Function at 0x41d380
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov esi, dword [esp + 0xd4]
mov ebp, dword [esp + 0xd0]
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 2
mov dword [esp + 0xa4], 1
push 0x28501340
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
lea ecx, [esp + 0x20]
lea edx, [esp + 0x9c]
push ecx
push edx
push esi
push ebp
call eax
test eax, eax
mov dword [esp + 0x10], edi
jne 0x41d4d9
push 0x1268aeb0
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
mov dword [esp], eax
push 0x4ab545
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
mov dword [esp + 0x18], eax
push 0xa2994af6
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x41d4bc
mov edi, dword [esp + 0x10]
jmp 0x41d487
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x41d4bc
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x41d480
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [esp + 0x24]
test eax, eax
je 0x41d4bc
push dword [edi]
call dword [esp + 0x18]
mov dword [edi], 0xffffffff
jmp 0x41d480
push 0x6177aa44
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
push dword [esp + 0x20]
call eax
mov edi, dword [esp + 0x10]
xor ebx, ebx
cmp dword [edi], 0xffffffff
je 0x41deb0
mov edi, dword [esp + 0xd8]
nop
nop
nop
nop
nop
cmp byte [edi + ebx], 0
lea ebx, [ebx + 1]
jne 0x41d4f0
mov eax, edi
not eax
xor ecx, ecx
nop
cmp byte [ebp + ecx], 0
lea ecx, [ecx + 1]
jne 0x41d500
lea edx, [edi + ebx]
dec edx
mov dword [esp], edx
and eax, edx
mov edx, ebp
not edx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
cmp byte [esi + ebx], 0
lea ebx, [ebx + 1]
jne 0x41d520
xor dword [esp], edi
add ecx, ebp
dec ecx
and edx, ecx
xor ecx, ebp
add ecx, dword [esp]
add eax, edx
lea edx, [esi + ebx]
dec edx
mov ebx, esi
not ebx
and ebx, edx
xor edx, esi
add edx, ecx
add eax, eax
sub eax, edx
lea eax, [eax + ebx*2]
add eax, 0x8c
push eax
call fcn.00408000
add esp, 4
mov dword [esp], eax
mov dword [esp + 0x26], 0xe7e6f990
mov dword [esp + 0x2a], 0x99879ae4
mov dword [esp + 0x2e], 0xf3b0b489
mov dword [esp + 0x32], 0x85caced3
mov word [esp + 0x36], 0xc1e0
mov eax, 0xe7774430
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x1888bbf6]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x80
mov byte [esp + eax + 0x1888bbf6], cl
inc eax
cmp eax, 0xe7774442
jne 0x41d590
mov dword [esp + 4], 0x9ec9f9fc
mov byte [esp + 8], 0xbf
mov eax, 0x21588ca3
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x21588c9f]
xor ecx, eax
neg ecx
mov edx, ecx
and edx, 0x19
xor ecx, 0x19
lea ecx, [ecx + edx*2]
mov dl, 1
sub dl, cl
mov byte [esp + eax - 0x21588c9f], dl
inc eax
cmp eax, 0x21588ca8
jne 0x41d5d0
movzx eax, byte [esp + 4]
mov ebx, dword [esp]
test al, al
je 0x41d61b
lea ecx, [esp + 5]
mov ebx, dword [esp]
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d610
mov byte [ebx], 0
