Function at 0x40b4e1
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
and dword [ebp - 8], 0
mov edx, 0xd3e65c39
and dword [ebp - 4], 0
xor ecx, ecx
push ebx
push esi
push edi
call fcn.00404bfc
mov esi, eax
mov cl, byte [str.gdiplus.dll]
mov al, byte [0x41ad6a]
mov dl, 0x6a
push 0xa
pop ebx
add al, bl
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x16], al
add cl, bl
mov al, byte [0x41ad6b]
add al, bl
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x15], al
mov al, byte [0x41ad6c]
add al, bl
mov cl, byte [0x41ad69]
mov byte [ebp - 0x14], al
add cl, bl
mov al, byte [0x41ad6d]
add al, bl
mov byte [ebp - 0x17], cl
mov byte [ebp - 0x13], al
mov al, byte [0x41ad6e]
add al, bl
mov byte [ebp - 0x12], al
mov al, byte [0x41ad6f]
add al, bl
mov byte [ebp - 0x11], al
mov al, byte [0x41ad70]
add al, bl
mov byte [ebp - 0x10], al
mov al, byte [0x41ad71]
add al, bl
mov byte [ebp - 0xf], al
mov al, byte [0x41ad72]
add al, bl
xor ebx, ebx
mov byte [ebp - 0xe], al
mov ecx, ebx
mov byte [ebp - 0xd], bl
movsx eax, dl
and eax, 0x8000000f
jns 0x40b58e
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0xb
jae 0x40b59d
mov dl, byte [ebp - 0x19]
jmp 0x40b57f
lea eax, [ebp - 0x18]
mov byte [ebp - 0xd], bl
push eax
call esi
mov esi, eax
test esi, esi
je 0x40b6ef
mov edx, 0xdc02ba32
xor ecx, ecx
call fcn.00404bfc
movaps xmm0, xmmword [0x41b2f0]
mov edi, eax
movups xmmword [ebp - 0x49], xmm0
mov dword [ebp - 0x39], 0x786f6e65
mov ecx, ebx
mov dword [ebp - 0x35], 0x70635979
mov word [ebp - 0x31], 0x6f
mov al, byte [ebp - 0x49]
xor byte [ebp + ecx - 0x48], al
inc ecx
cmp ecx, 0x18
jb 0x40b5df
lea eax, [ebp - 0x48]
mov byte [ebp - 0x30], bl
push eax
push esi
call edi
mov edx, 0xdc02ba32
xor ecx, ecx
mov edi, eax
call fcn.00404bfc
movaps xmm0, xmmword [0x41b270]
mov edx, eax
movups xmmword [ebp - 0x2f], xmm0
mov dword [ebp - 0x1f], 0x4f585952
mov ecx, ebx
mov word [ebp - 0x1b], 0x4e
mov al, byte [ebp - 0x2f]
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0x14
jb 0x40b620
lea eax, [ebp - 0x2e]
mov byte [ebp - 0x1a], bl
push eax
push esi
call edx
mov ebx, eax
test edi, edi
je 0x40b6e0
test ebx, ebx
je 0x40b6e0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call edi
cmp dword [ebp - 4], 0
je 0x40b6ef
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
mov dword [ebp - 0xc], edi
pop ecx
test edi, edi
je 0x40b6ef
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call ebx
xor ebx, ebx
cmp dword [ebp - 8], ebx
jbe 0x40b6c0
lea edx, [edi + 0x30]
mov ecx, dword [ebp + 8]
mov eax, dword [edx]
mov si, word [eax]
cmp si, word [ecx]
jne 0x40b6ae
test si, si
je 0x40b6aa
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x40b6ae
add eax, 4
add ecx, 4
test si, si
jne 0x40b688
xor eax, eax
jmp 0x40b6b3
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b6cf
inc ebx
add edx, 0x4c
cmp ebx, dword [ebp - 8]
jb 0x40b683
or ebx, 0xffffffff
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, ebx
jmp 0x40b6f2
imul esi, ebx, 0x4c
add esi, edi
mov edi, dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
jmp 0x40b6c3
mov edx, 0xdef80ae7
xor ecx, ecx
call fcn.00404bfc
push esi
call eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 8