Function at 0x4161df
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x63c
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0xf0], edx
mov ebp, ecx
mov dword [esp + 0x90], 0xd0e1d6b4
push edi
mov dword [esp + 0x98], 0x96c8d3d3
mov ecx, ebx
mov dword [esp + 0x9c], 0x8797959b
mov dword [esp + 0xa0], 0xd4d6ca8f
mov dword [esp + 0xa4], 0xd0dbc8d7
mov dword [esp + 0xa8], 0xa2ccd3c9
mov dword [esp + 0xac], 0xb0bab487
mov dword [esp + 0xb0], 0x959e87ac
mov dword [esp + 0xb4], 0xbe87a297
mov dword [esp + 0xb8], 0xd6cbd5d0
mov dword [esp + 0xbc], 0xb587dade
mov dword [esp + 0xc0], 0x959c87bb
mov dword [esp + 0xc4], 0xb087a298
mov dword [esp + 0xc8], 0xb7d6cdd5
mov dword [esp + 0xcc], 0x95cfdbc8
mov word [esp + 0xd0], 0x9098
mov al, byte [esp + ecx + 0x94]
sub al, 0x67
mov byte [esp + ecx + 0x100], al
inc ecx
cmp ecx, 0x3e
jl 0x4162a5
push 0x3c
lea eax, [esp + 0x98]
mov byte [esp + 0x142], bl
push ebx
push eax
mov esi, ebx
call fcn.00403960
add esp, 0xc
lea eax, [esp + 0x100]
mov edx, 0xb3507b39
push ebx
push ebx
push ebx
push ebx
push eax
push 2
pop ecx
call fcn.00412ca7
call eax
mov edi, eax
mov dword [esp + 0xfc], edi
test edi, edi
je 0x4169eb
push dword [ebp]
xor ecx, ecx
mov dword [esp + 0x98], 0x3c
lea eax, [esp + 0x144]
mov dword [esp + 0xac], 0x104
mov edx, 0x9e7f4339
mov dword [esp + 0xa8], eax
inc ecx
call fcn.00412ca7
call eax
add eax, eax
push eax
mov dword [esp + 0xc8], eax
call fcn.0040570b
pop ecx
mov dword [esp + 0xc0], eax
mov edx, 0xc589a631
lea eax, [esp + 0x94]
push eax
push 0x80000000
push ebx
push dword [ebp]
push 2
pop ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x4168b5
push ebx
push 0x4400000
push 3
push ebx
push ebx
push dword [esp + 0xc0]
mov edx, 0xe4f8f001
push dword [esp + 0xbc]
push edi
push 2
pop ecx
call fcn.00412ca7
call eax
mov ecx, eax
mov dword [esp + 0xf8], ecx
test ecx, ecx
je 0x4167b1
cmp dword [esp + 0xa0], 4
mov edx, 0x84c83100
push ebx
mov eax, 0x84480100
cmove eax, edx
mov edx, 0xad1bc01
push eax
push ebx
push ebx
push ebx
push dword [esp + 0xd4]
push dword [ebp + 4]
push ecx
push 2
pop ecx
call fcn.00412ca7
call eax
mov edi, eax
test edi, edi
je 0x416680
push 4
lea eax, [esp + 0xf4]
mov dword [esp + 0xf4], 0x4380
push eax
push 0x1f
push edi
push 2
mov edx, 0xc4435159
pop ecx
call fcn.00412ca7
call eax
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x416459
imul eax, eax, 0x3e8
mov edx, 0xc4435159
push 4
mov dword [esp + 0x64], eax
lea eax, [esp + 0x64]
push eax
push 6
push edi
push 2
pop ecx
call fcn.00412ca7
call eax
push 4
lea eax, [esp + 0x64]
mov edx, 0xc4435159
push eax
push 5
push edi
push 2
pop ecx
call fcn.00412ca7
call eax
push dword [ebp + 0x14]
mov edx, 0x8e87bc01
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 2
pop ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x41666b
push ebx
lea ecx, [esp + 0x60]
mov dword [esp + 0x60], 4
push ecx
lea eax, [ebp + 0x18]
mov edx, 0xacec4ce5
push eax
push 0x20000013
push edi
push 2
pop ecx
call fcn.00412ca7
call eax
test eax, eax
jne 0x4165bb
mov dword [esp + 0x18], 0xa7906262
mov ecx, ebx
mov dword [esp + 0x1c], 0xa09599a8
mov dword [esp + 0x20], 0x9c90a699
mov dword [esp + 0x24], 0x97a4a8a8
mov dword [esp + 0x28], 0xa2999da0
mov dword [esp + 0x2c], 0xa49762a8
mov byte [esp + 0x30], 0xa4
mov al, byte [esp + ecx + 0x18]
sub al, 0x34
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 0x19
jl 0x4164e3
mov byte [esp + 0xed], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x44405463
mov word [esp + 0x14], 0x4254
mov byte [esp + 0x16], 0x45
mov al, byte [esp + ecx + 0x10]
xor al, 0x31
