Function at 0x4385a0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
push 0x42a510
lea ecx, [ebp - 0x1c]
call fcn.0043c240
mov esi, eax
mov dword [ebp - 4], 0
cmp dword [esi + 4], 0
jne 0x4385e2
push 1
call fcn.0043d843
add esp, 4
push dword [esi + 4]
push dword [esi]
call fcn.0043e61f
add esp, 8
test eax, eax
je 0x4385fc
push eax
call fcn.0043d816
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
jne 0x438b72
push 0x42a540
lea ecx, [ebp - 0x1c]
call fcn.0043c300
mov esi, eax
mov dword [ebp - 4], 1
cmp dword [esi + 4], 0
jne 0x438640
push 1
call fcn.0043d843
add esp, 4
push dword [esi + 4]
push dword [esi]
call fcn.0043e61f
add esp, 8
test eax, eax
je 0x43865a
push eax
call fcn.0043d816
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
jne 0x438b77
push 0x42a760
lea ecx, [ebp - 0x1c]
call fcn.0043c300
mov esi, eax
mov dword [ebp - 4], 2
cmp dword [esi + 4], 0
jne 0x43869e
push 1
call fcn.0043d843
add esp, 4
push dword [esi + 4]
push dword [esi]
call fcn.0043e61f
add esp, 8
test eax, eax
je 0x4386b8
push eax
call fcn.0043d816
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
jne 0x438b7c
push 0x42a910
lea ecx, [ebp - 0x1c]
call fcn.0043c300
mov esi, eax
mov dword [ebp - 4], 3
cmp dword [esi + 4], 0
jne 0x4386fc
push 1
call fcn.0043d843
add esp, 4
push dword [esi + 4]
push dword [esi]
call fcn.0043e61f
add esp, 8
test eax, eax
je 0x438716
push eax
call fcn.0043d816
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
jne 0x438b81
push 0
call fcn.00464a4d
push eax
call fcn.004633cd
add esp, 8
mov esi, 0xa
nop dword [eax]
call fcn.00437000
mov byte [ebp - 0x10], al
mov ecx, 0x4b4278
push dword [ebp - 0x10]
call fcn.0043b070
call fcn.00437000
mov byte [ebp - 0x14], al
mov ecx, 0x4b4150
push dword [ebp - 0x14]
call fcn.0043b070
call fcn.00437000
mov byte [ebp - 0x18], al
mov ecx, 0x4b4208
push dword [ebp - 0x18]
call fcn.0043b070
sub esi, 1
jne 0x438750
push edi
call fcn.004633ac
cdq
lea ecx, [ebp - 0x2c]
mov edi, 0xb
idiv edi
mov eax, edx
cdq
xor eax, edx
sub eax, edx
lea edx, [eax + 5]
call fcn.004371d0
mov esi, eax
cmp esi, 0x4b40f0
je 0x43883a
mov ecx, dword [0x4b4104]
cmp ecx, 0x10
jb 0x4387f7
mov eax, dword [0x4b40f0]
inc ecx
cmp ecx, 0x1000
jb 0x4387ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438b86
mov eax, edx
push ecx
push eax
call fcn.0043f63c
add esp, 8
mov dword [0x4b4100], 0
mov dword [0x4b4104], 0xf
mov byte [0x4b40f0], 0
movups xmm0, xmmword [esi]
movups xmmword [0x4b40f0], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x4b4100], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x43886e
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x438864
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438b86
push edx
push ecx
call fcn.0043f63c
add esp, 8
call fcn.004633ac
cdq
lea ecx, [ebp - 0x2c]
idiv edi
mov eax, edx
cdq
xor eax, edx
sub eax, edx
lea edx, [eax + 5]
call fcn.004371d0
mov esi, eax
pop edi
cmp esi, 0x4b4168
je 0x43890f
mov ecx, dword [0x4b417c]
cmp ecx, 0x10
jb 0x4388cc
mov eax, dword [0x4b4168]
inc ecx
cmp ecx, 0x1000
jb 0x4388c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438b86
mov eax, edx
push ecx
push eax
call fcn.0043f63c
add esp, 8
mov dword [0x4b4178], 0
mov dword [0x4b417c], 0xf
mov byte [0x4b4168], 0
movups xmm0, xmmword [esi]
movups xmmword [0x4b4168], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x4b4178], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x438943
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x438939
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438b8b
push edx
push ecx
call fcn.0043f63c
add esp, 8
mov dword [ebp - 0x1a], 0x978082c3
xor ecx, ecx
mov word [ebp - 0x16], 0x100
mov al, cl
sub al, 0x13
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 4
jb 0x438952
lea eax, [ebp - 0x1a]
mov byte [ebp - 0x15], 0
push eax
mov ecx, 0x4b4150
call fcn.00439960
cmp dword [0x4b428c], 0x10
mov eax, 0x4b4278
cmovae eax, dword [0x4b4278]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [ebp - 0x1b], 0x80aeacbd
xor ecx, ecx
mov word [ebp - 0x17], 0x81
mov byte [ebp - 0x15], 1
nop
mov al, cl
sub al, 0x13
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 5
jb 0x4389a0
push 0
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x15], 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push 0x4b6eb0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x438a8a
call fcn.00439490
mov dword [eax + 0x10], esi
lea eax, [ebp - 0x24]
push eax
call fcn.00439490
mov eax, dword [eax + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x24]
call fcn.00439490
mov dword [eax + 0x1c], esi
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x20]
call fcn.00439490
mov dword [eax + 0x18], esi
call fcn.00439490
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x20], ecx
call fcn.00439490
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x24], ecx
call fcn.00439490
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x28], ecx
call fcn.00439490
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x2c], ecx
call fcn.0042ab50
movaps xmm0, xmmword [0x493970]
xor ecx, ecx
movups xmmword [ebp - 0x4e], xmm0
mov word [ebp - 0x2e], 0x100
movaps xmm0, xmmword [0x4938e0]
movups xmmword [ebp - 0x3e], xmm0
pop esi
nop dword [eax + eax]
mov al, cl
sub al, 0x13
xor byte [ebp + ecx - 0x4e], al
inc ecx
cmp ecx, 0x20
jb 0x438a60
lea ecx, [ebp - 0x4e]
mov byte [ebp - 0x2d], 0
call fcn.00437270
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x493960]
lea ecx, [ebp - 0x59]
push 5
movups xmmword [ebp - 0x59], xmm0
push 0
movaps xmm0, xmmword [0x493240]
push 0
movups xmmword [ebp - 0x49], xmm0
mov dword [ebp - 0x39], 0x57797e6c
mov dword [ebp - 0x35], 0x275f2650
mov dword [ebp - 0x31], 0x7c5920
mov byte [ebp - 0x2d], 1
mov dword [ebp - 0x1a], 0x9e8a9e82
mov word [ebp - 0x16], 0x100
call fcn.0042edb0
push eax
lea ecx, [ebp - 0x1a]
call fcn.00429f10
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
push 0x429f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [0x493260]
mov ecx, 0x4b4278
movups xmmword [ebp - 0x65], xmm0
push 0x10
movaps xmm0, xmmword [0x4937e0]
movups xmmword [ebp - 0x55], xmm0
mov dword [ebp - 0x35], 0x4f533e73
movaps xmm0, xmmword [0x4937b0]
movups xmmword [ebp - 0x45], xmm0
mov dword [ebp - 0x31], 0x5a4043
mov byte [ebp - 0x2d], 1
call fcn.00439950
push eax
lea ecx, [ebp - 0x65]
call fcn.004371a0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
push 0x64
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Beep]
push 0xa
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00464683
call fcn.00464683
call fcn.00464683
call fcn.00464683
call fcn.00465175
call fcn.00465175
int3