Function at 0x417230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor eax, eax
push esi
mov esi, dword [eax + 0x41a980]
mov edx, dword [edi]
mov dword [eax + edx], esi
add eax, 4
cmp eax, 0x48
jl 0x41723c
xor eax, eax
mov edx, 0x100
mov ebx, dword [eax + 0x41a9c8]
mov esi, dword [edi + 4]
mov dword [eax + esi], ebx
add eax, 4
dec edx
jne 0x417256
cmp eax, 0x1000
jl 0x417251
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
mov edx, dword [ebp - 4]
add edx, eax
mov dword [ebp - 8], edx
push 0x38
lea eax, [esi + 1]
cdq
pop ebx
idiv ebx
lea eax, [esi + 2]
push 0x38
add dword [ebp - 4], 4
movzx ebx, byte [edx + ecx]
mov bh, byte [esi + ecx]
cdq
pop ecx
idiv ecx
mov eax, dword [ebp + 8]
shl ebx, 8
push 0x38
movzx eax, byte [edx + eax]
or ebx, eax
lea eax, [esi + 3]
cdq
idiv ecx
mov ecx, dword [ebp + 8]
shl ebx, 8
movzx eax, byte [edx + ecx]
or ebx, eax
mov eax, dword [ebp - 8]
xor dword [eax], ebx
lea eax, [esi + 4]
cdq
pop esi
idiv esi
cmp dword [ebp - 4], 0x48
mov esi, edx
jl 0x417274
and dword [ebp + 8], 0
and dword [ebp - 4], 0
xor esi, esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push edi
call fcn.00416b5e
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [esi + eax], ecx
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
mov dword [esi + eax + 4], ecx
add esi, 8
cmp esi, 0x48
jl 0x4172d9
xor esi, esi
mov ebx, 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push edi
call fcn.00416b5e
mov eax, dword [edi + 4]
mov ecx, dword [ebp + 8]
mov dword [esi + eax], ecx
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
mov dword [esi + eax + 4], ecx
add esi, 8
dec ebx
jne 0x417307
cmp esi, 0x1000
jl 0x417302
pop esi
pop ebx
leave
ret 4

Function at 0x417a5d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
mov esi, 0x104
xor ebx, ebx
push esi
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], bl
call 0x4270f4
xor eax, eax
mov byte [ebp - 0x10], bl
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
cmp byte [0x41d530], bl
stosb byte es:[edi], al
mov edi, 0x41d530
jne 0x417aaf
push esi
push edi
call dword [0x414140]
mov dword [0x41d638], eax
lea eax, [ebp - 0x118]
push edi
push eax
call 0x427080
pop ecx
pop ecx
lea esi, [ebp - 0x118]
call fcn.00419e87
call fcn.004164e7
test eax, eax
jne 0x417af9
mov byte [ebp - 7], bl
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 9], 0x78
lea eax, [ebp - 0x10]
push eax
lea edi, [ebp - 0x118]
call fcn.0041a572
pop ecx
call 0x4244ba
mov eax, edi
push eax
mov dword [0x41cfe0], ebx
call 0x4248d3
cmp dword [0x41cfe0], ebx
pop ecx
je 0x417b50
push 0x10c
lea eax, [ebp - 0x228]
push 0x41ced0
push eax
call 0x427074
add esp, 0xc
cmp dword [0x41cfe0], ebx
je 0x417b50
mov eax, dword [ebp - 0x228]
cmp eax, ebx
jne 0x417b52
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret