Function at 0x41de40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, ecx
mov ebx, dword [esp + 0xd4]
mov edi, dword [esp + 0xd0]
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 2
mov dword [esp + 0xa4], 1
push 0x28501340
push dword [0x448338]
call int.0043ce00
add esp, 8
lea ecx, [esp + 0x20]
lea edx, [esp + 0x9c]
push ecx
push edx
push ebx
push edi
call eax
test eax, eax
je 0x41dee8
cmp dword [esi], 0xffffffff
jne 0x41df8f
jmp 0x41e3f8
push 0x1268aeb0
push dword [0x448338]
call int.0043ce00
add esp, 8
mov edi, eax
push 0x4ab545
push dword [0x448338]
call int.0043ce00
add esp, 8
mov dword [esp + 0x14], eax
push 0xa2994af6
push dword [0x448338]
call int.0043ce00
add esp, 8
mov dword [esp], eax
mov ebp, dword [esp + 0x20]
jmp 0x41df33
mov ebp, dword [ebp + 0x1c]
test ebp, ebp
je 0x41df66
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 4]
call edi
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x41df30
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push eax
call dword [esp + 0x20]
test eax, eax
je 0x41df66
push dword [esi]
call dword [esp + 4]
mov dword [esi], 0xffffffff
jmp 0x41df30
push 0x6177aa44
push dword [0x448338]
call int.0043ce00
add esp, 8
push dword [esp + 0x20]
call eax
mov edi, dword [esp + 0xd0]
cmp dword [esi], 0xffffffff
je 0x41e3f8
mov ecx, dword [esp + 0xd8]
mov eax, 0x89
nop
nop
nop
nop
nop
cmp byte [ecx + eax - 0x89], 0
lea eax, [eax + 1]
jne 0x41dfa0
mov ecx, edi
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x41dfb0
mov dword [esp + 0x14], esi
mov ecx, ebx
nop
inc eax
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne 0x41dfc0
push eax
call fcn.00407ff0
add esp, 4
mov dword [esp], eax
mov dword [esp + 0x26], 0x27263950
mov dword [esp + 0x2a], 0x59475a24
mov dword [esp + 0x2e], 0x33707449
mov dword [esp + 0x32], 0x450a0e13
mov word [esp + 0x36], 0x81a0
mov eax, 0x8b3ba50f
mov ecx, 0x74c45af0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x74c45aca]
mov esi, ecx
and esi, edx
add esi, esi
mov ebp, edx
sub ebp, esi
add ebp, ecx
or ebp, eax
mov esi, ebp
not esi
mov ebx, esi
and ebx, 0x74c45bfd
mov edi, esi
and edi, 2
or esi, 2
imul esi, edi
mov edi, ebp
and edi, 2
imul edi, ebx
shr ebp, 1
and ebp, 1
imul ebp, ebx
add edi, esi
lea esi, [esi + ebp*2]
add edi, eax
inc edi
xor edi, edx
not esi
add esi, ecx
and esi, edx
add esi, esi
sub esi, edi
mov edx, esi
neg edx
or edx, 1
add edx, esi
add esi, 0x7f
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + ecx - 0x74c45aca], dl
dec eax
inc ecx
cmp eax, 0x8b3ba4fd
jne 0x41e010
mov dword [esp + 4], 0x3bcedcdf
mov byte [esp + 8], 0x1c
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edx + 4]
mov ebx, edx
or ebx, 0xd8
and ebx, eax
mov esi, eax
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0xdd
mul cl
mov ecx, eax
mov eax, esi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x18
mov byte [esp + edx + 4], al
inc edx
cmp edx, 5
jne 0x41e0a0
movzx eax, byte [esp + 4]
mov edx, dword [esp]
mov ebp, edx
test al, al
je 0x41e10c
lea ecx, [esp + 5]
mov ebp, edx
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41e100
mov byte [ebp], 0
mov ecx, dword [esp + 0xd8]
movzx eax, byte [ecx]
test al, al
mov edx, dword [esp + 0xd0]
je 0x41e13e
inc ecx
mov ebx, dword [esp + 0x14]
nop
nop
nop