movzx eax, byte [edi]
test al, al
je 0x41d63b
inc edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [edi]
inc edi
test al, al
jne 0x41d630
mov byte [ebx], 0
movzx eax, byte [esp + 0x26]
test al, al
je 0x41d65b
lea ecx, [esp + 0x27]
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d650
mov byte [ebx], 0
movzx eax, byte [ebp]
test al, al
je 0x41d67c
inc ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ebp]
inc ebp
test al, al
jne 0x41d670
mov byte [ebx], 0x3a
mov dword [esp + 0x26], 0x50baf4f0
mov dword [esp + 0x2a], 0x40425046
mov dword [esp + 0x2e], 0x4f87ac40
mov dword [esp + 0x32], 0x4348585c
mov dword [esp + 0x36], 0x445a455e
mov dword [esp + 0x3a], 0x4bb0e8ec
mov dword [esp + 0x3e], 0x6b52484b
mov dword [esp + 0x42], 0x7274737d
mov dword [esp + 0x46], 0x709aae87
mov dword [esp + 0x4a], 0x60627066
mov dword [esp + 0x4e], 0x8bdddb60
mov dword [esp + 0x52], 0x8ba6797c
mov dword [esp + 0x56], 0x6f8c7c78
mov dword [esp + 0x5a], 0x60766972
mov dword [esp + 0x5e], 0xa1728da8
mov dword [esp + 0x62], 0x5fa34a63
mov dword [esp + 0x66], 0x7d777477
mov dword [esp + 0x6a], 0x557f6683
mov dword [esp + 0x6e], 0x837bac60
mov dword [esp + 0x72], 0x7e7c7381
mov dword [esp + 0x76], 0x877b9685
mov dword [esp + 0x7a], 0x2e2e7f7c
mov dword [esp + 0x7e], 0x75949366
mov dword [esp + 0x82], 0x5fa9af5e
mov dword [esp + 0x86], 0xa5b4adb2
mov dword [esp + 0x8a], 0xa1557fb5
mov dword [esp + 0x8e], 0xa7beb5b7
mov dword [esp + 0x92], 0x6d7b50a7
mov dword [esp + 0x96], 0xd05036e
mov word [esp + 0x9a], 0x120b
mov eax, 0xc5
mov ecx, 0x6de3243a
nop
nop
nop
movzx edi, byte [esp + eax - 0x9f]
mov edx, eax
xor edx, ecx
and edx, edi
xor edx, ecx
mov edi, edx
not edi
mov ebp, edi
and ebp, 0xd7
xor edx, 0x28
add edx, edi
and edi, 0x28
sub edx, edi
add edx, ebp
inc dl
mov byte [esp + eax - 0x9f], dl
inc eax
dec ecx
cmp eax, 0x13b
jne 0x41d790
inc ebx
movzx eax, byte [esi]
test al, al
je 0x41d7ed
inc esi
mov edi, dword [esp + 0x10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [esi]
inc esi
test al, al
jne 0x41d7e0
jmp 0x41d7f1
mov edi, dword [esp + 0x10]
mov byte [ebx], 0
movzx eax, byte [esp + 0x26]
test al, al
je 0x41d81b
lea ecx, [esp + 0x27]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41d810
mov byte [ebx], 0
mov esi, dword [esp]
sub ebx, esi
push 0x12007ce3
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
push 0
push ebx
push esi
push dword [edi]
call eax
mov ebx, eax
cmp eax, 0xffffffff
jne 0x41d892
cmp dword [edi], 0xffffffff
je 0x41d892
push 0x4f80c377
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
push 2
push dword [edi]
call eax
push 0xa2994af6
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
push dword [esp]
call fcn.00408010
add esp, 4
xor ebx, ebx
jmp 0x41deb0
push dword [esp]
call fcn.00408010
add esp, 4
cmp ebx, 0xffffffff
je 0x41d8ed
push 0x400
call fcn.00408000
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
add eax, 0x400
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
mov ecx, edi
push eax
call fcn.0041dec0
test al, al
je 0x41de95
mov ebp, dword [esp + 4]
mov edi, dword [esp + 8]
mov esi, edi
sub esi, ebp
cmp edi, dword [esp + 0xc]
je 0x41d8f4
mov eax, ebp
jmp 0x41daa9
xor ebx, ebx
jmp 0x41deb0
lea eax, [esi + 1]
mov ebx, esi
shr ebx, 1
add ebx, esi
cmp ebx, eax
ja 0x41d903
mov ebx, eax
push ebx
call fcn.00408000
add esp, 4
test ebp, ebp
je 0x41da98
mov dword [esp + 0x18], ebx
cmp eax, ebp
mov dword [esp], eax
jbe 0x41d963
cmp edi, eax
jbe 0x41d963
test esi, esi
je 0x41da85
lea eax, [esi + ebp]
dec eax
mov ecx, dword [esp]
add ecx, esi
dec ecx
mov ebx, esi
and esi, 7
je 0x41da29
mov dword [esp + 0x14], ebx
neg esi
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp esi, edx
jne 0x41d948
add eax, edx
add ecx, edx
mov esi, dword [esp + 0x14]
add edx, esi
jmp 0x41da2d
mov ecx, esi
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov ecx, esi
and ecx, 3
mov ebx, ecx
not ebx
or ebx, 1
add ebx, ecx
shr ecx, 1
mov ebp, esi
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov esi, ebp
mov ecx, ebx
inc ecx
je 0x41da85
and esi, 2
add eax, esi
add edx, esi
mov esi, ecx
and esi, 7
je 0x41d9cd
mov dword [esp + 0x14], ebx
xor edi, edi
movzx ebx, byte [edx + edi]
mov byte [eax + edi], bl
inc edi
cmp esi, edi
jne 0x41d9b7
add edx, edi
add eax, edi
sub ecx, edi
mov ebx, dword [esp + 0x14]
cmp ebx, 7
mov esi, ebp
jb 0x41da85
xor edi, edi
movzx ebx, byte [edx + edi]
mov byte [eax + edi], bl
movzx ebx, byte [edx + edi + 1]
mov byte [eax + edi + 1], bl
movzx ebx, byte [edx + edi + 2]
mov byte [eax + edi + 2], bl
movzx ebx, byte [edx + edi + 3]
mov byte [eax + edi + 3], bl
movzx ebx, byte [edx + edi + 4]
mov byte [eax + edi + 4], bl
movzx ebx, byte [edx + edi + 5]
mov byte [eax + edi + 5], bl
movzx ebx, byte [edx + edi + 6]
mov byte [eax + edi + 6], bl
movzx ebx, byte [edx + edi + 7]
mov byte [eax + edi + 7], bl
add edi, 8
cmp ecx, edi
jne 0x41d9da
jmp 0x41da85
mov edx, ebx
mov esi, ebx
sub ebp, edi
cmp ebp, 0xfffffff8
ja 0x41da85
neg edx
xor edi, edi
movzx ebx, byte [eax + edi]
mov byte [ecx + edi], bl
movzx ebx, byte [eax + edi - 1]
mov byte [ecx + edi - 1], bl
movzx ebx, byte [eax + edi - 2]
mov byte [ecx + edi - 2], bl
movzx ebx, byte [eax + edi - 3]
mov byte [ecx + edi - 3], bl
movzx ebx, byte [eax + edi - 4]
mov byte [ecx + edi - 4], bl
movzx ebx, byte [eax + edi - 5]
mov byte [ecx + edi - 5], bl
movzx ebx, byte [eax + edi - 6]
mov byte [ecx + edi - 6], bl
movzx ebx, byte [eax + edi - 7]
mov byte [ecx + edi - 7], bl
add edi, 0xfffffff8
cmp edx, edi
jne 0x41da38
push dword [esp + 4]
call fcn.00408010
add esp, 4
mov ebx, dword [esp + 0x18]
mov eax, dword [esp]
mov dword [esp + 4], eax
lea ecx, [eax + esi]
mov dword [esp + 8], ecx
add ebx, eax
mov dword [esp + 0xc], ebx
mov byte [eax + esi], 0
mov esi, dword [esp + 4]
mov ebp, dword [esp + 8]
inc ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x26], 0x8b8e8d90
mov dword [esp + 0x2a], 0x6e706c73
mov dword [esp + 0x2e], 0x52525040
mov byte [esp + 0x32], 0x64
mov ecx, 0x8d266898
nop
nop
nop
nop
movzx eax, byte [esp + ecx + 0x72d9978e]
mov edx, eax
and edx, ecx
add dl, dl
sub al, dl
movzx eax, al
add eax, ecx
add al, 0x40
mov byte [esp + ecx + 0x72d9978e], al
inc ecx
cmp ecx, 0x8d2668a5
jne 0x41dae0
movzx edx, byte [esp + 0x26]
mov ecx, esi
test dl, dl
je 0x41db46
lea edi, [esp + 0x26]
mov eax, esi
mov ecx, esi
jmp 0x41db27
movzx edx, byte [edi]
test dl, dl
je 0x41db46
mov dh, byte [eax]
test dh, dh
je 0x41de2b
inc eax
inc edi
lea ebx, [ecx + 1]
cmp dh, dl
je 0x41db3e
mov ecx, ebx
mov eax, ebx
je 0x41db20
lea edi, [esp + 0x26]
jmp 0x41db20
test ecx, ecx
je 0x41de2b
mov ecx, dword [esp + 0x10]
jmp 0x41db75
movsx eax, al
mov edx, eax
xor edx, ebx
not eax
and eax, ebx
add eax, eax
cmp eax, edx
je 0x41de97
mov edx, esi
sub edx, ebp
je 0x41db98
mov eax, ebp
mov edi, esi
xor ecx, ecx
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
xor ecx, ecx
mov edi, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov ecx, dword [esp + 0x10]
add dword [esp + 8], edx
lea eax, [esp + 4]
push eax
call fcn.0041dec0
test al, al
je 0x41de95
mov ebx, eax
mov eax, dword [esp + 4]
mov edi, dword [esp + 8]
mov esi, edi
sub esi, eax
cmp edi, dword [esp + 0xc]
je 0x41dbd0
mov edi, ebx
jmp 0x41ddc5
mov dword [esp], eax
lea eax, [esi + 1]
mov ebp, esi
shr ebp, 1
add ebp, esi
cmp ebp, eax
ja 0x41dbe2
mov ebp, eax
push ebp
call fcn.00408000
add esp, 4
mov edx, dword [esp]
test edx, edx
je 0x41ddb2
mov dword [esp + 0x14], ebp
cmp eax, edx
mov dword [esp + 0x18], eax
jbe 0x41dc4c
cmp edi, eax
jbe 0x41dc4c
test esi, esi
je 0x41dd9e
lea ebp, [edx + esi]
dec ebp
mov eax, dword [esp + 0x18]
lea ecx, [eax + esi]
dec ecx
mov eax, esi
and esi, 7
je 0x41dd2f
mov dword [esp + 0x1c], eax
neg esi
xor edx, edx
nop
nop
nop
movzx eax, byte [ebp + edx]
mov byte [ecx + edx], al
dec edx
cmp esi, edx
jne 0x41dc30
add ebp, edx
add ecx, edx
mov esi, dword [esp + 0x1c]
add edx, esi
jmp 0x41dd33
mov ecx, esi
shr ecx, 2
mov ebp, edx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, esi
and edx, 0xfffffffc
add eax, edx
add edx, ebp
mov ecx, esi
and ecx, 3
mov ebp, ecx
not ebp
or ebp, 1
add ebp, ecx
shr ecx, 1
mov dword [esp + 0x1c], esi
mov esi, edx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov esi, dword [esp + 0x1c]
mov dword [esp], ebp
inc ebp
je 0x41dd9e
and esi, 2
add eax, esi
add edx, esi
mov esi, ebp
and esi, 7
je 0x41dcc2
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + edi]
mov byte [eax + edi], cl
inc edi
cmp esi, edi
jne 0x41dcb0
