Function at 0x4106d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x238
mov edi, dword [esp + 0x25c]
mov dword [esp + 0x38], 0x29bb2b57
mov dword [esp + 0x3c], 0x2d412fb6
mov dword [esp + 0x40], 0x513e5340
mov dword [esp + 0x44], 0x55075737
mov dword [esp + 0x48], 0x59085b0f
mov dword [esp + 0x4c], 0x5d7e5f08
mov dword [esp + 0x50], 0x413b4374
mov dword [esp + 0x54], 0x45d4472f
mov dword [esp + 0x58], 0x49db4b20
mov dword [esp + 0x5c], 0x4ddb4fd1
mov dword [esp + 0x60], 0x7100736c
mov dword [esp + 0x64], 0x75567704
mov dword [esp + 0x68], 0x792a7b23
mov dword [esp + 0x6c], 0x7d2e7f2a
mov dword [esp + 0x70], 0x61426321
mov dword [esp + 0x74], 0x65096719
mov dword [esp + 0x78], 0x69306bf6
mov dword [esp + 0x7c], 0x6d336f3c
mov dword [esp + 0x80], 0x910a934c
mov dword [esp + 0x84], 0x95c297ca
mov dword [esp + 0x88], 0x99ba9bbb
mov dword [esp + 0x8c], 0x9d0e9fdf
mov dword [esp + 0x90], 0x81ee830c
mov dword [esp + 0x94], 0x85ff87eb
mov dword [esp + 0x98], 0x89ec8bef
mov dword [esp + 0x9c], 0x8de18fc5
mov dword [esp + 0xa0], 0xb1e3b318
mov dword [esp + 0xa4], 0xb5e3b7eb
mov dword [esp + 0xa8], 0xb9e8bbed
mov dword [esp + 0xac], 0xbde4bfed
mov dword [esp + 0xb0], 0xa18aa39c
mov dword [esp + 0xb4], 0xa5eea7ed
mov dword [esp + 0xb8], 0xa9d9abd0
mov dword [esp + 0xbc], 0xad82afe4
mov dword [esp + 0xc0], 0xd1bed38c
mov dword [esp + 0xc4], 0xd5bbd7bf
mov dword [esp + 0xc8], 0xd9fadbbf
mov dword [esp + 0xcc], 0xddb5df91
mov dword [esp + 0xd0], 0xc1afc3b9
mov dword [esp + 0xd4], 0xc5e9c751
mov dword [esp + 0xd8], 0xc98fcbe4
mov dword [esp + 0xdc], 0xcd58cfa0
mov dword [esp + 0xe0], 0xf161f35d
mov dword [esp + 0xe4], 0xf5a7f79b
mov dword [esp + 0xe8], 0xf9adfba3
mov dword [esp + 0xec], 0xfdacffa7
mov dword [esp + 0xf0], 0xe1b0e3ac
mov dword [esp + 0xf4], 0xe5b4e7b0
mov dword [esp + 0xf8], 0xe9caebb4
mov dword [esp + 0xfc], 0xed89ef9d
mov dword [esp + 0x100], 0x11751386
mov dword [esp + 0x104], 0x15791786
mov dword [esp + 0x108], 0x19411b45
mov dword [esp + 0x10c], 0x1d471f4d
mov dword [esp + 0x110], 0x157034e
mov dword [esp + 0x114], 0x506075a
mov eax, dword [0x44f304]
mov ecx, 0xb7
mov edx, 0x48
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x7f]
mov ebx, edx
xor ebx, ecx
and ebx, esi
xor ebx, ecx
add bl, 0x6d
mov byte [esp + ecx - 0x7f], bl
inc ecx
dec edx
cmp ecx, 0x197
jne case.default.0x410968
lea ecx, [esp + 0x38]
push 0
push 0
push 0
push 0
push ecx
call eax
mov esi, eax
xor eax, eax
test esi, esi
setne al
xor ebx, ebx
jmp dword [eax*4 + 0x449cac]
mov eax, dword [0x44f308]
mov dword [esp + 0x38], 0x2322206b
mov ecx, 0xa8075c48
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x57f8a3f0]
xor edx, ecx
mov ebx, edx
xor ebx, 0x69
and edx, 0x16
add edx, edx
sub edx, ebx
inc dl
mov byte [esp + ecx + 0x57f8a3f0], dl
inc ecx
cmp ecx, 0xa8075c4c
jne 0x410990
movzx ecx, word [esp + 0x38]
push 0
push ecx
push 0x44f338
push esi
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449cb4]
xor ebx, ebx
jmp dword [0x449d1c]
mov dword [esp + 4], eax
mov eax, dword [0x44f30c]
mov dword [esp], eax
mov dword [esp + 8], 0x1f9e1918
mov dword [esp + 0xc], 0
mov ecx, 0x1ca2e97a
nop
movzx eax, byte [esp + ecx - 0x1ca2e972]
mov edx, eax
and edx, ecx
add dl, dl
sub al, dl
movzx eax, al
add eax, ecx
add al, 0x9e
mov byte [esp + ecx - 0x1ca2e972], al
inc ecx
cmp ecx, 0x1ca2e982
jne 0x410a00
mov ecx, dword [esp + 8]
mov dword [esp + 0x38], 0x13451140
mov dword [esp + 0x3c], 0x6fc26d3f
mov dword [esp + 0x40], 0x6968
mov byte [esp + 0x44], 0
mov edx, 0xbc
mov ebx, 0x43
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx - 0x84]
mov ebp, edx
or ebp, eax
not eax
or eax, ebx
and eax, ebp
add al, 0x54
mov byte [esp + edx - 0x84], al
inc edx
dec ebx
cmp edx, 0xc9
jne case.default.0x410aa8
push ecx
push 0
push 0
push 0
push dword [esp + 0x25c]
lea eax, [esp + 0x4c]
push eax
mov ebp, dword [esp + 0x1c]
push ebp
call dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449cbc]
xor ebx, ebx
jmp 0x410d8c
xor ecx, ecx
mov edx, dword [esp + 0x264]
test edx, edx
setg cl
mov dword [esp], eax
jmp dword [ecx*4 + 0x449cc4]
movzx eax, byte [0x44f43c]
mov ebx, dword [esp + 0x260]
mov ebp, dword [esp + 0x250]
jmp dword [eax*4 + 0x449ccc]
push edx
push edx
push edx
push edx
push eax
call dword [0x44f314]
movzx eax, byte [0x44f43c]
mov ebx, dword [esp + 0x260]
mov ebp, dword [esp + 0x250]
jmp dword [eax*4 + 0x449ccc]
mov dword [esp + 8], 0x3fad397f
mov dword [esp + 0xc], 0x238d3daf
mov dword [esp + 0x10], 0x27832189
mov dword [esp + 0x14], 0x2b4a257a
mov dword [esp + 0x18], 0x2f8d298b
mov dword [esp + 0x1c], 0x13b82d8b
mov dword [esp + 0x20], 0x17bb11b3
mov dword [esp + 0x24], 0x1bb9158f
mov dword [esp + 0x28], 0x1f8719be
mov dword [esp + 0x2c], 0x35f1d8c
mov word [esp + 0x30], 0x100
mov dword [esp + 0x32], 0
mov word [esp + 0x36], 0
mov eax, 0x272e4f0a
mov ecx, 0x58d1b0f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax - 0x272e4f02]
lea ebp, [ecx - 0x40000000]
or ebp, ebx
lea edx, [ecx - 0x58d1b080]
and edx, ebx
xor edx, ebp
and edx, eax
mov ebp, edx
and ebp, 2
mov edi, edx
or edx, 2
imul edx, ebp
xor ebp, 2
and edi, 0x7d
imul edi, ebp
add edx, edi
mov edi, edx
xor edi, eax
and edx, ecx
add edx, edx
sub edx, edi
mov edi, ebx
not edi
and edi, edx
not edx
and edx, ebx
sub edx, edi
add edx, 0x8f0a8b8b
mov edi, edx
and edi, 0x42
mov ebx, edx
xor ebx, 0x42
lea ebx, [ebx + edi*2]
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + eax - 0x272e4f02], bl
inc eax
dec ecx
cmp eax, 0x272e4f3a
jne 0x410b90
movzx eax, word [esp + 8]
test ax, ax
lea edx, [esp + 0x38]
je 0x410c31
lea ecx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], ax
add edx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410c20
mov word [edx], 0
movzx eax, word [0x44f43e]
test ax, ax
je 0x410c65
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx + ecx], ax
movzx eax, word [ecx + 0x44f440]
add ecx, 2
test ax, ax
jne 0x410c50
add edx, ecx
mov edi, dword [esp + 0x25c]
mov ebx, dword [esp + 0x260]
mov ebp, dword [esp + 0x250]
mov word [edx], 0
mov eax, dword [0x44f318]
mov dword [esp + 8], 0x1262724
mov byte [esp + 0xc], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x39
xor dl, byte [esp + ecx + 8]
add dl, 0xe3
mov byte [esp + ecx + 8], dl
inc ecx
cmp ecx, 5
jne case.default.0x410cf3
lea ecx, [esp + 0x38]
push dword [esp + 8]
push 0xffffffffffffffff
push ecx
push dword [esp + 0xc]
call eax
xor eax, eax
mov ecx, ebp
neg ecx
sbb eax, eax
push 0
push ebx
push dword [esp + 0x260]
push dword [esp + 0x260]
push eax
push ebp
push dword [esp + 0x18]
call dword [0x44f31c]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x449cd4]
xor ebx, ebx
mov ebp, dword [esp + 4]
jmp 0x410d83
mov dword [esp + 0x38], 0
mov ebp, dword [esp + 4]
lea eax, [esp + 0x38]
push eax
push ebx
push edi
push dword [esp + 0xc]
call dword [0x44f32c]
mov ecx, dword [case.0x410aa8.14]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
xor ecx, ecx
test eax, eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x449cfc]
mov edi, dword [esp]
jmp dword [0x449d04]
push 0
push edi
call dword [0x44f320]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push edi
call dword [0x44f320]
jmp dword [0x449d10]
xor ecx, ecx
test eax, eax
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x449d14]
jmp 0x410d83
mov bl, 1
push dword [esp]
call dword [0x44f330]
push ebp
call dword [0x44f330]
jmp dword [0x449d1c]
push esi
call dword [0x44f330]
push esi
call dword [0x44f330]
jmp dword [0x449d28]
mov eax, ebx
add esp, 0x238
pop esi
pop edi
pop ebx
pop ebp
ret
int3
or eax, 0x96f0041
inc ecx
add dh, dl
or dword [ecx], eax
fimul word [ecx]
inc ecx
add byte [edi - 0x49ffbef6], ch
or al, byte [ecx]
mov dh, 0xa
inc ecx
add dh, cl
or al, byte [ecx]
mov dh, 0xa
inc ecx
add dh, cl
or al, byte [ecx]
ljmp 0x410c
or al, 0x41
add byte [0x100410d], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [edx + 0x100410d], bh
add byte [eax], al
add byte [eax], dh
or eax, 0xd300041
inc ecx
add byte [eax], dh
or eax, 0xd320041
inc ecx
add byte [edi + 0xd], bh
inc ecx
add byte [edx + 0xd], al
inc ecx
add byte [eax + 0xd], ah
inc ecx
add byte [ebx + 0xd], cl
inc ecx
add byte [eax + 0xd], ah
inc ecx
add byte [edi + 0xd], ch
inc ecx
add byte [edi + 0xd], bh
inc ecx
add byte [ecx - 0x5fffbef3], al
or eax, 0xd990041
inc ecx
add byte [eax - 0x52ffbef3], ah
or eax, 0x41
add byte [eax], al
xchg ebx, eax
cmovno eax, dword [eax]
loope 0x449d43
inc ecx
add bh, dl
and al, byte [ecx]
xlatb
and al, byte [ecx]
xlatb
and al, byte [ecx]
add dword [eax], eax
add byte [eax], al
xlatb
add byte [ecx], al
add byte [eax], al
add bh, dl
and al, byte [ecx]
lea ecx, [edi]
inc ecx
add byte [ebx], al
push cs
inc ecx
add byte [edx], al
adc al, byte [ecx]
out dx, al
adc dword [ecx], eax
lea ecx, [edi]
inc ecx
add byte [ebx - 0x63ffbeee], cl
adc al, byte [ecx]
movsd dword es:[edi], dword [esi]
adc al, byte [ecx]
adc eax, dword ds:[ecx]
xlatb
and al, byte [ecx]
jae 0x449d91
inc ecx
add byte [ebp + 0x13], cl
inc ecx
add byte [ebx - 0x43ffbeeb], dh
adc eax, 0x19e70041
inc ecx
add byte [edi + 0x1a], ah
inc ecx
add byte [eax + 0x1a], dh
inc ecx
add byte [edi - 0x62ffbee7], bh
sbb dword [ecx], eax
popfd
sbb al, byte [ecx]
rcr dword [ecx], cl
inc ecx
add byte [ebx + 0x1b], dl
inc ecx
add byte [ebp + 0x1b], ch
inc ecx
add byte [ecx], al
push ds
inc ecx
add byte [edi + 0x20], dh
inc ecx
add byte [ebp - 0x45ffbee0], al
and byte [ecx], al
mul byte [ecx]
inc ecx
add dh, dh
and dword [ecx], eax
mov byte [edx], ah
inc ecx
add byte [eax - 0x77ffbede], cl
and al, byte [ecx]
mov byte [edx], ah
inc ecx
add bh, dl
and al, byte [ecx]
xlatb
and al, byte [ecx]
xchg ebx, eax
cmovno eax, dword [eax]
add dword [eax], eax
add byte [eax], al
test byte [ebx], bl
inc ecx
add byte [ecx + 0x21], bl
inc ecx
add bl, dh
ljmp 0x48