Function at 0x418860
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov ecx, dword [esp + 0x68]
mov ebp, dword [esp + 0x64]
mov ebx, dword [ebp + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x418880
mov esi, dword [ecx + 4]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x4188a0
sar eax, 1
sar ecx, 1
lea edx, [ecx + eax]
add eax, ecx
add eax, 0x1b
test eax, eax
mov dword [esp], edx
jns 0x4188c5
mov eax, 0xffffffff
jmp 0x4188cc
lea eax, [edx*2 + 0x36]
push eax
call fcn.00408770
add esp, 4
mov dword [esp + 0x10], 0x3762395c
mov dword [esp + 0x14], 0x334d3547
mov dword [esp + 0x18], 0x4f3a3151
mov dword [esp + 0x1c], 0x4b174d6c
mov dword [esp + 0x20], 0x47ca49c0
mov dword [esp + 0x24], 0x43304539
mov dword [esp + 0x28], 0x5f2741cf
mov dword [esp + 0x2c], 0x5b285d2f
mov dword [esp + 0x30], 0x57395978
mov dword [esp + 0x34], 0x53de5529
mov dword [esp + 0x38], 0x6f1751dc
mov dword [esp + 0x3c], 0x6b116d1e
mov dword [esp + 0x40], 0x670269e7
mov dword [esp + 0x44], 0x6564
mov byte [esp + 0x48], 0
xor edi, edi
nop
nop
nop
nop
lea ecx, [edi + 0x36]
mov edx, 0xc9
sub edx, edi
and edx, 0xae
and ecx, 0x51
or ecx, edx
xor cl, byte [esp + edi + 0x10]
xor cl, 0xae
add cl, 0xf2
mov byte [esp + edi + 0x10], cl
mov ecx, edi
xor ecx, 1
and edi, 1
lea edi, [ecx + edi*2]
cmp edi, 0x39
jb 0x418950
movzx ecx, word [ebx]
mov edi, eax
test cx, cx
je 0x4189b1
add ebx, 2
mov edi, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4189a0
mov word [edi], 0
movzx ecx, word [esp + 0x10]
test cx, cx
je 0x4189e1
lea edx, [esp + 0x12]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4189d0
mov word [edi], 0
movzx ecx, word [esi]
test cx, cx
mov dword [esp + 4], eax
je 0x418a11
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edi], cx
add edi, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x418a00
mov word [edi], 0
mov edi, dword [ebp]
mov eax, 0xfffffffe
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x418a20
mov ebp, dword [ebp + 8]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x418a40
mov edx, dword [esp + 0x68]
mov esi, dword [edx]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + edx + 2], 0
lea edx, [edx + 2]
jne 0x418a60
sar eax, 1
sar ecx, 1
sar edx, 1
add ecx, eax
lea eax, [edx + ecx]
add eax, 0x13
test eax, eax
mov dword [esp + 8], esi
jns 0x418a88
mov eax, 0xffffffff
jmp 0x418a91
add ecx, edx
lea eax, [ecx*2 + 0x26]
push eax
call fcn.00408770
add esp, 4
movzx ecx, word [edi]
mov esi, eax
test cx, cx
je 0x418ac1
add edi, 2
mov esi, eax
nop
nop
nop
nop
nop
nop
nop
mov word [esi], cx
add esi, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x418ab0
mov dword [esp + 0xc], eax
mov word [esi], 0x2f
mov dword [esp + 0x10], 0xf931fb2d
mov dword [esp + 0x14], 0xe57ae760
mov dword [esp + 0x18], 0xe170e30f
mov dword [esp + 0x1c], 0xed79ef7d
mov dword [esp + 0x20], 0xe978eb7d
mov dword [esp + 0x24], 0x95479775
mov word [esp + 0x28], 0x9394
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
xor eax, eax
movzx edx, byte [esp + eax + 0x10]
lea ecx, [eax + 0x2b]
mov ebx, 0xd4
sub ebx, eax
mov edi, ebx
and edi, 0x59
and ecx, 0x26
or ecx, edi
xor ecx, 0x26
or ecx, ebx
or ebx, edx
and ecx, edx
not ebx
or ebx, ecx
add bl, 0x29
mov byte [esp + eax + 0x10], bl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x1f
jb 0x418b10
add esi, 2
movzx eax, word [ebp]
test ax, ax
je 0x418b74
add ebp, 2
mov edi, dword [esp + 0x68]
mov word [esi], ax
add esi, 2
movzx eax, word [ebp]
add ebp, 2
test ax, ax
jne 0x418b60
jmp 0x418b78
mov edi, dword [esp + 0x68]
mov word [esi], 0
movzx eax, word [esp + 0x10]
test ax, ax
je 0x418ba3
lea ecx, [esp + 0x12]
mov ebx, dword [esp + 0xc]
nop
mov word [esi], ax
add esi, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418b90
jmp 0x418ba7
mov ebx, dword [esp + 0xc]
mov word [esi], 0
mov ecx, dword [esp + 8]
movzx eax, word [ecx]
test ax, ax
je 0x418bd1
add ecx, 2
nop
nop
nop
nop
nop
mov word [esi], ax
add esi, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418bc0
mov word [esi], 0
mov dword [esp + 0x10], 0x4f4e4996
mov byte [esp + 0x14], 0
mov eax, 0x12
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 2]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xa6
mov byte [esp + eax - 2], cl
inc eax
cmp eax, 0x17
jne 0x418bf0
lea eax, [esp + 0x10]
push 0
push 0
push 0xc00000
push eax
mov ebp, dword [esp + 0x14]
push ebp
push ebx
push dword [esp + 0x78]
call fcn.0041c800
add esp, 0x1c
mov byte [esp + 8], al
jmp dword [0x441da4]