Function at 0x404fa0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4430d6
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x459054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x420], ebx
push 0x105
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.00427f80
add esp, 0xc
lea eax, [ebp - 0x24c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov esi, dword [ebx + 0x264]
cmp esi, dword [ebx + 0x268]
je 0x405366
mov edi, 1
cmp dword [esi + 0x58], 0x10
jb 0x40502f
mov eax, dword [esi + 0x44]
jmp 0x405032
lea eax, [esi + 0x44]
push eax
lea eax, [ebp - 0x384]
push eax
call fcn.0040ccc0
push 0
lea eax, [ebp - 0x384]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.0040cb80
add esp, 0x14
mov ecx, dword [esi + 0xc]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x405086
cmp dword [ebp - 0x358], 8
lea eax, [ebp - 0x36c]
push ecx
cmovae eax, dword [ebp - 0x36c]
mov ecx, ebx
push eax
call fcn.00407270
mov eax, dword [esi + 0x10]
cmp eax, 1
je 0x405097
cmp eax, 2
jne 0x4052d9
push 0x105
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.00427f80
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x144]
push 0x105
push eax
call fcn.0042b761
add esp, 0x18
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
cmp dword [ebp - 0x370], 0x10
lea eax, [ebp - 0x384]
cmovae eax, dword [ebp - 0x384]
push eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4052d9
push 0x40
lea eax, [ebp - 0x3c4]
push 0
push eax
call fcn.00427f80
add esp, 0xc
mov dword [ebp - 0x3c8], 0x44
lea eax, [ebp - 0x3d8]
mov dword [ebp - 0x39c], 1
xorps xmm0, xmm0
mov word [ebp - 0x398], di
movups xmmword [ebp - 0x3d8], xmm0
push eax
lea eax, [ebp - 0x3c8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x144]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x405191
push dword [ebp - 0x3d4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x3d8]
call edi
jmp 0x4052d4
cmp eax, 0x2e4
jne 0x4052c4
push 0x105
lea eax, [ebp - 0x354]
push 0
push eax
call fcn.00427f80
movaps xmm0, xmmword [str._app_s__chnid_s__ver_s__cverLHE]
add esp, 0xc
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x1c], 0x2f207325
movaps xmm0, xmmword [0x4460c0]
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0x3d736441
mov word [ebp - 0x14], 0x6425
mov byte [ebp - 0x12], 0
call fcn.00401570
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x41c], eax
call fcn.00401570
add eax, 0xd0
mov dword [ebp - 0x418], eax
cmp dword [eax + 0x14], 0x10
jb 0x40520c
mov eax, dword [eax]
mov dword [ebp - 0x418], eax
call fcn.00401570
cmp dword [eax + 0xb4], 0x10
lea ebx, [eax + 0xa0]
jb 0x405222
mov ebx, dword [ebx]
call fcn.00401570
cmp dword [eax + 0x48], 0x10
lea edi, [eax + 0x34]
jb 0x405232
mov edi, dword [edi]
call fcn.00401570
add eax, 0x1c
cmp dword [eax + 0x14], 0x10
jb 0x405242
mov eax, dword [eax]
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
push ebx
push edi
push eax
lea eax, [ebp - 0x3c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x354]
push 0x104
push eax
call fcn.00408b40
push 0x38
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00427f80
lea eax, [ebp - 0x144]
mov dword [ebp - 0x414], 0x3c
mov dword [ebp - 0x404], eax
add esp, 0x30
lea eax, [ebp - 0x354]
mov dword [ebp - 0x408], str.runas
mov dword [ebp - 0x400], eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x3f8], 5
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ebx, dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], 0x1b
mov dword [esi + 8], eax
mov edi, 1
mov eax, dword [ebp - 0x358]
cmp eax, 8
jb 0x4052f7
inc eax
lea ecx, [ebp - 0x36c]
push eax
push dword [ebp - 0x36c]
call fcn.00401f60
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x36c], ax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x358], 7
cmp eax, 0x10
jb 0x405357
mov ecx, dword [ebp - 0x384]
inc eax
cmp eax, 0x1000
jb 0x40534e
test cl, 0x1f
jne 0x405382
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x405382
sub ecx, eax
cmp ecx, 4
jb 0x405382
cmp ecx, 0x23
ja 0x405382
mov ecx, eax
push ecx
call fcn.004249eb
add esp, 4
add esi, 0x74
cmp esi, dword [ebx + 0x268]
jne 0x405024
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424ea2
mov esp, ebp
pop ebp
ret
call fcn.0042b711
int3