Function at 0x425f6e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x62b0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
push edi
push 0x44
xor ebx, ebx
push ebx
push eax
call fcn.00445350
push 0x10
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x82c], 0x44
push ebx
push eax
call fcn.00445350
add esp, 0x18
call fcn.0043a59f
out 0x45, al
add dword [eax], eax
test al, al
je 0x425fde
scasb al, byte es:[edi]
xor eax, 0x13840ef2
dec ecx
jge 0x42602d
sahf
inc ebx
jnp 0x425fb5
leave
das
cmc
jae 0x426031
mov al, byte [0xc0f8df30]
push cs
xchg ecx, eax
or dword [eax + eax*4], esi
movsd dword es:[edi], dword [esi]
pop eax
xor ebx, ebx
push esi
lea eax, [ebp - 0x7d4]
push 0x5a6048
push eax
call fcn.00407470
add esp, 0xc
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4260a0
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x7e8]
push eax
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call fcn.0043a6f8
test al, al
je 0x426063
test dword [eax], ebx
clc
invalid
call dword [eax - 1]
mov ch, 0x1c
clc
invalid
xor eax, 0xadb8a29c
pop eax
push esi
test dword [ebx], edi
clc
pop es
aaa
loope 0x4260c2
adc edx, esp
push edi
and dword [ecx], edx
movsb byte es:[edi], byte [esi]
mov byte [ecx + 0x49], bh
xchg ebp, eax
pop ss
inc eax
call fcn.0043a59f
test al, al
je 0x42608a
nop
test al, 0x1b
inc ecx
push edx
xor eax, 0x378b0ca8
dec edi
lodsd eax, dword [esi]
sal dword [ecx], 0x92
repne cmpsd dword [esi], dword es:[edi]
mov ecx, 0xbe2785dc
sub byte [esi - 0x2e], ch
mov al, 0x90
inc ecx
inc edx
ljmp 0xffff
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433ee3
mov esp, ebp
pop ebp
ret
add byte [ebx], dh
lds ecx, [ecx + 0x458bfc45]
or byte [ebx - 0x14135b], al
inc dword [eax]
push ebx
push esi
push edi
push 0x1000
mov dword [ebp - 0x1410], eax
lea eax, [ebp - 0x1404]
push 0
push eax
call fcn.00445350
add esp, 0xc
call fcn.0043a9ef
test al, al
je 0x42610b
jns 0x426105
scasd eax, dword es:[edi]
fcom dword [ecx + 0x33ccdc0e]
mov ebx, 0x7504f1db
int1
add al, 0x75
insb byte es:[edi], dx
xchg esi, eax
pop es
call fcn.0043a6f8
test al, al
je 0x426133
sbb byte [edi - 0x11a4fad9], dh
add eax, 0x4f17a2d
invalid
call fcn.0043a515
test al, al
je 0x426152
movsb byte es:[edi], byte [esi]
ljmp 0x1af0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x140c]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call fcn.0043ab03
test al, al
je 0x426192
mov byte [ecx + 1], cl
add byte [eax + eax*8 - 0x50d3ec8c], al
sub al, 0xaf
jmp 0x426177
call fcn.0043aa79
test al, al
je 0x4261b6
jmp 0xd1dae5e4
call fcn.0043aa34
test al, al
je 0x4261d8
jno 0x426170
sbb esi, dword [ebx + eax - 0x2c]
or eax, dword [ebp - 7]
sbb dl, ah
inc ebp
aaa
sal eax, cl
push edi
sbb bl, byte [esi - 0xe8f060e]
js 0x4261bf
jo 0x426166
lea eax, [ebp - 0x1408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push 1
push dword [ebp - 0x140c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x1418]
push eax
lea eax, [ebp - 0x1408]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x1408]
push eax
lea eax, [ebp - 0x1404]
push eax
push dword [ebp - 0x404]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
call fcn.0043a4d0
test al, al
je 0x426247
test eax, edi
jmp 0x4261dc
invalid
mov eax, dword [edx]
and cl, byte [esi - 0x3e5da9b7]
ret
mov ecx, dword [ebp - 0x1410]
lea eax, [ebp - 0x1404]
push eax
call fcn.00401870
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1410]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00433ee3
mov esp, ebp
pop ebp
ret