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41e130
jmp 0x41e142
mov ebx, dword [esp + 0x14]
mov byte [ebp], 0
movzx eax, byte [esp + 0x26]
test al, al
je 0x41e16c
lea ecx, [esp + 0x27]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41e160
mov byte [ebp], 0
movzx eax, byte [edx]
test al, al
je 0x41e18c
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [edx]
inc edx
test al, al
jne 0x41e180
mov byte [ebp], 0x3a
mov dword [esp + 0x26], 0xddb94147
mov dword [esp + 0x2a], 0x9591dda9
mov dword [esp + 0x2e], 0xe254a997
mov dword [esp + 0x32], 0x96eb9593
mov dword [esp + 0x36], 0xe9999099
mov dword [esp + 0x3a], 0x8ea37573
mov dword [esp + 0x3e], 0x86818d8c
mov dword [esp + 0x42], 0x87878ef2
mov dword [esp + 0x46], 0xfd994bb0
mov dword [esp + 0x4a], 0xf5f1fd89
mov dword [esp + 0x4e], 0xe61e1ef7
mov dword [esp + 0x52], 0xee35f4f3
mov dword [esp + 0x56], 0xf2eff9ff
mov dword [esp + 0x5a], 0x95e5f4fd
mov dword [esp + 0x5e], 0x9ce1c82f
mov dword [esp + 0x62], 0xda9027dc
mov dword [esp + 0x66], 0xc0c4c1c0
mov dword [esp + 0x6a], 0xe0fccbec
mov dword [esp + 0x6e], 0xdef8a9f7
mov dword [esp + 0x72], 0xfbffeede
mov dword [esp + 0x76], 0xaaf8c3d2
mov dword [esp + 0x7a], 0x2b2de2e3
mov dword [esp + 0x7e], 0x8c7c6d1
mov dword [esp + 0x82], 0xdacac2d1
mov dword [esp + 0x86], 0xc8c7c8c5
mov dword [esp + 0x8a], 0x342602ba
mov dword [esp + 0x8e], 0x3a3d4040
mov dword [esp + 0x92], 0x8f80d38
mov dword [esp + 0x96], 0xd0d6d609
mov word [esp + 0x9a], 0xdfd4
mov eax, 0x16241e9a
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x16241e74]
xor ecx, eax
mov edx, ecx
and edx, 0x2d
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
xor ecx, 0x2f
add ecx, edi
add ecx, edx
inc cl
mov byte [esp + eax - 0x16241e74], cl
inc eax
cmp eax, 0x16241f10
jne 0x41e2a0
inc ebp
mov ecx, dword [esp + 0xd4]
movzx eax, byte [ecx]
test al, al
je 0x41e2fe
inc ecx
mov edi, dword [esp]
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41e2f0
jmp 0x41e301
mov edi, dword [esp]
mov byte [ebp], 0
movzx eax, byte [esp + 0x26]
test al, al
je 0x41e32c
lea ecx, [esp + 0x27]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebp], al
inc ebp
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x41e320
mov byte [ebp], 0
sub ebp, edi
push 0x12007ce3
push dword [0x448338]
call int.0043ce00
add esp, 8
push 0
push ebp
push edi
push dword [ebx]
call eax
mov esi, eax
cmp eax, 0xffffffff
jne 0x41e39f
cmp dword [ebx], 0xffffffff
je 0x41e39f
push 0x4f80c377
push dword [0x448338]
call int.0043ce00
add esp, 8
push 2
push dword [ebx]
call eax
push 0xa2994af6
push dword [0x448338]
call int.0043ce00
add esp, 8
push dword [ebx]
call eax
mov dword [ebx], 0xffffffff
push edi
call fcn.00408000
add esp, 4
xor eax, eax
jmp 0x41e677
push edi
call fcn.00408000
add esp, 4
cmp esi, 0xffffffff
je 0x41e3f8
push 0x400
call fcn.00407ff0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
add eax, 0x400
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
mov ecx, ebx
push eax
call fcn.0041e8e0
test al, al
je 0x41e654
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
mov ecx, edi
sub ecx, esi
cmp edi, dword [esp + 0xc]
je 0x41e3ff
mov eax, esi
jmp 0x41e535
xor eax, eax
jmp 0x41e677
lea eax, [ecx + 1]
mov ebp, ecx
shr ebp, 1
mov dword [esp], ecx
add ecx, ebp
cmp ecx, eax
ja 0x41e411
mov ecx, eax
mov dword [esp + 0x18], ecx
push ecx
call fcn.00407ff0
add esp, 4
test esi, esi
je 0x41e51d
cmp eax, esi
mov ebx, dword [esp]
mov dword [esp + 0x10], eax
jbe 0x41e4cf
cmp edi, eax
jbe 0x41e4cf
test ebx, ebx
je 0x41e509
mov edx, dword [esp]
lea eax, [esi + edx]
dec eax
mov ecx, dword [esp + 0x10]
add ecx, edx
dec ecx
mov ebp, edx
and ebp, 7
je 0x41e471
neg ebp
xor edx, edx
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp ebp, edx
jne 0x41e45e
add eax, edx
add ecx, edx
add edx, dword [esp]
sub esi, edi
cmp esi, 0xfffffff8
ja 0x41e509
neg edx
xor esi, esi
movzx ebx, byte [eax + esi]
mov byte [ecx + esi], bl
movzx ebx, byte [eax + esi - 1]
mov byte [ecx + esi - 1], bl
movzx ebx, byte [eax + esi - 2]
mov byte [ecx + esi - 2], bl
movzx ebx, byte [eax + esi - 3]
mov byte [ecx + esi - 3], bl
movzx ebx, byte [eax + esi - 4]
mov byte [ecx + esi - 4], bl
movzx ebx, byte [eax + esi - 5]
mov byte [ecx + esi - 5], bl
movzx ebx, byte [eax + esi - 6]
mov byte [ecx + esi - 6], bl
movzx ebx, byte [eax + esi - 7]
mov byte [ecx + esi - 7], bl
add esi, 0xfffffff8
cmp edx, esi
jne 0x41e480
jmp 0x41e509
mov ecx, ebx
shr ecx, 2
mov edx, esi
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add eax, edx
add edx, esi
and ebp, 1
mov esi, edx
mov edi, eax
mov ecx, ebp
xchg esi, esi
rep movsw word es:[edi], word [esi]
xchg esi, esi
test bl, 1
je 0x41e509
mov ecx, dword [esp]
and ecx, 2
movzx edx, byte [edx + ecx]
mov byte [eax + ecx], dl
push dword [esp + 4]
call fcn.00408000
add esp, 4
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov ecx, dword [esp]
lea edx, [eax + ecx]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x18]
add edx, eax
mov dword [esp + 0xc], edx
mov byte [eax + ecx], 0
mov eax, dword [esp + 4]
mov ebp, dword [esp + 8]
inc ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x26], 0x1510172a
mov dword [esp + 0x2a], 0x38463649
mov dword [esp + 0x2e], 0x3c3c3a4a
mov byte [esp + 0x32], 0x6e
mov ecx, 0x61aa18f2
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x61aa18cc]
mov esi, ecx
or esi, edx
lea edi, [ecx - 0x61aa1800]
and edi, edx
sub esi, edi
add esi, 0xf2af386f
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
mov byte [esp + ecx - 0x61aa18cc], dl
inc ecx
cmp ecx, 0x61aa18ff
jne 0x41e570
movzx edx, byte [esp + 0x26]
mov ecx, eax
test dl, dl
je 0x41e5e6
lea edi, [esp + 0x26]
mov esi, eax
mov ecx, eax
jmp 0x41e5cb
movzx edx, byte [edi]
test dl, dl
mov ebx, dword [esp + 0x14]
je 0x41e5e6
mov dh, byte [esi]
test dh, dh
je 0x41e5ee
inc esi
inc edi
lea ebx, [ecx + 1]
cmp dh, dl
je 0x41e5de
mov ecx, ebx
mov esi, ebx
je 0x41e5c0
lea edi, [esp + 0x26]
jmp 0x41e5c0
test ecx, ecx
jne 0x41e69b
cmp dword [ebx], 0xffffffff
je 0x41e654
mov word [ebx + 6], 0x3ea
mov word [esp + 0x26], 0xea03
lea eax, [esp + 0x26]
mov ecx, ebx
push 0x440bdc
push 1
push 1
push 8
push 2
push eax
call fcn.0041d420
cmp dword [ebx], 0xffffffff
je 0x41e654
push 0x4f80c377
push dword [0x448338]
call int.0043ce00
add esp, 8
push 2
push dword [ebx]
call eax
push 0xa2994af6
push dword [0x448338]
call int.0043ce00
add esp, 8
push dword [ebx]
call eax
mov dword [ebx], 0xffffffff
mov dword [esp + 0x18], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x41e673
cmp eax, dword [esp + 8]
je 0x41e673
push eax
call fcn.00408000
add esp, 4
mov eax, dword [esp + 0x18]
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
cmp dl, dh
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp]
je 0x41e65c
mov edx, eax
sub edx, ebp
je 0x41e6bc
mov esi, ebp
mov edi, eax
xor ecx, ecx
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
xor ecx, ecx
mov edi, eax
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
add dword [esp + 8], edx
mov ecx, ebx
lea eax, [esp + 4]
push eax
call fcn.0041e8e0
test al, al
je 0x41e654
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 4]
mov edi, dword [esp + 8]
mov ebx, edi
sub ebx, ebp
cmp edi, dword [esp + 0xc]
je 0x41e6f0
mov eax, ebp
jmp 0x41e832
lea eax, [ebx + 1]
mov esi, ebx
shr esi, 1
lea ecx, [esi + ebx]
cmp ecx, eax
ja 0x41e700
mov ecx, eax
mov dword [esp], ecx
push ecx
call fcn.00407ff0
add esp, 4
test ebp, ebp
je 0x41e81e
cmp eax, ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
jbe 0x41e7cf
cmp edi, eax
jbe 0x41e7cf
test ebx, ebx
je 0x41e80a
mov edx, dword [esp + 0x10]
lea eax, [edx + ebp]
dec eax
mov ecx, dword [esp + 0x1c]
add ecx, edx
dec ecx
mov esi, edx
and esi, 7
je 0x41e764
neg esi
xor edx, edx
nop
nop
movzx ebx, byte [eax + edx]
mov byte [ecx + edx], bl
dec edx
cmp esi, edx
jne 0x41e750
add eax, edx
add ecx, edx
add edx, dword [esp + 0x10]
sub ebp, edi
cmp ebp, 0xfffffff8
ja 0x41e80a
neg edx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + esi]
mov byte [ecx + esi], bl
movzx ebx, byte [eax + esi - 1]
mov byte [ecx + esi - 1], bl
movzx ebx, byte [eax + esi - 2]
mov byte [ecx + esi - 2], bl
movzx ebx, byte [eax + esi - 3]
mov byte [ecx + esi - 3], bl
movzx ebx, byte [eax + esi - 4]
mov byte [ecx + esi - 4], bl
movzx ebx, byte [eax + esi - 5]
mov byte [ecx + esi - 5], bl
movzx ebx, byte [eax + esi - 6]
mov byte [ecx + esi - 6], bl
movzx ebx, byte [eax + esi - 7]
mov byte [ecx + esi - 7], bl
add esi, 0xfffffff8
cmp edx, esi
jne 0x41e780
jmp 0x41e80a
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add eax, edx
add edx, ebp
and esi, 1
mov ebp, edx
mov ecx, esi
mov edi, eax
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
test bl, 1
je 0x41e80a
mov ecx, dword [esp + 0x10]
and ecx, 2
movzx edx, byte [edx + ecx]
mov byte [eax + ecx], dl
push dword [esp + 4]
call fcn.00408000
add esp, 4
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
lea ecx, [eax + ebx]
mov dword [esp + 8], ecx
mov ecx, dword [esp]
add ecx, eax
mov dword [esp + 0xc], ecx
mov byte [eax + ebx], 0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
inc ecx
mov dword [esp], ecx
mov dword [esp + 8], ecx
mov word [esp + 0x26], 0x4e4e
mov byte [esp + 0x28], 0x75
xor ecx, ecx
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi + 0x26]
mov edx, esi
xor edx, 0x54236b2b
add edx, ecx
xor edx, edi
mov edi, edx
not edi
or edi, 0x5ee4a6a7
add edi, edx
inc edi
mov ebx, edi
and ebx, 0xfffffffd
mov ebp, edi
and ebp, 2
or edi, 2
imul edi, ebp
xor ebp, 2
imul ebp, ebx
add edi, ebp
xor edx, 0x5ee4a6a7
mov ebx, edi
and ebx, edx
xor edx, edi
lea edx, [edx + ebx*2]
inc dl
mov byte [esp + esi + 0x26], dl
inc esi
add ecx, 2
cmp esi, 3
jne 0x41e860
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax + ecx]
mov dh, byte [esp + ecx + 0x26]
test dl, dl
je 0x41e690
inc ecx
cmp dl, dh
je 0x41e8c0
jmp 0x41e690