Function at 0x422520
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00421bc0
xor edi, edi
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x21c], edi
xor bl, bl
mov dword [ebp - 0x220], 0x63
mov dword [0x4f8fb8], edi
call fcn.004224b0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.GlobalSessionEventUltra
push edi
push edi
push edi
call esi
push str.GlobalSessionEventUltraCad
push edi
push edi
push edi
mov dword [0x4f8bb4], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
mov dword [0x4f8b78], eax
call esi
mov eax, dword [0x4f8fc8]
mov dword [ebp - 0x234], eax
mov eax, dword [0x4f8b78]
mov dword [ebp - 0x230], eax
jmp 0x4225b0
cmp dword [0x4f8fd0], 4
jne 0x422843
push 0x3e8
push 0
lea eax, [ebp - 0x234]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
sub eax, 0
je 0x422843
dec eax
je 0x422724
sub eax, 0x101
jne 0x4225b0
mov eax, dword [ebp - 0x228]
xor ecx, ecx
inc eax
cmp eax, 0x1e
cmove eax, ecx
mov dword [ebp - 0x228], eax
mov eax, dword [0x503bcc]
test eax, eax
je 0x422612
call eax
mov edi, eax
mov dword [ebp - 0x21c], edi
cmp dword [ebp - 0x220], edi
je 0x422626
push dword [0x4f8bb4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp edi, 0xffffffff
je 0x4225b0
mov eax, dword [0x4f8fb8]
mov dword [ebp - 0x224], 0
test eax, eax
jne 0x422668
push 0x3e8
call esi
test bl, bl
je 0x422710
push 0x7d0
call esi
mov ecx, edi
call fcn.004221a0
xor bl, bl
mov dword [ebp - 0x220], edi
jmp 0x4225b0
lea ecx, [ebp - 0x224]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4226e0
cmp dword [ebp - 0x224], 0x103
je 0x4226d3
push 0x3e8
call esi
test bl, bl
je 0x422698
push 0xfa0
call esi
push 0x3a98
push dword [0x4f8fb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x4f8fb8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [0x4f8fbc]
call ebx
mov ecx, edi
call fcn.004221a0
xor bl, bl
mov dword [ebp - 0x220], edi
jmp 0x4225b0
mov bl, 1
mov dword [ebp - 0x220], edi
jmp 0x4225b0
push 0x3e8
call esi
test bl, bl
je 0x4226f2
push 0xfa0
call esi
mov eax, dword [0x4f8fb8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x422704
push eax
call ebx
mov eax, dword [0x4f8fbc]
test eax, eax
je 0x422710
push eax
call ebx
mov ecx, edi
call fcn.004221a0
xor bl, bl
mov dword [ebp - 0x220], edi
jmp 0x4225b0
push str.sas.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SendSAS
push eax
mov dword [ebp - 0x22c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42274e
push 0
call eax
jmp 0x422829
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x422782
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.004ad400
add esp, 8
test eax, eax
je 0x4228ac
mov byte [eax], 0
lea edx, [ebp - 0x218]
mov byte [ebp - 0x110], 0
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x422791
lea edi, [ebp - 0x110]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4227a1
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x110]
dec edi
mov edi, edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4227c0
mov ax, word [0x4dfc28]
mov word [edi], ax
lea eax, [ebp - 0x110]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
lea eax, [eax + 1]
test cl, cl
jne 0x4227e0
mov ecx, dword [str.cad.exe]
push 1
mov dword [eax], ecx
mov ecx, dword [0x4e1790]
push 0
mov dword [eax + 4], ecx
lea eax, [ebp - 0x110]
push 0x4d9f42
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x4225b0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4225b0
mov eax, dword [0x4f8bb4]
test eax, eax
je 0x422858
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x4f8bb4]
mov ecx, dword [0x4f8fb8]
test ecx, ecx
je 0x422893
push 0x3a98
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x4f8fb8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x422880
push eax
call esi
mov eax, dword [0x4f8fbc]
test eax, eax
je 0x42288c
push eax
call esi
mov eax, dword [0x4f8bb4]
jmp 0x422899
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4228a0
push eax
call esi
mov eax, dword [0x4f8b78]
test eax, eax
je 0x4228ac
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret