Function at 0x417380
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x10], 0xf33ecd30
mov dword [esp + 0x14], 0xf711f163
mov dword [esp + 0x18], 0xfb16f515
mov dword [esp + 0x1c], 0xff3bf9d8
mov dword [esp + 0x20], 0xe376fd64
mov dword [esp + 0x24], 0xe774e105
mov dword [esp + 0x28], 0xeb03e573
mov dword [esp + 0x2c], 0xef7ce97b
mov dword [esp + 0x30], 0x9365edcc
mov dword [esp + 0x34], 0x97029175
mov dword [esp + 0x38], 0x9b739500
mov dword [esp + 0x3c], 0x9f75990a
mov dword [esp + 0x40], 0x837e9d0b
lea eax, [esp + 0x44]
mov word [esp + 0x44], 0x8180
mov dword [esp + 0x46], 0
mov dword [esp + 0x4a], 0
mov dword [esp + 0x4e], 0
mov byte [esp + 0x52], 0
mov dword [esp + 0x84], 0
mov ecx, dword [esp + 0x84]
cmp ecx, 0x42
ja 0x417476
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x84]
add cl, 0x1e
xor cl, byte [esp + edx + 0x10]
add cl, 0x2e
mov edx, dword [esp + 0x84]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 0x84]
mov ecx, dword [esp + 0x84]
cmp ecx, 0x43
jb 0x417440
lea edi, [esp + 0x84]
lea edx, [esp + 0x10]
mov ecx, 0xd
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb8]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov esi, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4174b0
sar eax, 1
mov ecx, dword [ebp + 0x10]
mov edi, dword [ecx + 4]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x4174d0
sar ecx, 1
lea edx, [eax + ecx]
add edx, 0x1b
test edx, edx
jns 0x4174ee
mov eax, 0xffffffff
jmp 0x4174f5
add eax, ecx
add eax, eax
add eax, 0x36
push eax
call fcn.00435ac0
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 0xc], eax
test cx, cx
je 0x417531
add esi, 2
mov eax, dword [esp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x417520
mov word [eax], 0
movzx ecx, word [esp + 0x84]
test cx, cx
je 0x417561
lea edx, [esp + 0x86]
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417550
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x417591
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x417580
mov word [eax], 0
mov dword [esp + 0x10], 0x431f4177
mov dword [esp + 0x14], 0x5fd05dca
mov dword [esp + 0x18], 0x5b2e5921
mov dword [esp + 0x1c], 0x572f55d7
mov dword [esp + 0x20], 0x53265127
mov dword [esp + 0x24], 0x6f5d6ddf
lea eax, [esp + 0x28]
mov word [esp + 0x28], 0x696e
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov byte [esp + 0x3a], 0
mov dword [esp + 0x68], 0
mov ecx, dword [esp + 0x68]
cmp ecx, 0x2a
ja 0x417637
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x68]
add cl, 0xcb
xor cl, byte [esp + edx + 0x10]
add cl, 0x73
mov edx, dword [esp + 0x68]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 0x68]
mov ecx, dword [esp + 0x68]
cmp ecx, 0x2b
jb 0x417610
lea edi, [esp + 0x68]
lea edx, [esp + 0x10]
mov ecx, 6
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x80]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [ebx]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x417670
sar eax, 1
mov esi, dword [ebx + 8]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x417690
inc eax
sar ecx, 1
mov edx, ecx
and edx, eax
add edx, edx
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x10]
mov ebx, dword [edx]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + edx + 2], 0
lea edx, [edx + 2]
jne 0x4176c0
xor ecx, eax
sar edx, 1
add ecx, dword [esp + 8]
lea eax, [edx + ecx]
add eax, 0xd
test eax, eax
jns 0x4176e4
mov eax, 0xffffffff
jmp 0x4176ec
add ecx, edx
lea eax, [ecx + ecx]
add eax, 0x1a
push eax
call fcn.00435ac0
add esp, 4
movzx ecx, word [edi]
mov dword [esp + 8], eax
test cx, cx
je 0x417721
add edi, 2
mov eax, dword [esp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x417710
mov word [eax], 0x2f
add eax, 2
movzx ecx, word [esi]
test cx, cx
je 0x417751
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x417740
mov word [eax], 0
movzx ecx, word [esp + 0x68]
test cx, cx
je 0x417783
lea edx, [esp + 0x6a]
mov esi, dword [esp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x417770
jmp 0x417787
mov esi, dword [esp + 0xc]
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x4177b1
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4177a0
mov word [eax], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0xebd4d5e8
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1f
ja 0x417851
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x1f10fe1d]
and edx, ecx
add eax, ecx
add eax, 0x1f10fe1d
add edx, edx
sub eax, edx
mov ecx, eax
or ecx, 0x34
and eax, 0x34
add eax, ecx
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x20
jb 0x417810
push 0
push 0
push 0xc00000
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x1c]
push dword [ebp + 8]
call fcn.0041a910
add esp, 0x1c
mov ebx, eax
mov eax, dword [0x442728]
mov ecx, 0xcc536ab6
xor ecx, dword [str.u3sK]
add eax, ecx
inc eax
jmp eax