Function at 0x421e80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa00
mov dword [esp + 0x58], 0xd9e9dbf7
mov dword [esp + 0x5c], 0xddaadf53
mov dword [esp + 0x60], 0xd1aed3a3
mov dword [esp + 0x64], 0xd5a2d7af
mov dword [esp + 0x68], 0xe9d9eb5b
mov dword [esp + 0x6c], 0xed65ef9d
mov dword [esp + 0x70], 0xe1d1e38a
mov dword [esp + 0x74], 0xe569e794
mov dword [esp + 0x78], 0xf981fb94
mov dword [esp + 0x7c], 0xfd8cffbb
mov dword [esp + 0x80], 0xf186f387
mov dword [esp + 0x84], 0xf587f779
mov dword [esp + 0x88], 0x9770b82
mov dword [esp + 0x8c], 0xd7d0f3a
mov dword [esp + 0x90], 0x17c037d
mov dword [esp + 0x94], 0x5750771
mov dword [esp + 0x98], 0x19481b36
mov dword [esp + 0x9c], 0x1d6a1f63
mov dword [esp + 0xa0], 0x11631395
mov dword [esp + 0xa4], 0x156b1766
mov dword [esp + 0xa8], 0x29512b41
mov dword [esp + 0xac], 0x2da42f5e
mov dword [esp + 0xb0], 0x21472353
mov dword [esp + 0xb4], 0x2526275b
mov byte [esp + 0xb8], 0
lea eax, [esp + 0xb8]
mov dword [esp + 8], eax
mov ecx, 0x4f
mov ebx, 0xfde0ec30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebx + 0x21f1400]
mov edi, eax
and edi, 0xb3
mov esi, ecx
and esi, 0x4c
or esi, edi
movzx edi, byte [esp + ecx + 9]
xor esi, 0x4c
or esi, eax
mov edx, ebx
or edx, edi
and esi, edi
lea eax, [edx + edx]
not eax
add eax, edx
or eax, esi
mov edx, eax
and edx, 1
or eax, 1
add eax, edx
add al, 0xf4
mov byte [esp + ecx + 9], al
inc ecx
dec ebx
cmp ecx, 0xb0
jne 0x421fa0
lea edi, [esp + 0x498]
lea eax, [esp + 0x58]
mov ecx, 0x18
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x4f8]
xor ecx, ecx
mov eax, dword [esp + 8]
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x58], 0x54554a4b
mov eax, 0xe63abe6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x19c541ea]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0xda47d9
xor ecx, 0x80da47d9
lea esi, [ecx + edx*2]
mov edi, 0x37
sub edi, esi
lea ecx, [ecx + edx*2]
add ecx, 8
and edi, 0xc7
and ecx, 0x38
sub ecx, edi
mov byte [esp + eax + 0x19c541ea], cl
inc eax
cmp eax, 0xe63abe72
jne 0x422030
mov eax, dword [esp + 0x58]
mov ecx, dword [0x44e804]
test ecx, ecx
mov ebx, dword [ebp + 0x14]
je 0x4220d4
xor edx, edx
mov esi, dword [0x44e808]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x4220b0
inc edx
cmp ecx, edx
jne 0x4220a0
jmp 0x4220d4
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4220d4
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 5
push 4
push ecx
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x1c
mov dword [esp + 0x58], 0x1c6c7c8
mov word [esp + 0x5c], 0
mov byte [esp + 0x5e], 0
mov esi, 0xd1
mov edx, 0x2e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, edx
and edi, 0x2c
mov ecx, esi
and ecx, 0x93
or ecx, edi
xor cl, byte [esp + esi - 0x79]
xor cl, 0x6c
add cl, 0xeb
mov byte [esp + esi - 0x79], cl
inc esi
dec edx
cmp esi, 0xd8
jne 0x422100
cmp eax, dword [esp + 0x58]
jne 0x4221d0
push dword [esp + 0x24]
call fcn.0043ba50
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x58], 0x54554a4b
mov eax, 0xe63abe6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x19c541ea]
mov esi, eax
and esi, edx
add esi, esi
sub edx, esi
add edx, eax
mov esi, edx
and esi, 0xda47d9
xor edx, 0x80da47d9
lea edi, [edx + esi*2]
mov ebx, 0x37
sub ebx, edi
lea edx, [edx + esi*2]
add edx, 8
and ebx, 0xc7
and edx, 0x38
sub edx, ebx
mov byte [esp + eax + 0x19c541ea], dl
inc eax
cmp eax, 0xe63abe72
jne 0x422160
mov eax, dword [esp + 0x58]
mov edx, dword [0x44e804]
test edx, edx
je 0x4221fd
xor esi, esi
mov edi, dword [0x44e808]
cmp dword [edi + esi*8], 0x9abdb589
je 0x4221db
inc esi
cmp edx, esi
jne 0x4221c0
jmp 0x4221fd
xor ecx, ecx
xor edx, edx
xor esi, esi
jmp 0x4227ca
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x4221fd
push 0
push ecx
push dword [esp + 0x20]
push 5
push 4
push edx
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x1c
test eax, eax
mov ebx, dword [ebp + 0x14]
js 0x42279a
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
jmp 0x422241
mov ecx, ebx
call fcn.0043bf20
mov eax, dword [esi]
test eax, eax
je 0x4227b2
mov ecx, dword [esi + eax + 0x3c]
add esi, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx + eax]
mov edi, dword [ebp + 8]
movzx edi, word [edi + eax]
test dx, dx
je 0x422268
add eax, 2
cmp dx, di
je 0x422250
cmp dx, di
jne 0x422237
mov eax, dword [esi + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xc], eax
mov ecx, ebx
push 0x410
call fcn.0043bdc0
test eax, eax
js 0x422237
mov dword [esp + 0x20], 0
mov ebx, dword [ebx]
mov dword [esp + 0x58], 0x54554a4b
mov eax, 0xe63abe6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x19c541ea]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0xda47d9
xor ecx, 0x80da47d9
lea edi, [ecx + edx*2]
lea ecx, [ecx + edx*2]
add ecx, 8
mov edx, 0x37
sub edx, edi
and edx, 0xc7
and ecx, 0x38
sub ecx, edx
mov byte [esp + eax + 0x19c541ea], cl
inc eax
cmp eax, 0xe63abe72
jne 0x4222b0
mov eax, dword [esp + 0x58]
mov edx, dword [0x44e804]
test edx, edx
je 0x422350
xor edi, edi
mov ecx, dword [0x44e808]
cmp dword [ecx + edi*8], 0xae6e2b0b
je 0x422320
inc edi
cmp edx, edi
jne 0x422310
jmp 0x422350
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x422350
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x2b
push ebx
push 5
push ecx
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x58], 0x43020104
mov dword [esp + 0x5c], 0
mov edi, 0x3f6909bf
mov edx, 0x3f690940
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + edx - 0x3f6908e8]
mov ecx, edi
xor ecx, edx
and ecx, ebx
xor ecx, edx
mov ebx, ecx
xor ebx, 0x3d0d2e41
and ecx, 0x26001be
add ecx, ecx
sub ecx, ebx
mov ebx, ecx
xor ebx, 0xb9
and ecx, 0x46
add ecx, ecx
sub ecx, ebx
add cl, 0xba
mov byte [esp + edx - 0x3f6908e8], cl
dec edi
inc edx
cmp edi, 0x3f6909b7
jne 0x422370
cmp eax, dword [esp + 0x58]
jne 0x422470
mov eax, dword [esp + 0x20]
add eax, 2
push eax
call fcn.0043ba50
add esp, 4
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
mov dword [esp], eax
mov dword [esp + 0x58], 0x54554a4b
mov eax, 0xe63abe6e
movzx ecx, byte [esp + eax + 0x19c541ea]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0xda47d9
xor ecx, 0x80da47d9
lea edi, [ecx + edx*2]
lea ecx, [ecx + edx*2]
add ecx, 8
mov edx, 0x37
sub edx, edi
and edx, 0xc7
and ecx, 0x38
sub ecx, edx
mov byte [esp + eax + 0x19c541ea], cl
inc eax
cmp eax, 0xe63abe72
jne 0x4223f0
mov eax, dword [esp + 0x58]
mov edi, dword [0x44e804]
test edi, edi
je 0x4224a1
add dword [esp + 4], 2
xor ecx, ecx
mov edx, dword [0x44e808]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xae6e2b0b
je 0x422478
inc ecx
cmp edi, ecx
jne 0x422460
jmp 0x4224a1
mov ebx, dword [ebp + 0x14]
jmp 0x42277f
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, eax
je 0x4224a1
push 0
push dword [esp + 8]
push dword [esp + 0x24]
push 0x2b
push dword [esp + 0x10]
push 5
push ecx
push dword [0x44e80c]
call fcn.0043eb30
add esp, 0x20
test eax, eax
js 0x422773
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
not eax
mov edx, 0xffffffff
nop
nop
nop
nop
inc eax
je 0x4224dc
mov edi, dword [ebp + 0xc]
movzx edi, word [edi + edx*2 + 2]
cmp di, word [ecx + edx*2 + 2]
jne 0x422773
inc edx
test di, di
jne 0x4224c0
mov ecx, ebx
call fcn.0043c460
cmp eax, 2
jne 0x422773
mov ecx, ebx
push 0
push 0x30
lea eax, [esp + 0x30]
push eax
push 0
call fcn.0043c2a0
test eax, eax
js 0x422773
mov ecx, ebx
push 0
push 0
push 0x28
lea eax, [esp + 0x67c]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.0043c800
test eax, eax
js 0x422773
mov ecx, ebx
push 0
push 0
push 0x80
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0043c800
test eax, eax
js 0x422773
movzx eax, word [esp + 0xca]
push eax
call fcn.0043ba50
add esp, 4
mov edi, eax
movzx eax, word [esp + 0xca]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0xe4]
push dword [esp + 0xe4]
call fcn.0043c800
test eax, eax
js 0x42276a
mov eax, edi
movzx edi, word [esp + 0x498]
mov dword [esp + 0xc], eax
mov dword [esp], eax
test di, di
je 0x4225fd
lea edx, [esp + 0x498]
mov eax, dword [esp + 0xc]
mov ecx, eax
mov dword [esp], eax
jmp 0x4225c8
movzx edi, word [edx]
test di, di
je 0x4225fd
movzx eax, word [ecx]
test ax, ax
je 0x422766
add ecx, 2
add edx, 2
mov dword [esp + 4], edx
mov edx, dword [esp]
add edx, 2
cmp ax, di
je 0x4225ee
mov dword [esp], edx
mov ecx, edx
mov edx, dword [esp + 4]
je 0x4225c0
lea edx, [esp + 0x498]
jmp 0x4225c0
cmp dword [esp], 0
je 0x422766
mov ecx, ebx
push 0
push 0
push 0x20
lea eax, [esp + 0x624]
push eax
push dword [esp + 0x69c]
push dword [esp + 0x69c]
call fcn.0043c800
test eax, eax
js 0x422766
mov eax, dword [esp + 0x688]
mov ecx, dword [esp + 0x68c]
add eax, 0x10
mov dword [esp + 4], eax
adc ecx, 0
mov dword [esp], ecx
mov eax, dword [esp + 0x628]
mov edx, dword [esp + 0x62c]
mov dword [esp + 0x4fc], edx
mov dword [esp + 0x4f8], eax
jmp 0x42269e
cmp cx, dx
je 0x42273c
push edi
call fcn.0043bac0
add esp, 4
mov eax, dword [esp + 0x4f8]
mov edx, dword [esp + 0x4fc]
mov ecx, edx
xor ecx, dword [esp]
mov edi, eax
xor edi, dword [esp + 4]
or edi, ecx
je 0x422766
mov ecx, ebx
push 0
push 0
push 0x68
lea edi, [esp + 0x504]
push edi
push edx
push eax
call fcn.0043c800
test eax, eax
js 0x422766
movzx eax, word [esp + 0x552]
push eax
call fcn.0043ba50
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x552]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0x56c]
push dword [esp + 0x56c]
call fcn.0043c800
test eax, eax
js 0x422674
xor eax, eax
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x422713
or ecx, 0x20
movzx edx, word [edi + eax]
lea ebx, [edx - 0x41]
cmp bx, 0x1a
jae 0x422723
or edx, 0x20
mov ebx, dword [ebp + 0x14]
test cx, cx
je 0x42266b
add eax, 2
cmp cx, dx
je 0x422700
jmp 0x42266b
mov eax, dword [esp + 0x528]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x52c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x538]
mov dword [esp + 0x10], eax
push edi
call fcn.0043bac0
add esp, 4
mov edi, dword [esp + 0xc]
push edi
call fcn.0043bac0
add esp, 4
push dword [esp + 0x1c]
call fcn.0043bac0
add esp, 4
mov eax, dword [esp + 8]
or eax, dword [esp + 0x14]
je 0x422230
cmp dword [esp + 0x10], 0
je 0x422230
jmp 0x4227b2
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
push dword [esp + 0x18]
call fcn.0043bac0
add esp, 4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
mov esi, dword [esp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, ebx
call fcn.0043bf10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret