Function at 0x411d70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
xor edx, edx
mov ecx, edx
mov al, byte [esp + ecx + 0x2c]
sub al, 0x79
mov byte [esp + ecx + 0xd0], al
inc ecx
cmp ecx, 5
stc
invalid
jl 0x411cb6
mov byte [esp + 0xd5], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x64]
xor al, 0xb7
mov byte [esp + ecx + 0xf0], al
inc ecx
cmp ecx, 0xc
jl 0x411cd2
mov byte [esp + 0xfc], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x10]
xor al, 0xad
mov byte [esp + ecx + 0x100], al
inc ecx
cmp ecx, 0xc
jl 0x411cee
mov byte [esp + 0x10c], dl
mov ecx, edx
mov al, byte [esp + ecx + 0x70]
add al, 0x20
mov byte [esp + ecx + 0x110], al
inc ecx
cmp ecx, 0xf
jl 0x411d0a
mov byte [esp + 0x11f], dl
mov ecx, edx
mov word [esp + 0x28], 0x5f
mov dword [esp + 0x34], 0x8989beb9
xor al, 0xb9
mov esi, 0x44c78989
and al, 0x38
mov dword [ecx + 0x44c78989], ecx
and al, 0x3c
mov dword [ecx + 0x44c78989], ecx
and al, 0x40
mov dword [ecx - 0x38997677], ecx
inc esp
and al, 0x44
mov dword [ecx + 0x462444c6], edi
invalid
mov al, byte [esp + ecx + 0x34]
xor al, 0xb4
mov byte [esp + ecx + 0x120], al
inc ecx
cmp ecx, 0x13
jl 0x411d59
lea eax, [esp + 0xd0]
mov byte [esp + 0x133], dl
push eax
call fcn.00416cbb
pop ecx
push eax
lea edx, [esp + 0xd4]
lea ecx, [esp + 0x58]
call 0x42ca09
pop ecx
push 0
push dword [esp + 0x24]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 0
push dword [esp + 0x28]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x58]
call 0x42cb87
pop ecx
lea eax, [esp + 0xf0]
push eax
call fcn.00416cfe
pop ecx
push eax
lea edx, [esp + 0xf4]
lea ecx, [esp + 0x58]
call 0x42ca4c
pop ecx
push 1
push dword [esp + 0x24]
call dword [esi + 0x20]
pop ecx
pop ecx
push eax
push 1
push dword [esp + 0x28]
call dword [esi + 0x10]
pop ecx
pop ecx
mov edx, eax
lea ecx, [esp + 0x58]
call 0x42cbca
pop ecx
lea eax, [esp + 0x100]
push eax
call fcn.00416d41
pop ecx
push eax
lea edx, [esp + 0x104]
lea ecx, [esp + 0x58]
call 0x42ca8f
pop ecx
push 2
push dword [esp + 0x24]
call dword [esi + 0x14]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x411ece
push 2
push dword [esp + 0x24]
call dword [esi + 0x20]
cmp byte [edi], 0x76
mov edx, eax
pop ecx
pop ecx
jne 0x411e7e
cmp byte [edi + 1], 0x31
lea eax, [edi + 2]
jne 0x411e7e
cmp byte [eax], 0x30
je 0x411e53
cmp byte [eax], 0x31
jne 0x411e7e
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call 0x420ad6
mov edi, eax
pop ecx
test edi, edi
je 0x411ece
push dword [esp + 0x24]
mov edx, edi
lea ecx, [esp + 0x58]
call 0x42caec
pop ecx
push edi
call fcn.00416967
jmp 0x411ecd
lea eax, [esp + 0xe8]
mov dword [esp + 0xe0], edx
push eax
xor eax, eax
mov dword [esp + 0xe8], edi
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0xf8]
mov edx, 0xbedfd981
push eax
push 3
pop ecx
call 0x423f52
call eax
test eax, eax
je 0x411ece
push dword [esp + 0xe8]
mov edx, dword [esp + 0xf0]
lea ecx, [esp + 0x58]
call 0x42cb44
pop ecx
lea eax, [esp + 0x110]
push eax
call fcn.00416e16
pop ecx
push eax
lea edx, [esp + 0x114]
lea ecx, [esp + 0x58]
call 0x42cb64
pop ecx
mov edx, ebx
lea ecx, [esp + 0x54]
call 0x42c9f7
lea eax, [esp + 0x28]
push eax
call fcn.00416e3e
pop ecx
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x58]
call 0x42cb89
mov edx, dword [esp + 0x1c0]
pop ecx
lea ecx, [esp + 0x54]
call 0x42ca21
lea eax, [esp + 0x120]
push eax
call fcn.00416e6b
pop ecx
push eax
lea edx, [esp + 0x124]
lea ecx, [esp + 0x58]
call 0x42cbb9
pop ecx
push dword [esp + 0x20]
call dword [esi + 0xc]
pop ecx
cmp eax, 0x64
je 0x411cb2
mov ebx, dword [esp + 0xc4]