Function at 0x4378ec
Capabilities:
Create process on windows
Get token membership
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x480
mov esi, esp
mov eax, dword [0x4f6014]
xor eax, ebp
mov dword [esi + 0x478], eax
xor ebx, ebx
dec ebx
lea ecx, [esi + 0x38]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0043813d
lea edi, [esi + 0x2c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push 0x4e6930
lea eax, [esi + 0x38]
push eax
push edi
call fcn.004197cc
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x437948
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
lea ebx, [esi + 0x270]
mov ecx, ebx
push eax
push edi
call fcn.0043d840
push ebx
mov edi, ebx
call fcn.00450290
add esp, 4
mov ebx, eax
mov ecx, edi
call fcn.0043d8f0
mov byte [esi + 7], bl
test bl, bl
je 0x437b50
xor eax, eax
mov dword [esi + 0x270], eax
mov word [esi + 0x274], 0x500
lea ecx, [esi + 0x68]
mov dword [ecx], eax
sub esp, 0x2c
mov dword [esi + 8], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
movdqa xmm0, xmmword [0x4e6920]
movdqu xmmword [esp + 4], xmm0
lea ebx, [esi + 0x270]
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esi + 0x50], eax
test eax, eax
je 0x437bc6
lea eax, [esi + 0x50]
push eax
push dword [esi + 0x68]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4379e4
mov dword [esi + 0x50], 0
push dword [esi + 0x68]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esi + 0x50], 0
je 0x437bc6
call fcn.0043a15c
mov edi, eax
mov ecx, ebx
push 0x4e3558
call fcn.00414142
mov dword [esi + 0x50], 5
lea ebx, [esi + 0x68]
mov ecx, ebx
push str.qdhg03
call fcn.00414142
mov ecx, edi
lea eax, [esi + 0x270]
push eax
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.0043a70a
cmp byte [esi + 0x73], 0
jns 0x437a44
push dword [esi + 0x68]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x27b], 0
jns 0x437a5b
push dword [esi + 0x270]
call fcn.004a7ee0
add esp, 4
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
pcmpeqd xmm0, xmm0
lea edi, [esi + 0x50]
movdqa xmmword [edi], xmm0
lea ebx, [esi + 0x270]
mov ecx, ebx
push 0xc
push str.wtsapi32.dll
call fcn.0043d840
mov ecx, edi
push ebx
call fcn.0044a2b0
mov ecx, ebx
call fcn.0043d8f0
mov ecx, edi
push str.WTSEnumerateProcessesW
call fcn.0044a310
mov ebx, eax
mov ecx, edi
push str.WTSFreeMemory
call fcn.0044a310
mov dword [esi + 0x10], ebx
test ebx, ebx
je 0x437e36
test eax, eax
je 0x437e36
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], 0xffffffff
xor ecx, ecx
lea eax, [esi + 0x4c]
mov dword [eax], ecx
lea eax, [esi + 0x48]
mov dword [eax], ecx
mov dword [esi + 0x44], 0x104
mov edi, 0x208
lea eax, [esi + 0x270]
push edi
push ecx
xor ebx, ebx
push eax
call fcn.004ab560
add esp, 0xc
lea eax, [esi + 0x68]
push edi
push ebx
push eax
call fcn.004ab560
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov ecx, dword [esi + 0x10]
call dword [section..00cfg]
lea eax, [esi + 0x48]
push eax
lea eax, [esi + 0x4c]
push eax
push 1
push ebx
push ebx
call ecx
test eax, eax
je 0x437e36
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x437e27
mov eax, dword [esi + 0x4c]
add eax, 0xc
cmp dword [eax - 8], edi
je 0x437def
add eax, 0x10
dec ecx
jne 0x437b3c
jmp 0x437e27
call fcn.0043a15c
mov edi, eax
lea ecx, [esi + 0x270]
push 0x4e3558
call fcn.00414142
lea eax, [esi + 0x50]
mov dword [eax], 3
lea ebx, [esi + 0x68]
mov ecx, ebx
push str.qdhg03
call fcn.00414142
mov ecx, edi
lea eax, [esi + 0x270]
push eax
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.0043a70a
cmp byte [ebx + 0xb], 0
jns 0x437ba3
push dword [esi + 0x68]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x27b], 0
