Function at 0x417400
Capabilities:
Contain obfuscated stackstrings
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp], 0x69056b1d
mov dword [esp + 4], 0x6d0b6f1a
mov dword [esp + 8], 0x7142730d
mov dword [esp + 0xc], 0x75467740
mov dword [esp + 0x10], 0x797a7b44
mov dword [esp + 0x14], 0
mov eax, 0xa3a91167
mov ecx, 0x98
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x5c56ee99]
mov ebx, ecx
and ebx, 0x85
mov edi, eax
and edi, 0x7a
or edi, ebx
xor edi, 0x7a
and edi, ecx
not edi
and edi, edx
or edx, eax
xor edx, edi
mov edi, edx
xor edi, 4
and edx, 0x7b
add edx, edx
sub edx, edi
inc dl
mov byte [esp + eax + 0x5c56ee99], dl
inc eax
dec ecx
cmp eax, 0xa3a9117f
jne 0x417450
lea edi, [esi + 4]
movzx eax, word [esp]
mov ebx, edi
test ax, ax
je 0x4174c1
lea ecx, [esp + 2]
mov ebx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4174b0
mov word [ebx], 0
call fcn.004088d0
mov ecx, eax
mov ebp, 0x51eb851f
mul ebp
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov edx, ecx
and edx, 2
mov eax, ecx
or ecx, 2
imul ecx, edx
xor edx, 2
and eax, 0x7d
imul eax, edx
movsx edx, byte [eax + ecx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [ebx], dx
movsx eax, byte [eax + ecx + 0x43f2d7]
mov word [ebx + 2], ax
call fcn.004088d0
mov ecx, eax
mul ebp
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov edx, ecx
and edx, 2
mov eax, ecx
or ecx, 2
imul ecx, edx
xor edx, 2
and eax, 0x7d
imul eax, edx
movsx edx, byte [eax + ecx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [ebx + 4], dx
movsx eax, byte [eax + ecx + 0x43f2d7]
mov word [ebx + 6], ax
mov word [ebx + 8], 0x5f
call fcn.004088d0
movzx eax, al
add eax, eax
movsx ecx, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0xa], cx
movsx eax, byte [eax + 0x43f3a0]
mov word [ebx + 0xc], ax
call fcn.004088d0
movzx eax, al
add eax, eax
movsx ecx, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0xe], cx
movsx eax, byte [eax + 0x43f3a0]
mov word [ebx + 0x10], ax
call fcn.004088d0
movzx eax, al
add eax, eax
movsx ecx, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x12], cx
movsx eax, byte [eax + 0x43f3a0]
mov word [ebx + 0x14], ax
call fcn.004088d0
movzx eax, al
add eax, eax
movsx ecx, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x16], cx
movsx eax, byte [eax + 0x43f3a0]
mov word [ebx + 0x18], ax
call fcn.004088d0
movzx eax, al
add eax, eax
movsx ecx, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x1a], cx
movsx eax, byte [eax + 0x43f3a0]
mov word [ebx + 0x1c], ax
call fcn.004088d0
movzx eax, al
add eax, eax
movsx ecx, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x1e], cx
movsx eax, byte [eax + 0x43f3a0]
mov word [ebx + 0x20], ax
call fcn.004088d0
movzx eax, al
add eax, eax
movsx ecx, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x22], cx
movsx eax, byte [eax + 0x43f3a0]
mov word [ebx + 0x24], ax
call fcn.004088d0
movzx eax, al
add eax, eax
movsx ecx, byte [eax + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x26], cx
movsx eax, byte [eax + 0x43f3a0]
mov word [ebx + 0x28], ax
mov word [ebx + 0x2a], 0
push 0x4dc40177
push dword [0x449108]
call fcn.0043b9b0
add esp, 8
push 0
push 0xf00c7
push 0
push 0
push 0
push edi
call eax
mov dword [esi], eax
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret