Function at 0x7fe3d3
Capabilities:
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x859fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2808
call fcn.008224c0
push edi
mov dword [ebp - 0x280c], ecx
mov dword [ebp - 0x2750], 0x2710
mov byte [ebp - 0x27dc], 0x77
mov byte [ebp - 0x27db], 0x6d
mov byte [ebp - 0x27da], 0x69
mov byte [ebp - 0x27d9], 0x63
mov byte [ebp - 0x27d8], 0x20
mov byte [ebp - 0x27d7], 0x42
mov byte [ebp - 0x27d6], 0x61
mov byte [ebp - 0x27d5], 0x73
mov byte [ebp - 0x27d4], 0x65
mov byte [ebp - 0x27d3], 0x42
mov byte [ebp - 0x27d2], 0x6f
mov byte [ebp - 0x27d1], 0x61
mov byte [ebp - 0x27d0], 0x72
mov byte [ebp - 0x27cf], 0x64
mov byte [ebp - 0x27ce], 0x20
mov byte [ebp - 0x27cd], 0x67
mov byte [ebp - 0x27cc], 0x65
mov byte [ebp - 0x27cb], 0x74
mov byte [ebp - 0x27ca], 0x20
mov byte [ebp - 0x27c9], 0x53
mov byte [ebp - 0x27c8], 0x65
mov byte [ebp - 0x27c7], 0x72
mov byte [ebp - 0x27c6], 0x69
mov byte [ebp - 0x27c5], 0x61
mov byte [ebp - 0x27c4], 0x6c
mov byte [ebp - 0x27c3], 0x4e
mov byte [ebp - 0x27c2], 0x75
mov byte [ebp - 0x27c1], 0x6d
mov byte [ebp - 0x27c0], 0x62
mov byte [ebp - 0x27bf], 0x65
mov byte [ebp - 0x27be], 0x72
mov byte [ebp - 0x27bd], 0
mov byte [ebp - 0x2748], 0x53
mov byte [ebp - 0x2747], 0x65
mov byte [ebp - 0x2746], 0x72
mov byte [ebp - 0x2745], 0x69
mov byte [ebp - 0x2744], 0x61
mov byte [ebp - 0x2743], 0x6c
mov byte [ebp - 0x2742], 0x4e
mov byte [ebp - 0x2741], 0x75
mov byte [ebp - 0x2740], 0x6d
mov byte [ebp - 0x273f], 0x62
mov byte [ebp - 0x273e], 0x65
mov byte [ebp - 0x273d], 0x72
mov byte [ebp - 0x273c], 0
mov dword [ebp - 0x2738], 0
mov dword [ebp - 0x2734], 0
mov dword [ebp - 0x27e0], 0
mov byte [ebp - 0x2720], 0
mov ecx, 0x9c4
xor eax, eax
lea edi, [ebp - 0x271f]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x27e4]
push eax
lea ecx, [ebp - 0x2778]
call fcn.007f7fe0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2760], 0
mov dword [ebp - 0x274c], 0
push 0x80
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00825920
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x2730]
push edx
call fcn.00825920
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x27bc]
push eax
call fcn.00825920
add esp, 0xc
push 0xc
push 0
lea ecx, [ebp - 0x275c]
push ecx
call fcn.00825920
add esp, 0xc
mov dword [ebp - 0x2730], 0
mov dword [ebp - 0x272c], 0
mov dword [ebp - 0x27bc], 0x44
mov dword [ebp - 0x275c], 0xc
mov dword [ebp - 0x2758], 0
mov dword [ebp - 0x2754], 1
push 0
lea edx, [ebp - 0x275c]
push edx
lea eax, [ebp - 0x27e0]
push eax
lea ecx, [ebp - 0x2734]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x2738], eax
cmp dword [ebp - 0x2738], 0
jne 0x7fe6ab
cmp dword [ebp - 0x27e0], 0
je 0x7fe66c
mov edx, dword [ebp - 0x27e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2734], 0
je 0x7fe682
mov eax, dword [ebp - 0x2734]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov ecx, dword [ebp - 0x2738]
mov dword [ebp - 0x27e8], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2778]
call fcn.007cd120
mov eax, dword [ebp - 0x27e8]
jmp 0x7feaf0
lea edx, [ebp - 0x27bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA_1]
mov eax, dword [ebp - 0x27e0]
mov dword [ebp - 0x277c], eax
mov ecx, dword [ebp - 0x27e0]
mov dword [ebp - 0x2780], ecx
mov word [ebp - 0x278c], 0
mov dword [ebp - 0x2790], 0x101
lea edx, [ebp - 0x2730]
push edx
lea eax, [ebp - 0x27bc]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x27dc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x2738], eax
cmp dword [ebp - 0x2738], 0
jne 0x7fe7a0
cmp dword [ebp - 0x27e0], 0
je 0x7fe735
mov edx, dword [ebp - 0x27e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2734], 0
je 0x7fe74b
mov eax, dword [ebp - 0x2734]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2730], 0
je 0x7fe761
mov ecx, dword [ebp - 0x2730]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x272c], 0
je 0x7fe777
mov edx, dword [ebp - 0x272c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov eax, dword [ebp - 0x2738]
mov dword [ebp - 0x27ec], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2778]
call fcn.007cd120
mov eax, dword [ebp - 0x27ec]
jmp 0x7feaf0
push 0x1f4
mov ecx, dword [ebp - 0x2730]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
lea edx, [ebp - 0x2760]
push edx
push 0x2710
lea eax, [ebp - 0x2720]
push eax
mov ecx, dword [ebp - 0x2734]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile_1]
mov dword [ebp - 0x2738], eax
cmp dword [ebp - 0x2738], 0
jne 0x7fe868
cmp dword [ebp - 0x27e0], 0
je 0x7fe7fd
mov edx, dword [ebp - 0x27e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2734], 0
je 0x7fe813
mov eax, dword [ebp - 0x2734]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2730], 0
je 0x7fe829
mov ecx, dword [ebp - 0x2730]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x272c], 0
je 0x7fe83f
mov edx, dword [ebp - 0x272c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov eax, dword [ebp - 0x2738]
mov dword [ebp - 0x27f0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2778]
call fcn.007cd120
mov eax, dword [ebp - 0x27f0]
jmp 0x7feaf0
mov dword [ebp - 0x2738], 0
lea ecx, [ebp - 0x2720]
push ecx
lea ecx, [ebp - 0x2778]
call fcn.007f8070
push 0
lea edx, [ebp - 0x2748]
push edx
lea ecx, [ebp - 0x2778]
call fcn.007f8280
mov dword [ebp - 0x274c], eax
mov eax, dword [ebp - 0x274c]
cmp eax, dword [0x12da0bc]
jne 0x7fe931
cmp dword [ebp - 0x27e0], 0
je 0x7fe8c6
mov ecx, dword [ebp - 0x27e0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2734], 0
je 0x7fe8dc
mov edx, dword [ebp - 0x2734]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2730], 0
je 0x7fe8f2
mov eax, dword [ebp - 0x2730]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x272c], 0
je 0x7fe908
mov ecx, dword [ebp - 0x272c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov edx, dword [ebp - 0x2738]
mov dword [ebp - 0x27f4], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2778]
call fcn.007cd120
mov eax, dword [ebp - 0x27f4]
jmp 0x7feaf0
mov eax, dword [0x12da0bc]
push eax
lea ecx, [ebp - 0x2748]
push ecx
call fcn.00824a40
add esp, 4
mov edx, dword [ebp - 0x274c]
add edx, eax
push edx
lea eax, [ebp - 0x2804]
push eax
lea ecx, [ebp - 0x2778]
call fcn.007f8330
mov dword [ebp - 0x2810], eax
mov ecx, dword [ebp - 0x2810]
mov dword [ebp - 0x2814], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2814]
push edx
lea ecx, [ebp - 0x2778]
call fcn.007f8050
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2804]
call fcn.007cd120
push 0x2711
push 0
lea eax, [ebp - 0x2720]
push eax
call fcn.00825920
add esp, 0xc
lea ecx, [ebp - 0x2778]
call fcn.007cd140
push eax
lea ecx, [ebp - 0x2720]
push ecx
call fcn.00825c00
add esp, 8
mov dword [ebp - 0x2768], 0
mov dword [ebp - 0x2764], 0
jmp 0x7fe9ee
mov edx, dword [ebp - 0x2764]
add edx, 1
mov dword [ebp - 0x2764], edx
lea eax, [ebp - 0x2720]
push eax
call fcn.00824a40
add esp, 4
cmp dword [ebp - 0x2764], eax
jge 0x7fea6a
mov ecx, dword [ebp - 0x2764]
movsx edx, byte [ebp + ecx - 0x2720]
cmp edx, 0x20
je 0x7fea65
mov eax, dword [ebp - 0x2764]
movsx ecx, byte [ebp + eax - 0x2720]
cmp ecx, 0xa
je 0x7fea65
mov edx, dword [ebp - 0x2764]
movsx eax, byte [ebp + edx - 0x2720]
cmp eax, 0xd
je 0x7fea65
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x2768]
mov edx, dword [ebp - 0x2764]
mov al, byte [ebp + edx - 0x2720]
mov byte [ecx], al
mov ecx, dword [ebp - 0x2768]
add ecx, 1
mov dword [ebp - 0x2768], ecx
jmp 0x7fe9df
mov dword [ebp - 0x2738], 1
cmp dword [ebp - 0x27e0], 0
je 0x7fea8a
mov edx, dword [ebp - 0x27e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2734], 0
je 0x7feaa0
mov eax, dword [ebp - 0x2734]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x2730], 0
je 0x7feab6
mov ecx, dword [ebp - 0x2730]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
cmp dword [ebp - 0x272c], 0
je 0x7feacc
mov edx, dword [ebp - 0x272c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov eax, dword [ebp - 0x2738]
mov dword [ebp - 0x2808], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2778]
call fcn.007cd120
mov eax, dword [ebp - 0x2808]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 8