Function at 0x401f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3e4b
mov eax, dword fs:[0]
push eax
sub esp, 0x1f4
mov eax, dword [0x4f6040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1d4], esi
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 0x1e0], esi
lea ecx, [ebp - 0xd0]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0xc0], 0
push str._Content_Types_.xml
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xbc], 0
call fcn.0040bd30
mov dword [ebp - 4], 0
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x1d0]
call fcn.00408100
mov byte [ebp - 4], 1
mov dword [ebp - 0x1b8], 0
mov byte [ebp - 0x1b4], 1
mov byte [ebp - 4], 2
xorps xmm0, xmm0
push 0x10
push str.AppxBlockMap.xml
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa8], 0
movups xmmword [ebp - 0xb8], xmm0
mov dword [ebp - 0xa4], 0
call fcn.0040bd30
mov byte [ebp - 4], 3
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.00408100
mov byte [ebp - 4], 4
mov dword [ebp - 0x198], 0
mov byte [ebp - 0x194], 0
mov byte [ebp - 4], 5
xorps xmm0, xmm0
push 0x10
push str.AppxManifest.xml
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x90], 0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.0040bd30
mov byte [ebp - 4], 6
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x190]
call fcn.00408100
mov byte [ebp - 4], 7
mov dword [ebp - 0x178], 0x4fa3ec
mov byte [ebp - 0x174], 1
mov byte [ebp - 4], 8
xorps xmm0, xmm0
push 0x16
push str.FilesystemMetadata.xml
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], 0
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x74], 0
call fcn.0040bd30
mov byte [ebp - 4], 9
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x170]
call fcn.00408100
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x158], 0x4fa40c
mov byte [ebp - 0x154], 1
mov byte [ebp - 4], 0xb
push 0x12
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
push str.PackageHistory.xml
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x5c], 0
movups xmmword [ebp - 0x70], xmm0
call fcn.0040bd30
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x150]
call fcn.00408100
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x134], 1
mov byte [ebp - 4], 0xe
xorps xmm0, xmm0
push 0xc
push str.Registry.dat
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0
call fcn.0040bd30
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x130]
call fcn.00408100
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x118], 0
mov byte [ebp - 0x114], 0
mov byte [ebp - 4], 0x11
xorps xmm0, xmm0
push 0xd
push str.StreamMap.xml
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.0040bd30
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x110]
call fcn.00408100
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xf8], 0x4fa42c
mov byte [ebp - 0xf4], 1
mov byte [ebp - 4], 0x14
xorps xmm0, xmm0
push 0x11
push str.AppxSignature.p7x
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.0040bd30
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00408100
mov byte [ebp - 4], 0x16
mov dword [ebp - 0xd8], 0
mov byte [ebp - 0xd4], 0
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0xd0]
lea ecx, [ebp - 0x1d0]
push eax
push ecx
lea ecx, [ebp - 0x200]
lea edi, [esi + 0x174]
call fcn.00407d40
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp + 8]
push eax
sub esp, 0x20
mov dword [esi + 8], eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1dc], esp
mov ecx, esp
mov dword [esi], 0x4d9510
add esi, 0xc
push eax
call fcn.0043a840
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x1f
mov ecx, esi
call fcn.00450900
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x1d4]
push dword [eax + 8]
lea ecx, [eax + 0x90]
mov dword [eax + 0x8c], edi
push edi
push esi
call fcn.0043a950
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x1f4]
call fcn.00407c60
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0x1fc]
call fcn.00409350
push 0x28
push dword [ebp - 0x1fc]
call fcn.00486428
add esp, 8
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x1d0]
push 0x401df0
push 8
push 0x20
push eax
call fcn.00486493
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x4022f8
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4022ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402617
push ecx
push edx
call fcn.00486428
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x40234a
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402340
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402617
push ecx
push edx
call fcn.00486428
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x40239c
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402392
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402617
push ecx
push edx
call fcn.00486428
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x5c]
cmp ecx, 7
jbe 0x4023ee
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4023e4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402617
push ecx
push edx
call fcn.00486428
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x74]
cmp ecx, 7
jbe 0x402443
mov edx, dword [ebp - 0x88]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402439
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402617
push ecx
push edx
call fcn.00486428
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x8c]
cmp ecx, 7
jbe 0x40249e
mov edx, dword [ebp - 0xa0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402494
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402617
push ecx
push edx
call fcn.00486428
add esp, 8
xor eax, eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0xa4]
cmp ecx, 7
jbe 0x4024ff
mov edx, dword [ebp - 0xb8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4024f5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402617
push ecx
push edx
call fcn.00486428
add esp, 8
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0xbc]
cmp ecx, 7
jbe 0x402560
mov edx, dword [ebp - 0xd0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402556
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402617
push ecx
push edx
call fcn.00486428
add esp, 8
mov ecx, dword [ebp - 0x1d4]
xor eax, eax
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x1dc], edi
xor esi, esi
mov word [ebp - 0xd0], ax
lea eax, [edi + 4]
mov dword [ecx], 0x4d3858
mov dword [ecx + 0x170], edx
mov dword [edi], 0x4d75b0
mov dword [ebp - 0x1d8], eax
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 7
mov word [eax], si
mov byte [ebp - 4], 0x32
mov byte [edi + 0x1c], 0
mov byte [ebp - 4], 0x33
mov dword [edi], 0x4d758c
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], esi
mov byte [ebp - 4], 0x35
mov byte [ecx + 0x19c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048641a
mov esp, ebp
pop ebp
ret 4
call fcn.0048b78f
int3