Function at 0x417520
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x33d731cb
mov dword [esp + 0x14], 0x370235bd
mov dword [esp + 0x18], 0xcb2ec9f6
mov dword [esp + 0x1c], 0xcfcecd2e
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x17
ja 0x4175ad
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0xe461e8f8
xor eax, 0x6461e8f8
lea edx, [eax + edx*2]
lea eax, [edx + ecx]
and edx, ecx
add edx, edx
sub eax, edx
add al, 0x38
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x18
jb 0x417570
lea esi, [esp + 0x10]
push esi
push edi
push dword [ebp + 8]
call fcn.00414380
add esp, 0xc
mov byte [esp + 0xf], al
mov dword [esp + 0x10], 0x433f413b
mov dword [esp + 0x14], 0x5fd05d30
mov dword [esp + 0x18], 0x5b6e5915
mov dword [esp + 0x1c], 0x57365526
mov word [esp + 0x20], 0x5156
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x29
ja 0x417669
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx eax, byte [esp + eax + 0x10]
lea edx, [ecx + 0xcb]
and edx, eax
mov ebx, 0x34
sub ebx, ecx
or ebx, eax
add ebx, edx
sub eax, ebx
add al, 0x72
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x2a
jb 0x417630
push esi
push edi
push dword [ebp + 8]
call fcn.00414380
add esp, 0xc
mov byte [esp + 0xe], al
mov dword [esp + 0x10], 0x73016d06
mov dword [esp + 0x14], 0x771b7106
mov dword [esp + 0x18], 0x7b13751c
mov dword [esp + 0x1c], 0x7f0a790f
mov dword [esp + 0x20], 0x83f47d0f
mov dword [esp + 0x24], 0x87b481f9
mov dword [esp + 0x28], 0x8bfb85f3
mov dword [esp + 0x2c], 0x8fe789e4
mov dword [esp + 0x30], 0x93f78df8
mov word [esp + 0x34], 0x9190
mov dword [esp + 0x36], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3d], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x30
ja 0x41772f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x6e]
add eax, ecx
and edx, ecx
add edx, edx
sub eax, edx
add al, 0x6c
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x31
jb 0x417700
push esi
push edi
push dword [ebp + 8]
call fcn.00414380
add esp, 0xc
mov bh, al
mov dword [esp + 0x10], 0x43d14deb
mov dword [esp + 0x14], 0x47d941d3
mov dword [esp + 0x18], 0xbb1f45dd
mov dword [esp + 0x1c], 0xbfecb92f
mov dword [esp + 0x20], 0xb323bd2b
mov dword [esp + 0x24], 0xb72fb12c
mov dword [esp + 0x28], 0xab0fb520
mov word [esp + 0x2c], 0xa9a8
mov dword [esp + 0x2e], 0
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov dword [esp + 0x39], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x2c
ja 0x4177e8
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 0xf6
add ecx, 0xf6
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0x46
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x2d
jb 0x4177b0
push esi
push edi
push dword [ebp + 8]
call fcn.00414380
add esp, 0xc
mov byte [esp + 0xd], al
mov dword [esp + 0x10], 0x2b95258a
mov dword [esp + 0x14], 0x2f872983
mov dword [esp + 0x18], 0x33992d9c
mov dword [esp + 0x1c], 0x379e3140
mov dword [esp + 0x20], 0x3b853583
mov dword [esp + 0x24], 0x3f383988
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1f
ja 0x417888
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 0xe2ced05
add ecx, 0xe2ced05
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0xdd
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x20
jb 0x417850
push esi
push edi
push dword [ebp + 8]
call fcn.00414380
add esp, 0xc
mov bl, al
mov dword [esp + 0x10], 0x33ae31a0
mov dword [esp + 0x14], 0x37553555
mov dword [esp + 0x18], 0x2bb9294d
mov dword [esp + 0x1c], 0x2fbd2d72
mov dword [esp + 0x20], 0x23be21b1
mov dword [esp + 0x24], 0x27b225bd
mov dword [esp + 0x28], 0x5b5a593d
mov dword [esp + 0x2c], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1f
ja 0x417928
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 0x2adcb328
add ecx, 0x2adcb328
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0xe8
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x20
jb 0x4178f0
movzx eax, byte [esp + 0xf]
or al, byte [esp + 0xe]
or bh, byte [esp + 0xd]
or bh, al
push esi
push edi
push dword [ebp + 8]
call fcn.00414380
add esp, 0xc
or al, bl
or al, bh
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret