Function at 0x4223a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa00
mov dword [esp + 0x58], 0xc191c793
mov dword [esp + 0x5c], 0xcd5ec35f
mov dword [esp + 0x60], 0xc95acfa7
mov dword [esp + 0x64], 0xf556cba3
mov dword [esp + 0x68], 0xf1a1f76f
mov dword [esp + 0x6c], 0xfd6df36d
mov dword [esp + 0x70], 0xf9a9ff9e
mov dword [esp + 0x74], 0xe561fb64
mov dword [esp + 0x78], 0xe189e774
mov dword [esp + 0x7c], 0xed74e3a7
mov dword [esp + 0x80], 0xe972ef83
mov dword [esp + 0x84], 0x157beb71
mov dword [esp + 0x88], 0x11831786
mov dword [esp + 0x8c], 0x1d851346
mov dword [esp + 0x90], 0x19741f8d
mov dword [esp + 0x94], 0x58d1b89
mov dword [esp + 0x98], 0x1700752
mov dword [esp + 0x9c], 0xd9e036f
mov dword [esp + 0xa0], 0x99f0f95
mov dword [esp + 0xa4], 0x359f0b9a
mov dword [esp + 0xa8], 0x31593749
mov dword [esp + 0xac], 0x3dac33a2
mov dword [esp + 0xb0], 0x39533f57
mov dword [esp + 0xb4], 0x253a3b57
mov byte [esp + 0xba], 0
mov word [esp + 0xb8], 0
lea edx, [esp + 0xb8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xd1
xor cl, byte [esp + eax + 0x58]
add cl, 0xeb
mov byte [esp + eax + 0x58], cl
inc eax
cmp eax, 0x63
jne 0x4224c0
lea edi, [esp + 0x498]
lea eax, [esp + 0x58]
mov esi, eax
mov ecx, 0x18
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [esp + 0x4f8]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x58], 0xdcdddedf
mov dword [esp + 0x5c], 0
mov ecx, 0xaf
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x7cea7800]
or esi, edx
and edx, ecx
not esi
or esi, edx
mov edx, esi
or edx, 0x6f
add edx, esi
not esi
or esi, 0x6f
add edx, esi
add dl, 2
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0xa7
jne 0x422520
mov eax, dword [esp + 0x58]
mov ecx, dword [0x45064c]
test ecx, ecx
je 0x4225a4
xor edx, edx
mov esi, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9abdb589
je 0x422580
inc edx
cmp ecx, edx
jne 0x422570
jmp 0x4225a4
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4225a4
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 5
push 4
push dword [0x450654]
push ecx
call fcn.00441b40
add esp, 0x1c
mov dword [esp + 0x58], 0xdf9e999c
mov byte [esp + 0x5c], 0
mov esi, 0x6b1b77da
mov edx, 0x94e48825
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi - 0x6b1b7782]
lea ebx, [edx + 0x70000000]
and ebx, 0x4208834
mov ecx, esi
and ecx, 0x6002104b
or ecx, ebx
xor ecx, 0x4b
or ecx, edi
mov ebx, esi
not ebx
and ebx, edx
and ebx, edi
not ecx
or ecx, ebx
add cl, 0xbe
mov byte [esp + esi - 0x6b1b7782], cl
inc esi
dec edx
cmp esi, 0x6b1b77df
jne 0x4225c0
cmp eax, dword [esp + 0x58]
jne 0x4226a0
push dword [esp + 0x24]
call fcn.0043e7c0
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x24]
mov dword [esp + 0x58], 0xdcdddedf
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x58]
mov edx, 0xaf
mov ebx, dword [ebp + 0x14]
nop
nop
nop
movzx ecx, byte [eax]
lea esi, [edx - 0x7cea7800]
or esi, ecx
and ecx, edx
not esi
or esi, ecx
mov ecx, esi
or ecx, 0x6f
add ecx, esi
not esi
or esi, 0x6f
add ecx, esi
add cl, 2
mov byte [eax], cl
inc eax
dec edx
cmp edx, 0xa7
jne 0x422640
mov eax, dword [esp + 0x58]
mov edx, dword [0x45064c]
test edx, edx
je 0x4226d0
mov ecx, edi
xor esi, esi
mov edi, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x9abdb589
je 0x4226ae
inc esi
cmp edx, esi
jne 0x422690
jmp 0x4226d0
xor ecx, ecx
xor edx, edx
xor esi, esi
mov ebx, dword [ebp + 0x14]
jmp 0x422c5a
mov edx, dword [edi + esi*8 + 4]
cmp edx, eax
je 0x4226d0
push 0
push ecx
push dword [esp + 0x24]
push 5
push 4
push dword [0x450654]
push edx
call fcn.00441b40
add esp, 0x1c
test eax, eax
js 0x422c2a
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
jmp 0x422711
mov ecx, ebx
call fcn.0043ed50
mov eax, dword [esi]
test eax, eax
je 0x422c42
mov ecx, dword [esi + eax + 0x3c]
add esi, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [ecx + eax]
mov edi, dword [ebp + 8]
movzx edi, word [edi + eax]
test dx, dx
je 0x422738
add eax, 2
cmp dx, di
je 0x422720
cmp dx, di
jne 0x422707
mov eax, dword [esi + 0x44]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xc], eax
mov ecx, ebx
push 0x410
call fcn.0043ebc0
test eax, eax
js 0x422707
mov dword [esp + 0x20], 0
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 0x58], 0xdcdddedf
mov dword [esp + 0x5c], 0
mov eax, 0xaf
lea edx, [esp + 0x58]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [edx]
lea edi, [eax - 0x7cea7800]
or edi, ecx
and ecx, eax
not edi
or edi, ecx
mov ecx, edi
or ecx, 0x6f
add ecx, edi
not edi
or edi, 0x6f
add ecx, edi
add cl, 2
mov byte [edx], cl
inc edx
dec eax
cmp eax, 0xa7
jne 0x422790
mov eax, dword [esp + 0x58]
mov edx, dword [0x45064c]
test edx, edx
je 0x422820
xor edi, edi
mov ecx, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + edi*8], 0xae6e2b0b
je 0x4227f0
inc edi
cmp edx, edi
jne 0x4227e0
jmp 0x422820
mov ecx, dword [ecx + edi*8 + 4]
cmp ecx, eax
je 0x422820
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x2b
push dword [esp + 0x1c]
push 5
push dword [0x450654]
push ecx
call fcn.00441b40
add esp, 0x20
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x58], 0xc3828184
mov ecx, 0x9719460
nop
nop
nop
movzx edx, byte [esp + ecx - 0x9719408]
xor edx, ecx
add edx, 0x695dca8f
mov edi, edx
and edi, 0x1f
xor edx, 0x1f
lea edx, [edx + edi*2]
add dl, 0x72
mov byte [esp + ecx - 0x9719408], dl
inc ecx
cmp ecx, 0x9719464
jne 0x422830
cmp eax, dword [esp + 0x58]
jne 0x422c0f
mov eax, dword [esp + 0x20]
add eax, 2
push eax
call fcn.0043e7c0
add esp, 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
mov dword [esp + 0x58], 0xdcdddedf
mov dword [esp + 0x5c], 0
mov eax, 0xaf
lea edi, [esp + 0x58]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [edi]
lea ecx, [eax - 0x7cea7800]
or ecx, edx
and edx, eax
not ecx
or ecx, edx
mov edx, ecx
or edx, 0x6f
add edx, ecx
not ecx
or ecx, 0x6f
add edx, ecx
add dl, 2
mov byte [edi], dl
inc edi
dec eax
cmp eax, 0xa7
jne 0x4228b0
mov eax, dword [esp + 0x58]
mov edi, dword [0x45064c]
test edi, edi
je 0x422939
add dword [esp + 4], 2
xor ecx, ecx
mov edx, dword [0x450650]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xae6e2b0b
je 0x422910
inc ecx
cmp edi, ecx
jne 0x422900
jmp 0x422939
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, eax
je 0x422939
push 0
push dword [esp + 8]
push dword [esp + 0x14]
push 0x2b
push dword [esp + 0x10]
push 5
push dword [0x450654]
push ecx
call fcn.00441b40
add esp, 0x20
test eax, eax
js 0x422c03
mov ecx, dword [esp + 0xc]
movzx eax, word [ecx]
shr eax, 1
mov ecx, dword [ecx + 4]
xor edx, edx
nop
cmp eax, edx
je 0x42296b
mov edi, dword [ebp + 0xc]
movzx edi, word [edi + edx*2]
cmp di, word [ecx + edx*2]
jne 0x422c03
inc edx
test di, di
jne 0x422950
mov ecx, ebx
call fcn.0043f340
cmp eax, 2
jne 0x422c03
mov ecx, ebx
push 0
push 0x30
lea eax, [esp + 0x30]
push eax
push 0
call fcn.0043f0e0
test eax, eax
js 0x422c03
mov ecx, ebx
push 0
push 0
push 0x28
lea eax, [esp + 0x67c]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.0043f6e0
test eax, eax
js 0x422c03
mov ecx, ebx
push 0
push 0
push 0x80
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x6a4]
push dword [esp + 0x6a4]
call fcn.0043f6e0
test eax, eax
js 0x422c03
movzx eax, word [esp + 0xca]
push eax
call fcn.0043e7c0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0xca]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0xe4]
push dword [esp + 0xe4]
call fcn.0043f6e0
test eax, eax
js 0x422bfa
mov eax, edi
movzx edi, word [esp + 0x498]
mov dword [esp + 8], eax
mov dword [esp], eax
test di, di
je 0x422a8d
lea edx, [esp + 0x498]
mov eax, dword [esp + 8]
mov ecx, eax
mov dword [esp], eax
jmp 0x422a58
movzx edi, word [edx]
test di, di
je 0x422a8d
movzx eax, word [ecx]
test ax, ax
je 0x422bf6
add ecx, 2
add edx, 2
mov dword [esp + 4], edx
mov edx, dword [esp]
add edx, 2
cmp ax, di
je 0x422a7e
mov dword [esp], edx
mov ecx, edx
mov edx, dword [esp + 4]
je 0x422a50
lea edx, [esp + 0x498]
jmp 0x422a50
cmp dword [esp], 0
je 0x422bf6
mov ecx, ebx
push 0
push 0
push 0x20
lea eax, [esp + 0x624]
push eax
push dword [esp + 0x69c]
push dword [esp + 0x69c]
call fcn.0043f6e0
test eax, eax
js 0x422bf6
mov eax, dword [esp + 0x688]
mov ecx, dword [esp + 0x68c]
add eax, 0x10
mov dword [esp + 4], eax
adc ecx, 0
mov dword [esp], ecx
mov eax, dword [esp + 0x628]
mov edx, dword [esp + 0x62c]
mov dword [esp + 0x4fc], edx
mov dword [esp + 0x4f8], eax
jmp 0x422b2e
cmp cx, dx
je 0x422bcc
push edi
call fcn.0043e820
add esp, 4
mov eax, dword [esp + 0x4f8]
mov edx, dword [esp + 0x4fc]
mov ecx, edx
xor ecx, dword [esp]
mov edi, eax
xor edi, dword [esp + 4]
or edi, ecx
je 0x422bf6
mov ecx, ebx
push 0
push 0
push 0x68
lea edi, [esp + 0x504]
push edi
push edx
push eax
call fcn.0043f6e0
test eax, eax
js 0x422bf6
movzx eax, word [esp + 0x552]
push eax
call fcn.0043e7c0
add esp, 4
mov edi, eax
movzx eax, word [esp + 0x552]
mov ecx, ebx
push 0
push 0
push eax
push edi
push dword [esp + 0x56c]
push dword [esp + 0x56c]
call fcn.0043f6e0
test eax, eax
js 0x422b04
xor eax, eax
nop
nop
nop
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
lea edx, [ecx - 0x41]
cmp dx, 0x1a
jae 0x422ba3
or ecx, 0x20
movzx edx, word [edi + eax]
lea ebx, [edx - 0x41]
cmp bx, 0x1a
jae 0x422bb3
or edx, 0x20
mov ebx, dword [ebp + 0x14]
test cx, cx
je 0x422afb
add eax, 2
cmp cx, dx
je 0x422b90
jmp 0x422afb
mov eax, dword [esp + 0x528]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x52c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x538]
mov dword [esp + 0x10], eax
push edi
call fcn.0043e820
add esp, 4
mov edi, dword [esp + 8]
push edi
call fcn.0043e820
add esp, 4
push dword [esp + 0xc]
call fcn.0043e820
add esp, 4
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x14]
je 0x422700
cmp dword [esp + 0x10], 0
je 0x422700
jmp 0x422c42
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push dword [esp + 0x1c]
call fcn.0043e820
add esp, 4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, ebx
call fcn.0043ed40
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret