Function at 0x410680
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov eax, dword [0x44d164]
mov dword [esp + 0x3c], 0x93659145
mov dword [esp + 0x40], 0xaf57ad26
mov dword [esp + 0x44], 0xab5ea95c
mov dword [esp + 0x48], 0xa791a545
mov dword [esp + 0x4c], 0xa394a16d
mov dword [esp + 0x50], 0xbf9ebd8c
mov dword [esp + 0x54], 0xbb55b980
mov dword [esp + 0x58], 0xb740b54d
mov dword [esp + 0x5c], 0xb345b14c
mov dword [esp + 0x60], 0x4fbd4dc3
mov dword [esp + 0x64], 0x4b9c4968
mov dword [esp + 0x68], 0x476645a8
mov dword [esp + 0x6c], 0x43724171
mov dword [esp + 0x70], 0x5f6e5d6a
mov dword [esp + 0x74], 0x5b7a5993
mov dword [esp + 0x78], 0x57af55bb
mov dword [esp + 0x7c], 0x539c51a6
mov dword [esp + 0x80], 0x6fa56da0
mov dword [esp + 0x84], 0x6be26948
mov dword [esp + 0x88], 0x67aa65aa
mov dword [esp + 0x8c], 0x63426159
mov dword [esp + 0x90], 0x7f8e7dbd
mov dword [esp + 0x94], 0x7b8e7988
mov dword [esp + 0x98], 0x77997589
mov dword [esp + 0x9c], 0x7390718d
mov dword [esp + 0xa0], 0xff70dd7
mov dword [esp + 0xa4], 0xb3d0984
mov dword [esp + 0xa8], 0x73505c9
mov dword [esp + 0xac], 0x33401cf
mov dword [esp + 0xb0], 0x1fd01d2f
mov dword [esp + 0xb4], 0x1b221938
mov dword [esp + 0xb8], 0x17ce15cf
mov dword [esp + 0xbc], 0x13c711fc
mov dword [esp + 0xc0], 0x2f1a2df8
mov dword [esp + 0xc4], 0x2bde2908
mov dword [esp + 0xc8], 0x27dd25dd
mov dword [esp + 0xcc], 0x230221dd
mov dword [esp + 0xd0], 0x3fc33de3
mov dword [esp + 0xd4], 0x3bc139db
mov dword [esp + 0xd8], 0x370f35c3
mov dword [esp + 0xdc], 0x33f13110
mov dword [esp + 0xe0], 0xcf3ccd34
mov dword [esp + 0xe4], 0xcb3fc93f
mov dword [esp + 0xe8], 0xc7f1c539
mov dword [esp + 0xec], 0xc3f3c1f1
mov dword [esp + 0xf0], 0xdfe8dd15
mov dword [esp + 0xf4], 0xdbecd9e8
mov dword [esp + 0xf8], 0xd7e0d5e4
mov dword [esp + 0xfc], 0xd3f2d1e0
mov dword [esp + 0x100], 0xef0fed3f
mov dword [esp + 0x104], 0xeb0be916
mov dword [esp + 0x108], 0xe71fe516
mov dword [esp + 0x10c], 0xe32fe1d7
mov dword [esp + 0x110], 0xff31fdcf
mov dword [esp + 0x114], 0xfbc9f9ce
mov dword [esp + 0x118], 0xf7f6f53a
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xe2
ja 0x410928
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x3c]
add ecx, 0x974da45c
xor ecx, edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 8]
add cl, 0x34
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x3c], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xe3
jb 0x4108f0
lea ebx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ebx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x447fbc]
xor ebx, ebx
jmp 0x410f1b
mov eax, dword [0x44d168]
mov dword [esp + 4], 0xc1c6c401
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 3
ja 0x4109bc
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov edx, dword [esp + 8]
movzx edx, byte [esp + edx + 4]
mov edi, ecx
xor edi, 0x24068951
and ecx, 0x24068951
lea ecx, [edi + ecx*2]
xor ecx, edx
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x3c]
mov edx, ecx
xor edx, 0x95
and ecx, 0x6a
add ecx, ecx
sub ecx, edx
mov edx, dword [esp + 8]
mov byte [esp + edx + 4], cl
inc dword [esp + 8]
mov ecx, dword [esp + 8]
cmp ecx, 4
jb 0x410970
movzx ecx, word [esp + 4]
push 0
push ecx
push 0x44d198
push esi
call eax
xor ecx, ecx
mov dword [esp + 0x38], eax
test eax, eax
setne cl
jmp dword [ecx*4 + 0x447fc4]
xor ebx, ebx
jmp 0x410f14
mov eax, dword [0x44d16c]
mov dword [esp + 8], 0x59da5b44
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 5
ja 0x410a75
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
mov edi, edx
or edi, 0xc525d9f0
mov ebp, edx
not ebp
or ebp, 0x3ada260f
and ebp, edi
not ebp
and edx, 0x3ada260f
lea edx, [edx*2]
add edx, ebp
lea edi, [edx + ecx]
and edx, ecx
mov ecx, edi
not ecx
and ecx, edx
add ecx, edx
not edx
and edx, edi
sub edx, ecx
mov dword [esp + 0x3c], edx
mov ecx, dword [esp + 0x3c]
add cl, 0xb5
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 6
jb 0x410a10
mov edx, dword [esp + 8]
mov dword [esp + 0x3c], 0x398b3b8c
mov dword [esp + 0x40], 0x259a2785
mov dword [esp + 0x44], 0x2324
mov dword [esp], 0
mov edi, dword [esp]
cmp edi, 0xb
ja 0x410aed
mov edi, dword [esp]
mov ebp, dword [esp]
movzx ecx, byte [esp + ebp + 0x3c]
mov ebp, edi
xor ebp, 0x891e654b
and edi, 0x91e654b
lea ebp, [ebp + edi*2]
lea edi, [ecx + ebp]
and ebp, ecx
mov ecx, edi
xor ecx, ebp
add ecx, ebp
not ebp
and ebp, edi
add ebp, ebp
sub ebp, ecx
mov dword [esp + 4], ebp
mov ecx, dword [esp + 4]
add cl, 0x89
mov edi, dword [esp]
mov byte [esp + edi + 0x3c], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xc
jb case.default.0x410b0b
push edx
push 0
push 0
push 0
push dword [esp + 0x260]
push ebx
push dword [esp + 0x50]
call eax
mov ebp, eax
xor eax, eax
test ebp, ebp
setne al
jmp dword [eax*4 + 0x447fcc]
xor ebx, ebx
jmp 0x410f0a
mov eax, dword [esp + 0x268]
xor ecx, ecx
test eax, eax
setg cl
jmp dword [ecx*4 + 0x447fd4]
movzx eax, byte [0x44d29c]
jmp dword [eax*4 + 0x447fdc]
push eax
push eax
push eax
push eax
push ebp
call dword [0x44d174]
movzx eax, byte [0x44d29c]
jmp dword [eax*4 + 0x447fdc]
xor eax, eax
mov edx, dword [esp + 0x254]
mov ecx, edx
neg ecx
sbb eax, eax
push 0
mov edi, dword [esp + 0x268]
push edi
push dword [esp + 0x264]
push dword [esp + 0x264]
push eax
push edx
push ebp
call dword [0x44d17c]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x447ff4]
xor ebx, ebx
jmp 0x410f03
jmp dword [0x447fe8]
mov dword [esp + 8], 0x81378749
mov dword [esp + 0xc], 0x8d378331
mov dword [esp + 0x10], 0x89218f27
mov dword [esp + 0x14], 0x956a8b72
mov dword [esp + 0x18], 0x91379735
mov dword [esp + 0x1c], 0x9d3c933d
mov dword [esp + 0x20], 0x99299f3d
mov dword [esp + 0x24], 0x653b9b21
mov dword [esp + 0x28], 0x61dd67c6
mov dword [esp + 0x2c], 0x6da563d0
mov word [esp + 0x30], 0x6f6c
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x2e
ja 0x410c59
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x1c00a1e1
and eax, 0x1c00a1e1
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x9b
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x2f
jb 0x410c20
movzx ecx, word [esp + 8]
lea eax, [esp + 0x3c]
test cx, cx
je 0x410c81
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x410c70
mov word [eax], 0
movzx ecx, word [0x44d29e]
test cx, cx
je 0x410cb5
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax + edx], cx
movzx ecx, word [edx + 0x44d2a0]
add edx, 2
test cx, cx
jne 0x410ca0
add eax, edx
mov word [eax], 0
mov eax, dword [0x44d178]
mov dword [esp + 8], 0x77564948
mov word [esp + 0xc], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x410d1b
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov edi, ecx
xor edi, 0x7fbfcd0e
and ecx, 0xffbfcd0e
lea ecx, [edi + ecx*2]
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xba
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x410ce0
lea ecx, [esp + 0x3c]
push dword [esp + 8]
push 0xffffffffffffffff
push ecx
push ebp
call eax
jmp case.0x410b0b.7
lea ecx, [esp + 0x3c]
push dword [esp + 8]
push 0xffffffffffffffff
push ecx
push ebp
call eax
jmp dword [0x447ff0]
mov dword [esp + 8], 0x81378749
mov dword [esp + 0xc], 0x8d378331
mov dword [esp + 0x10], 0x89218f27
mov dword [esp + 0x14], 0x956a8b72
mov dword [esp + 0x18], 0x91379735
mov dword [esp + 0x1c], 0x9d3c933d
mov dword [esp + 0x20], 0x99299f3d
mov dword [esp + 0x24], 0x653b9b21
mov dword [esp + 0x28], 0x61dd67c6
mov dword [esp + 0x2c], 0x6da563d0
mov word [esp + 0x30], 0x6f6c
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x2e
ja 0x410df9
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x1c00a1e1
and eax, 0x1c00a1e1
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x9b
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x2f
jb 0x410dc0
movzx ecx, word [esp + 8]
mov eax, ebx
test cx, cx
je 0x410e21
lea edx, [esp + 0xa]
lea eax, [esp + 0x3c]
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x410e10
mov word [eax], 0
movzx ecx, word [0x44d29e]
test cx, cx
je 0x410e55
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax + edx], cx
movzx ecx, word [edx + 0x44d2a0]
add edx, 2
test cx, cx
jne 0x410e40
add eax, edx
mov word [eax], 0
mov eax, dword [0x44d178]
mov dword [esp + 8], 0x77564948
mov word [esp + 0xc], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 5
ja 0x410d30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov edi, ecx
xor edi, 0x7fbfcd0e
and ecx, 0xffbfcd0e
lea ecx, [edi + ecx*2]
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xba
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 6
jb 0x410e90
jmp 0x410d30
mov eax, dword [esp + 0x260]
mov dword [esp + 0x3c], 0
lea ecx, [esp + 0x3c]
push ecx
push edi
push eax
push ebp
call dword [0x44d18c]
xor ecx, ecx
test eax, eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x447ffc]
jmp dword [0x448008]
push ebp
call dword [0x44d190]
push dword [esp + 0x38]
call dword [0x44d190]
push esi
call dword [0x44d190]
mov eax, ebx
add esp, 0x23c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
test eax, eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x448014]
jmp 0x410f03
mov bl, 1
jmp 0x410f03
push 0
push ebp
call dword [0x44d180]
push 0
push ebp
call dword [0x44d180]
jmp dword [0x44800c]