Function at 0x41f9b7
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x28], 0x6a64706c
push edi
mov dword [esp + 0x30], 0x736d3268
mov ecx, ebx
mov word [esp + 0x34], 0x6a68
mov edx, 0xff
movzx eax, byte [esp + ecx + 0x2c]
sub ax, 3
and ax, dx
mov word [esp + ecx*2 + 0xb0], ax
inc ecx
cmp ecx, 0xa
jl 0x41f9e1
xor eax, eax
mov dword [esp + 0x48], 0x46
mov word [esp + 0xc4], ax
mov ecx, 0x1ec
add cx, word [0x42cb58]
mov eax, 0xf98c
or cx, ax
mov dword [esp + 0x14], ebx
movzx ecx, cx
mov eax, 0x28bc
imul ecx, eax
mov edx, 0x58dc
mov eax, 0xdc0b
mov dword [esp + 0x78], 1
push ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
sub dx, cx
mov dword [esp + 0x88], ebx
and dx, ax
mov eax, 0x2074
movzx ecx, dx
mov edx, 0xe7ea7d5c
imul ecx, eax
mov eax, 0x3bab
add cx, ax
imul eax, ecx, 0x778f
mov word [0x42cb58], cx
mov word [0x42cb54], ax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x90]
push eax
push 6
pop ecx
call fcn.00415f33
call eax
test eax, eax
jne 0x420510
mov dword [esp + 0x24], 0xa2a1bbb6
mov ecx, ebx
mov word [esp + 0x28], 0xb3be
mov byte [esp + 0x2a], 0xab
mov al, byte [esp + ecx + 0x24]
xor al, 0xf2
movzx eax, al
mov word [esp + ecx*2 + 0x8c], ax
inc ecx
cmp ecx, 7
jl 0x41fabe
movzx ecx, word [0x42cb54]
xor eax, eax
mov word [esp + 0x9a], ax
mov edx, 0xf09d96e3
mov eax, 0x184b
imul ecx, eax
mov eax, 0x4c93
push ebx
push ebx
push ebx
sub cx, ax
mov word [0x42cb58], cx
lea eax, [ecx + 0x6d1]
mov word [0x42cb54], ax
lea eax, [esp + 0x98]
push eax
push 7
pop ecx
call fcn.00415f33
call eax
mov dx, word [0x42cb54]
mov edi, eax
mov eax, 0x1124
movzx ecx, dx
sub cx, ax
mov dword [esp + 0x24], edi
test edi, edi
je 0x420517
mov eax, 0x6c13
xor ecx, 0xea47
sub dx, ax
sub ecx, 0x4677
mov eax, 0x9405
xor ecx, 0xf0c
and dx, ax
and ecx, 0x8f1c
mov eax, 0x44f
mov word [0x42cb58], cx
sub dx, ax
mov eax, 0xa5ce
and dx, ax
push edi
mov word [0x42cb54], dx
mov edx, 0x271b5d23
push 7
pop ecx
call fcn.00415f33
call eax
mov dx, word [0x42cb58]
mov esi, eax
mov ecx, 0x43e6
mov dword [esp + 0x4c], esi
add cx, dx
mov word [0x42cb54], cx
test esi, esi
je 0x4204ee
push 0x8040
push ebx
push ebx
mov ecx, 0x77e7
add ecx, edx
mov edx, 0x19e8f7ab
imul eax, ecx, 0x7c0
xor ecx, 0x73b7
push 2
push 0x7f00
push ebx
push 5
mov word [0x42cb58], ax
pop eax
mov word [0x42cb54], cx
mov ecx, eax
call fcn.00415f33
call eax
movzx edx, word [0x42cb54]
mov ecx, 0xbee7
imul edx, ecx
mov ebp, eax
mov eax, 0xb297
and dx, ax
mov eax, 0x8846
xor word [0x42cb58], ax
mov word [0x42cb54], dx
test ebp, ebp
je 0x41fc49
lea eax, [esp + 0x9c]
mov edx, 0x6b592b67
push eax
push ebp
push 5
pop ecx
call fcn.00415f33
call eax
test eax, eax
je 0x41fc61
lea eax, [esp + 0x2c]
mov edx, 0xfc7a7777
push eax
push 5
pop ecx
call fcn.00415f33
call eax
test eax, eax
jne 0x41fc84
mov ecx, 0x235
mov eax, 0xd0
add cx, word [0x42cb54]
mov ebp, ebx
movzx ecx, cx
imul ecx, eax
mov eax, 0x4a4
and cx, ax
jmp 0x41fc8b
mov cx, word [0x42cb58]
mov eax, 0x7ddc
mov edx, 0x1be3efe3
or cx, ax
push 8
movzx eax, cx
push edi
mov word [0x42cb58], cx
add eax, 0xffffca4e
push 7
pop ecx
mov word [0x42cb54], ax
call fcn.00415f33
call eax
movzx edx, word [0x42cb58]
mov ecx, 0xf0cb
imul edx, ecx
push 0xa
push edi
push 7
pop ecx
mov word [0x42cb54], dx
mov edx, 0x1be3efe3
mov dword [esp + 0x24], eax
call fcn.00415f33
call eax
mov cx, word [0x42cb58]
mov edx, 0x4afa
push eax
push dword [esp + 0x20]
sub cx, dx
mov dword [esp + 0x28], eax
push edi
mov word [0x42cb54], cx
mov edx, 0x8e1e617c
push 7
pop ecx
call fcn.00415f33
call eax
mov cx, word [0x42cb54]
mov edx, eax
mov eax, 0x987f
mov dword [esp + 0x54], edx
add cx, ax
test edx, edx
je 0x4204bb
movzx ecx, word [0x42cb58]
mov eax, 0x1970
sub cx, ax
mov eax, ecx
or ecx, 0x20fe
push edx
and eax, 0x327e
mov word [0x42cb54], cx
imul eax, eax, 0xd707
mov edx, 0x93f47bf0
push esi
push 7
pop ecx
mov word [0x42cb58], ax
call fcn.00415f33
call eax
movzx edx, word [0x42cb54]
mov ecx, 0xd8db
imul edx, ecx
mov dword [esp + 0x50], eax
mov eax, 0xe574
xor dx, ax
mov word [0x42cb54], dx
lea ecx, [edx - 0x3312]
movzx eax, cx
cmp dword [esp + 0x50], ebx
je 0x420493
push 0x40cc0020
push ebx
push ebx
push edi
push dword [esp + 0x30]
and eax, 0xfffc
mov edx, 0x14b1f8c4
push dword [esp + 0x30]
or eax, 0xfdfc
push ebx
push ebx
add eax, 0x6709
push esi
mov word [0x42cb58], ax
or eax, 0x4023
push 7
pop ecx
mov word [0x42cb54], ax
call fcn.00415f33
call eax
test eax, eax
je 0x420469
mov ecx, 0x7775
mov eax, 0x2ac3
or cx, word [0x42cb54]
mov edx, 0x4175
movzx ecx, cx
imul ecx, eax
sub dx, cx
movzx eax, dx
test ebp, ebp
je 0x41feb4
mov edi, dword [esp + 0x2c]
and eax, 0x4b13
xor eax, 0x909c
mov esi, dword [esp + 0x30]
add eax, 0x2c71
movzx edx, ax
mov eax, edx
or eax, 0x4fee
sub edi, dword [esp + 0xa0]
movzx ecx, ax
mov eax, edx
cmovns ecx, eax
mov eax, 0x3669
sub cx, ax
movzx edx, cx
mov eax, edx
and eax, 0xe592
sub esi, dword [esp + 0xa4]
movzx ecx, ax
mov eax, edx
cmovns ecx, eax
mov edx, 0x7de53dfa
mov eax, 0xffbd
or cx, ax
xor eax, eax
mov word [0x42cb58], cx
xor ecx, 0x18cc
test esi, esi
mov word [0x42cb54], cx
push ebp
cmovns eax, esi
mov esi, dword [esp + 0x50]
push eax
xor eax, eax
test edi, edi
cmovns eax, edi
push eax
push esi
push 5
pop ecx
call fcn.00415f33
call eax
mov dx, word [0x42cb54]
mov eax, 0x4f19
mov dword [esp + 0x1c], ebx
or ax, dx
mov ecx, 0x6037
sub ax, cx
mov edx, 0x883893dc
mov ecx, 0x59d0
or ax, cx
mov word [0x42cb54], ax
or eax, 0x2c4e
mov word [0x42cb58], ax
lea eax, [esp + 0x1c]
push eax
push ebx
push dword [esp + 0x5c]
push 6
pop ecx
call fcn.00415f33
call eax
test eax, eax
jne 0x420469
cmp dword [esp + 0x1c], ebx
je 0x420469
mov eax, 0x183
mov dword [esp + 0x18], ebx
xor ax, word [0x42cb58]
mov ecx, 0x7068
or ax, cx
mov dword [esp + 0x20], ebx
mov word [0x42cb58], ax
mov edx, 0x5ba82cd
or eax, 0x9daa
xor eax, 0x503e
mov word [0x42cb54], ax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
push 6
pop ecx
call fcn.00415f33
call eax
test eax, eax
jne 0x420446
cmp dword [esp + 0x20], ebx
je 0x420446
cmp dword [esp + 0x18], ebx
je 0x420446
push dword [esp + 0x20]
call fcn.0040630b
