Function at 0x40d3b8
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff18
push ebx
push esi
push edi
mov dword [ebp - 0x88], eax
mov eax, 0x7cc8b0
call fcn.007b7c14
mov word [ebp - 0x74], 0xc
mov word [ebp - 0x74], 0x18
lea eax, [ebp - 8]
call fcn.00402e20
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
mov word [ebp - 0x74], 0x24
mov edx, dword [ebp - 0x88]
add edx, 4
mov dword [ebp - 0x90], edx
mov edx, 0x7e9938
mov eax, dword [ebp - 0x90]
call fcn.007c54f4
mov ecx, dword [ebp - 0x88]
add ecx, 0xc
mov dword [ebp - 0x94], ecx
mov word [ebp - 0x74], 0x30
mov edx, str.Datamaster.mdf
lea eax, [ebp - 0x10]
xor ecx, ecx
call fcn.007c5314
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x14]
inc dword [ebp - 0x68]
mov eax, dword [ebp - 0x88]
add eax, 4
pop edx
call fcn.00402e50
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x94]
call fcn.007c54f4
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00402554
mov ecx, dword [ebp - 0x88]
add ecx, 8
mov dword [ebp - 0x98], ecx
mov word [ebp - 0x74], 0x3c
mov edx, str.Datamastlog.ldf
lea eax, [ebp - 0x18]
xor ecx, ecx
call fcn.007c5314
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x1c]
inc dword [ebp - 0x68]
mov eax, dword [ebp - 0x88]
add eax, 4
pop edx
call fcn.00402e50
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x98]
call fcn.007c54f4
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00402554
mov ecx, dword [ebp - 0x88]
add ecx, 0x10
mov dword [ebp - 0x9c], ecx
mov word [ebp - 0x74], 0x48
mov edx, str.DataERRORLOG.log
lea eax, [ebp - 0x20]
xor ecx, ecx
call fcn.007c5314
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x24]
inc dword [ebp - 0x68]
mov eax, dword [ebp - 0x88]
add eax, 4
pop edx
call fcn.00402e50
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x9c]
call fcn.007c54f4
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00402554
mov eax, dword [ebp - 0x88]
call fcn.0040f364
mov eax, dword [ebp - 0x88]
call fcn.0040da08
mov word [ebp - 0x74], 0x54
mov edx, 0x7cc1b1
lea eax, [ebp - 0x4c]
xor ecx, ecx
call fcn.007c5314
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
lea edx, [ebp - 0x4c]
push edx
mov edx, 0x7cc1ad
lea eax, [ebp - 0x40]
xor ecx, ecx
call fcn.007c5314
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
lea eax, [ebp - 0x40]
push eax
mov edx, 0x7cc1a9
lea eax, [ebp - 0x34]
xor ecx, ecx
call fcn.007c5314
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
lea edx, [ebp - 0x34]
push edx
mov edx, str.binn_sqlservr.exe__c__x__s
lea eax, [ebp - 0x28]
xor ecx, ecx
call fcn.007c5314
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
inc dword [ebp - 0x68]
mov eax, dword [ebp - 0x88]
add eax, 4
pop edx
call fcn.00402e50
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x30]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x30]
inc dword [ebp - 0x68]
mov edx, dword [ebp - 0x88]
add edx, 0x28
pop eax
call fcn.00402e50
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x38]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x38]
inc dword [ebp - 0x68]
pop eax
pop edx
call fcn.00402e50
lea ecx, [ebp - 0x38]
push ecx
lea eax, [ebp - 0x3c]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x3c]
inc dword [ebp - 0x68]
mov edx, dword [ebp - 0x88]
add edx, 0xc
pop eax
call fcn.00402e50
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x44]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x44]
inc dword [ebp - 0x68]
pop eax
pop edx
call fcn.00402e50
lea ecx, [ebp - 0x44]
push ecx
lea eax, [ebp - 0x48]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x48]
inc dword [ebp - 0x68]
mov edx, dword [ebp - 0x88]
add edx, 8
pop eax
call fcn.00402e50
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x50]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x50]
inc dword [ebp - 0x68]
pop eax
pop edx
call fcn.00402e50
lea ecx, [ebp - 0x50]
push ecx
lea eax, [ebp - 0x54]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0x54]
inc dword [ebp - 0x68]
mov edx, dword [ebp - 0x88]
add edx, 0x10
pop eax
call fcn.00402e50
lea edx, [ebp - 0x54]
lea eax, [ebp - 8]
call fcn.007c54f4
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00402554
push 0x10
push 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x14
push ecx
call fcn.007b76df
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0xe8]
push eax
call fcn.007b76df
add esp, 0xc
mov dword [ebp - 0xe8], 0x44
push 0xff
call fcn.007ae9c8
pop ecx
mov dword [ebp - 0xa0], eax
mov word [ebp - 0x74], 0x24
mov word [ebp - 0x74], 0x60
mov edx, str.binn_
lea eax, [ebp - 0x58]
xor ecx, ecx
call fcn.007c5314
inc dword [ebp - 0x68]
inc dword [ebp - 0x68]
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0xc]
call fcn.00402e20
inc dword [ebp - 0x68]
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x68]
mov eax, dword [ebp - 0x88]
add eax, 4
pop edx
call fcn.00402e50
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00402554
mov word [ebp - 0x74], 0x24
push 0xff
push 0
push dword [ebp - 0xa0]
call fcn.007b76df
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x40d8aa
mov ecx, 0x7cc1bb
jmp 0x40d8ad
mov ecx, dword [ebp - 0xc]
push ecx
push dword [ebp - 0xa0]
call fcn.007b78b0
add esp, 8
mov eax, dword [ebp - 0x88]
add eax, 0x14
push eax
lea edx, [ebp - 0xe8]
push edx
push dword [ebp - 0xa0]
push 0
push 0x8000000
push 1
push 0
push 0
cmp dword [ebp - 8], 0
jne 0x40d8ed
mov eax, 0x7cc1bc
jmp 0x40d8f0
mov eax, dword [ebp - 8]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 0x89], dl
sub dword [ebp - 0x68], 2
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00402554
sub dword [ebp - 0x68], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402554
mov word [ebp - 0x74], 0xc
mov word [ebp - 0x74], 0
jmp 0x40d9ed
mov al, byte [ebp - 0x89]
mov edx, dword [ebp - 0x84]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret