Function at 0x421a50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa08
mov dword [esp + 0xc0], 0xc3efc1ed
mov dword [esp + 0xc4], 0xc752c551
mov dword [esp + 0xc8], 0xcba6c9a1
mov dword [esp + 0xcc], 0xcf5acda5
mov dword [esp + 0xd0], 0xf3dff169
mov dword [esp + 0xd4], 0xf763f567
mov dword [esp + 0xd8], 0xfbd7f99a
mov dword [esp + 0xdc], 0xff67fd68
mov dword [esp + 0xe0], 0xe387e170
mov dword [esp + 0xe4], 0xe788e5b9
mov dword [esp + 0xe8], 0xeb7ee98d
mov dword [esp + 0xec], 0xef81ed7b
mov dword [esp + 0xf0], 0x13791182
mov dword [esp + 0xf4], 0x177b153a
mov dword [esp + 0xf8], 0x1b701977
mov dword [esp + 0xfc], 0x1f731d73
mov dword [esp + 0x100], 0x34c012e
mov dword [esp + 0x104], 0x7920561
mov dword [esp + 0x108], 0xb65099f
mov dword [esp + 0x10c], 0xf650d9e
mov dword [esp + 0x110], 0x33573143
mov dword [esp + 0x114], 0x37a035a6
mov dword [esp + 0x118], 0x3b593951
mov dword [esp + 0x11c], 0x3f3e3d59
mov byte [esp + 0x120], 0
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x120]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc0]
mov edx, 0x3f0ec12f
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx]
mov esi, edx
or esi, edi
lea eax, [edx - 0x3f0ec100]
and eax, edi
not esi
or esi, eax
lea eax, [esi + 0x3b49c5ef]
not esi
add esi, esi
and esi, 2
mov edi, esi
and edi, eax
xor esi, eax
xor esi, 1
lea eax, [esi + edi*2]
mov byte [ecx], al
inc ecx
dec edx
cmp edx, 0x3f0ec0ce
jne 0x421b90
lea edi, [esp + 0x60]
lea eax, [esp + 0xc0]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0xc0]
xor ecx, ecx
mov eax, dword [esp + 0x10]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0xc0], 0x80b0a0d
mov word [esp + 0xc4], 0
mov byte [esp + 0xc6], 0
mov eax, 0x43
mov ecx, 0xbc
nop
nop
nop
movzx esi, byte [esp + eax + 0x7d]
mov edx, ecx
xor edx, eax
and edx, esi
xor edx, eax
add dl, 0xb1
mov byte [esp + eax + 0x7d], dl
inc eax
dec ecx
cmp eax, 0x4a
jne 0x421c20
mov eax, dword [esp + 0xc0]
mov ecx, dword [0x44f534]
test ecx, ecx
je 0x421c94
xor edx, edx
mov esi, dword [0x44f538]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xc85f7986
je 0x421c70
inc edx
cmp ecx, edx
jne 0x421c60
jmp 0x421c94
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x421c94
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 5
push 4
push dword [0x44f53c]
push ecx
call fcn.00440f10
add esp, 0x1c
cmp eax, 0xc0000004
jne 0x421d30
push dword [esp + 0x28]
call fcn.0043e690
add esp, 4
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc0], 0x80b0a0d
mov word [esp + 0xc4], 0
mov byte [esp + 0xc6], 0
mov eax, 0x43
mov esi, 0xbc
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x7d]
mov edx, esi
xor edx, eax
and edx, edi
xor edx, eax
add dl, 0xb1
mov byte [esp + eax + 0x7d], dl
inc eax
dec esi
cmp eax, 0x4a
jne 0x421ce0
mov eax, dword [esp + 0xc0]
mov edx, dword [0x44f534]
test edx, edx
je 0x421d60
xor esi, esi
mov edi, dword [0x44f538]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0xc85f7986
je 0x421d3e
inc esi
cmp edx, esi
jne 0x421d20
jmp 0x421d60
xor edx, edx
xor esi, esi
xor edi, edi
mov ecx, dword [ebp + 0x14]
jmp 0x4222b1
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x421d60
push 0
