Function at 0x41cc80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp], 0x31453fb5
mov dword [esp + 4], 0x3557334e
mov dword [esp + 8], 0x49063755
mov dword [esp + 0xc], 0x4d7a4b78
mov dword [esp + 0x10], 0x414e4f7c
mov word [esp + 0x14], 0
mov byte [esp + 0x16], 0
mov eax, 0x4857ebb5
mov ecx, 0x4a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x4857ebb5]
mov edi, ecx
xor edi, eax
and edi, edx
xor edi, eax
neg edi
lea edx, [edi + edi]
and edx, 0x14
xor edi, 0x96486575
lea ebx, [edi + 1]
lea edi, [edi*2 + 2]
and edi, 2
mov ebp, edi
and ebp, ebx
sub ebx, edx
xor ebx, edi
xor ebx, 1
lea edx, [ebx + ebp*2]
mov byte [esp + eax - 0x4857ebb5], dl
inc eax
dec ecx
cmp eax, 0x4857ebcc
jne 0x41ccd0
lea edi, [esi + 4]
movzx eax, word [esp]
mov ebx, edi
test ax, ax
je 0x41cd41
lea ecx, [esp + 2]
mov ebx, edi
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cd30
mov word [ebx], 0
call fcn.00408ce0
mov ecx, eax
mov ebp, 0x51eb851f
mul ebp
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov edx, ecx
and edx, 2
mov eax, ecx
or ecx, 2
imul ecx, edx
xor edx, 2
and eax, 0x7d
imul eax, edx
movsx edx, byte [eax + ecx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [ebx], dx
movsx eax, byte [eax + ecx + 0x4442bd]
mov word [ebx + 2], ax
call fcn.00408ce0
mov ecx, eax
mul ebp
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov edx, ecx
and edx, 2
mov eax, ecx
or ecx, 2
imul ecx, edx
xor edx, 2
and eax, 0x7d
imul eax, edx
movsx edx, byte [eax + ecx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [ebx + 4], dx
movsx eax, byte [eax + ecx + 0x4442bd]
mov word [ebx + 6], ax
mov word [ebx + 8], 0x5f
call fcn.00408ce0
mov ecx, eax
and ecx, 0xfd
and eax, 2
mov edx, eax
xor edx, 2
imul edx, ecx
or ecx, 2
imul ecx, eax
movsx eax, byte [ecx + edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0xa], ax
movsx eax, byte [ecx + edx + 0x444386]
mov word [ebx + 0xc], ax
call fcn.00408ce0
mov ecx, eax
and ecx, 0xfd
and eax, 2
mov edx, eax
xor edx, 2
imul edx, ecx
or ecx, 2
imul ecx, eax
movsx eax, byte [ecx + edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0xe], ax
movsx eax, byte [ecx + edx + 0x444386]
mov word [ebx + 0x10], ax
call fcn.00408ce0
mov ecx, eax
and ecx, 0xfd
and eax, 2
mov edx, eax
xor edx, 2
imul edx, ecx
or ecx, 2
imul ecx, eax
movsx eax, byte [ecx + edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x12], ax
movsx eax, byte [ecx + edx + 0x444386]
mov word [ebx + 0x14], ax
call fcn.00408ce0
mov ecx, eax
and ecx, 0xfd
and eax, 2
mov edx, eax
xor edx, 2
imul edx, ecx
or ecx, 2
imul ecx, eax
movsx eax, byte [ecx + edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x16], ax
movsx eax, byte [ecx + edx + 0x444386]
mov word [ebx + 0x18], ax
call fcn.00408ce0
mov ecx, eax
and ecx, 0xfd
and eax, 2
mov edx, eax
xor edx, 2
imul edx, ecx
or ecx, 2
imul ecx, eax
movsx eax, byte [ecx + edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x1a], ax
movsx eax, byte [ecx + edx + 0x444386]
mov word [ebx + 0x1c], ax
call fcn.00408ce0
mov ecx, eax
and ecx, 0xfd
and eax, 2
mov edx, eax
xor edx, 2
imul edx, ecx
or ecx, 2
imul ecx, eax
movsx eax, byte [ecx + edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x1e], ax
movsx eax, byte [ecx + edx + 0x444386]
mov word [ebx + 0x20], ax
call fcn.00408ce0
mov ecx, eax
and ecx, 0xfd
and eax, 2
mov edx, eax
xor edx, 2
imul edx, ecx
or ecx, 2
imul ecx, eax
movsx eax, byte [ecx + edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x22], ax
movsx eax, byte [ecx + edx + 0x444386]
mov word [ebx + 0x24], ax
call fcn.00408ce0
mov ecx, eax
and ecx, 0xfd
and eax, 2
mov edx, eax
xor edx, 2
imul edx, ecx
or ecx, 2
imul ecx, eax
movsx eax, byte [ecx + edx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [ebx + 0x26], ax
movsx eax, byte [ecx + edx + 0x444386]
mov word [ebx + 0x28], ax
mov word [ebx + 0x2a], 0
push 0x1d3bbfc5
push dword [0x44e1dc]
call fcn.00440350
add esp, 8
push 0
push 0xf00c7
push 0
push 0
push 0
push edi
call eax
mov dword [esi], eax
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret