Function at 0x41cba1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x34], 0xd4d9e7d8
mov esi, ecx
mov ebp, edx
push edi
mov ecx, ebx
mov al, byte [esp + ecx + 0x38]
sub al, 0x70
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 4
jl 0x41cbb8
mov byte [esp + 0x48], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0xd0d5c9de
mov byte [esp + 0x40], 0xd8
mov al, byte [esp + ecx + 0x3c]
xor al, 0xbc
mov byte [esp + ecx + 0x5c], al
inc ecx
cmp ecx, 5
jl 0x41cbdb
mov cl, byte [0x42baf9]
mov edx, 0xdb8
xor dword [0x42bb20], 0x884ec75
xor cl, 0xd7
movzx eax, cl
mov byte [0x42bb54], cl
sub ax, dx
add cl, 0x19
mov byte [esp + 0x61], bl
push esi
mov word [0x42bb04], ax
mov byte [0x42baf9], cl
call fcn.00405b40
pop ecx
mov ecx, ebx
cmp byte [eax + esi - 1], 0x2f
jne 0x41ccb0
mov dword [esp + 0x38], 0xaafcaafc
mov al, byte [esp + ecx + 0x38]
xor al, 0xd9
mov byte [esp + ecx + 0x3c], al
inc ecx
cmp ecx, 4
jl 0x41cc3a
mov byte [esp + 0x40], bl
mov ecx, ebx
mov dword [esp + 0x4c], 0xeeedf5f2
mov dword [esp + 0x50], 0xf3b5e8fb
mov dword [esp + 0x54], 0xebfaf9e7
mov byte [esp + 0x58], 0xf8
mov al, byte [esp + ecx + 0x4c]
add al, 0x7a
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0xd
jl 0x41cc6d
imul eax, dword [0x42bb20], 0x8b80e681
xor byte [0x42bb54], 0x63
mov byte [esp + 0x71], bl
mov dword [0x42bb20], eax
and eax, 0xb871
mov word [0x42bb04], ax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x40]
jmp 0x41cd36
mov dword [esp + 0x3c], 0x8288d482
mov byte [esp + 0x40], 0xd4
mov al, byte [esp + ecx + 0x3c]
xor al, 0xa7
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 5
jl 0x41ccbd
mov byte [esp + 0x51], bl
mov ecx, ebx
mov dword [esp + 0x64], 0xe3e2eae7
mov dword [esp + 0x68], 0xe8aaddf0
mov dword [esp + 0x6c], 0xe0efeedc
mov byte [esp + 0x70], 0xed
mov al, byte [esp + ecx + 0x64]
sub al, 0x7b
mov byte [esp + ecx + 0x74], al
inc ecx
cmp ecx, 0xd
jl 0x41ccf0
movzx eax, byte [0x42baf9]
mov ecx, 0xd79d
xor eax, 0xa7cfa048
mov byte [esp + 0x81], bl
mov dword [0x42bb20], eax
movzx eax, byte [0x42baf9]
xor ax, cx
mov word [0x42bb04], ax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x50]
push esi
push eax
push 0x104
push 0x42d018
mov edx, 0x534fbfb6
xor ecx, ecx
call fcn.00415084
call eax
movzx ecx, byte [0x42baf9]
lea edi, [esp + 0x60]
xor eax, eax
mov dword [0x42d220], 0x1f4
stosd dword es:[edi], eax
add ecx, 0x135e0f7d
add esp, 0x14
mov dword [0x42bb20], ecx
xor cl, 0x25
mov byte [0x42bb54], cl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov al, byte [0x42bb04]
sub al, 0xe
mov byte [0x42baf9], al
call fcn.004203ac
movzx ecx, byte [0x42bb54]
mov esi, eax
mov al, byte [0x42bb04]
mov edi, 0x9e7f4339
or al, 0x18
mov edx, edi
mov byte [0x42baf9], al
mov eax, 0x9c09
and cx, ax
mov word [0x42bb04], cx
xor ecx, ecx
push esi
inc ecx
call fcn.00415084
call eax
push eax
push esi
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x54]
call fcn.0041cab2
mov al, byte [0x42bb20]
mov esi, str.froms
pop ecx
pop ecx
xor ecx, ecx
or al, 8
push esi
mov edx, edi
mov byte [0x42baf9], al
inc ecx
call fcn.00415084
call eax
push eax
push esi
lea edx, [esp + 0x64]
lea ecx, [esp + 0x54]
call fcn.0041cab2
movzx eax, byte [0x42baf9]
mov edx, 0x3e1e
mov cl, byte [0x42bb20]
xor ax, dx
mov word [0x42bb04], ax
lea edx, [esp + 0x40]
movzx eax, ax
sub cl, 0x5a
imul eax, eax, 0xad2bb747
mov byte [0x42bb54], cl
add cl, 0x3e
or cl, 0x8c
mov dword [esp + 0x40], ebx
mov byte [0x42baf9], cl
lea ecx, [esp + 0x54]
xor eax, 0xacacc32e
mov dword [0x42bb20], eax
lea eax, [esp + 0x44]
push eax
call fcn.0041c6f1
add esp, 0xc
test al, al
je 0x41d1bd
mov esi, dword [esp + 0x38]
test esi, esi
je 0x41d1bd
mov dword [esp + 0x38], 0x2c2f6d71
mov ecx, ebx
mov al, byte [esp + ecx + 0x38]
sub al, 0x22
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 4
jl 0x41ce81
mov al, byte [0x42bb54]
mov ecx, 0x673c
sub al, 0x16
mov byte [esp + 0x50], bl
movzx eax, al
imul eax, eax, 0x1c
push 4
and al, 0x8f
movzx eax, al
or ax, cx
mov word [0x42bb04], ax
mov al, byte [0x42bb20]
sub al, 0x25
mov byte [0x42bb54], al
lea eax, [esp + 0x50]
push eax
push esi
call fcn.004022e4
add esp, 0xc
test eax, eax
jne 0x41d193
mov cl, byte [0x42baf9]
movzx eax, cl
add cl, 0x35
imul eax, eax, 0xa9836c9f
movzx ecx, cl
mov word [esp + 0x10], 0x7c
mov dword [0x42bb20], eax
mov eax, 0x68d4
sub cx, ax
mov al, cl
mov word [0x42bb04], cx
sub al, 0x3a
or cl, 0xef
and al, 0xae
mov byte [0x42bb54], cl
mov byte [0x42baf9], al
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 4]
push eax
call fcn.00405d9c
movzx ecx, byte [0x42baf9]
mov edx, 0x6c31
sub cx, dx
add esp, 0xc
mov edx, dword [0x42bb20]
mov edi, ebx
mov word [0x42bb04], cx
mov cl, dl
and cl, 0x82
jmp 0x41d16e
shl cl, 2
or dl, 0x2b
mov word [esp + 0x14], 0x31
mov word [esp + 0x18], 0x31
mov word [esp + 0x1c], 0x31
mov word [esp + 0x20], 0x31
mov word [esp + 0x24], 0x31
mov word [esp + 0x28], 0x31
mov word [esp + 0x2c], 0x31
mov word [esp + 0x30], 0x31
mov word [esp + 0x34], 0x31
mov word [esp + 0x38], 0x31
mov byte [0x42baf9], cl
mov byte [0x42bb54], dl
cmp edi, 0xa
ja case.default.0x41cfbc
jmp dword [edi*4 + 0x41d1d9]
push eax
xor ecx, ecx
mov edx, 0xf89245dd
push 0x42d11c
inc ecx
call fcn.00415084
call eax
jmp case.default.0x41cfbc
lea ecx, [esp + 0x14]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x18]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 1], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x1c]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 2], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x20]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 3], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x24]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 4], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x28]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 5], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x2c]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 6], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x30]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 7], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x34]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 8], al
jmp case.default.0x41cfbc
lea ecx, [esp + 0x38]
mov edx, 0xbf77ea11
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00415084
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 9], al
movzx eax, word [0x42bb04]
xor eax, 0xaa42afce
mov dword [0x42bb20], eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00405d9c
mov cl, byte [0x42baf9]
add esp, 0xc
movzx edx, word [0x42bb04]
and cl, 0xe8
sub edx, 0x2ee169a7
xor cl, 0x3c
mov dword [0x42bb20], edx
inc edi
test eax, eax
jne 0x41cf5b
movzx eax, byte [0x42baf9]
sub cl, 0x6e
add eax, 0x92de15eb
mov bl, 1
mov dword [0x42bb20], eax
add eax, 0x2d28
jmp 0x41d19f
mov ax, word [0x42bb04]
mov cl, byte [0x42bb54]
mov edx, 0x5bb1
add cl, 0x16
and ax, dx
mov byte [0x42bb54], cl
push esi
mov word [0x42bb04], ax
call fcn.004056f0
pop ecx
mov cl, byte [0x42baf9]
mov al, bl
pop edi
pop esi
add cl, 0x15
pop ebp
mov byte [0x42bb54], cl
pop ebx
add esp, 0x74
ret