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 7
jl 0x416513
mov byte [esp + 0x93], bl
mov ecx, ebx
mov dword [esp + 0x64], 0xf5f1f1cd
mov dword [esp + 0x68], 0xf7e0f0d4
mov dword [esp + 0x6c], 0xe3ebccfc
mov dword [esp + 0x70], 0xe4e3a5ea
mov dword [esp + 0x74], 0xbef6e9ec
mov dword [esp + 0x78], 0xf6e4e9a5
mov dword [esp + 0x7c], 0xf7e0a5f1
mov dword [esp + 0x80], 0xbff7eaf7
mov dword [esp + 0x84], 0x8ffda0a5
mov al, byte [esp + ecx + 0x64]
xor al, 0x85
mov byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 0x24
jl 0x41657d
or dword [ebp + 0x18], 0xffffffff
mov byte [esp + 0x58], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0xe0]
push 0x34
push eax
call fcn.00412711
add esp, 0x14
mov dword [esp + 0x5c], ebx
jmp 0x41661c
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x416646
test esi, esi
je 0x4165de
mov eax, dword [esp + 0x5c]
inc ecx
add eax, ecx
push eax
push esi
call fcn.00405c8c
pop ecx
jmp 0x4165e7
lea eax, [ecx + 1]
push eax
call fcn.0040570b
mov esi, eax
pop ecx
test esi, esi
je 0x416646
push dword [esp + 0x60]
lea eax, [esp + 0x24c]
push eax
mov eax, dword [esp + 0x64]
add eax, esi
push eax
call fcn.00401d70
mov eax, dword [esp + 0x6c]
add esp, 0xc
add eax, dword [esp + 0x5c]
mov byte [eax + esi], bl
mov eax, dword [esp + 0x60]
add dword [esp + 0x5c], eax
lea eax, [esp + 0x60]
mov edx, 0xa7abc4a5
push eax
push 0x400
lea eax, [esp + 0x250]
push eax
push edi
push 2
pop ecx
call fcn.00412ca7
call eax
test eax, eax
jne 0x4165c1
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x41665d
test esi, esi
je 0x41665d
push esi
call fcn.004056f0
mov eax, dword [esp + 0x60]
pop ecx
mov dword [ebp + 0x1c], eax
mov bl, 1
mov eax, dword [esp + 0xf4]
mov dword [eax], esi
push edi
push 2
mov edx, 0xc71af175
pop ecx
call fcn.00412ca7
call eax
jmp 0x41678f
mov dword [esp + 0x18], 0x517e0c0c
mov ecx, ebx
mov dword [esp + 0x1c], 0x4e434756
mov dword [esp + 0x20], 0x4a7e5047
mov dword [esp + 0x24], 0x41525656
mov dword [esp + 0x28], 0x4c474b4e
mov dword [esp + 0x2c], 0x52410c56
mov byte [esp + 0x30], 0x52
mov al, byte [esp + ecx + 0x18]
xor al, 0x22
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 0x19
jl 0x4166b7
mov byte [esp + 0xed], bl
mov ecx, ebx
mov dword [esp + 0x10], 0xe1ddd1be
mov word [esp + 0x14], 0xdfd1
mov byte [esp + 0x16], 0xe0
mov al, byte [esp + ecx + 0x10]
sub al, 0x6c
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 7
jl 0x4166e7
mov byte [esp + 0x93], bl
mov ecx, ebx
mov dword [esp + 0x34], 0x602023e
mov dword [esp + 0x38], 0x18130639
mov dword [esp + 0x3c], 0x3071324
mov dword [esp + 0x40], 0x56020513
mov dword [esp + 0x44], 0x1a1f1710
mov dword [esp + 0x48], 0x1a564d05
mov dword [esp + 0x4c], 0x56020517
mov dword [esp + 0x50], 0x19040413
mov dword [esp + 0x54], 0x53564c04
mov word [esp + 0x58], 0x7c0e
mov al, byte [esp + ecx + 0x34]
xor al, 0x76
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x26
jl 0x416752
mov byte [esp + 0x8a], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0xe0]
push 0x4e
push eax
call fcn.00412711
add esp, 0x14
push dword [esp + 0xf8]
mov edx, 0xc71af175
push 2
pop ecx
call fcn.00412ca7
call eax
mov edi, dword [esp + 0xfc]
jmp 0x4169c9
mov dword [esp + 0x18], 0xe3cc9e9e
mov ecx, ebx
mov dword [esp + 0x1c], 0xdcd1d5e4
mov dword [esp + 0x20], 0xd8cce2d5
mov dword [esp + 0x24], 0xd3e0e4e4
mov dword [esp + 0x28], 0xded5d9dc
mov dword [esp + 0x2c], 0xe0d39ee4
mov byte [esp + 0x30], 0xe0
mov al, byte [esp + ecx + 0x18]
sub al, 0x70
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 0x19
jl 0x4167e8
mov byte [esp + 0xed], bl
mov ecx, ebx
