Function at 0x41f8cd
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x4a4
mov eax, 0x4df39f
call fcn.004c1130
mov dword [ebp - 0x4a8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test edx, edx
je 0x41fb95
test eax, eax
je 0x41fb95
xor ebx, ebx
push ebx
push eax
push edx
call fcn.00439540
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41fb95
lea eax, [ebp - 0x498]
push eax
push ebx
push edi
call fcn.00439400
add esp, 0xc
test eax, eax
jne 0x41fb95
mov esi, dword [ebp - 0x26c]
push esi
mov dword [ebp - 0x4a0], esi
call fcn.004b8adf
mov dword [ebp - 0x49c], eax
pop ecx
test eax, eax
je 0x41fb95
push esi
push eax
push ebx
push edi
call fcn.00439b60
add esp, 0x10
test esi, esi
je 0x41fb95
push esi
call fcn.004b8adf
mov dword [ebp - 0x4a4], eax
pop ecx
test eax, eax
je 0x41fb95
push esi
push ebx
push eax
call fcn.004be330
add esp, 0xc
mov dword [ebp - 0x17], 0x420f4c81
mov dword [ebp - 0x1b], 0x507d567d
mov ecx, ebx
mov dword [ebp - 0x1f], 0x68515b6b
mov byte [ebp - 0x20], 0x49
mov al, byte [ebp + ecx - 0x20]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xd
jl 0x41f998
mov edx, dword [ebp - 0x49c]
lea edi, [ebp - 0x2b]
xor eax, eax
mov byte [ebp - 0x2c], bl
stosd dword es:[edi], eax
mov ecx, edx
mov dword [ebp - method.DES.virtual_0], vtable.DES.0
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, esi
shr eax, 3
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x41fa4a
mov esi, dword [ebp - 0x4a4]
mov ebx, eax
mov eax, dword [ecx]
mov edi, 0x518bc0
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 4]
add ecx, 8
mov dword [ebp - 0x30], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x4ac], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x20]
mov dword [0x518bc0], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x518bc4], eax
call fcn.0041f109
push ecx
push ecx
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x2c]
call fcn.0041f032
mov eax, dword [ebp - 0x2c]
mov dword [esi], eax
lea esi, [esi + 8]
mov eax, dword [ebp - 0x28]
mov dword [esi - 4], eax
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4ac]
dec ebx
jne 0x41f9e2
mov esi, dword [ebp - 0x4a0]
xor ebx, ebx
mov edx, dword [ebp - 0x49c]
mov edi, dword [ebp - 0x4a4]
mov ecx, esi
and ecx, 7
je 0x41fa6e
mov eax, esi
sub eax, ecx
add eax, edx
push ecx
push eax
mov eax, edi
sub eax, ecx
add eax, esi
push eax
call fcn.004bdce0
add esp, 0xc
push dword [ebp - 0x49c]
call fcn.004bb670
push ebx
push esi
push edi
mov dword [ebp - 0x49c], ebx
call fcn.00439540
add esp, 0x10
mov dword [ebp - 0x4a0], eax
test eax, eax
je 0x41fad6
lea ecx, [ebp - 0x268]
push ecx
push ebx
push eax
call fcn.00439400
add esp, 0xc
test eax, eax
jne 0x41fb83
mov esi, dword [ebp - 0x3c]
push esi
call fcn.004b8adf
mov dword [ebp - 0x49c], eax
pop ecx
test eax, eax
je 0x41fb83
push esi
push eax
push ebx
push dword [ebp - 0x4a0]
call fcn.00439b60
add esp, 0x10
push edi
call fcn.004bb670
mov eax, dword [ebp - 0x49c]
pop ecx
test eax, eax
je 0x41fb83
test esi, esi
je 0x41fb83
mov ecx, eax
call fcn.0041f64b
mov ecx, dword [ebp - 0x4a8]
mov dword [ecx], eax
test eax, eax
je 0x41fb83
mov esi, str.DllGetClassObject
lea edi, [ebp - 0x24]
lea edx, [ebp - 0x24]
mov ecx, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.0041f7a3
test eax, eax
je 0x41fb67
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x49c], ebx
push ecx
push 0x4f7830
push 0x5009c0
call eax
mov edx, dword [ebp - 0x49c]
test edx, edx
je 0x41fb67
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [edx]
add eax, 4
push eax
push 0x5009d0
push ebx
push edx
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x49c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41fb83
mov eax, dword [ecx]
push 1
push ecx
call dword [eax + 0x20]
test eax, eax
js 0x41fb83
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
mov al, bl
mov dword [ebp - method.DES.virtual_0], vtable.DES.0
jmp 0x41fb97
xor al, al
call fcn.004c10df
ret 8