov dword [esp + 0x30], 0x18
lea eax, [esp + 0x34]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
lea eax, [esp + 0x8c]
mov dword [esp + 0x44], eax
mov edx, dword [0x4452ac]
mov eax, 0xffffffff
test edx, edx
je 0x418c06
mov ecx, dword [esp + 0x14]
xor edi, edi
mov ebp, dword [0x4452b0]
cmp dword [ebp + edi*8], 0x4d7e2c49
je 0x418bd8
inc edi
cmp edx, edi
jne 0x418bc7
jmp 0x418c06
mov edx, dword [ebp + edi*8 + 4]
cmp edx, 0xffffffff
je 0x418c06
lea eax, [esp + 0x18]
push eax
push 2
push 0
lea eax, [esp + 0x3c]
push eax
push 0x2000000
push ecx
push 0x18
push edx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x24
test eax, eax
jns 0x418c12
mov dword [esp + 0x18], 0
push dword [esp + 0x1c]
call fcn.00435c10
add esp, 4
mov eax, dword [esp + 0x78]
push eax
call fcn.00435c10
add esp, 4
mov ecx, dword [0x4452ac]
test ecx, ecx
je 0x418c6c
mov eax, dword [esp + 0x14]
xor edx, edx
mov edi, dword [0x4452b0]
cmp dword [edi + edx*8], 0xb430e561
je 0x418c51
inc edx
cmp ecx, edx
jne 0x418c41
jmp 0x418c6c
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, 0xffffffff
je 0x418c6c
push eax
push 4
push ecx
push dword [0x4452b4]
call fcn.00437870
add esp, 0x10
lea edi, [esp + 0x7c]
mov ecx, edi
call fcn.00436150
cmp dword [esp + 0x18], 0
jne 0x418c8a
add esi, ebx
mov ebx, dword [esi]
test ebx, ebx
jne 0x4187dc
push dword [esp + 0x24]
call fcn.00435c10
add esp, 4
mov eax, dword [esp + 0x18]
jmp 0x418640