mov dword [esp + 0x10], 0xb0aca08d
mov word [esp + 0x14], 0xaea0
mov byte [esp + 0x16], 0xaf
mov al, byte [esp + ecx + 0x10]
sub al, 0x3b
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 7
jl 0x416818
mov byte [esp + 0x93], bl
mov ecx, ebx
mov dword [esp + 0x34], 0xdccdd7f0
mov dword [esp + 0x38], 0xcddcd7cb
mov dword [esp + 0x3c], 0xd7d7d6fa
mov dword [esp + 0x40], 0x99cddadc
mov dword [esp + 0x44], 0xd5d0d8df
mov dword [esp + 0x48], 0xd59982ca
mov dword [esp + 0x4c], 0x99cdcad8
mov dword [esp + 0x50], 0xd6cbcbdc
mov dword [esp + 0x54], 0x9c9983cb
mov word [esp + 0x58], 0xb3c1
mov al, byte [esp + ecx + 0x34]
xor al, 0xb9
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x26
jl 0x416883
mov byte [esp + 0x8a], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x94]
push eax
push 0x53
jmp 0x4169b9
mov dword [esp + 0x18], 0xfae3b5b5
mov ecx, ebx
mov dword [esp + 0x1c], 0xf3e8ecfb
mov dword [esp + 0x20], 0xefe3f9ec
mov dword [esp + 0x24], 0xeaf7fbfb
mov dword [esp + 0x28], 0xf5ecf0f3
mov dword [esp + 0x2c], 0xf7eab5fb
mov byte [esp + 0x30], 0xf7
mov al, byte [esp + ecx + 0x18]
add al, 0x79
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 0x19
jl 0x4168ec
mov byte [esp + 0xed], bl
mov ecx, ebx
mov dword [esp + 0x10], 0xf3f7e3d4
mov word [esp + 0x14], 0xf5e3
mov byte [esp + 0x16], 0xf2
mov al, byte [esp + ecx + 0x10]
xor al, 0x86
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 7
jl 0x41691c
mov byte [esp + 0x93], bl
mov ecx, ebx
mov dword [esp + 0x34], 0x8796906b
mov dword [esp + 0x38], 0x96879094
mov dword [esp + 0x3c], 0x85839465
mov dword [esp + 0x40], 0x8e94778d
mov dword [esp + 0x44], 0x8b838842
mov dword [esp + 0x48], 0x425d958e
mov dword [esp + 0x4c], 0x9695838e
mov dword [esp + 0x50], 0x94948742
mov dword [esp + 0x54], 0x425c9491
mov word [esp + 0x58], 0x9a47
mov byte [esp + 0x5a], 0x2c
mov al, byte [esp + ecx + 0x34]
sub al, 0x22
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x27
jl 0x41698c
mov byte [esp + 0x8b], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x94]
push eax
push 0x57
lea eax, [esp + 0xe4]
push eax
call fcn.00412711
add esp, 0x14
push dword [esp + 0xc0]
call fcn.004056f0
pop ecx
push edi
push 2
mov edx, 0xc71af175
pop ecx
call fcn.00412ca7
call eax
jmp 0x416afd
mov dword [esp + 0x18], 0xc235151
mov ecx, ebx
mov dword [esp + 0x1c], 0x131e1a0b
mov dword [esp + 0x20], 0x17230d1a
mov dword [esp + 0x24], 0x1c0f0b0b
mov dword [esp + 0x28], 0x111a1613
mov dword [esp + 0x2c], 0xf1c510b
mov byte [esp + 0x30], 0xf
mov al, byte [esp + ecx + 0x18]
xor al, 0x7f
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 0x19
jl 0x416a22
mov byte [esp + 0xed], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x848094a3
mov word [esp + 0x14], 0x8294
mov byte [esp + 0x16], 0x85
mov al, byte [esp + ecx + 0x10]
xor al, 0xf1
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 7
jl 0x416a52
mov byte [esp + 0x93], bl
mov ecx, ebx
mov dword [esp + 0x64], 0x182721fc
mov dword [esp + 0x68], 0x27182125
mov dword [esp + 0x6c], 0x21182302
mov dword [esp + 0x70], 0x1c1419d3
mov dword [esp + 0x74], 0xd3ee261f
mov dword [esp + 0x78], 0x2726141f
mov dword [esp + 0x7c], 0x252518d3
mov dword [esp + 0x80], 0xd3ed2522
mov word [esp + 0x84], 0x2bd8
mov byte [esp + 0x86], 0xbd
mov al, byte [esp + ecx + 0x64]
add al, 0x4d
mov byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 0x23
jl 0x416ac3
mov byte [esp + 0x57], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0xe0]
push 0x5d
push eax
call fcn.00412711
add esp, 0x14
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x63c
ret