Function at 0x41cab0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov eax, dword [esp + 0xa8]
mov ebx, dword [esp + 0xa4]
mov ecx, dword [eax + 4]
mov eax, 0xfffffffe
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x41cad0
mov ecx, 0xfffffffe
cmp word [ebx + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x41cae0
sar eax, 1
sar ecx, 1
lea edx, [eax + ecx]
add edx, 0x3f
test edx, edx
jns 0x41cb00
mov eax, 0xffffffff
jmp 0x41cb09
add eax, ecx
lea eax, [eax*2 + 0x7e]
push eax
call fcn.004084c0
add esp, 4
mov dword [esp], eax
mov dword [esp + 0x4c], 0x23b7214e
mov dword [esp + 0x50], 0x274325b7
mov dword [esp + 0x54], 0x5b1959ca
mov dword [esp + 0x58], 0x5fc05dc3
mov dword [esp + 0x5c], 0x533751c4
mov dword [esp + 0x60], 0x57c255dc
mov dword [esp + 0x64], 0x4b2e4931
mov dword [esp + 0x68], 0x4f1a4d01
mov dword [esp + 0x6c], 0x430b4112
mov dword [esp + 0x70], 0x470f4510
mov dword [esp + 0x74], 0x7b2d792e
mov dword [esp + 0x78], 0x7f377d2e
mov dword [esp + 0x7c], 0x731e7125
mov dword [esp + 0x80], 0x771275ed
mov dword [esp + 0x84], 0x6b6a690a
mov word [esp + 0x88], 0
mov eax, 0x42f3d038
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + eax - 0x42f3cfec]
lea edx, [eax - 0x42f3d000]
or edx, eax
and edx, ebp
mov esi, edx
and esi, 0x7d
mov edi, edx
and edi, 2
mov ecx, edx
or ecx, 0xfffffffd
inc ecx
imul ecx, esi
or edx, 2
imul edx, edi
add ecx, ebp
sub ecx, edx
add ecx, eax
mov edx, ecx
and edx, 0xb13ceee5
mov esi, ecx
and esi, 2
mov edi, esi
xor edi, 2
imul edi, edx
or edx, 2
imul edx, esi
add edx, edi
xor ecx, 0xb13ceee7
mov esi, edx
and esi, ecx
xor edx, ecx
lea edx, [edx + esi*2]
and ecx, 1
xor edx, 1
or edx, ecx
add edx, ecx
mov byte [esp + eax - 0x42f3cfec], dl
inc eax
cmp eax, 0x42f3d076
jne 0x41cbb0
mov dword [esp + 4], 0x138111f4
mov dword [esp + 8], 0x1f891d80
mov dword [esp + 0xc], 0x1bfb198a
mov dword [esp + 0x10], 0x7eb05eb
mov dword [esp + 0x14], 0x3ee01e4
mov dword [esp + 0x18], 0xfe00de1
mov dword [esp + 0x1c], 0xb9709e9
mov dword [esp + 0x20], 0x37aa35a0
mov dword [esp + 0x24], 0x33a731d4
mov dword [esp + 0x28], 0x3fa43dab
mov dword [esp + 0x2c], 0x3bd739ed
mov dword [esp + 0x30], 0x27ba25bc
mov dword [esp + 0x34], 0x23b421cd
mov dword [esp + 0x38], 0x2fc72dbf
mov dword [esp + 0x3c], 0x2bbc29bf
mov dword [esp + 0x40], 0xd7fdd5ff
mov dword [esp + 0x44], 0xd3d2d1fb
mov eax, 0x7e27f744
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7e27f740]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xac
mov byte [esp + eax - 0x7e27f740], cl
inc eax
cmp eax, 0x7e27f788
jne 0x41ccc0
mov edi, dword [esp + 0xa8]
mov ecx, dword [edi + 4]
movzx edx, word [ecx]
mov esi, dword [esp]
mov eax, esi
test dx, dx
je 0x41cd21
add ecx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x41cd10
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x41cd51
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cd40
mov word [eax], 0
movzx ecx, word [ebx]
test cx, cx
je 0x41cd81
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x41cd70
mov word [eax], 0
movzx ecx, word [esp + 0x4c]
test cx, cx
je 0x41cdb1
lea edx, [esp + 0x4e]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cda0
mov word [eax], 0
mov eax, dword [esp + 0xac]
mov esi, dword [eax]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x41cdd0
mov edx, dword [edi]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edx + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x41cdf0
mov edi, dword [edi + 8]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + edx + 2], 0
lea edx, [edx + 2]
jne 0x41ce10
sar eax, 1
sar ecx, 1
sar edx, 1
add ecx, eax
lea eax, [edx + ecx]
add eax, 0xb
test eax, eax
jns 0x41ce34
mov eax, 0xffffffff
jmp 0x41ce3d
add ecx, edx
lea eax, [ecx*2 + 0x16]
push eax
call fcn.004084c0
add esp, 4
mov dword [esp + 0x48], eax
mov dword [esp + 4], 0xe343e157
mov dword [esp + 8], 0xe77ae578
mov dword [esp + 0xc], 0xdb4ed97d
mov dword [esp + 0x10], 0xdf81dd4f
mov dword [esp + 0x14], 0xd1d0
xor eax, eax
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 4]
mov ebp, eax
and ebp, 0x30
mov edx, ecx
xor edx, 0x16e8cf58
add edx, ebp
mov ebp, edx
and ebp, ebx
add ebp, ebp
sub edx, ebp
add edx, ebx
mov ebx, edx
xor ebx, 0x728c0cb8
mov ebp, edx
or ebp, 0x8d73f347
and ebp, ebx
mov edi, ebp
and edi, 0xfffffffd
mov ebx, edx
and ebx, 2
or ebp, 2
imul ebp, ebx
xor ebx, 2
imul ebx, edi
xor edx, 0x8d73f347
add ebx, edx
add ebx, ebp
and edx, 1
or ebx, 1
add ebx, edx
mov byte [esp + ecx + 4], bl
inc ecx
add eax, 2
cmp ecx, 0x14
jne 0x41ce80
movzx ecx, word [esp + 4]
mov ebp, dword [esp + 0x48]
mov eax, ebp
test cx, cx
je 0x41cf11
lea edx, [esp + 6]
mov eax, ebp
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41cf00
mov word [eax], 0
movzx ecx, word [esi]
test cx, cx
mov edi, dword [esp + 0xa8]
je 0x41cf41
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x41cf30
mov word [eax], 0
mov word [eax], 0x5f
add eax, 2
mov ecx, dword [edi]
movzx edx, word [ecx]
test dx, dx
je 0x41cf71
add ecx, 2
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x41cf60
mov word [eax], 0x5f
add eax, 2
mov ecx, dword [edi + 8]
movzx edx, word [ecx]
test dx, dx
je 0x41cfa1
add ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x41cf90
mov word [eax], 0
mov dword [esp + 4], 0x939291fa
mov byte [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 4]
lea esi, [eax + 0xa4]
and esi, edx
lea ecx, [eax + 0x3dd5e2a4]
or ecx, edx
xor ecx, esi
mov edx, ecx
and edx, 0xc9
mov esi, ecx
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or edx, 2
imul edx, esi
xor ecx, 0xcb
add ecx, ebx
add ecx, edx
inc cl
mov byte [esp + eax + 4], cl
mov ecx, eax
or ecx, 1
xor eax, 0xfffffffe
and eax, ecx
add eax, ecx
cmp eax, 4
jbe 0x41cfc0
lea eax, [esp + 4]
push 0
push 1
push 0
push eax
mov esi, dword [esp + 0x10]
push esi
push ebp
push dword [esp + 0xb8]
call fcn.0041d300
add esp, 0x1c
mov ebx, eax
mov eax, dword [0x442ff8]
nop
nop
nop
nop
nop
nop
jmp eax