add edx, edi
add eax, edi
sub ebp, edi
cmp dword [esp], 7
mov esi, dword [esp + 0x1c]
jb 0x41dd9e
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx + edi]
mov byte [eax + edi], cl
movzx ecx, byte [edx + edi + 1]
mov byte [eax + edi + 1], cl
movzx ecx, byte [edx + edi + 2]
mov byte [eax + edi + 2], cl
movzx ecx, byte [edx + edi + 3]
mov byte [eax + edi + 3], cl
movzx ecx, byte [edx + edi + 4]
mov byte [eax + edi + 4], cl
movzx ecx, byte [edx + edi + 5]
mov byte [eax + edi + 5], cl
movzx ecx, byte [edx + edi + 6]
mov byte [eax + edi + 6], cl
movzx ecx, byte [edx + edi + 7]
mov byte [eax + edi + 7], cl
add edi, 8
cmp ebp, edi
jne 0x41dce0
jmp 0x41dd9e
mov edx, eax
mov esi, eax
mov eax, dword [esp]
sub eax, edi
cmp eax, 0xfffffff8
ja 0x41dd9e
neg edx
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + edi]
mov byte [ecx + edi], al
movzx eax, byte [ebp + edi - 1]
mov byte [ecx + edi - 1], al
movzx eax, byte [ebp + edi - 2]
mov byte [ecx + edi - 2], al
movzx eax, byte [ebp + edi - 3]
mov byte [ecx + edi - 3], al
movzx eax, byte [ebp + edi - 4]
mov byte [ecx + edi - 4], al
movzx eax, byte [ebp + edi - 5]
mov byte [ecx + edi - 5], al
movzx eax, byte [ebp + edi - 6]
mov byte [ecx + edi - 6], al
movzx eax, byte [ebp + edi - 7]
mov byte [ecx + edi - 7], al
add edi, 0xfffffff8
cmp edx, edi
jne 0x41dd50
push dword [esp + 4]
call fcn.00408010
add esp, 4
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edi, ebx
mov dword [esp + 4], eax
lea ecx, [eax + esi]
mov dword [esp + 8], ecx
add ebp, eax
mov dword [esp + 0xc], ebp
mov byte [eax + esi], 0
mov esi, dword [esp + 4]
mov ebp, dword [esp + 8]
inc ebp
mov dword [esp + 8], ebp
mov word [esp + 0x26], 0xdad2
mov byte [esp + 0x28], 0xa1
xor ebx, ebx
xor edx, edx
mov ecx, dword [esp + 0x10]
nop
nop
nop
nop
nop
nop
mov eax, edx
xor al, 0x17
add al, bl
xor al, byte [esp + edx + 0x26]
add al, 0x48
mov byte [esp + edx + 0x26], al
lea eax, [edx + 1]
add bl, 2
mov edx, eax
cmp eax, 3
jne 0x41ddf0
xor edx, edx
nop
movsx ebx, byte [esi + edx]
movzx eax, byte [esp + edx + 0x26]
test ebx, ebx
je 0x41db60
inc edx
cmp bl, al
je 0x41de10
jmp 0x41db60
mov esi, dword [esp + 0x10]
cmp dword [esi], 0xffffffff
je 0x41de95
mov word [esi + 6], 0x3ea
mov word [esp + 0x26], 0xea03
lea eax, [esp + 0x26]
mov ecx, esi
push 0x43ebd8
push 1
push 1
push 8
push 2
push eax
call fcn.0041c8c0
cmp dword [esi], 0xffffffff
je 0x41de95
push 0x4f80c377
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
push 2
push dword [esi]
call eax
push 0xa2994af6
push dword [0x4462e0]
call fcn.0043a7f0
add esp, 8
push dword [esi]
call eax
mov dword [esi], 0xffffffff
xor edi, edi
mov eax, dword [esp + 4]
test eax, eax
je 0x41deae
cmp eax, dword [esp + 8]
je 0x41deae
push eax
call fcn.00408010
add esp, 4
mov ebx, edi
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc