Function at 0x41fcd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov eax, dword [esp + 0xa8]
mov ebx, dword [esp + 0xa4]
mov eax, dword [eax + 4]
lea ecx, [eax - 2]
mov edx, eax
add ecx, 2
cmp word [edx], 0
lea edx, [edx + 2]
jne 0x41fcf0
mov edx, ecx
xor edx, eax
not eax
and eax, ecx
add eax, eax
sub eax, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
cmp word [ebx + ecx], 0
lea ecx, [ecx + 2]
jne 0x41fd10
sar eax, 1
lea edx, [ebx + ecx]
add edx, 0xfffffffe
mov ecx, ebx
not ecx
and ecx, edx
xor edx, ebx
add ecx, ecx
sub ecx, edx
sar ecx, 1
lea edx, [eax + ecx]
add edx, 0x3f
test edx, edx
jns 0x41fd41
mov eax, 0xffffffff
jmp 0x41fd4a
add eax, ecx
lea eax, [eax*2 + 0x7e]
push eax
call fcn.0040cc40
add esp, 4
mov esi, eax
mov dword [esp + 0x4c], 0x61e96702
mov dword [esp + 0x50], 0x7d1d63ed
mov dword [esp + 0x54], 0x79237f0e
mov dword [esp + 0x58], 0x750c7b09
mov dword [esp + 0x5c], 0x710977f8
mov dword [esp + 0x60], 0x8dfe73f8
mov dword [esp + 0x64], 0x89f28fd7
mov dword [esp + 0x68], 0x85c68bcf
mov dword [esp + 0x6c], 0x81cd87b6
mov dword [esp + 0x70], 0x9dc983cc
mov dword [esp + 0x74], 0x99d79fd2
mov dword [esp + 0x78], 0x95d19baa
mov dword [esp + 0x7c], 0x91f297db
mov dword [esp + 0x80], 0xadee93eb
mov dword [esp + 0x84], 0xa9aeafce
mov word [esp + 0x88], 0
mov byte [esp + 0x8a], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x4c]
lea edx, [eax + 0x7aaea9e9]
mov ebp, 0x16
sub ebp, eax
mov edi, ebp
xor edi, edx
and edi, ecx
xor edi, edx
not edi
and edi, edx
add edi, edi
xor edx, edi
and edi, ebp
add edi, edi
sub edx, edi
add dl, cl
add dl, 0x73
mov byte [esp + eax + 0x4c], dl
mov ecx, eax
and ecx, 0x27
xor eax, 0xbd36f7a7
lea ecx, [eax + ecx*2]
and eax, 1
or ecx, 1
add eax, ecx
add eax, 0x42c90859
cmp eax, 0x3f
jb 0x41fdf0
mov dword [esp], 0x118b1f70
mov dword [esp + 4], 0x15831384
mov dword [esp + 8], 0x9751786
mov dword [esp + 0xc], 0xd6d0b91
mov dword [esp + 0x10], 0x16a0f60
mov dword [esp + 0x14], 0x5640367
mov dword [esp + 0x18], 0x39910767
mov dword [esp + 0x1c], 0x3dae3ba4
mov dword [esp + 0x20], 0x31a13f50
mov dword [esp + 0x24], 0x35b833a1
mov dword [esp + 0x28], 0x2951376b
mov dword [esp + 0x2c], 0x2dbe2ba0
mov dword [esp + 0x30], 0x21b02f4b
mov dword [esp + 0x34], 0x25b923b5
mov dword [esp + 0x38], 0x59b827b5
mov dword [esp + 0x3c], 0x5d075b05
mov dword [esp + 0x40], 0x515e5f01
mov word [esp + 0x44], 0
mov eax, 0xfd4a2a05
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x2b5d5fb]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xe7
mov byte [esp + eax + 0x2b5d5fb], cl
inc eax
cmp eax, 0xfd4a2a4b
jne 0x41fee0
mov ebp, dword [esp + 0xa8]
mov ecx, dword [ebp + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x41ff31
add ecx, 2
mov eax, esi
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x41ff20
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x41ff61
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ff50
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x41ff91
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41ff80
mov word [eax], 0
movzx ecx, word [esp + 0x4c]
test cx, cx
je 0x41ffc1
lea edx, [esp + 0x4e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41ffb0
mov word [eax], 0
mov eax, dword [esp + 0xac]
mov ebx, dword [eax]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x41ffe0
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
mov eax, ebx
not eax
and eax, ecx
xor ecx, ebx
add eax, eax
sub eax, ecx
sar eax, 1
mov ecx, dword [ebp]
lea edx, [ecx - 2]
mov edi, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, 2
cmp word [edi], 0
lea edi, [edi + 2]
jne 0x420010
mov edi, edx
xor edi, ecx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, edi
sar ecx, 1
lea edx, [eax + ecx]
lea edi, [eax + ecx]
add edi, 0xa
lea ecx, [edx*2 + 0x14]
xor edi, 1
mov eax, dword [ebp + 8]
lea edx, [eax - 2]
mov ebp, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edx, 2
cmp word [ebp], 0
lea ebp, [ebp + 2]
jne 0x420050
mov dword [esp + 0x48], esi
and ecx, 2
add ecx, edi
mov edi, edx
xor edi, eax
not eax
and eax, edx
add eax, eax
sub eax, edi
sar eax, 1
add eax, ecx
jns 0x42007f
mov eax, 0xffffffff
jmp 0x420081
add eax, eax
push eax
call fcn.0040cc40
add esp, 4
mov edi, eax
mov dword [esp], 0x3353316f
mov dword [esp + 4], 0x3f4a3d48
mov dword [esp + 8], 0x3b463955
mov dword [esp + 0xc], 0x47714537
mov word [esp + 0x10], 0x4140
mov dword [esp + 0x12], 0
mov byte [esp + 0x16], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov edx, 0x9e7ca44b
sub edx, eax
mov ebp, ecx
not ebp
lea esi, [ecx + ebp*2]
inc esi
mov ebp, esi
xor ebp, edx
add ebp, eax
and edx, esi
mov esi, 0x4b
sub esi, eax
and esi, ecx
lea ecx, [edx + ebp]
add ecx, 0xb5
or ecx, esi
add cl, 0x7c
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x17
jb 0x4200d0
movzx ecx, word [esp]
mov eax, edi
test cx, cx
je 0x420141
lea edx, [esp + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420130
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
mov esi, dword [esp + 0x48]
mov ebp, dword [esp + 0xa8]
je 0x420171
add ebx, 2
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x420160
mov word [eax], 0x5f
add eax, 2
mov ecx, dword [ebp]
movzx edx, word [ecx]
test dx, dx
je 0x4201a1
add ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x420190
mov word [eax], 0x5f
add eax, 2
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test dx, dx
je 0x4201d1
add ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4201c0
mov word [eax], 0
mov dword [esp], 0x111e1fc6
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xc5
xor cl, byte [esp + eax]
add cl, 0x27
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 7
jb 0x4201f0
mov eax, esp
push 0
push 1
push 0
push eax
push esi
push edi
push dword [esp + 0xb8]
call fcn.00420510
add esp, 0x1c
mov ebx, eax
jmp dword [0x44702c]