Function at 0x4110b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x47f470
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4ad980]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ad980]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
xor ebx, ebx
mov byte [esp + 0x4c], 0x40
mov byte [esp + 0x4d], 0x23
mov byte [esp + 0x4e], 0x25
mov byte [esp + 0x4f], 0x2a
mov byte [esp + 0x50], 0x3a
mov byte [esp + 0x51], 0x3b
mov byte [esp + 0x52], 0x2d
mov byte [esp + 0x53], 0x5f
mov byte [esp + 0x54], 0x2b
cmp eax, ebx
je 0x4112e6
cmp ebp, ebx
je 0x4112e6
xor ecx, ecx
mov word [esp + 0x34], cx
mov edi, 7
mov ecx, eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x411142
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x34]
call fcn.0040bfd0
mov dword [esp + 0x64], ebx
xor edx, edx
mov eax, ebp
mov word [esp + 0x18], dx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x411173
sub eax, edx
sar eax, 1
push eax
mov eax, ebp
lea esi, [esp + 0x18]
call fcn.0040bfd0
mov byte [esp + 0x64], 1
mov eax, dword [esp + 0x34]
mov esi, 8
cmp dword [esp + 0x48], esi
jae 0x4111a6
lea eax, [esp + 0x34]
push 0x490a38
push eax
call fcn.00465096
mov ebp, eax
add esp, 8
cmp ebp, ebx
jne 0x4111e7
push 0x490a40
call fcn.00466185
add esp, 4
mov byte [esp + 0x64], bl
cmp dword [esp + 0x2c], esi
jb 0x4112ad
mov eax, dword [esp + 0x18]
push eax
call fcn.00444924
add esp, 4
jmp 0x4112ad
push ebx
push ebx
push ebp
call fcn.00465c38
push 2
push ebx
push ebp
call fcn.00465c38
push ebp
call fcn.00465e5a
push ebx
push ebx
push ebp
mov esi, eax
call fcn.00465c38
push esi
call fcn.00444919
push ebp
push esi
mov edi, eax
push 1
push edi
call fcn.00466168
add esp, 0x3c
xor ecx, ecx
cmp esi, ebx
jle 0x41123c
mov eax, ecx
cdq
mov ebx, 9
idiv ebx
inc ecx
mov dl, byte [esp + edx + 0x4c]
xor byte [ecx + edi - 1], dl
cmp ecx, esi
jl 0x411223
xor ebx, ebx
push ebp
call fcn.0046535b
mov eax, dword [esp + 0x1c]
add esp, 4
cmp dword [esp + 0x2c], 8
jae 0x411254
lea eax, [esp + 0x18]
push 0x490a58
push eax
call fcn.00465096
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x411283
push ebx
push ebx
push ebp
call fcn.00465c38
push ebp
push esi
push 1
push edi
call fcn.00465262
push ebp
call fcn.0046535b
add esp, 0x20
push edi
call fcn.00444924
add esp, 4
mov byte [esp + 0x64], bl
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x4112a8
mov eax, dword [esp + 0x18]
push eax
call fcn.00444924
add esp, 4
mov edi, 7
xor ecx, ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], cx
mov dword [esp + 0x64], 0xffffffff
cmp dword [esp + 0x48], esi
jb 0x4112d7
mov edx, dword [esp + 0x34]
push edx
call fcn.00444924
add esp, 4
xor eax, eax
mov word [esp + 0x34], ax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004644a2
add esp, 0x54
ret