Function at 0x45dbc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f494
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x4c70c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
xor eax, eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
push eax
push 0x104
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], eax
push 0x104
call fcn.0040c470
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x54]
dec ecx
cmp dword [ebp - 0x40], 8
jb 0x45dc3d
mov eax, dword [ebp - 0x54]
push ecx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
jne 0x45dd73
mov byte [ebp - 0x3c], 0x4c
xor ecx, ecx
mov byte [ebp - 0x3b], 0x75
mov byte [ebp - 0x3a], 0x78
mov byte [ebp - 0x39], 0x7c
mov byte [ebp - 0x38], 0x6e
mov byte [ebp - 0x37], 0x4a
mov byte [ebp - 0x36], 0x79
mov byte [ebp - 0x35], 0x79
mov byte [ebp - 0x34], 0x43
mov byte [ebp - 0x33], 0x29
mov byte [ebp - 0x32], 0x4c
mov byte [ebp - 0x31], 0x78
mov byte [ebp - 0x30], 0x7e
mov byte [ebp - 0x2f], 0x75
mov byte [ebp - 0x2e], 0x6d
mov byte [ebp - 0x2d], 0x29
mov byte [ebp - 0x2c], 0x77
mov byte [ebp - 0x2b], 0x78
mov byte [ebp - 0x2a], 0x7d
mov byte [ebp - 0x29], 0x29
mov byte [ebp - 0x28], 0x70
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x7d
mov byte [ebp - 0x25], 0x29
mov byte [ebp - 0x24], 0x79
mov byte [ebp - 0x23], 0x7b
mov byte [ebp - 0x22], 0x78
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1f], 0x7c
mov byte [ebp - 0x1e], 0x29
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x6a
mov byte [ebp - 0x1a], 0x70
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x29
mov byte [ebp - 0x17], 0x77
mov byte [ebp - 0x16], 0x6a
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x3c]
jmp 0x45dd00
mov al, byte [ebp + ecx - 0x3c]
sub al, 9
mov byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0x29
jb 0x45dd00
lea eax, [ebp - 0x3c]
mov ecx, 0x4ca988
push eax
call fcn.0040b6f0
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ecx, dword [ebp - 0x40]
cmp ecx, 8
jb 0x45df14
mov edx, dword [ebp - 0x54]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45dd6c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45df32
push ecx
push edx
jmp 0x45df0c
mov dword [ebp - 0x74], 0x18
xor edx, edx
mov byte [ebp - 0x70], 0x5b
mov byte [ebp - 0x6f], 0x74
mov byte [ebp - 0x6e], 0x77
mov byte [ebp - 0x6d], 0x6b
mov byte [ebp - 0x6c], 0x7d
mov byte [ebp - 0x6b], 0x59
mov byte [ebp - 0x6a], 0x68
mov byte [ebp - 0x69], 0x68
mov byte [ebp - 0x68], 0x22
mov byte [ebp - 0x67], 0x38
mov byte [ebp - 0x66], 0x48
mov byte [ebp - 0x65], 0x6a
mov byte [ebp - 0x64], 0x77
mov byte [ebp - 0x63], 0x7b
mov byte [ebp - 0x62], 0x7d
mov byte [ebp - 0x61], 0x6b
mov byte [ebp - 0x60], 0x6b
mov byte [ebp - 0x5f], 0x38
mov byte [ebp - 0x5e], 0x68
mov byte [ebp - 0x5d], 0x79
mov byte [ebp - 0x5c], 0x6c
mov byte [ebp - 0x5b], 0x70
mov byte [ebp - 0x5a], 0x22
mov byte [ebp - 0x59], 0x38
mov al, byte [ebp - 0x70]
mov byte [ebp - 0x58], 0
mov al, byte [ebp + edx - 0x70]
mov ecx, dword [ebp - 0x74]
xor cl, al
mov byte [ebp + edx - 0x70], cl
inc edx
cmp edx, 0x18
jb 0x45dde3
sub esp, 0x18
mov byte [ebp - 0x58], 0
mov ecx, esp
lea edx, [ebp - 0x54]
push 0
call fcn.004612d0
add esp, 4
lea eax, [ebp - 0x70]
mov ecx, 0x4ca988
push eax
call fcn.0040b380
mov edi, dword [ebp - 0x40]
lea edx, [ebp - 0x54]
mov ebx, dword [ebp - 0x54]
cmp edi, 8
jb 0x45de2a
mov edx, ebx
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x45de59
lea eax, [ecx - 1]
cmp eax, 0xffffffff
jb 0x45de3c
or eax, 0xffffffff
cmp word [edx + eax*2], 0x5c
lea eax, [edx + eax*2]
je 0x45de53
cmp eax, edx
je 0x45de59
sub eax, 2
cmp word [eax], 0x5c
jne 0x45de46
sub eax, edx
sar eax, 1
jmp 0x45de5c
or eax, 0xffffffff
lea edx, [ebp - 0x54]
mov dword [ebp - 0x78], edx
cmp edi, 8
jb 0x45de6c
mov edx, ebx
mov dword [ebp - 0x78], ebx
test ecx, ecx
je 0x45de9c
xor edi, edi
test ecx, ecx
je 0x45de91
mov esi, dword [ebp - 0x78]
cmp word [esi], di
mov esi, dword [ebp - 0x7c]
je 0x45de8f
cmp ecx, 1
je 0x45de91
add edx, 2
dec ecx
cmp word [edx], di
jne 0x45de81
mov edi, edx
test edi, edi
je 0x45de9c
sub edi, dword [ebp - 0x78]
sar edi, 1
jmp 0x45de9f
or edi, 0xffffffff
mov ecx, edi
sub ecx, eax
dec ecx
cmp eax, 0xffffffff
je 0x45dec7
cmp edi, 0xffffffff
je 0x45dec7
inc eax
cmp eax, edi
jae 0x45dec7
test ecx, ecx
jle 0x45dec7
push ecx
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.0040acd0
jmp 0x45dd38
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, dword [ebp - 0x40]
cmp eax, 8
jb 0x45df14
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x45df0a
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45df32
push ecx
push ebx
call fcn.00435dd2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00435b39
mov esp, ebp
pop ebp
ret
call fcn.0043f67c
int3