mov edi, eax
pop ecx
test edi, edi
je 0x420446
mov dx, word [0x42cb54]
mov eax, 0xfcb5
sub dx, 0x74
mov ecx, 0xd2b6
or dx, ax
movzx eax, dx
mov edx, 0x55220f7b
imul eax, ecx
push edi
push dword [esp + 0x24]
push dword [esp + 0x20]
mov word [0x42cb58], ax
imul eax, eax, 0x4f0e
push 6
pop ecx
mov word [0x42cb54], ax
call fcn.00415f33
call eax
mov dx, word [0x42cb54]
test eax, eax
jne 0x4200ae
mov eax, 0xe4f
mov cx, dx
sub cx, ax
mov ebp, ebx
mov eax, 0xff4
movzx ecx, cx
imul ecx, eax
mov word [0x42cb58], cx
cmp dword [esp + 0x18], ebx
jbe 0x4200ae
mov esi, edi
push dword [esi + 0x30]
mov eax, 0xe399
mov ecx, 0x3f0b
and ax, dx
sub ax, cx
mov word [0x42cb54], ax
imul eax, eax, 0x47a8
mov word [0x42cb58], ax
lea eax, [esp + 0xb4]
push eax
call fcn.004066f6
pop ecx
pop ecx
test eax, eax
je 0x420054
mov dx, word [0x42cb54]
inc ebp
add esi, 0x4c
cmp ebp, dword [esp + 0x18]
jb 0x420009
jmp 0x4200ae
mov cx, word [0x42cb58]
mov edx, 0x6e10
mov ax, cx
and ax, dx
mov edx, 0x4d6
add ax, dx
mov word [0x42cb54], ax
mov eax, 0x7084
and cx, ax
lea eax, [esp + 0xc8]
push 0x10
push esi
push eax
mov word [0x42cb58], cx
call fcn.00402970
mov edx, 0x8f53
mov dword [esp + 0x24], ebx
xor dx, word [0x42cb58]
mov eax, 0x7978
add esp, 0xc
add dx, ax
mov eax, 0xe4d9
add dx, ax
push edi
mov word [0x42cb54], dx
call fcn.004062f0
mov ax, word [0x42cb54]
pop ecx
mov ecx, 0xf39a
xor ax, cx
mov word [0x42cb54], ax
movzx eax, ax
and eax, 0x9dee
mov word [0x42cb58], ax
cmp dword [esp + 0x18], ebx
jne 0x420446
lea eax, [esp + 0x14]
xor edi, edi
push eax
inc edi
mov edx, 0xb91d33f0
push edi
push ebx
push 8
pop ecx
call fcn.00415f33
call eax
test eax, eax
jne 0x420446
mov esi, dword [esp + 0x14]
test esi, esi
je 0x420446
mov cx, word [0x42cb58]
mov eax, 0x54b
sub cx, ax
mov dword [esp + 0x58], ebx
mov eax, 0x28d3
or cx, ax
mov eax, 0xd886
movzx ecx, cx
imul ecx, eax
mov eax, 0xae8f
movzx edx, cx
and dx, ax
imul eax, edx, 0x352
movzx ecx, ax
cmp dword [esp + 0x48], ebx
jbe 0x4201f1
imul eax, edx, 0x301b
push 0x10
push 0x429f28
and eax, 0x4994
mov word [0x42cb54], ax
or eax, 0x3b94
sub eax, 0x4869
mov word [0x42cb58], ax
lea eax, [esp + 0x64]
push eax
call fcn.00402970
imul eax, dword [esp + 0x64], 0x1c
lea ecx, [esp + 0x54]
mov esi, dword [esp + 0x20]
add esp, 0xc
push 5
mov dword [esp + eax + 0x74], 4
imul eax, dword [esp + 0x5c], 0x1c
mov dword [esp + eax + 0x70], edi
imul eax, dword [esp + 0x5c], 0x1c
mov dword [esp + eax + 0x78], ecx
mov ecx, 0x1d53
xor cx, word [0x42cb58]
mov eax, 0x342a
inc dword [esp + 0x5c]
movzx ecx, cx
imul ecx, eax
mov eax, 0x1364
sub cx, ax
pop eax
xor cx, ax
mov eax, 0xaef2
or cx, ax
movzx ecx, cx
mov eax, ecx
mov edx, 0x3a256861
xor eax, 0xc5b8
and ecx, 0x2c51
mov word [0x42cb58], ax
sub ecx, 0x6e66
lea eax, [esp + 0x58]
mov word [0x42cb54], cx
push eax
lea eax, [esp + 0xcc]
push eax
push esi
push dword [esp + 0x28]
push 6
pop ecx
call fcn.00415f33
call eax
test eax, eax
je 0x420274
movzx ecx, word [0x42cb54]
mov eax, 0x363a
imul ecx, eax
mov eax, 0xa79c
xor cx, ax
mov word [0x42cb58], cx