mov bl, byte [esi + 7]
jns 0x438104
push dword [esi + 0x270]
call fcn.004a7ee0
add esp, 4
jmp 0x438104
lea eax, [esi + 0x20]
xor ecx, ecx
dec ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
push 0x4e6980
lea ecx, [esi + 0x38]
push ecx
push eax
call fcn.004197cc
add esp, 0xc
call fcn.0043a15c
mov dword [esi + 8], eax
lea ebx, [esi + 0x270]
mov ecx, ebx
push 0x4e3558
call fcn.00414142
lea edi, [esi + 0x50]
mov dword [edi], 4
lea ecx, [esi + 0x68]
push str.qdhg03
call fcn.00414142
mov ecx, dword [esi + 8]
push ebx
push edi
lea edi, [esi + 0x68]
push edi
call fcn.0043a70a
cmp byte [edi + 0xb], 0
jns 0x437c35
push dword [esi + 0x68]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x27b], 0
jns 0x437c4c
push dword [esi + 0x270]
call fcn.004a7ee0
add esp, 4
call fcn.0043a15c
mov ebx, eax
lea ecx, [esi + 0x270]
push 0x4e3558
call fcn.00414142
mov dword [esi + 0x50], 1
lea edi, [esi + 0x68]
mov ecx, edi
push str.qdhg05
call fcn.00414142
mov ecx, ebx
lea eax, [esi + 0x270]
push eax
lea eax, [esi + 0x50]
push eax
push edi
call fcn.0043a70a
cmp byte [esi + 0x73], 0
jns 0x437c9d
push dword [esi + 0x68]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x27b], 0
jns 0x437cb4
push dword [esi + 0x270]
call fcn.004a7ee0
add esp, 4
mov edi, esp
push eax
sub esp, 8
mov ebx, esp
cmp byte [esi + 0x2b], 0
js 0x437cd3
mov eax, dword [esi + 0x28]
mov dword [ebx + 8], eax
movq xmm0, qword [esi + 0x20]
movq qword [ebx], xmm0
jmp 0x437ce0
mov ecx, ebx
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.00435230
pxor xmm0, xmm0
movdqu xmmword [esi + 0x298], xmm0
movdqu xmmword [esi + 0x288], xmm0
movdqu xmmword [esi + 0x278], xmm0
mov dword [esi + 0x2a8], 0
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x437d10
mov eax, dword [ebx]
mov dword [esi + 0x280], eax
mov dword [esi + 0x270], 0x3c
mov dword [esi + 0x27c], str.runas
mov dword [esi + 0x274], 0x8000
mov dword [esi + 0x28c], 0xa
mov dword [esi + 0x284], str.Administrator
lea eax, [esi + 0x270]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x437dcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x437dcb
mov dword [esi + 8], edi
call fcn.0043a15c
lea ecx, [esi + 0x68]
mov edi, eax
push 0x4e3558
call fcn.00414142
lea eax, [esi + 0x14]
mov dword [eax], 8
lea ecx, [esi + 0x50]
push str.qdhg03
call fcn.00414142
mov ecx, edi
lea eax, [esi + 0x68]
push eax
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 0x50]
push eax
call fcn.0043a70a
cmp byte [esi + 0x5b], 0
jns 0x437db7
push dword [esi + 0x50]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x73], 0
jns 0x437dc8
push dword [esi + 0x68]
call fcn.004a7ee0
add esp, 4
mov edi, dword [esi + 8]
cmp byte [ebx + 0xb], 0
jns 0x437ddb
push dword [ebx]
call fcn.004a7ee0
add esp, 4
mov esp, edi
cmp byte [esi + 0x2b], 0
jns 0x438101
push dword [esi + 0x20]
jmp 0x4380f9
lea ecx, [esi + 0x14]
lea edx, [esi + 0x44]
push ecx
push edx
lea ecx, [esi + 0x68]
push ecx
push edx
lea ecx, [esi + 0x270]
push ecx
push dword [eax]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x437e27
lea edi, [esi + 0x68]
push edi
call fcn.004c3f8c
add esp, 4
lea ecx, [esi + 0x20]
push eax
push edi
call fcn.0043544c
mov edi, dword [esi + 0x4c]
mov ecx, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
lea ecx, [esi + 0x50]
call fcn.0044a280
cmp byte [esi + 0x2b], 0
jns 0x437e49
mov eax, dword [esi + 0x20]
jmp 0x437e4c
lea eax, [esi + 0x20]
push str.NT_AUTHORITY
push eax
call fcn.004bf564
add esp, 8
mov edi, eax
cmp byte [esi + 0x2b], 0
jns 0x437e6d
push dword [esi + 0x20]
call fcn.004a7ee0
add esp, 4
test edi, edi
je 0x437ef9
call fcn.00438206
xor edi, edi
dec edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
push 0x4e6980
lea ebx, [esi + 0x38]
push ebx
lea eax, [esi + 0x68]
push eax
call fcn.004197cc
add esp, 0xc
push str.2345Explorer_rubbish
push ebx
lea ebx, [esi + 0x270]
push ebx
call fcn.004197cc
add esp, 0xc
cmp byte [esi + 0x27b], 0
jns 0x437ebf
mov ebx, dword [esi + 0x270]
cmp byte [esi + 0x73], 0
jns 0x437ecb
mov eax, dword [esi + 0x68]
mov dword [esi + 8], eax
push 1
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp byte [esi + 0x27b], 0
jns 0x437eee
push dword [esi + 0x270]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x73], 0
jns 0x437f1e
mov eax, dword [esi + 0x68]
jmp 0x437f21
call fcn.0043a15c
mov edi, eax
lea ecx, [esi + 0x270]
push 0x4e3558
call fcn.00414142
lea eax, [esi + 0x50]
mov dword [eax], 6
jmp 0x437b70
lea eax, [esi + 0x68]
cmp byte [esi + 0x37], 0
jns 0x437f2c
mov ecx, dword [esi + 0x2c]
jmp 0x437f2f
lea ecx, [esi + 0x2c]
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
lea edi, [esi + 0x50]
mov ecx, edi
call fcn.0043d7e0
push edi
push 0x70
call fcn.0045a860
add esp, 8
lea eax, [esi + 0x20]
mov ecx, edi
push 0xc
push 0x4e69cc
push eax
call fcn.0043e830
lea ebx, [esi + 0x270]
lea ecx, [esi + 0x20]
push 0xa
push str.config.ini
push ebx
call fcn.0043e830
mov ecx, edi
push ebx
call fcn.0043d930
mov ecx, ebx
call fcn.0043d8f0
lea ecx, [esi + 0x20]
call fcn.0043d8f0
pxor xmm0, xmm0
movdqa xmmword [ebx + 0x70], xmm0
movdqa xmmword [ebx + 0x60], xmm0
movdqa xmmword [ebx + 0x50], xmm0
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
cmp byte [esi + 0x5b], 0
jns 0x437fca
mov edi, dword [esi + 0x50]
push edi
push 0x40
push ebx
push 0x4e38c0
push str.Version
push 0x4e6a0c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.0043a15c
mov dword [esi + 8], eax
push ebx
call fcn.004c3f8c
add esp, 4
push eax
push ebx
lea eax, [esi + 0x20]
push eax
call fcn.0044ca20
add esp, 0xc
lea eax, [esi + 0x4c]
mov dword [eax], 7
lea edi, [esi + 0x14]
mov ecx, edi
push str.qdhg03
call fcn.00414142
mov ecx, dword [esi + 8]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x4c]
push eax
push edi
call fcn.0043a70a
cmp byte [edi + 0xb], 0
jns 0x43803c
push dword [esi + 0x14]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x2b], 0
jns 0x43804d
push dword [esi + 0x20]
call fcn.004a7ee0
add esp, 4
call fcn.0043a15c
mov edi, eax
push ebx
call fcn.004c3f8c
add esp, 4
push eax
push ebx
lea ebx, [esi + 0x20]
push ebx
call fcn.0044ca20
add esp, 0xc
mov dword [esi + 0x4c], 0
lea ebx, [esi + 0x14]
mov ecx, ebx
push str.qdhg05
call fcn.00414142
mov ecx, edi
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x4c]
push eax
push ebx
call fcn.0043a70a
cmp byte [esi + 0x1f], 0
jns 0x4380a2
push dword [esi + 0x14]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x2b], 0
jns 0x4380b3
push dword [esi + 0x20]
call fcn.004a7ee0
add esp, 4
mov ebx, esp
push eax
sub esp, 8
mov edi, esp
cmp byte [esi + 0x73], 0
js 0x4380d2
mov eax, dword [esi + 0x70]
mov dword [edi + 8], eax
movq xmm0, qword [esi + 0x68]
movq qword [edi], xmm0
jmp 0x4380df
mov ecx, edi
push dword [esi + 0x6c]
push dword [esi + 0x68]
call fcn.00435230
mov ecx, edi
call fcn.00438e72
mov esp, ebx
lea ecx, [esi + 0x50]
call fcn.0043d8f0
cmp byte [esi + 0x73], 0
jns 0x438101
push dword [esi + 0x68]
call fcn.004a7ee0
add esp, 4
mov bl, byte [esi + 7]
cmp byte [esi + 0x37], 0
jns 0x438115
push dword [esi + 0x2c]
call fcn.004a7ee0
add esp, 4
cmp byte [esi + 0x43], 0
jns 0x438126
push dword [esi + 0x38]
call fcn.004a7ee0
add esp, 4
mov ecx, dword [esi + 0x478]
xor ecx, ebp
call fcn.004a8de3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret