Function at 0x48201d
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
lea eax, [edx + 0x14]
mov edx, dword [edx + 0x14]
cmp eax, edx
je 0x482054
mov ecx, dword [edx + 0x10]
mov edx, dword [edx]
mov dword [esp + 0x64], ecx
cmp eax, edx
je 0x482054
mov edx, dword [edx]
cmp eax, edx
je 0x482054
mov eax, dword [edx + 0x10]
mov dword [esp + 0x6c], eax
mov edi, dword [esp + 0x6c]
mov eax, dword [esp + 0x64]
mov ecx, 0x4e4e
xor ebp, ebp
mov word [esp + 0x7e], cx
mov ebx, 0x4a5d
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x34], edi
mov ecx, dword [edi + eax + 0x78]
mov dword [esp + 0x72], 0x6d49587a
mov dword [esp + 0x76], 0x7c5e524f
add ecx, edi
mov dword [esp + 0x7a], 0x584f5959
mov eax, ecx
mov ecx, dword [ecx + 0x1c]
mov byte [esp + 0x80], 0
add edi, dword [eax + 0x20]
mov dword [esp + 0x81], 0x4a4c5768
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0x24]
mov dword [esp + 0x85], 0x6e525f4b
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x89], 0x5b4a514c
mov word [esp + 0x8d], bx
mov byte [esp + 0x8f], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
test ecx, ecx
je 0x48248a
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
mov ecx, 1
mov edi, 0x7a
add esi, dword [eax + ebp*4]
movzx ebx, byte [esi]
mov edx, ebx
xor edx, 0x3d
movsx eax, dl
cmp dl, 0x7a
jne 0x482480
mov edx, edi
jmp 0x482143
movzx ebx, byte [esi + ecx]
movsx edi, byte [esp + ecx + 0x72]
add ecx, 1
mov eax, ebx
mov edx, edi
xor eax, 0x3d
movsx eax, al
cmp eax, edi
jne 0x48232c
test bl, bl
jne 0x482125
mov edi, edx
mov eax, edi
test al, al
sete al
movzx eax, al
test eax, eax
jne 0x48245e
add ebp, 1
cmp ebp, dword [esp + 0x14]
jne 0x4820f5
mov dword [esp + 0x3c], 0
mov ebp, dword [esp + 0x18]
xor edi, edi
mov esi, dword [esp + 0x34]
add esi, dword [ebp + edi*4]
mov eax, 1
mov ecx, 0x68
movzx edx, byte [esi]
cmp dl, 0x56
je 0x4821b1
jmp 0x482423
movzx edx, byte [esi + eax]
movzx ecx, byte [esp + eax + 0x81]
add eax, 1
mov ebx, edx
xor ebx, 0x3e
cmp bl, cl
jne 0x482423
test dl, dl
jne 0x482195
test cl, cl
je 0x482433
add edi, 1
cmp edi, dword [esp + 0x14]
jne 0x482172
mov dword [esp + 0x40], 0
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x5c]
mov eax, dword [esi + 0x3c]
add eax, esi
mov edi, dword [eax + 0x80]
mov ebx, dword [eax + 0x84]
add edi, esi
add esi, dword [eax + 0xd8]
mov eax, dword [eax + 0xdc]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], esi
mov dword [esp + 0xc], ecx
mov dword [esp], esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x30], edi
mov dword [esp + 0x48], eax
mov dword [esp + 8], 4
mov dword [esp + 4], eax
call esi
sub esp, 0x10
lea eax, [esp + 0x60]
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
mov eax, dword [edi]
sub esp, 0x10
test eax, eax
je 0x4823cc
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
add eax, edi
add edi, dword [ecx + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [eax]
mov dword [esp + 0x28], edi
test eax, eax
jne 0x482285
jmp 0x4823b9
add dword [esp + 0x24], 4
mov eax, dword [esp + 0x24]
add dword [esp + 0x28], 4
mov eax, dword [eax]
test eax, eax
je 0x4823b9
test eax, eax
js 0x48226d
add eax, dword [esp + 0x2c]
mov edx, dword [esp + 0xb0]
lea edi, [eax + 2]
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], edi
test edx, edx
jle 0x48226d
movsx eax, byte [eax + 2]
mov dword [esp + 0x14], 0
mov ebp, dword [esp + 0xb4]
mov byte [esp + 0x20], al
mov dword [esp + 0x1c], eax
lea esi, [esi]
mov edx, dword [esp + 0xb4]
add edx, dword [ebp]
movsx esi, byte [edx]
movzx eax, byte [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ebx, esi
cmp esi, dword [esp + 0x1c]
je 0x482303
jmp 0x48234d
movsx edi, byte [ecx + 1]
movsx esi, byte [edx + 1]
add edx, 1
add ecx, 1
mov eax, edi
mov ebx, esi
cmp edi, esi
jne 0x48234d
test al, al
jne 0x4822ed
xor eax, eax
test bl, bl
sete al
test eax, eax
jne 0x48235a
add dword [esp + 0x14], 1
add ebp, 8
mov eax, dword [esp + 0x14]
cmp dword [esp + 0xb0], eax
jne 0x4822c5
jmp 0x48226d
mov edx, edi
test bl, bl
je 0x482149
cmp edx, eax
sete al
movzx eax, al
jmp 0x482153
test al, al
je 0x482307
xor eax, eax
cmp edi, esi
sete al
jmp 0x48230e
mov ecx, dword [esp + 0xb4]
add ecx, dword [ebp + 4]
xor edx, edx
movzx eax, byte [ecx]
mov ebx, dword [esp + 0x38]
test al, al
je 0x482455
lea esi, [esi]
nop
xor eax, 0x41
mov byte [ebx + edx + 2], al
add edx, 1
movzx eax, byte [ecx + edx]
test al, al
jne 0x48237d
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov byte [edx], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
call eax
sub esp, 8
mov edi, dword [esp + 0x28]
mov dword [edi], eax
jmp 0x48226d
add dword [esp + 0x30], 0x14
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
test eax, eax
jne 0x482247
lea eax, [esp + 0x5c]
mov edi, dword [esp + 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call edi
sub esp, 0x10
lea eax, [esp + 0x60]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call edi
sub esp, 0x10
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
test dl, dl
jne 0x4821bd
test cl, cl
jne 0x4821bd
mov esi, dword [esp + 0x34]
lea eax, [esi + edi*2]
mov edi, dword [esp + 0x20]
movzx eax, word [eax + edi]
mov edi, dword [esp + 0x1c]
lea eax, [esi + eax*4]
add esi, dword [eax + edi]
mov dword [esp + 0x40], esi
jmp 0x4821ce
mov edx, dword [esp + 0x18]
jmp 0x482393
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
lea eax, [edi + ebp*2]
movzx eax, word [eax + ecx]
lea eax, [edi + eax*4]
add edi, dword [eax + esi]
mov dword [esp + 0x3c], edi
jmp 0x48216c
mov edx, 0x7a
jmp 0x48232e
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
jmp 0x4821ce