Function at 0x44155b
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Parse pe header

Disassembly:
sub esp, 0x78
movaps xmm0, xmmword [0x4085e0]
push ebx
push ebp
push esi
mov dword [esp + 0x20], edx
mov esi, ecx
xor edx, edx
mov dword [esp + 0x14], esi
push edi
movups xmmword [esp + 0x38], xmm0
mov dword [esp + 0x48], 0x4c787973
mov ecx, edx
mov dword [esp + 0x4c], 0x786b5283
mov dword [esp + 0x50], 0x6f766e
movsx eax, byte [esp + 0x38]
and eax, 0x8000000f
jns 0x4415a5
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x39], al
inc ecx
cmp ecx, 0x1a
jb 0x441594
mov byte [esp + 0x53], dl
mov al, 9
mov dword [esp + 0x28], 0x7b6e5409
mov ecx, edx
mov dword [esp + 0x2c], 0x3c756e77
mov dword [esp + 0x30], 0x756d373b
mov word [esp + 0x34], 0x75
movsx eax, al
and eax, 0x8000000f
jns 0x4415e5
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0xc
jae 0x4415f5
mov al, byte [esp + 0x28]
jmp 0x4415d6
mov byte [esp + 0x35], dl
lea ecx, [esp + 0x29]
lea edx, [esp + 0x39]
call fcn.0040c457
lea ecx, [esp + 0x54]
push ecx
push esi
call eax
test eax, eax
jne 0x44161c
mov eax, 0x200
jmp 0x441b5f
mov ebx, dword [esp + 0x54]
mov edi, 0x41000000
mov esi, ebx
mov eax, ebx
and esi, 1
mov ebp, ebx
mov ecx, esi
or ecx, 2
and al, 2
mov eax, ebx
cmove ecx, esi
mov edx, ecx
or edx, 4
and al, 4
cmove edx, ecx
mov eax, edx
or eax, 0x10
and ebp, 0x10
cmove eax, edx
mov ecx, eax
or ecx, 0x20
and bl, 0x20
cmove ecx, eax
test ebp, ebp
mov eax, 0x81000000
cmove edi, eax
or edi, ecx
test esi, esi
jne 0x44167b
test ebp, ebp
mov edi, 0x41800000
mov eax, 0x81800000
cmove edi, eax
or edi, ecx
xor edx, edx
mov dword [esp + 0x28], 0x7a6b4d66
push 0xb
mov al, 0x66
mov dword [esp + 0x30], 0x6b726f4c
mov dword [esp + 0x34], 0x6b806f59
mov ecx, edx
mov byte [esp + 0x38], dl
pop ebx
movsx eax, al
and eax, 0x8000000f
jns 0x4416af
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, ebx
jae 0x4416be
mov al, byte [esp + 0x28]
jmp 0x4416a0
push 0x1a
pop ecx
mov byte [esp + 0x34], dl
mov eax, edx
mov byte [esp + 0x38], cl
mov dword [esp + 0x39], 0x74687f51
mov dword [esp + 0x3d], 0x2829767f
mov dword [esp + 0x41], 0x76767e34
mov byte [esp + 0x45], dl
xor byte [esp + eax + 0x39], cl
inc eax
cmp eax, 0xc
jae 0x4416f7
mov cl, byte [esp + 0x38]
jmp 0x4416e7
mov byte [esp + 0x45], dl
lea ecx, [esp + 0x39]
lea edx, [esp + 0x29]
call fcn.0040c457
mov ebp, dword [esp + 0x18]
push 0
push ebp
call eax
mov esi, eax
cmp esi, 0x28
jbe 0x441aa8
movaps xmm0, xmmword [0x407300]
xor edx, edx
movups xmmword [esp + 0x28], xmm0
mov ecx, edx
movsx eax, byte [esp + 0x28]
and eax, 0x8000000f
jns 0x44173d
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0xe
jb 0x44172c
mov byte [esp + 0x37], dl
mov cl, 0x4a
mov dword [esp + 0x38], 0x382f014a
mov eax, edx
mov dword [esp + 0x3c], 0x79262f24
mov dword [esp + 0x40], 0x262e6478
mov word [esp + 0x44], 0x26
xor byte [esp + eax + 0x39], cl
inc eax
cmp eax, 0xc
jae 0x44177e
mov cl, byte [esp + 0x38]
jmp 0x44176e
mov byte [esp + 0x45], dl
lea ecx, [esp + 0x39]
lea edx, [esp + 0x29]
call fcn.0040c457
xor ecx, ecx
push ecx
push ecx
push ecx
push ebp
call eax
mov byte [esp + 0x28], bl
xor eax, eax
mov dword [esp + 0x29], 0x6f6a6e59
mov dword [esp + 0x2d], 0x6e67624d
mov byte [esp + 0x31], 0
xor byte [esp + eax + 0x29], bl
inc eax
cmp eax, 8
jae 0x4417c2
mov bl, byte [esp + 0x28]
jmp 0x4417b2
xor ebx, ebx
mov dword [esp + 0x38], 0x7f68460d
mov byte [esp + 0x31], bl
mov cl, 0xd
mov dword [esp + 0x3c], 0x3e616863
mov eax, ebx
mov dword [esp + 0x40], 0x6169233f
mov word [esp + 0x44], 0x61
xor byte [esp + eax + 0x39], cl
inc eax
cmp eax, 0xc
jae 0x4417fb
mov cl, byte [esp + 0x38]
jmp 0x4417eb
lea edx, [esp + 0x29]
mov byte [esp + 0x45], bl
lea ecx, [esp + 0x39]
call fcn.0040c457
push ebx
lea ecx, [esp + 0x20]
push ecx
push 2
lea ecx, [esp + 0x20]
push ecx
push ebp
call eax
movaps xmm0, xmmword [0x4070a0]
mov ecx, ebx
movups xmmword [esp + 0x28], xmm0
mov al, byte [esp + 0x28]
xor byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0xe
jb 0x44182a
mov byte [esp + 0x37], bl
mov al, 0x5c
mov dword [esp + 0x38], 0x7e71575c
mov ecx, ebx
mov dword [esp + 0x3c], 0x3f78717a
mov dword [esp + 0x40], 0x78703a3e
mov word [esp + 0x44], 0x78
movsx eax, al
and eax, 0x8000000f
jns 0x44186e
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x39], al
inc ecx
cmp ecx, 0xc
jae 0x44187e
mov al, byte [esp + 0x38]
jmp 0x44185f
lea edx, [esp + 0x29]
mov byte [esp + 0x45], bl
lea ecx, [esp + 0x39]
call fcn.0040c457
push ebx
push ebx
push 0x24
push ebp
call eax
mov al, 0x4e
mov dword [esp + 0x28], 0x6f73604e
mov dword [esp + 0x2c], 0x7a775472
mov ecx, ebx
mov word [esp + 0x30], 0x73
movsx eax, al
and eax, 0x8000000f
jns 0x4418c0
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 8
jae 0x4418d0
mov al, byte [esp + 0x28]
jmp 0x4418b1
mov byte [esp + 0x31], bl
mov al, 0x75
mov dword [esp + 0x38], 0x776a5075
mov ecx, ebx
mov dword [esp + 0x3c], 0x38716a73
mov dword [esp + 0x40], 0x71693337
mov word [esp + 0x44], 0x71
movsx eax, al
and eax, 0x8000000f
jns 0x441906
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x39], al
inc ecx
cmp ecx, 0xc
jae 0x441916
mov al, byte [esp + 0x38]
jmp 0x4418f7
lea edx, [esp + 0x29]
mov byte [esp + 0x45], bl
lea ecx, [esp + 0x39]
call fcn.0040c457
push ebx
lea ecx, [esp + 0x20]
push ecx
push 4
lea ecx, [esp + 0x24]
push ecx
push ebp
call eax
mov eax, 0x54ad
cmp word [esp + 0x14], ax
jne 0x441aa8
mov eax, dword [esp + 0x18]
add eax, 0x34
cmp esi, eax
jbe 0x441aa8
movaps xmm0, xmmword [0x407280]
mov ecx, ebx
movups xmmword [esp + 0x28], xmm0
movsx eax, byte [esp + 0x28]
and eax, 0x8000000f
jns 0x441975
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0xe
jb 0x441964
mov byte [esp + 0x37], bl
mov al, 7
mov dword [esp + 0x38], 0x796c5207
mov ecx, ebx
mov dword [esp + 0x3c], 0x3a736c75
mov dword [esp + 0x40], 0x736b3539
mov word [esp + 0x44], 0x73
movsx eax, al
and eax, 0x8000000f
jns 0x4419b5
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x39], al
inc ecx
cmp ecx, 0xc
jae 0x4419c5
mov al, byte [esp + 0x38]
jmp 0x4419a6
lea edx, [esp + 0x29]
mov byte [esp + 0x45], bl
lea ecx, [esp + 0x39]
call fcn.0040c457
push ebx
push ebx
push dword [esp + 0x20]
push ebp
call eax
mov al, 0x7d
mov dword [esp + 0x28], 0x6e725f7d
mov dword [esp + 0x2c], 0x79765371
mov ecx, ebx
mov word [esp + 0x30], 0x72
movsx eax, al
and eax, 0x8000000f
jns 0x441a09
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 8
jae 0x441a19
mov al, byte [esp + 0x28]
jmp 0x4419fa
push 0x28
pop eax
mov byte [esp + 0x31], bl
mov ecx, ebx
mov byte [esp + 0x38], al
mov dword [esp + 0x39], 0x767a6d53
mov dword [esp + 0x3d], 0x3a3b746d
mov dword [esp + 0x41], 0x74746c36
mov byte [esp + 0x45], bl
movsx eax, al
and eax, 0x8000000f
jns 0x441a51
dec eax
or eax, 0xfffffff0
inc eax
sub byte [esp + ecx + 0x39], al
inc ecx
cmp ecx, 0xc
jae 0x441a61
mov al, byte [esp + 0x38]
jmp 0x441a42
lea edx, [esp + 0x29]
mov byte [esp + 0x45], bl
lea ecx, [esp + 0x39]
call fcn.0040c457
push ebx
lea ecx, [esp + 0x20]
push ecx
push 4
lea ecx, [esp + 0x2c]
push ecx
push ebp
call eax
mov eax, dword [esp + 0x20]
cmp eax, 0x5a4d
je 0x441aa2
cmp eax, 0x454e
je 0x441aa2
cmp eax, 0x454c
je 0x441aa2
cmp eax, 0x4550
jne 0x441aa8
or edi, 0x400000
mov eax, dword [esp + 0x24]
test eax, eax
je 0x441ab2
mov dword [eax], edi
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x441abf
mov dword [eax], esi
mov esi, dword [esp + 0x90]
test esi, esi
je 0x441b2c
mov ecx, dword [esp + 0x60]
mov ebp, 0xd53e8000
mov eax, dword [esp + 0x64]
sub ecx, ebp
push 0
mov ebx, 0x19db1de
mov edi, 0x989680
push edi
sbb eax, ebx
push eax
push ecx
call fcn.00453240
mov ecx, dword [esp + 0x68]
mov dword [esi], eax
sub ecx, ebp
mov eax, dword [esp + 0x6c]
push 0
push edi
sbb eax, ebx
mov dword [esi + 4], edx
push eax
push ecx
call fcn.00453240
mov ecx, dword [esp + 0x58]
mov dword [esi + 8], eax
sub ecx, ebp
mov eax, dword [esp + 0x5c]
push 0
push edi
sbb eax, ebx
mov dword [esi + 0xc], edx
push eax
push ecx
call fcn.00453240
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x94]
test esi, esi
je 0x441b5d
push dword [esp + 0x6c]
lea edx, [esp + 0x1c]
push dword [esp + 0x6c]
lea ecx, [esp + 0x1c]
call fcn.0044148d
movzx ecx, word [esp + 0x14]
movzx eax, word [esp + 0x18]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78
ret 0xc