Function at 0x422990
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
xor ebx, ebx
cmp byte [esp + 0x60], 0
je 0x422c3a
mov eax, dword [esp + 0x68]
mov ebp, dword [esp + 0x5c]
mov edi, dword [eax + 4]
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x4229b0
lea ecx, [edi + ebx]
add ecx, 0xfffffffe
mov eax, edi
not eax
and eax, ecx
add eax, eax
xor ecx, edi
sub eax, ecx
xor ecx, ecx
nop
nop
cmp word [ebp + ecx], 0
lea ecx, [ecx + 2]
jne 0x4229d0
sar eax, 1
lea edx, [ecx + ebp]
add edx, 0xfffffffe
mov ecx, ebp
not ecx
and ecx, edx
add ecx, ecx
xor edx, ebp
sub ecx, edx
sar ecx, 1
lea edx, [eax + ecx]
add edx, 0x1f
test edx, edx
jns 0x422a02
mov eax, 0xffffffff
jmp 0x422a0b
add eax, ecx
lea eax, [eax*2 + 0x3e]
push eax
call fcn.00408300
add esp, 4
mov esi, eax
movzx ecx, word [edi]
test cx, cx
je 0x422a41
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x422a30
mov word [eax], 0x5c
mov dword [esp], 0x4c174a25
mov dword [esp + 4], 0x402c4e32
mov dword [esp + 8], 0x443f4220
mov dword [esp + 0xc], 0x58334616
mov dword [esp + 0x10], 0x5c2f5a38
mov dword [esp + 0x14], 0x50335e38
mov dword [esp + 0x18], 0x542d5208
mov dword [esp + 0x1c], 0x68325631
mov dword [esp + 0x20], 0x6c0e6ae1
mov dword [esp + 0x24], 0x60036e09
mov dword [esp + 0x28], 0x641a623d
mov dword [esp + 0x2c], 0x78026613
mov dword [esp + 0x30], 0x7c047a3a
mov dword [esp + 0x34], 0x70027e00
mov dword [esp + 0x38], 0x7473721d
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x41
xor dl, byte [esp + ecx]
add dl, 0xf8
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 0x3c
jne 0x422ac0
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x422b02
add ebp, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebp]
add ebp, 2
test cx, cx
jne 0x422af0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x422b31
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x422b20
mov word [eax], 0
mov dword [esp + 0x3c], 0xb7d8b5de
mov dword [esp + 0x40], 0xbb17b91d
mov dword [esp + 0x44], 0xbfbebd10
mov eax, 0xc85fd614
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x37a02a28]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x60
mov byte [esp + eax + 0x37a02a28], cl
inc eax
cmp eax, 0xc85fd620
jne 0x422b60
mov dword [esp], 0xad4dab67
mov dword [esp + 4], 0x51bcaf47
mov dword [esp + 8], 0x557b53c1
mov dword [esp + 0xc], 0x59b157a1
mov dword [esp + 0x10], 0x5db85bb4
mov dword [esp + 0x14], 0x41d75fb1
mov dword [esp + 0x18], 0x456443d1
mov dword [esp + 0x1c], 0x49a9478b
mov dword [esp + 0x20], 0x4da04ba3
mov word [esp + 0x24], 0x4f4e
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ecx]
mov ebx, eax
and ebx, 0x74
mov edx, ecx
xor edx, 0x58db4d7a
add edx, ebx
mov ebx, edx
and ebx, edi
add edx, edi
add ebx, ebx
sub edx, ebx
add dl, 0x30
mov byte [esp + ecx], dl
inc ecx
add eax, 2
cmp ecx, 0x26
jne 0x422be0
lea eax, [esp + 0x3c]
mov ecx, esp
push 0
push 4
push 0xc00000
push eax
push esi
push ecx
mov eax, dword [esp + 0x80]
push dword [eax]
call fcn.0041e9a0
add esp, 0x1c
mov ebx, eax
push esi
call fcn.00408310
add esp, 4
mov eax, ebx
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret 0x10