Function at 0x422220
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
cmp byte [esp + 0x60], 0
je 0x422270
mov edi, dword [esp + 0x68]
mov ebx, dword [esp + 0x5c]
mov ebp, dword [edi + 4]
mov eax, 0xfffffffe
nop
nop
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x422240
mov ecx, 0xfffffffe
cmp word [ebx + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x422250
sar eax, 1
sar ecx, 1
lea edx, [eax + ecx]
add edx, 0x1f
test edx, edx
jns 0x422277
mov eax, 0xffffffff
jmp 0x422280
xor ebx, ebx
jmp 0x4224e8
add eax, ecx
lea eax, [eax*2 + 0x3e]
push eax
call fcn.00408310
add esp, 4
mov esi, eax
movzx ecx, word [ebp]
test cx, cx
je 0x4222b2
add ebp, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebp]
add ebp, 2
test cx, cx
jne 0x4222a0
mov word [eax], 0x5c
mov dword [esp], 0x2c772a45
mov dword [esp + 4], 0x204c2e52
mov dword [esp + 8], 0x245f2240
mov dword [esp + 0xc], 0x38532676
mov dword [esp + 0x10], 0x3c4f3a58
mov dword [esp + 0x14], 0x30533e58
mov dword [esp + 0x18], 0x344d3268
mov dword [esp + 0x1c], 0x48523651
mov dword [esp + 0x20], 0x4c2e4ac1
mov dword [esp + 0x24], 0x40234e29
mov dword [esp + 0x28], 0x443a421d
mov dword [esp + 0x2c], 0x58224633
mov dword [esp + 0x30], 0x5c245a1a
mov dword [esp + 0x34], 0x50225e20
mov dword [esp + 0x38], 0x5453523d
mov ecx, 0x157efe21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x157efe21]
mov ebp, ecx
and ebp, edx
add ebp, ebp
sub edx, ebp
add edx, ecx
mov ebp, edx
and ebp, 0x109
xor ebp, 0xaa810109
and edx, 0x14080ef6
sub edx, ebp
mov ebp, edx
and ebp, 1
xor edx, 1
lea edx, [edx + ebp*2]
mov byte [esp + ecx - 0x157efe21], dl
inc ecx
cmp ecx, 0x157efe5d
jne 0x422340
add eax, 2
movzx ecx, word [ebx]
test cx, cx
je 0x4223b1
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x4223a0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4223e1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4223d0
mov word [eax], 0
mov dword [esp + 0x3c], 0xe3cce1ca
mov dword [esp + 0x40], 0xe78be581
mov dword [esp + 0x44], 0xebeae984
xor eax, eax
movzx ecx, byte [esp + eax + 0x3c]
lea edx, [ecx + ecx]
not edx
add edx, ecx
mov ebx, eax
xor ebx, 0x1f
or ebx, edx
or ecx, eax
or ecx, 0xe0
and ecx, ebx
mov byte [esp + eax + 0x3c], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0xc
jb 0x422400
mov dword [esp], 0x9cfa9ac4
mov dword [esp + 4], 0x90e39ee4
mov dword [esp + 8], 0x94ac92e2
mov dword [esp + 0xc], 0xa8ee96c2
mov dword [esp + 0x10], 0xaccfaad7
mov dword [esp + 0x14], 0xa0d8aed2
mov dword [esp + 0x18], 0xa483a2d2
mov dword [esp + 0x1c], 0xb8c6a6f8
mov dword [esp + 0x20], 0xbcc7bac0
mov word [esp + 0x24], 0xbebd
mov eax, 0x11
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x11]
lea edx, [eax - 0x2dc7300]
mov ebx, eax
and ebx, ecx
or edx, ecx
xor edx, ebx
mov ecx, edx
xor ecx, 0x88
or edx, 0x16e39777
and ecx, edx
add ecx, edx
inc cl
mov byte [esp + eax - 0x11], cl
inc eax
cmp eax, 0x37
jne 0x422490
lea eax, [esp + 0x3c]
mov ecx, esp
push 0
push 4
push 0xc00000
push eax
push esi
push ecx
push dword [edi]
call fcn.0041e110
add esp, 0x1c
mov ebx, eax
push esi
call fcn.00408320
add esp, 4
mov eax, ebx
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret 0x10