Function at 0x42c260
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc4
mov dword [esp + 0x24], 0x99559bb7
mov dword [esp + 0x28], 0xa556a768
mov dword [esp + 0x2c], 0xa14da368
mov dword [esp + 0x30], 0xad41af5c
mov dword [esp + 0x34], 0xa94eab87
mov dword [esp + 0x38], 0xb547b77a
mov dword [esp + 0x3c], 0xb159b348
mov dword [esp + 0x40], 0xbd51bf40
mov dword [esp + 0x44], 0xb98fbb50
mov dword [esp + 0x48], 0x45a2478d
mov dword [esp + 0x4c], 0x41a943b9
mov dword [esp + 0x50], 0x4db34fbd
mov dword [esp + 0x54], 0x49bb4bbb
mov dword [esp + 0x58], 0x556457ba
mov dword [esp + 0x5c], 0x51a153ac
mov dword [esp + 0x60], 0x5d5e5fa4
lea eax, [esp + 0x64]
mov word [esp + 0x64], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xdb
xor dl, byte [esp + ecx + 0x24]
add dl, 0xb9
mov byte [esp + ecx + 0x24], dl
inc ecx
cmp ecx, 0x42
jne 0x42c300
lea ebp, [esp + 0x84]
lea edx, [esp + 0x24]
mov edi, ebp
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xc4]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x7c]
push esi
push 0
push 0
push 0x1f
push ebp
push 0
call dword [0x44cfec]
mov dword [esp + 0x24], 0x1c6c7e9
mov dword [esp + 0x28], 0
mov ecx, 0xd1
mov edx, 0x2e
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0xad]
mov edi, ecx
or edi, ebx
not ebx
or ebx, edx
and ebx, edi
add bl, 0xeb
mov byte [esp + ecx - 0xad], bl
inc ecx
dec edx
cmp ecx, 0xd9
jne case.default.0x42c3a1
xor ecx, ecx
cmp eax, dword [esp + 0x24]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448330]
jmp dword [0x44833c]
mov edi, dword [esp + 0x7c]
test edi, edi
jns 0x42c3bd
mov eax, 0xffffffff
jmp 0x42c3c0
lea eax, [edi + edi]
push eax
call fcn.00408c10
add esp, 4
push esi
push edi
push eax
push 0x1f
push ebp
push 0
call dword [0x44cfec]
jmp case.0x42c3a1.2
mov eax, 0xffffffff
push eax
call fcn.00408c10
add esp, 4
mov edi, eax
push esi
push ebx
push eax
push 0x1f
push ebp
push 0
call dword [0x44cfec]
jmp dword [0x448344]
mov ebx, dword [esp + 0x7c]
test ebx, ebx
js 0x42c3e0
lea eax, [ebx + ebx]
jmp 0x42c3e5
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448348]
jmp dword [0x448350]
push edi
call fcn.00408c20
add esp, 4
nop
nop
nop
nop
xor eax, eax
jmp dword [0x448360]
lea eax, [esp + 0x20]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.004405b0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448368]
xor eax, eax
xor ebx, ebx
jmp dword [0x448440]
push edi
call fcn.00408c20
add esp, 4
mov eax, ebx
mov ecx, dword [case.0x42c3a1.72]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
add esp, 0xc4
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0x78]
push 0
push eax
push dword [esp + 0x28]
call fcn.00440910
add esp, 0xc
not eax
shr eax, 0x1f
xor ebx, ebx
xor ebp, ebp
jmp dword [eax*4 + 0x448370]
mov esi, dword [esp + 0x78]
lea eax, [esi + 1]
push eax
call fcn.00408c10
add esp, 4
push 0
push esi
mov dword [esp + 0x78], eax
push eax
push dword [esp + 0x2c]
call fcn.004409f0
add esp, 0x10
not eax
shr eax, 0x1f
xor ebp, ebp
jmp dword [eax*4 + 0x448378]
jmp dword [0x448438]
push dword [esp + 0x70]
call fcn.00408c20
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], 0x70605
mov ecx, ebx
add cl, 0x81
xor cl, byte [esp + ebx + 0x24]
add cl, 0x7b
mov byte [esp + ebx + 0x24], cl
inc ebx
cmp ebx, 4
jne 0x42c500
mov ecx, dword [0x44cff0]
test ecx, ecx
je 0x42c54c
mov edx, dword [esp + 0x24]
xor esi, esi
mov ebx, dword [0x44cff4]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1b6183f2
je 0x42c540
inc esi
cmp ecx, esi
jne 0x42c530
jmp 0x42c54c
mov ecx, dword [ebx + esi*8 + 4]
cmp ecx, edx
jne 0x42cad8
mov eax, ebp
and al, 1
mov ebx, eax
jmp dword [0x448440]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x70]
mov byte [ecx + eax], 0
mov dword [esp + 0x1c], 0
mov dword [esp], ecx
nop
mov dword [esp + 0x24], 0x4a424042
mov dword [esp + 0x28], 0x4e475446
mov word [esp + 0x2c], 0xf75
mov byte [esp + 0x2e], 0x4e
lea eax, [esp + 0x2f]
mov byte [eax + 4], 0
mov dword [eax], 0
mov eax, 0xffffffff
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
or edx, 0x5cfe4836
add edx, ecx
inc edx
mov esi, edx
and esi, 2
mov ebp, edx
or edx, 2
imul edx, esi
xor esi, 2
and ebp, 0xfffffffd
imul ebp, esi
mov esi, ecx
xor esi, 0x5cfe4836
add esi, edx
movzx edx, byte [esp + ecx + 0x24]
add esi, ebp
mov ebp, esi
xor ebp, 0x9c590e03
xor esi, edx
xor edx, 3
not esi
and esi, ebp
add edx, ebp
add esi, esi
sub edx, esi
add dl, 0xf2
mov byte [esp + ecx + 0x24], dl
inc ecx
dec eax
cmp ecx, 0x10
jne 0x42c5b0
movzx edx, byte [esp + 0x24]
test dl, dl
je 0x42c650
lea eax, [esp + 0x24]
mov esi, dword [esp]
mov ecx, esi
jmp 0x42c629
movzx edx, byte [eax]
test dl, dl
mov esi, ebp
je 0x42c662
mov dh, byte [ecx]
test dh, dh
je 0x42c660
inc ecx
inc eax
mov ebp, esi
inc esi
cmp dh, dl
je 0x42c63c
mov ebp, esi
mov ecx, esi
je 0x42c620
lea eax, [esp + 0x24]
jmp 0x42c620
mov esi, dword [esp]
jmp 0x42c662
xor esi, esi
xor eax, eax
test esi, esi
sete al
mov ebp, dword [esp + 0x1c]
jmp dword [eax*4 + 0x448380]
movzx eax, byte [esi + 0xa]
add esi, 0xa
xor edx, edx
test al, al
je 0x42c6a2
mov ecx, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp al, 0x22
je 0x42c6a0
movzx eax, byte [ecx + 1]
inc ecx
test al, al
jne 0x42c690
jmp 0x42c6a2
mov edx, ecx
mov ebp, edx
not ebp
and ebp, esi
mov dword [esp], esi
not esi
and esi, edx
mov ecx, esi
sub ecx, ebp
xor eax, eax
cmp ecx, 5
setb al
jmp dword [eax*4 + 0x448388]
xor eax, eax
cmp byte [edx - 1], 0x74
setne al
jmp dword [eax*4 + 0x448390]
jmp dword [0x4483a0]
xor eax, eax
cmp byte [edx - 2], 0x78
setne al
jmp dword [eax*4 + 0x4483a8]
xor eax, eax
cmp byte [edx - 3], 0x74
setne al
jmp dword [eax*4 + 0x4483b0]
xor eax, eax
cmp byte [edx - 4], 0x2e
setne al
jmp dword [eax*4 + 0x4483b8]
mov dword [esp + 0x6c], ebp
mov dword [esp + 0xc], edx
jmp dword [0x4483c4]
mov ecx, ebp
sub ecx, dword [esp + 8]
sar ecx, 1
inc ecx
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 4]
mov eax, ebp
sub eax, ecx
jmp 0x42c749
mov dword [esp + 0x10], 0
xor eax, eax
mov ebp, dword [esp + 4]
add eax, 0x1b
push eax
call fcn.00408c10
add esp, 4
sub ebp, dword [esp + 0x10]
mov dword [esp + 4], ebp
mov dword [esp + 0x24], 0x1016103f
mov dword [esp + 0x28], 0xb01ef12
mov dword [esp + 0x2c], 0x2205ff0
mov dword [esp + 0x30], 0x44f7040c
mov dword [esp + 0x34], 0xefa0622
mov dword [esp + 0x38], 0xb80e1000
mov dword [esp + 0x3c], 0x8ebeb9
xor edx, edx
mov ecx, edx
add cl, 0xe9
xor cl, byte [esp + edx + 0x24]
add cl, 0x73
mov byte [esp + edx + 0x24], cl
inc edx
cmp edx, 0x1c
jne 0x42c797
movzx ecx, byte [esp + 0x24]
mov dword [esp + 0x68], eax
test cl, cl
mov ebp, dword [esp + 0x6c]
je 0x42c7d1
lea edx, [esp + 0x25]
mov eax, dword [esp + 0x68]
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x42c7c6
mov byte [eax], 0
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x42c81a
mov edx, dword [esp + 0x10]
add dword [esp], edx
and ecx, 3
je 0x42c81e
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov ebp, dword [esp]
movzx edx, byte [ebp]
cmp dl, 1
sbb ebp, 0xffffffff
mov byte [eax + ecx], dl
inc ecx
cmp dword [esp + 0x18], ecx
jne 0x42c7f1
mov dword [esp], ebp
add eax, ecx
sub dword [esp + 4], ecx
mov ecx, eax
mov ebp, dword [esp + 0x6c]
mov edx, dword [esp + 0x10]
jmp 0x42c81e
mov ecx, eax
jmp 0x42c867
sub edx, esi
add edx, ebp
cmp edx, 0xfffffffc
mov esi, dword [esp]
mov ebp, dword [esp + 4]
ja 0x42c867
movzx ecx, byte [esi]
cmp cl, 1
sbb esi, 0xffffffff
mov byte [eax], cl
movzx ecx, byte [esi]
cmp cl, 1
sbb esi, 0xffffffff
mov byte [eax + 1], cl
movzx ecx, byte [esi]
cmp cl, 1
sbb esi, 0xffffffff
mov byte [eax + 2], cl
movzx edx, byte [esi]
cmp dl, 1
sbb esi, 0xffffffff
lea ecx, [eax + 4]
mov byte [eax + 3], dl
mov eax, ecx
add ebp, 0xfffffffc
jne 0x42c82e
mov byte [ecx], 0
mov ecx, dword [esp + 0xd8]
push dword [esp + 0x74]
mov ebp, dword [esp + 0x84]
push ebp
mov esi, dword [esp + 0x70]
push esi
call fcn.00409a60
mov ecx, dword [esp + 0x1c]
and cl, 1
or cl, al
mov dword [esp + 0x1c], ecx
jmp dword [0x4483f0]
push esi
call fcn.00408c20
add esp, 4
mov eax, dword [case.0x42c6bb.22]
jmp eax
jmp dword [0x448418]
jmp dword [0x448420]
push ebp
call fcn.00408c10
add esp, 4
push 0
push ebp
mov ebp, eax
push eax
push dword [esp + 0x20]
call fcn.004409f0
add esp, 0x10
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4483e0]
mov eax, dword [case.0x42c6bb.34]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov dword [esp + 0x80], ebp
xor ecx, ecx
mov eax, dword [esp + 8]
jmp 0x42c909
add eax, 2
test dx, dx
je 0x42c91a
mov ebp, ecx
movzx edx, word [eax]
mov ecx, eax
cmp dx, 0x5c
je 0x42c901
mov ecx, ebp
jmp 0x42c901
xor eax, eax
test ebp, ebp
setne al
jmp dword [eax*4 + 0x4483e8]
push 0
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x1c]
call fcn.00440910
add esp, 0xc
test eax, eax
setns al
mov ebp, dword [esp + 0x74]
cmp ebp, 0x100000
setb cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x4483d8]
push eax
call fcn.00408c20
add esp, 4
mov dword [esp], esi
jmp case.0x42c6bb.1
mov esi, dword [esp + 0xc]
mov dword [esp], esi
mov eax, dword [esp + 8]
jmp dword [0x448430]
push ebp
call fcn.00408c20
add esp, 4
push ebp
call fcn.00408c20
add esp, 4
jmp dword [0x448428]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], 0x70605
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x81
xor dl, byte [esp + ecx + 0x24]
add dl, 0x7b
mov byte [esp + ecx + 0x24], dl
inc ecx
cmp ecx, 4
jne 0x42c9b0
mov ecx, dword [0x44cff0]
test ecx, ecx
je 0x42c9f5
mov edx, dword [esp + 0x24]
xor esi, esi
mov ebp, dword [0x44cff4]
cmp dword [ebp + esi*8], 0x1b6183f2
je 0x42c9ed
inc esi
cmp ecx, esi
jne 0x42c9dc
jmp 0x42c9f5
mov ecx, dword [ebp + esi*8 + 4]
cmp ecx, edx
jne 0x42ca06
mov esi, dword [esp + 0xc]
mov dword [esp], esi
mov eax, dword [esp + 8]
jmp dword [0x448430]
push eax
push 4
push ecx
push dword [0x44cff8]
call fcn.0043def0
add esp, 0x10
mov esi, dword [esp + 0xc]
mov dword [esp], esi
mov eax, dword [esp + 8]
jmp dword [0x448430]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4483d0]
mov dword [esp + 4], ecx
mov ebp, ecx
and ebp, 1
lea eax, [ebp*2]
push eax
call fcn.00408c10
add esp, 4
push dword [esp + 0xc]
push dword [esp + 4]
push ebp
push eax
mov ebp, eax
call fcn.0040b3e0
add esp, 0x10
push 0x60
push 3
push 0x120089
lea eax, [esp + 0x20]
push eax
push ebp
call fcn.004405b0
mov ecx, dword [esp + 0x18]
add esp, 0x14
mov edx, ecx
inc edx
lea eax, [ecx + ecx + 2]
jns 0x42ca8b
mov eax, 0xffffffff
push eax
mov dword [esp + 8], ecx
mov dword [esp + 0x1c], edx
call fcn.00408c10
add esp, 4
mov ebp, eax
push dword [esp + 0xc]
push dword [esp + 4]
push dword [esp + 0x20]
push eax
call fcn.0040b3e0
add esp, 0x10
push 0x60
push 3
push 0x120089
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x18], ebp
push ebp
call fcn.004405b0
mov ecx, dword [esp + 0x18]
add esp, 0x14
jmp dword [0x4483cc]
push eax
push 4
push ecx
push dword [0x44cff8]
call fcn.0043def0
add esp, 0x10
mov eax, ebp
and al, 1
mov ebx, eax
jmp dword [0x448440]