Function at 0x41ca10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
mov ebx, dword [eax + 4]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
cmp word [ebx + edx + 2], 0
lea edx, [edx + 2]
jne 0x41ca30
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41ca50
sar edx, 1
sar eax, 1
lea ecx, [edx + eax]
mov dword [esp + 0x50], eax
add eax, edx
add eax, 0x1b
test eax, eax
mov dword [esp + 0x54], edx
mov dword [esp + 0x4c], ecx
jns 0x41ca7e
mov eax, 0xffffffff
jmp 0x41ca85
lea eax, [ecx*2 + 0x36]
push eax
call fcn.0040cf60
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x1520760
mov dword [esp + 0x10], 0xd6f0371
mov dword [esp + 0x14], 0x97a0f6f
mov dword [esp + 0x18], 0x15450b28
mov dword [esp + 0x1c], 0x116a176c
mov dword [esp + 0x20], 0x1d64137f
mov dword [esp + 0x24], 0x19751f61
mov dword [esp + 0x28], 0x256c1b69
mov dword [esp + 0x2c], 0x217b2704
mov dword [esp + 0x30], 0x2d5e234f
mov dword [esp + 0x34], 0x29452f50
mov dword [esp + 0x38], 0x35432b5e
mov dword [esp + 0x3c], 0x31523749
mov word [esp + 0x40], 0x3330
mov dword [esp + 0x42], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
movzx esi, byte [esp + ecx + 0xc]
mov ebp, eax
and ebp, 2
mov edx, ecx
xor edx, 0xd6b24081
add edx, ebp
mov ebp, edx
and ebp, esi
add edx, esi
add ebp, ebp
sub edx, ebp
add dl, 0x7b
mov byte [esp + ecx + 0xc], dl
inc ecx
add eax, 2
cmp ecx, 0x3a
jne 0x41cb10
movzx ecx, word [ebx]
mov edx, dword [esp + 4]
mov eax, edx
test cx, cx
je 0x41cb71
add ebx, 2
mov eax, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41cb60
mov word [eax], 0
movzx ecx, word [esp + 0xc]
test cx, cx
je 0x41cba1
lea edx, [esp + 0xe]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cb90
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x41cbd1
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x41cbc0
mov word [eax], 0
mov eax, dword [esp + 0x74]
mov esi, dword [eax]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41cbf0
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + 8]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edx + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x41cc10
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x78]
mov edi, dword [edx]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [edi + edx + 2], 0
lea edx, [edx + 2]
jne 0x41cc30
sar eax, 1
sar ecx, 1
sar edx, 1
add ecx, eax
lea eax, [edx + ecx]
add eax, 0x13
test eax, eax
jns 0x41cc54
mov eax, 0xffffffff
jmp 0x41cc5d
add ecx, edx
lea eax, [ecx*2 + 0x26]
mov dword [esp + 0x48], edi
push eax
call fcn.0040cf60
add esp, 4
movzx ecx, word [esi]
mov edx, eax
test cx, cx
je 0x41cc91
add esi, 2
mov edx, eax
nop
nop
nop
nop
nop
nop
nop
mov word [edx], cx
add edx, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x41cc80
mov dword [esp], eax
mov dword [esp + 8], edx
mov word [edx], 0x2f
mov dword [esp + 0xc], 0x2367217f
mov dword [esp + 0x10], 0x27b225ac
mov dword [esp + 0x14], 0x5bc4593d
mov dword [esp + 0x18], 0x5fc75dcf
mov dword [esp + 0x1c], 0x53cc51cf
mov dword [esp + 0x20], 0x570955c7
mov word [esp + 0x24], 0x4948
mov dword [esp + 0x26], 0
mov word [esp + 0x2a], 0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0xc]
mov ebx, ecx
xor ebx, 0xd10c75c8
mov edx, eax
and edx, 0x2e
sub edx, ebx
mov ebx, edx
and ebx, esi
mov edi, ebx
and edi, 0x7d
mov ebp, ebx
or ebp, 0xfffffffd
inc ebp
imul ebp, edi
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
sub ebp, ebx
add edx, esi
add edx, ebp
mov esi, edx
and esi, 0xe5
mov edi, edx
and edi, 2
mov ebx, edi
xor ebx, 2
imul ebx, esi
or esi, 2
imul esi, edi
xor edx, 0xe7
add edx, ebx
add edx, esi
inc dl
mov byte [esp + ecx + 0xc], dl
inc ecx
add eax, 2
cmp ecx, 0x20
jne 0x41ccf0
mov ebp, dword [esp + 8]
add ebp, 2
mov ecx, dword [esp + 0x58]
movzx eax, word [ecx]
test ax, ax
je 0x41cd94
add ecx, 2
mov edx, dword [esp + 0x48]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebp], ax
add ebp, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cd80
jmp 0x41cd98
mov edx, dword [esp + 0x48]
mov word [ebp], 0
movzx eax, word [esp + 0xc]
test ax, ax
je 0x41cdc4
lea ecx, [esp + 0xe]
mov edi, dword [esp]
nop
mov word [ebp], ax
add ebp, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cdb0
jmp 0x41cdc7
mov edi, dword [esp]
mov word [ebp], 0
movzx eax, word [edx]
test ax, ax
je 0x41cdf2
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebp], ax
add ebp, 2
movzx eax, word [edx]
add edx, 2
test ax, ax
jne 0x41cde0
mov word [ebp], 0
mov dword [esp + 0xc], 0x4f4e4996
mov word [esp + 0x10], 0
mov eax, 0x93
mov ecx, 0x6d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x87]
mov esi, edx
not esi
or esi, ecx
add esi, eax
and edx, ecx
or edx, esi
add dl, 0x26
mov byte [esp + eax - 0x87], dl
inc eax
dec ecx
cmp eax, 0x99
jne 0x41ce20
lea eax, [esp + 0xc]
push 0
push 0
push 0xc00000
push eax
mov esi, dword [esp + 0x14]
push esi
push edi
push dword [esp + 0x88]
call fcn.004200d0
add esp, 0x1c
mov ebx, eax
jmp dword [0x446ab8]