lea eax, [ecx - 0xf55]
or eax, 0xe159
mov word [0x42cb54], ax
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x420446
mov eax, 0x64a8
mov edx, 0xb3d
add ax, word [0x42cb58]
movzx ecx, ax
or cx, dx
mov eax, ecx
and ecx, 0x46a7
or eax, 0xac4
mov word [0x42cb54], cx
sub eax, 0x8d2
push ebx
mov word [0x42cb58], ax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
movzx eax, word [0x42cb58]
lea edx, [esp + 0xf8]
mov ecx, 0xf99c
add ax, cx
mov ecx, 0x6fca
mov word [0x42cb58], ax
imul eax, eax, 0x2f19
push edi
push edx
sub ecx, eax
mov eax, dword [esp + 0x1c]
mov word [0x42cb54], cx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
jne 0x420423
cmp dword [esp + 0x104], ebx
jne 0x420423
push dword [esp + 0x100]
mov eax, 0x55f5
add ax, word [0x42cb54]
mov word [0x42cb58], ax
call fcn.0040630b
pop ecx
mov cx, word [0x42cb54]
mov esi, eax
mov eax, 0x41d3
or cx, ax
test esi, esi
je 0x42042a
movzx ecx, word [0x42cb58]
lea edx, [esp + 0x100]
mov eax, 0xef73
or cx, ax
mov eax, dword [esp + 0x14]
push edx
push dword [esp + 0x104]
mov word [0x42cb54], cx
xor ecx, 0x74ee
mov word [0x42cb58], cx
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x42040a
mov dword [esp + 0x38], 0x25322313
mov ecx, 0xff
mov dword [esp + 0x3c], 0x28332e25
mov dword [esp + 0x40], 0x2aee342f
mov word [esp + 0x44], 0x2530
mov byte [esp + 0x46], 0x27
movzx eax, byte [esp + ebx + 0x38]
add ax, 0x40
and ax, cx
mov word [esp + ebx*2 + 0xd8], ax
inc ebx
cmp ebx, 0xf
jl 0x4203af
mov edx, dword [esp + 0x100]
xor eax, eax
mov word [esp + 0xf6], ax
mov ecx, 0x3d46
movzx eax, word [0x42cb58]
sub ax, cx
mov ecx, esi
mov word [0x42cb54], ax
add eax, 0x3d82
mov word [0x42cb58], ax
lea eax, [esp + 0xd8]
push eax
call fcn.0041f651
pop ecx
mov eax, 0x653c
add ax, word [0x42cb58]
push esi
mov word [0x42cb54], ax
call fcn.004062f0
pop ecx
mov cx, word [0x42cb54]
mov eax, 0xc7c4
movzx ecx, cx
imul ecx, eax
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
mov word [0x42cb54], cx
call dword [edx + 8]
push dword [esp + 0x1c]
mov eax, 0x671a
mov edx, 0xe32ee8f1
xor word [0x42cb54], ax
push 6
pop ecx
call fcn.00415f33
call eax
mov esi, dword [esp + 0x4c]
push dword [esp + 0x50]
mov eax, 0x130c
mov edx, 0x93f47bf0
or word [0x42cb58], ax
push esi
push 7
pop ecx
call fcn.00415f33
call eax
mov ax, word [0x42cb58]
mov edi, dword [esp + 0x24]
push dword [esp + 0x54]
mov ecx, 0xe5a6
mov edx, 0xf93dcbf0
xor ax, cx
push 7
pop ecx
mov word [0x42cb58], ax
call fcn.00415f33
call eax
mov cx, word [0x42cb54]
movzx eax, cx
mov edx, 0x6496
add ax, dx
mov edx, 0x63cab623
push esi
mov word [0x42cb58], ax
add eax, 0xffffbf8c
push 7
pop ecx
mov word [0x42cb54], ax
call fcn.00415f33
call eax
mov dx, word [0x42cb58]
movzx esi, dx
mov eax, 0xa62f
imul esi, eax
mov edx, 0x63cab623
push edi
push 7
pop ecx
mov word [0x42cb58], si
call fcn.00415f33
call eax
mov cx, word [0x42cb58]
mov eax, 0x7a28
mov edx, 0x4c7
xor ax, cx
or ax, dx
pop edi
mov word [0x42cb54], ax
mov eax, 0x783
pop esi
xor cx, ax
pop ebp
mov word [0x42cb58], cx
pop ebx
add esp, 0x134
ret