push ecx
push dword [esp + 0x28]
push 5
push 4
push dword [0x44f53c]
push edx
call fcn.00440f10
add esp, 0x1c
test eax, eax
js 0x42227e
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], 0
jmp 0x421da2
mov ecx, dword [ebp + 0x14]
call fcn.0043eb40
mov eax, dword [esi]
test eax, eax
je 0x422296
mov ecx, dword [esi + eax + 0x3c]
add esi, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx + eax]
movzx edi, word [ebx + eax]
test dx, dx
je 0x421dc5
add eax, 2
cmp dx, di
je 0x421db0
cmp dx, di
jne 0x421d98
mov eax, dword [esi + 0x44]
mov edi, dword [ebp + 0x14]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xdc]
mov dword [edi + 0xc], eax
mov ecx, edi
push 0x410
call fcn.0043e9c0
test eax, eax
js 0x421d98
mov dword [esp + 0x24], 0
mov eax, dword [edi]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc0], 0x80b0a0d
lea eax, [esp + 0xc4]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0x43
mov edx, 0xbc
nop
movzx edi, byte [esp + eax + 0x7d]
mov ecx, edx
xor ecx, eax
and ecx, edi
xor ecx, eax
add cl, 0xb1
mov byte [esp + eax + 0x7d], cl
inc eax
dec edx
cmp eax, 0x4a
jne 0x421e20
mov eax, dword [esp + 0xc0]
mov edx, dword [0x44f534]
test edx, edx
je 0x421ea0
xor edi, edi
mov ecx, dword [0x44f538]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + edi*8], 0x62429966
je 0x421e70
inc edi
cmp edx, edi
jne 0x421e60
jmp 0x421ea0
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x421ea0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x2b
push dword [esp + 0x24]
push 5
push dword [0x44f53c]
push ecx
call fcn.00440f10
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0xc0000004
jne 0x422263
mov eax, dword [esp + 0x24]
add eax, 2
push eax
call fcn.0043e690
add esp, 4
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp + 0xc0], 0x80b0a0d
lea eax, [esp + 0xc4]
mov byte [eax + 2], 0
mov word [eax], 0
mov eax, 0x43
mov edi, 0xbc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x7d]
mov ecx, edi
xor ecx, eax
and ecx, edx
xor ecx, eax
add cl, 0xb1
mov byte [esp + eax + 0x7d], cl
inc eax
dec edi
cmp eax, 0x4a
jne 0x421f00
mov eax, dword [esp + 0xc0]
mov edi, dword [0x44f534]
test edi, edi
je 0x421f79
add dword [esp + 8], 2
xor ecx, ecx
mov edx, dword [0x44f538]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x62429966
je 0x421f50
inc ecx
cmp edi, ecx
jne 0x421f40
jmp 0x421f79
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, eax
je 0x421f79
push 0
push dword [esp + 0xc]
push dword [esp + 0x1c]
push 0x2b
push dword [esp + 0x14]
push 5
push dword [0x44f53c]
push ecx
call fcn.00440f10
add esp, 0x20
test eax, eax
js 0x422257
mov ecx, dword [esp + 0x14]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
cmp eax, edx
je 0x421fab
mov edi, dword [ebp + 0xc]
movzx edi, word [edi + edx*2]
cmp di, word [ecx + edx*2]
jne 0x422257
inc edx
test di, di
jne 0x421f90
mov edi, dword [ebp + 0x14]
mov ecx, edi
call fcn.0043f050
cmp eax, 2
jne 0x422257
mov ecx, edi
push 0
push 0x30
lea eax, [esp + 0x38]
push eax
push 0
call fcn.0043ee60
test eax, eax
js 0x422257
mov ecx, edi
push 0
push 0
push 0x28
lea eax, [esp + 0x684]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.0043f370
test eax, eax
js 0x422257
mov ecx, edi
push 0
push 0
push 0x80
lea eax, [esp + 0xcc]
push eax
push dword [esp + 0x6ac]
push dword [esp + 0x6ac]
call fcn.0043f370
test eax, eax
js 0x422257
movzx eax, word [esp + 0x132]
push eax
call fcn.0043e690
add esp, 4
movzx edx, word [esp + 0x132]
mov ecx, edi
push 0
push 0
push edx
mov dword [esp + 0x18], eax
push eax
push dword [esp + 0x14c]
push dword [esp + 0x14c]
call fcn.0043f370
test eax, eax
js 0x42224a
movzx edi, word [esp + 0x60]
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
test di, di
je 0x4220cc
lea edx, [esp + 0x60]
mov eax, dword [esp + 0xc]
mov ecx, eax
mov dword [esp + 4], eax
jmp 0x422098
movzx edi, word [edx]
test di, di
je 0x4220cc
movzx eax, word [ecx]
test ax, ax
je 0x42224a
add ecx, 2
add edx, 2
mov dword [esp + 8], edx
mov edx, dword [esp + 4]
add edx, 2
cmp ax, di
je 0x4220c0
mov dword [esp + 4], edx
mov ecx, edx
mov edx, dword [esp + 8]
je 0x422090
lea edx, [esp + 0x60]
jmp 0x422090
cmp dword [esp + 4], 0
je 0x42224a
mov ecx, dword [ebp + 0x14]
push 0
push 0
push 0x20
lea eax, [esp + 0x62c]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0043f370
test eax, eax
js 0x42224a
mov eax, dword [esp + 0x690]
mov ecx, dword [esp + 0x694]
add eax, 0x10
mov dword [esp + 4], eax
adc ecx, 0
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x630]
mov edx, dword [esp + 0x634]
mov dword [esp + 0x504], edx
mov dword [esp + 0x500], eax
jmp 0x422174
cmp cx, dx
je 0x42221d
push dword [esp + 8]
call fcn.0043e710
add esp, 4
mov eax, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
mov ecx, edx
xor ecx, dword [esp + 0x2c]
mov edi, eax
xor edi, dword [esp + 4]
or edi, ecx
je 0x42224a
mov ecx, dword [ebp + 0x14]
push 0
push 0
push 0x68
lea edi, [esp + 0x50c]
push edi
push edx
push eax
call fcn.0043f370
test eax, eax
js 0x42224a
movzx eax, word [esp + 0x55a]
push eax
call fcn.0043e690
add esp, 4
movzx edx, word [esp + 0x55a]
mov ecx, dword [ebp + 0x14]
push 0
push 0
push edx
mov dword [esp + 0x14], eax
push eax
push dword [esp + 0x574]
push dword [esp + 0x574]
call fcn.0043f370
test eax, eax
js 0x422146
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x4221f3
or ecx, 0x20
mov edx, dword [esp + 8]
movzx edx, word [edx + eax]
lea edi, [edx - 0x41]
cmp di, 0x1a
jae 0x422207
or edx, 0x20
test cx, cx
je 0x42213d
add eax, 2
cmp cx, dx
je 0x4221e0
jmp 0x42213d
mov eax, dword [esp + 0x530]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x534]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x540]
mov dword [esp + 0x18], eax
push dword [esp + 8]
call fcn.0043e710
add esp, 4
mov eax, dword [esp + 0xc]
push eax
call fcn.0043e710
add esp, 4
push dword [esp + 0x14]
call fcn.0043e710
add esp, 4
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x1c]
je 0x421d90
cmp dword [esp + 0x18], 0
je 0x421d90
jmp 0x422296
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], 0
push dword [esp + 0x20]
call fcn.0043e710
add esp, 4
mov ecx, dword [ebp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
mov dword [eax + 4], edi
mov eax, dword [ebp + 0x1c]
mov dword [eax], edx
call fcn.0043eb30
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret