Function at 0x417c00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], 0x36f0573
mov dword [esp + 0x14], 0xf3c0185
mov dword [esp + 0x18], 0xb600d3c
mov dword [esp + 0x1c], 0x17080964
mov dword [esp + 0x20], 0
mov word [esp + 0x24], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x15
ja 0x417ca5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x3cc25581]
mov esi, ecx
not esi
or esi, edx
and edx, ecx
add edx, esi
sub eax, edx
add al, 0xf9
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
mov eax, dword [esp + 8]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp eax, 0x16
jb 0x417c60
lea esi, [esp + 0x10]
push esi
push ebx
push edi
call fcn.004147d0
add esp, 0xc
mov byte [esp + 0xf], al
mov dword [esp + 0x10], 0x9b37993b
mov dword [esp + 0x14], 0x871a8516
mov dword [esp + 0x18], 0x83548159
mov dword [esp + 0x1c], 0x8f2c8d20
mov word [esp + 0x20], 0x8988
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov word [esp + 0x2e], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1f
ja 0x417d3f
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x6c]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add al, 0x78
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x20
jb 0x417d10
push esi
push ebx
push edi
call fcn.004147d0
add esp, 0xc
mov byte [esp + 0xe], al
mov dword [esp + 0x10], 0xfb69f920
mov dword [esp + 0x14], 0xff63fd68
mov dword [esp + 0x18], 0xf36bf166
mov dword [esp + 0x1c], 0xf760f567
mov dword [esp + 0x20], 0xeb7ae967
mov dword [esp + 0x24], 0xef32ed61
mov dword [esp + 0x28], 0xe373e17b
mov dword [esp + 0x2c], 0xe77fe57e
mov dword [esp + 0x30], 0x9b7f9972
mov word [esp + 0x34], 0x9d9a
mov dword [esp + 0x36], 0
mov dword [esp + 0x3a], 0
mov dword [esp + 0x3e], 0
mov dword [esp + 0x42], 0
mov dword [esp + 0x45], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x38
ja 0x417e18
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov eax, dword [esp + 8]
movzx edx, byte [esp + eax + 0x10]
lea eax, [ecx + edx]
add eax, 0x9f491d9f
add ecx, 0x9f491d9f
and ecx, edx
add ecx, ecx
sub eax, ecx
add al, 0xa7
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x39
jb 0x417de0
push esi
push ebx
push edi
call fcn.004147d0
add esp, 0xc
mov bh, al
mov dword [esp + 0x10], 0x836d8163
mov dword [esp + 0x14], 0x876d856b
mov dword [esp + 0x18], 0x8b6f8961
mov dword [esp + 0x1c], 0x8fa08d7f
mov dword [esp + 0x20], 0x93639163
mov dword [esp + 0x24], 0x977f9578
mov dword [esp + 0x28], 0x9b7f996c
mov dword [esp + 0x2c], 0x9d9c
mov byte [esp + 0x30], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x20
ja 0x417ea5
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
add al, 0x40
xor al, byte [esp + ecx + 0x10]
add al, 0x40
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x21
jb 0x417e80
push esi
push dword [ebp + 0xc]
push edi
call fcn.004147d0
add esp, 0xc
mov bl, al
mov dword [esp + 0x10], 0x4b394d38
mov dword [esp + 0x14], 0x573f4923
mov dword [esp + 0x18], 0x532d5526
mov dword [esp + 0x1c], 0x5f285162
mov dword [esp + 0x20], 0x5b295d23
mov dword [esp + 0x24], 0x6766592a
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x2f
ja 0x417f6d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, eax
and edx, 0xc3592a4a
xor eax, 0xc3592a4a
lea edx, [eax + edx*2]
lea eax, [edx + ecx]
and edx, ecx
add edx, edx
sub eax, edx
add al, 0xfa
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x30
jb 0x417f30
push esi
push dword [ebp + 0xc]
push edi
call fcn.004147d0
add esp, 0xc
mov dword [esp + 0x10], 0x731e6d1c
mov dword [esp + 0x14], 0x77117111
mov dword [esp + 0x18], 0x7b0d7511
mov dword [esp + 0x1c], 0x7f09794a
mov dword [esp + 0x20], 0x83ee7d0d
mov dword [esp + 0x24], 0x87f281e9
mov dword [esp + 0x28], 0x8b8a85e1
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 0x23
ja 0x41801a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx edi, byte [esp + ecx + 0x10]
lea ecx, [edx + edi]
add ecx, 0x547ef6ee
add edx, 0x547ef6ee
and edx, edi
add edx, edx
sub ecx, edx
add cl, 0x7e
mov edx, dword [esp + 8]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 8]
mov ecx, dword [esp + 8]
cmp ecx, 0x24
jb 0x417fe0
movzx ecx, byte [esp + 0xf]
or cl, byte [esp + 0xe]
or bh, bl
or bh, cl
or bh, al
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004147d0
add esp, 0xc
movzx eax, al
movzx ecx, bh
mov edx, eax
not edx
and edx, ecx
xor eax, ecx
add eax, ecx
cmp eax, edx
setne al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret