Function at 0x413433
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x178
mov al, byte [0x42b900]
push ebx
push ebp
push esi
mov ebp, edx
mov dword [esp + 0x24], ecx
sub al, 0x46
mov dword [esp + 0xcc], ebp
push edi
mov byte [0x42b8c8], al
call fcn.00420368
mov si, word [0x42b900]
mov ebx, eax
mov eax, 0xda3f
add si, ax
mov word [0x42b900], si
test ebx, ebx
je 0x4140bd
mov dword [esp + 0x40], 0xb7cec780
xor ecx, ecx
mov dword [esp + 0x44], 0xc4c2caa7
mov dword [esp + 0x48], 0xbc9f7bc9
mov word [esp + 0x4c], 0xbccf
movzx eax, byte [esp + ecx + 0x40]
mov edx, 0xff
sub ax, 0x5b
and ax, dx
mov word [esp + ecx*2 + 0x128], ax
inc ecx
cmp ecx, 0xe
jl 0x41349c
xor eax, eax
mov word [esp + 0x144], ax
movzx eax, si
xor eax, 0xf151fad6
mov dword [0x42b924], eax
add eax, 0x59ec
mov word [0x42b900], ax
mov al, byte [0x42b8d8]
or al, 0xb8
mov byte [0x42b8c8], al
lea eax, [esp + 0x128]
push ebp
push eax
call fcn.0042318b
pop ecx
mov esi, eax
mov eax, 0x7b6f
pop ecx
mov cx, word [0x42b8d8]
and cx, ax
mov dword [esp + 0xe0], esi
mov word [0x42b900], cx
xor cl, 0xba
mov byte [0x42b8c8], cl
test esi, esi
je 0x4140bd
movzx eax, byte [0x42b8b0]
mov ecx, 0x3b55
or dword [0x42b924], 0x4bb18b70
sub ax, cx
mov word [0x42b900], ax
mov ecx, 0xe0cf
xor al, 0x34
mov byte [0x42b8c8], al
movzx eax, al
and ax, cx
mov ecx, esi
mov word [0x42b8d8], ax
call fcn.00423320
movzx edx, word [0x42b900]
mov ecx, 0x29a1
imul edx, ecx
mov ebp, eax
movzx ecx, byte [0x42b924]
imul ecx, ecx, 0xf7
mov dword [esp + 0xcc], ebp
movzx eax, dx
mov dword [esp + 0x50], eax
mov word [0x42b900], dx
mov byte [0x42b8c8], cl
test ebp, ebp
je 0x414095
mov al, byte [0x42b8d8]
xor edx, edx
mov ecx, dword [esp + 0x50]
or al, 0x7a
mov byte [0x42b8c8], al
lea eax, [ecx + 2]
mov byte [0x42b8b0], al
movzx eax, al
sub eax, 0x5931464a
mov dword [0x42b924], eax
imul eax, ecx, 0x24ff
mov ecx, ebp
mov word [0x42b8d8], ax
call fcn.00423bcd
mov dl, byte [0x42b8c8]
mov edi, eax
mov cl, dl
mov dword [esp + 0xd4], edi
and cl, 0x17
mov byte [0x42b8b0], cl
movzx ecx, dl
add ecx, 0xb302c8a3
mov dword [0x42b924], ecx
test edi, edi
je 0x414035
mov al, byte [0x42b900]
sub al, 0x66
mov byte [0x42b8b0], al
movzx eax, dl
mov edx, 0x3502
add ax, dx
mov word [0x42b900], ax
lea eax, [ecx - 0x29a1]
push 0
mov word [0x42b8d8], ax
lea eax, [esp + 0x54]
push 1
push eax
push edi
call dword [ebx + 4]
add esp, 0x10
test eax, eax
jne 0x414007
mov dword [esp + 0x8c], 0xa0a7a0ae
xor ecx, ecx
mov dword [esp + 0x90], 0xca7baf9e
mov dword [esp + 0x94], 0xc4c2c4cd
mov dword [esp + 0x98], 0xcdd0bac9
mov dword [esp + 0x9c], 0xd07b87c7
mov dword [esp + 0xa0], 0xc9cdc0ce
mov dword [esp + 0xa4], 0xbac0c8bc
mov dword [esp + 0xa8], 0xd0c7bcd1
mov dword [esp + 0xac], 0xcb7b87c0
mov dword [esp + 0xb0], 0xd2cecebc
mov dword [esp + 0xb4], 0xbabfcdca
mov dword [esp + 0xb8], 0xd0c7bcd1
mov dword [esp + 0xbc], 0xada17bc0
mov dword [esp + 0xc0], 0xc77ba8aa
mov dword [esp + 0xc4], 0xc9c4c2ca
mov byte [esp + 0xc8], 0xce
mov al, byte [esp + ecx + 0x8c]
sub al, 0x5b
mov byte [esp + ecx + 0x148], al
inc ecx
cmp ecx, 0x3d
jl 0x413703
mov ecx, 0x86f2
mov byte [esp + 0x185], 0
xor cx, word [0x42b900]
mov eax, 0xf238
movzx ecx, cx
or esi, 0xffffffff
imul ecx, eax
movzx eax, byte [0x42b8b0]
sub eax, 0x465e346f
mov dword [0x42b924], eax
lea eax, [esp + 0x14]
push 0
push eax
push esi
lea eax, [esp + 0x154]
mov word [0x42b900], cx
push eax
push dword [esp + 0x60]
and ecx, 0x3b5b
mov word [0x42b8d8], cx
call dword [ebx + 8]
add esp, 0x14
test eax, eax
jne 0x4140c8
movzx ecx, byte [0x42b8b0]
lea edi, [esp + 0x2c]
push dword [esp + 0x14]
mov eax, 0x1de3
add cx, ax
xor eax, eax
stosd dword es:[edi], eax
mov word [0x42b8d8], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov al, cl
and al, 0xa7
mov byte [0x42b8c8], al
movzx eax, cx
imul eax, eax, 0xd7723d78
mov dword [0x42b924], eax
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
jne 0x413d10
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x54], 0x57696f72
mov byte [esp + 0x58], 0x3d
mov dword [esp + 0x5c], 0x5a3cf1f4
mov dword [esp + 0x60], 0x4855594c
mov dword [esp + 0x64], 0x7214c54
mov dword [esp + 0x18], 0x69580205
mov dword [esp + 0x1c], 0x677f7b7b
mov dword [esp + 0x20], 0x28326c7a
mov dword [esp + 0x68], 0x4819e2e5
mov dword [esp + 0x6c], 0x3b414448
mov dword [esp + 0x70], 0x47414c39
mov word [esp + 0x74], 0x1246
mov byte [esp + 0x76], 0xf8
xor edx, edx
mov ecx, edx
mov al, byte [esp + ecx + 0x54]
sub al, 0x1d
mov byte [esp + ecx + 0x38], al
inc ecx
cmp ecx, 5
jl 0x413832
mov byte [esp + 0x3d], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x5c]
add al, 0x19
mov byte [esp + ecx + 0xec], al
inc ecx
cmp ecx, 0xc
jl 0x413848
mov byte [esp + 0xf8], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x18]
xor al, 8
mov byte [esp + ecx + 0x40], al
inc ecx
cmp ecx, 0xc
jl 0x413864
mov byte [esp + 0x4c], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x68]
add al, 0x28
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, 0xf
jl 0x41387a
mov byte [esp + 0x127], dl
mov ecx, edx
mov word [esp + 0x10], 0x5f
mov dword [esp + 0x78], 0xf1f1bec1
mov dword [esp + 0x7c], 0xf1f1f1f1
mov dword [esp + 0x80], 0xf1f1f1f1
mov dword [esp + 0x84], 0xf1f1f1f1
mov word [esp + 0x88], 0xc1f1
mov byte [esp + 0x8a], 0xbe
mov al, byte [esp + ecx + 0x78]
add al, 0x4c
mov byte [esp + ecx + 0xfc], al
inc ecx
cmp ecx, 0x13
jl 0x4138d5
mov eax, dword [0x42b924]
lea ecx, [esp + 0x2c]
add byte [0x42b8c8], 0x15
add eax, 0xffff8558
mov byte [esp + 0x10f], dl
lea edx, [esp + 0x38]
push esi
mov word [0x42b900], ax
call fcn.00423aea
mov al, byte [0x42b924]
pop ecx
push 0
push dword [esp + 0x18]
add al, 0x75
mov byte [0x42b8b0], al
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.00423aea
mov al, byte [0x42b900]
lea edx, [esp + 0xf0]
pop ecx
xor al, 0x4e
lea ecx, [esp + 0x2c]
push esi
mov byte [0x42b8c8], al
call fcn.00423aea
mov eax, dword [0x42b924]
pop ecx
push 1
push dword [esp + 0x18]
xor eax, 0xf449
mov word [0x42b900], ax
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.00423aea
mov al, byte [0x42b8c8]
lea edx, [esp + 0x44]
and al, 0xa1
pop ecx
mov byte [0x42b8b0], al
lea ecx, [esp + 0x2c]
xor al, 0x77
push esi
mov byte [0x42b8c8], al
call fcn.00423aea
movzx eax, word [0x42b900]
imul eax, eax, 0x2dac66d3
pop ecx
mov ecx, 0xb080
push 2
push dword [esp + 0x18]
mov dword [0x42b924], eax
mov ax, word [0x42b8d8]
and ax, cx
mov word [0x42b900], ax
call dword [ebx + 0x14]
pop ecx
pop ecx
mov cl, byte [0x42b924]
mov esi, eax
and cl, 0x32
mov byte [0x42b8b0], cl
movzx ecx, cl
mov eax, 0xcda5
or cx, ax
mov word [0x42b8d8], cx
test esi, esi
je 0x413c40
movzx eax, byte [0x42b900]
or eax, 0xc2
imul eax, eax, 0xf5194a98
push 2
push dword [esp + 0x18]
mov dword [0x42b924], eax
movzx eax, byte [0x42b900]
imul eax, eax, 5
mov byte [0x42b8b0], al
sub al, 6
mov byte [0x42b8c8], al
call dword [ebx + 0x20]
pop ecx
pop ecx
mov cl, byte [0x42b8d8]
mov edi, eax
add cl, 0x40
cmp byte [esi], 0x76
jne 0x413b66
cmp byte [esi + 1], 0x31
lea eax, [esi + 2]
jne 0x413b66
cmp byte [eax], 0x30
je 0x413a7a
cmp byte [eax], 0x31
jne 0x413b66
mov dl, byte [0x42b8b0]
add dl, 0x90
movzx ecx, cl
mov al, dl
mov byte [0x42b8b0], dl
and al, 0x21
mov byte [0x42b8c8], al
lea eax, [ecx - 0x4396]
movzx ecx, ax
movzx eax, dl
xor ecx, 0x461c1f2e
mov edx, 0xfa80
mov dword [0x42b924], ecx
and ax, dx
xor ecx, 0xd2b3
mov word [0x42b8d8], ax
mov edx, edi
lea eax, [esp + 0x28]
mov word [0x42b900], cx
push eax
mov ecx, esi
call fcn.0040fac4
pop ecx
mov cl, byte [0x42b8b0]
mov esi, eax
xor cl, 0xa6
mov edx, 0x7da2
xor word [0x42b8d8], dx
mov al, cl
or al, 2
mov byte [0x42b8c8], cl
mov byte [0x42b8b0], al
test esi, esi
je 0x413c40
push dword [esp + 0x28]
movzx eax, al
sub cl, 7
or eax, 0xef33be1c
and cl, 0x5d
mov dword [0x42b924], eax
mov edx, esi
mov byte [0x42b8c8], cl
mov eax, 0x4f06
add word [0x42b900], ax
lea ecx, [esp + 0x30]
call fcn.0042358a
mov al, byte [0x42b8d8]
xor al, 0xf3
pop ecx
mov byte [0x42b8c8], al
mov ecx, 0x7dd2
movzx eax, byte [0x42b8b0]
sub ax, cx
push esi
mov word [0x42b8d8], ax
call fcn.004056f0
jmp 0x413c3f
movzx eax, byte [0x42b8b0]
mov edx, 0x9225
or ax, dx
mov dword [esp + 0xe8], esi
xor cl, 0xd4
mov dword [esp + 0xe4], edi
mov edx, 0xc83a
movzx ecx, cl
xor ax, dx
xor ecx, 0x4d6dea65
mov word [0x42b900], ax
mov edx, 0xbedfd981
mov al, byte [0x42b924]
xor al, 0xb6
mov byte [0x42b8c8], al
lea eax, [ecx + 0x7e74]
mov word [0x42b8d8], ax
xor cl, 0xb7
movzx eax, ax
xor eax, 0xdbc0f2ef
mov byte [0x42b8b0], cl
mov dword [0x42b924], eax
lea eax, [esp + 0xd8]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0xfc]
push eax
push 3
pop ecx
call fcn.0041568d
call eax
test eax, eax
je 0x413c40
mov al, byte [0x42b900]
movzx ecx, byte [0x42b8c8]
xor al, 0xbf
push dword [esp + 0xd8]
mov edx, dword [esp + 0xe0]
mov byte [0x42b8b0], al
movzx eax, word [0x42b8d8]
xor eax, 0x3a43f932
mov dword [0x42b924], eax
mov eax, 0x6d69
imul ecx, eax
mov word [0x42b900], cx
lea ecx, [esp + 0x30]
call fcn.0042358a
pop ecx
xor dword [0x42b924], 0x8d607f2a
lea edx, [esp + 0x118]
mov eax, 0x713
lea ecx, [esp + 0x2c]
and word [0x42b8d8], ax
or esi, 0xffffffff
push esi
call fcn.00423aea
pop ecx
mov eax, 0xa11b
lea ecx, [esp + 0x2c]
add word [0x42b900], ax
mov edx, ebp
call fcn.004230c9
mov al, byte [0x42b8c8]
lea edx, [esp + 0x10]
and al, 0xdb
lea ecx, [esp + 0x2c]
push esi
mov byte [0x42b8b0], al
call fcn.00423aea
mov eax, dword [0x42b924]
mov edx, dword [esp + 0x190]
xor eax, 0xbe47
pop ecx
lea ecx, [esp + 0x2c]
mov word [0x42b8d8], ax
call fcn.004230c9
mov cl, byte [0x42b8b0]
lea edx, [esp + 0xfc]
and dword [0x42b924], 0x7f8f60b7
push esi
lea eax, [ecx + 0x18]
mov byte [0x42b8c8], al
movzx eax, cl
mov ecx, 0xd14f
or ax, cx
lea ecx, [esp + 0x30]
mov word [0x42b900], ax
call fcn.00423aea
pop ecx
push dword [esp + 0x14]
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
je 0x41382e
mov ebp, dword [esp + 0xcc]
imul ecx, dword [0x42b924], 0x5963
cmp dword [esp + 0x2c], 0
mov word [0x42b900], cx
je 0x413fdd
mov dword [esp + 0x18], 0xb9b9ab9a
xor edx, edx
mov dword [esp + 0x1c], 0xaeb8a5bd
mov dword [esp + 0x20], 0xb2bee4b9
mov byte [esp + 0x24], 0xbe
mov al, byte [esp + edx + 0x18]
xor al, 0xca
movzx eax, al
mov word [esp + edx*2 + 0xfc], ax
inc edx
cmp edx, 0xd
jl 0x413d4b
xor eax, eax
mov byte [0x42b8b0], 0
mov word [esp + 0x116], ax
sub cl, 0x12
or cl, 0xd9
mov edx, 0x655
movzx eax, cl
and eax, 0x359c1a4a
mov byte [0x42b8c8], cl
mov dword [0x42b924], eax
mov al, byte [0x42b8d8]
add al, 0x22
movzx eax, al
xor ax, dx
lea edx, [esp + 0xcc]
mov word [0x42b900], ax
movzx eax, cl
mov ecx, 0x4727
add ax, cx
mov ecx, dword [esp + 0xd0]
mov word [0x42b8d8], ax
call fcn.004140d4
mov esi, eax
test esi, esi
je 0x413f65
mov cl, byte [0x42b924]
mov eax, 0x99e4
add word [0x42b900], ax
not cl
mov edx, dword [esp + 0xcc]
mov eax, 0x25c8
mov byte [0x42b8b0], cl
movzx ecx, byte [0x42b8c8]
sub cx, ax
lea eax, [esp + 0xd0]
mov word [0x42b8d8], cx
mov ecx, esi
push eax
call fcn.0040fac4
pop ecx
mov cl, byte [0x42b8c8]
mov edi, eax
or cl, 0xfd
mov eax, 0x2521
movzx ecx, cl
or cx, ax
mov word [0x42b900], cx
test edi, edi
je 0x413f46
mov dword [esp + 0x38], 0x1a00bfc2
xor edx, edx
mov word [esp + 0x3c], 0xef2e
mov byte [esp + 0x3e], 0xd5
mov al, byte [esp + edx + 0x38]
add al, 0x4b
mov byte [esp + edx + 0xd8], al
inc edx
cmp edx, 7
jl 0x413e54
mov byte [esp + 0xdf], 0
xor edx, edx
mov word [esp + 0x10], 0x3033
mov al, byte [esp + edx + 0x10]
sub al, 0x26
mov byte [esp + edx + 0x28], al
inc edx
cmp edx, 2
jl 0x413e78
mov eax, 0x752b
mov byte [esp + 0x2a], 0
add cx, ax
mov edx, 0x67c8
mov al, byte [0x42b8d8]
xor al, 0xf9
mov word [0x42b900], cx
mov byte [0x42b8b0], al
and cl, 0xb7
movzx eax, al
add ax, dx
mov byte [0x42b8c8], cl
push 0xffffffffffffffff
lea edx, [esp + 0xdc]
mov word [0x42b8d8], ax
lea ecx, [esp + 0x30]
call fcn.00423aea
mov al, byte [0x42b8d8]
mov edx, edi
pop ecx
push dword [esp + 0xd0]
add al, 3
lea ecx, [esp + 0x30]
mov byte [0x42b8c8], al
call fcn.0042358a
mov al, byte [0x42b8c8]
lea edx, [esp + 0x2c]
add al, 0x6d
mov byte [0x42b8b0], al
movzx eax, al
pop ecx
sub eax, 0x61ffdbd5
lea ecx, [esp + 0x2c]
push 0xffffffffffffffff
mov dword [0x42b924], eax
call fcn.00423aea
mov al, byte [0x42b924]
sub al, 0x7f
pop ecx
movzx ecx, al
mov eax, 0x31d5
imul ecx, eax
push edi
mov word [0x42b8d8], cx
sub cl, 0x22
mov byte [0x42b8b0], cl
call fcn.004056f0
pop ecx
mov cl, byte [0x42b8d8]
mov al, cl
and cl, 0x8b
xor al, 0x8e
mov byte [0x42b8b0], cl
push esi
mov byte [0x42b8c8], al
call fcn.004056f0
pop ecx
movzx eax, byte [0x42b8d8]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
imul eax, eax, 0x26
mov byte [0x42b8c8], al
mov eax, dword [0x42b924]
and eax, 0x5155
mov word [0x42b900], ax
lea eax, [esp + 0xfc]
push eax
call fcn.0041e8a4
movzx eax, word [0x42b8d8]
add eax, 0x325df7db
mov dword [0x42b924], eax
movzx eax, byte [0x42b8c8]
pop ecx
push dword [esp + 0x2c]
mov ecx, 0xa319
and ax, cx
mov word [0x42b8d8], ax
mov al, byte [0x42b900]
add al, 0x13
mov byte [0x42b8c8], al
call fcn.004056f0
pop ecx
mov cx, word [0x42b900]
mov edi, dword [esp + 0xd4]
push dword [esp + 0x14]
movzx eax, cx
and eax, 0xc1d91db8
mov dword [0x42b924], eax
and al, 0x21
mov byte [0x42b8b0], al
call dword [ebx + 0x18]
mov esi, dword [esp + 0xe4]
pop ecx
mov al, byte [0x42b8b0]
push dword [esp + 0x50]
or al, 0x8d
mov byte [0x42b8c8], al
call dword [ebx + 0x1c]
movzx eax, byte [0x42b8b0]
imul eax, eax, 0x1e
pop ecx
push edi
xor al, 0x51
add al, 0xb
mov byte [0x42b8c8], al
call fcn.004056f0
pop ecx
movzx edx, word [0x42b8d8]
mov eax, 0x68eb
imul edx, eax
xor ecx, ecx
push ebp
inc ecx
mov word [0x42b8d8], dx
mov edx, 0x62d87b
call fcn.0041568d
call eax
movzx ecx, byte [0x42b8c8]
mov eax, 0x857e
imul ecx, eax
mov al, byte [0x42b900]
add al, 0x46
mov byte [0x42b8c8], al
movzx eax, byte [0x42b8b0]
and eax, 0x5b3b41c9
mov word [0x42b8d8], cx
push ebp
mov dword [0x42b924], eax
call fcn.004056f0
pop ecx
movzx eax, byte [0x42b8b0]
mov ecx, 0x2b65
or ax, cx
mov word [0x42b900], ax
mov eax, 0x13b9
add word [0x42b8d8], ax
push esi
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x178
ret
mov cx, word [0x42b900]
jmp 0x413fe4