Function at 0x41c000
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebx
push ecx
push edx
push edi
push esi
push ebp
mov ecx, esp
call 0x41c00d
pop ebp
mov eax, 0x401375
sub eax, 0x401368
sub ebp, eax
sub ebp, 0x1000
mov eax, ebp
cmp dword [ebp + 0x120], 0x12345678
je 0x41c720
jmp 0x41c03f
push eax
mov ecx, 0xf00
add eax, 0x30
call fcn.0041c034
pop eax
sub eax, dword [ebp + 0x11c]
mov dword [ebp + 0x124], eax
mov dword [ebp + 0x120], 0x12345678
mov eax, dword [ebp + 0x2010]
add eax, dword [ebp + 0x124]
mov dword [ebp + 0x12c], eax
mov eax, dword [ebp + 0x2024]
add eax, dword [ebp + 0x124]
mov dword [ebp + 0x130], eax
mov eax, dword [ebp + 0x2038]
add eax, dword [ebp + 0x124]
mov eax, dword [eax]
mov dword [ebp + 0x128], eax
mov dword [ebp], 0x6c6c6443
mov dword [ebp + 4], 0x6c642e38
mov dword [ebp + 8], 0x6c
lea eax, [ebp]
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 4]
push eax
mov dword [ebp], 0x65696853
mov dword [ebp + 4], 0x4350646c
mov dword [ebp + 8], 0
lea ebx, [ebp]
push ebx
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 8]
mov dword [ebp + 0x16c], eax
pop eax
push eax
mov dword [ebp], 0x4746594c
mov dword [ebp + 4], 0x614c7465
mov dword [ebp + 8], 0x72457473
mov dword [ebp + 0xc], 0x72
lea ebx, [ebp]
push ebx
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 8]
mov dword [ebp + 0x174], eax
pop eax
push eax
mov dword [ebp], 0x74696e49
mov dword [ebp + 4], 0x65746169
mov dword [ebp + 8], 0x6b636f4c
mov dword [ebp + 0xc], 0
lea ebx, [ebp]
push ebx
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 8]
mov dword [ebp + 0x170], eax
pop eax
push eax
mov dword [ebp], 0x6e756f43
mov dword [ebp + 4], 0x726574
lea ebx, [ebp]
push ebx
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 8]
mov dword [ebp + 0x178], eax
pop eax
mov dword [ebp], 0x64616552
mov dword [ebp + 4], 0x6b636f4c
mov dword [ebp + 8], 0
lea ebx, [ebp]
push ebx
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 8]
mov dword [ebp + 0x17c], eax
mov eax, 0
push eax
call dword [ebp + 0x170]
add esp, 4
cmp eax, 0
je 0x41cac0
mov ax, word [ebp + 0x180]
cmp ax, 0
je 0x41c203
mov eax, 0
push eax
push eax
lea eax, [ebp + 0x194]
push eax
lea ebx, [ebp]
push ebx
mov eax, 0
mov ax, word [ebp + 0x182]
push eax
mov eax, dword [ebp + 0x17c]
call eax
add esp, 0x14
cmp eax, 0
je 0x41cac0
mov eax, dword [ebp]
mov ebx, dword [ebp + 0x184]
cmp eax, ebx
jne 0x41caf7
cmp dword [ebp + 0x140], 1
jne 0x41c231
lea ebx, [ebp]
push ebx
push 1
push 0
push 0
lea eax, [ebp + 0x194]
push eax
mov eax, dword [ebp + 0x178]
call eax
add esp, 0x14
cmp eax, 0
je 0x41caf7
mov dword [ebp], 0xffffffff
xor eax, eax
mov ax, word [ebp + 0x14e]
push eax
mov ax, word [ebp + 0x14c]
push eax
mov ax, word [ebp + 0x14a]
push eax
mov ax, word [ebp + 0x148]
push eax
push 0x4d2
call 0x41cb61
push eax
push 0
lea ebx, [ebp]
push ebx
push 0x4d2
mov eax, dword [ebp + 0x128]
call eax
add esp, 0
cmp eax, 0
je 0x41caf7
pop eax
cmp dword [ebp], eax
jne 0x41cac0
push 0
push 0
push 3
push 0
push 3
push 0
mov dword [ebp], 0x5c2e5c5c
mov dword [ebp + 4], 0x4349544e
mov dword [ebp + 8], 0x45
lea eax, [ebp]
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 0x14]
cmp eax, 0xffffffff
push 0
push 0
push 3
push 0
push 3
push 0
mov dword [ebp], 0x5c2e5c5c
mov dword [ebp + 4], 0x45434953
mov dword [ebp + 8], 0
lea eax, [ebp]
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 0x14]
cmp eax, 0xffffffff
push 0
push 0
push 3
push 0
push 3
push 0
mov dword [ebp], 0x5c2e5c5c
mov dword [ebp + 4], 0x44574953
mov dword [ebp + 8], 0x47554245
mov dword [ebp + 0xc], 0
lea eax, [ebp]
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 0x14]
cmp eax, 0xffffffff
push 0
push 0
push 3
push 0
push 3
push 0
mov dword [ebp], 0x5c2e5c5c
mov dword [ebp + 4], 0x575254
lea eax, [ebp]
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 0x14]
cmp eax, 0xffffffff
jne 0x41c960
push 0
push 0
push 3
push 0
push 3
push 0
mov dword [ebp], 0x5c2e5c5c
mov dword [ebp + 4], 0x44575254
mov dword [ebp + 8], 0x47554245
mov dword [ebp + 0xc], 0
lea eax, [ebp]
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 0x14]
cmp eax, 0xffffffff
jne 0x41c960
pushal
mov eax, dword fs:[0x30]
push eax
mov ebx, 0
pop eax
test eax, eax
mov ebx, 0
js 0x41c4a7
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x4000
mov esi, dword [eax + 0x18]
mov dword [ebp], 0x6e72656b
mov dword [ebp + 4], 0x32336c65
mov dword [ebp + 8], 0x6c6c642e
mov dword [ebp + 0xc], 0
lea eax, [ebp]
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 4]
push eax
mov dword [ebp], 0x43746547
mov dword [ebp + 4], 0x65727275
mov dword [ebp + 8], 0x7250746e
mov dword [ebp + 0xc], 0x7365636f
mov dword [ebp + 0x10], 0x73
lea ebx, [ebp]
push ebx
push eax
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 8]
call eax
mov edx, eax
pop ecx
push edx
mov dword [ebp], 0x74726956
mov dword [ebp + 4], 0x506c6175
mov dword [ebp + 8], 0x65746f72
mov dword [ebp + 0xc], 0x78457463
mov dword [ebp + 0x10], 0
lea ebx, [ebp]
push ebx
push ecx
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 8]
pop edx
push ebp
push 0x40
push 0x1000
push esi
push edx
call eax
mov edi, dword [esi + 0x3c]
mov dword [esi + edi + 0xf8], 0
mov dword [esi + edi + 0xfc], 0
mov dword [esi + edi + 0x100], 0
mov dword [esi + edi + 0x104], 0
mov dword [esi + edi + 0x108], 0
mov dword [esi + edi + 0x10c], 0
jmp 0x41c4c6
push 0
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 4]
test edx, edx
jns 0x41c4c6
cmp dword [edx + 8], 0xffffffff
jne 0x41c4c6
mov edx, dword [edx + 4]
mov dword [edx + 0x50], 0x1000
popal
pushal
mov esi, dword [ebp + 0x124]
add esi, dword [ebp + 0x104]
mov ecx, dword [ebp + 0x108]
call fcn.0041c83b
popal
pushal
mov eax, dword [ebp + 0x124]
add eax, dword [ebp + 0x10c]
mov ecx, dword [ebp + 0x110]
call fcn.0041c955
popal
mov eax, dword [ebp + 0x134]
cmp eax, 0xffffffff
je 0x41c53e
call 0x41c509
pop eax
mov edi, 0x401871
sub edi, 0x40186c
sub eax, edi
mov edi, 0x401cfb
sub edi, 0x40186c
add eax, edi
push eax
push dword [ebp + 0x134]
push 0
push 0
mov ebx, dword [ebp + 0x130]
call dword [ebx + 4]
mov dword [ebp + 0x138], eax
mov esi, dword [ebp + 0x124]
add esi, dword [ebp + 0x10c]
mov eax, dword [esi + 0xc]
or eax, eax
je 0x41c6da
add eax, dword [ebp + 0x124]
push eax
mov dword [ebp + 0x20], eax
mov ebx, dword [ebp + 0x124]
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 4]
mov edx, dword [ebp + 0x20]
or eax, eax
jne 0x41c5d0
push edx
push eax
and eax, 0
cmp byte [edx], 0
je 0x41c597
mov cl, byte [edx]
mov byte [ebp + eax + 0x1c], cl
inc edx
inc eax
cmp byte [edx], 0
jne 0x41c57f
mov byte [ebp + eax + 0x1c], 0x21
inc eax
mov byte [ebp + eax + 0x1c], 0
pop eax
call dword [ebx]
or eax, eax
jne 0x41c5d0
mov eax, dword [ebp + 0x2fc]
test eax, eax
je 0x41ca7f
push 0
push 0
lea ebx, [ebp + 0x300]
push ebx
lea eax, [ebp + 0x1c]
push eax
push 0
mov ebx, dword [ebp + 0x130]
call dword [ebx]
push 0
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 0x1c]
mov edx, eax
mov dword [ebp + 0x98], edx
mov eax, dword [esi]
add eax, dword [ebp + 0x124]
mov dword [ebp + 0x94], eax
mov eax, dword [esi + 0x10]
add eax, dword [ebp + 0x124]
mov dword [ebp + 0x90], eax
mov ecx, dword [ebp + 0x94]
mov eax, ecx
sub eax, dword [ebp + 0x124]
cmp eax, 0
jne 0x41c60d
call fcn.0041c66d
mov eax, dword [ecx]
shr eax, 0x1f
cmp eax, 0
jne 0x41c660
mov eax, dword [ecx]
add eax, dword [ebp + 0x124]
add eax, 2
push eax
mov dword [ebp + 0x8c], eax
push dword [ebp + 0x98]
call dword [ebx + 8]
cmp eax, 0
je 0x41c680
mov ecx, dword [ebp + 0x90]
mov dword [ecx], eax
add dword [ebp + 0x94], 4
add dword [ebp + 0x90], 4
mov eax, dword [ebp + 0x94]
cmp dword [eax], 0
jne 0x41c5f5
add esi, 0x14
jmp 0x41c54a
mov eax, dword [ecx]
shl eax, 1
shr eax, 1
and eax, 0xffff
jmp 0x41c622
mov eax, dword [ebp + 0x98]
add eax, 0x3c
mov ecx, dword [eax]
mov eax, dword [ebp + 0x98]
add eax, ecx
cmp word [eax], 0x4550
jne 0x41c59e
add eax, 0x78
mov ecx, dword [ebp + 0x98]
add ecx, dword [eax]
add ecx, 0x1c
mov eax, dword [ecx]
add eax, dword [ebp + 0x98]
mov ecx, eax
push ebx
mov ebx, 4
mov eax, dword [ebp + 0x8c]
dec eax
imul bx
pop ebx
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp + 0x98]
jmp 0x41c54a
call 0x41c79d
call 0x41c79e
pushal
push dword fs:[0x30]
pop eax
test eax, eax
js 0x41c700
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x1000
jmp 0x41c71f
push 0
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 4]
test edx, edx
jns 0x41c71f
cmp dword [edx + 8], 0xffffffff
jne 0x41c71f
mov edx, dword [edx + 4]
mov dword [edx + 0x50], 0x1000
popal
mov eax, dword [ebp + 0x124]
add eax, dword [ebp + 0x104]
pop ebp
pop esi
pop edi
pop edx
pop ecx
pop ebx
jmp eax
mov eax, dword [ebp + 0x2fc]
test eax, eax
je 0x41ca7f
push 0
push 0
lea eax, [ebp + 0x300]
push eax
lea ebx, [ebp + 0x600]
push ebx
push 0
mov ebx, dword [ebp + 0x130]
call dword [ebx]
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 0x1c]
pushal
call 0x41c999
pop ebp
mov ebx, 0x401d01
sub ebx, 0x401368
sub ebp, ebx
sub ebp, 0x1000
mov dword [ebp], 0xffffffff
xor eax, eax
mov ax, word [ebp + 0x14e]
push eax
mov ax, word [ebp + 0x14c]
push eax
mov ax, word [ebp + 0x14a]
push eax
mov ax, word [ebp + 0x148]
push eax
push 0x4d2
call 0x41cb61
push eax
push 0
lea ebx, [ebp]
push ebx
push 0x4d2
mov eax, dword [ebp + 0x128]
call eax
add esp, 0
cmp eax, 0
je 0x41caf7
pop eax
cmp dword [ebp], eax
je 0x41ca41
call 0x41ca0b
pop eax
mov edi, 0x401d73
sub edi, 0x401d6e
sub eax, edi
mov edi, 0x401df2
sub edi, 0x401d6e
add eax, edi
push eax
push 0x2710
push 0
push 0
mov ebx, dword [ebp + 0x130]
call dword [ebx + 4]
mov dword [ebp + 0x13c], eax
jmp 0x41ca43
popal
ret
mov ebx, dword [ebp + 0x130]
push dword [ebp + 0x138]
push 0
call dword [ebx + 8]
mov eax, dword [ebp + 0x2fc]
test eax, eax
je 0x41ca7f
push 0
push 0
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0x700]
push eax
push 0
call dword [ebx]
mov ebx, dword [ebp + 0x12c]
push 0
call dword [ebx + 0x1c]
push 0
mov ebx, dword [ebp + 0x12c]
call dword [ebx + 0x1c]
pushal
call 0x41ca90
pop ebp
mov ebx, 0x401df8
sub ebx, 0x401368
sub ebp, ebx
sub ebp, 0x1000
mov ebx, dword [ebp + 0x130]
push dword [ebp + 0x13c]
push 0
call dword [ebx + 8]
mov ebx, dword [ebp + 0x12c]
push 0
call dword [ebx + 0x1c]
call dword [ebp + 0x174]
mov eax, dword [ebp + 0x2fc]
test eax, eax
je 0x41ca7f
mov ebx, dword [ebp + 0x130]
push 0
push 0
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0x400]
push eax
push 0
call dword [ebx]
mov ebx, dword [ebp + 0x12c]
push 0
call dword [ebx + 0x1c]
mov eax, dword [ebp + 0x2fc]
test eax, eax
je 0x41ca7f
mov ebx, dword [ebp + 0x130]
push 0
push 0
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0x500]
push eax
push 0
call dword [ebx]
mov ebx, dword [ebp + 0x12c]
push 0
call dword [ebx + 0x1c]
mov eax, dword [ebp + 0x2fc]
test eax, eax
je 0x41ca7f
mov ebx, dword [ebp + 0x130]
push 0
push 0
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0xa00]
push eax
push 0
call dword [ebx]
mov ebx, dword [ebp + 0x12c]
push 0
call dword [ebx + 0x1c]
push ebp
mov ebp, esp
sub esp, 0x16
push ebx
mov ax, word [ebp + 8]
mov ax, word [ebp + 0xc]
mov ax, word [ebp + 0x10]
mov ax, word [ebp + 0x14]
mov ax, word [ebp + 0x18]
mov eax, dword [ebp + 8]
mov word [ebp - 0xc], ax
shr eax, 0x10
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xc]
xor ax, word [ebp + 0x10]
mov word [ebp - 8], ax
mov ax, word [ebp - 0xe]
xor ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov ax, word [ebp - 8]
add ax, word [ebp - 0x10]
mov word [ebp - 8], ax
mov ax, word [ebp - 8]
cmp ax, 0x7fff
jbe 0x41cbc4
mov ax, word [ebp - 8]
sub ax, 0x7fff
mov word [ebp - 8], ax
mov ax, word [ebp - 8]
xor ax, 0x10
mov word [ebp - 8], ax
mov ax, word [ebp - 8]
cmp ax, 0x7fff
jbe 0x41cbe6
mov ax, word [ebp - 8]
sub ax, 0x7fff
mov word [ebp - 8], ax
xor edx, edx
mov ax, word [ebp - 8]
mov cx, word [ebp + 0x18]
div cx
mov word [ebp - 8], dx
mov ax, word [ebp - 8]
xor ax, word [ebp + 0x14]
mov word [ebp - 6], ax
mov ax, word [ebp - 6]
cmp ax, 0xc350
jbe 0x41cc1d
mov ax, word [ebp - 6]
sub ax, 0xc350
sub ax, 1
mov word [ebp - 6], ax
mov ax, word [ebp - 0xc]
add ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov ax, word [ebp - 0x10]
cmp ax, 0x7fff
jbe 0x41cc3f
mov ax, word [ebp - 0x10]
sub ax, 0x7fff
mov word [ebp - 0x10], ax
xor edx, edx
mov ax, word [ebp - 0x10]
mov cx, word [ebp + 0x14]
div cx
mov word [ebp - 0x12], dx
mov ax, word [ebp + 0x18]
xor ax, word [ebp - 0xe]
mov word [ebp - 0x10], ax
mov ax, word [ebp - 0x12]
xor ax, word [ebp - 0x10]
mov word [ebp - 0xa], ax
mov ax, word [ebp - 0xa]
cmp ax, 0xc350
jbe 0x41cc82
mov ax, word [ebp - 0xa]
sub ax, 0xc350
sub ax, 1
mov word [ebp - 0xa], ax
mov ax, word [ebp - 6]
xor ax, word [ebp - 0xa]
mov word [ebp - 6], ax
mov ax, word [ebp - 0xa]
mov word [ebp - 4], ax
xor eax, eax
mov ax, word [ebp - 4]
shl eax, 0x10
xor ebx, ebx
mov bx, word [ebp - 6]
xor eax, ebx
pop ebx
add esp, 0x16
mov esp, ebp
pop ebp
ret 0x14