Function at 0x4345ce
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call fcn.004266e3
test al, al
je 0x434608
xor eax, 0x35189ace
sbb al, 0xf4
lahf
sar ebp, cl
fstp xword [eax]
xlatb
movsd dword es:[edi], dword [esi]
fbstp tbyte [esi - 0x16]
or eax, 0x761f46fe
lcall 0xdb33, 0x18b62fd3
lea eax, [ebp - 0xc]
mov esi, 0xf01ff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x434739
lea eax, [ebp - 0x14]
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x434739
push str.Kernel32.dll
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x43468b
push 0x5ab234
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x434684
call eax
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x43473c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00426209
test al, al
je 0x4346a8
sbb edi, edi
inc dword [eax + eax*8 - 0x207aeb8c]
sal byte [esp + edx - 0x7b], 0xdf
test edi, ebx
inc edi
fidiv dword [ebx + 0x10b78cb9]
inc eax
xor ch, ah
sub byte [edx + 0x6f], dl
pop ds
pop edx
jbe 0x434691
call fcn.004264bb
test al, al
je 0x4346cd
push cs
push ds
invalid
jnp 0x43468d
pop edi
push es
ror dword [edi + 0x72bc2d98], cl
jmp 0x1cc90236
call fcn.004266e3
test al, al
je 0x4346eb
or edi, dword ds:[ecx + 0x264f800e]
add edi, dword [ebx - 0x3e]
scasb al, byte es:[edi]
pop dword [eax + 0x25]
lodsb al, byte [esi]
mov ch, 0xa
nop
mov al, 0x85
pop esi
xor ebx, ebx
push str.Wtsapi32.dll
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x434851
push 0x5ab220
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43478c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push ecx
push dword [ebp - 0x18]
call eax
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
push dword [ebp - 0x10]
test eax, eax
jne 0x434786
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], ebx
call fcn.0042658a
test al, al
je 0x434756
push ecx
push ebp
inc ebx
jecxz 0x434719
jle 0x434711
add ebx, dword [esi - 0x1e]
invalid
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x434769
cmp eax, 0xffffffff
je 0x434769
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x43477c
cmp ecx, 0xffffffff
je 0x43477c
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004262d8
test al, al
je 0x4347b6
mov ebp, 0xd51774d4
push 0xffffffffffffffb6
hlt
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00447ad0
push 0x10
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00447ad0
add esp, 0x18
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], str.WinSta0Default
mov dword [ebp - 0x40], 1
push 5
pop eax
mov word [ebp - 0x3c], ax
call fcn.004266e3
test al, al
je 0x434811
jge 0x43478c
jp 0x434844
and byte [eax], ah
fidivr dword [ecx]
cli
psllq mm2, mm3
outsb dx, byte [esi]
mov eax, dword [0x77aff7a9]
lcall 0x7a63, 0xca96f434
add al, 0x33
fisttp dword [ebp - 0x72af27bb]
inc ebp
xchg esp, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 8]
push 0x430
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x434739
cmp dword [ebp - 8], 0
je 0x434848
push dword [ebp - 8]
call sub.USERENV.dll_DestroyEnvironmentBlock
jo 0x434898
add eax, dword [eax]
mov byte [ebp - 4], 1
jmp 0x43473c
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x43478c
push dword [ebp - 0xc]
jmp 0x434733
call fcn.00435318
jl 0x4348a4
add byte [eax], al
mov dword [ebp - 0x10], eax
call fcn.0042658a
test al, al
je 0x4348bc
inc ecx
imul byte [edx]
daa
invalid
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.004263a7
test al, al
je 0x4348e2
insb byte es:[edi], dx
imul ebp, dword fs:[esi - 0x7e], 0xffffffd2
dec eax
push ss
xchg ebp, eax
hlt
call fcn.004261c4
test al, al
je 0x434909
imul eax, dword [ebx - 0x1a], 0xffffffc1
ja 0x434897
sahf
sub bh, byte [edx - 0x2bf88051]
shl dword [ebx - 0x7c], 0xda
mov dh, 0xd0
outsd dx, dword [esi]
xchg byte [eax + 0x24e5b960], ch
xor eax, 0xe83897c9
test dword [ecx], ebx
invalid
call fcn.00426293
test al, al
je 0x434931
mov eax, 0x40a3c718
sbb cl, byte [ecx]
jge 0x434951
adc dword [eax], ebx
xor dword [ecx - 0x3d3117a8], ecx
scasd eax, dword es:[edi]
outsb dx, byte [esi]
salc
adc byte [edx], 0x99
cli
mov byte [eax], 0x7f
push cs
scasb al, byte es:[edi]
and al, 0x8b
jne 0x434924
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call sub.WTSAPI32.dll_WTSQueryUserToken
xor ebx, ebx
mov edi, 0x400
test eax, eax
jne 0x43497c
add byte [ebp + 0x562675c0], al
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x43497c
lea eax, [ebp - 4]
push eax
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edx
add byte [esi - 1], dl
adc eax, sym.imp.KERNEL32.dll_CloseHandle
call fcn.00426026
test al, al
je 0x43499a
and esi, esi
cwde
pop ecx
push ebp
jecxz 0x434973
dec ebp
dec esi
and esi, 0x6976ea68
mov edi, 0x400
cmp dword [ebp - 4], 0
je 0x434b00
lea eax, [ebp - 0x1c]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push 0x13
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor esi, esi
inc esi
test eax, eax
jne 0x4349ea
lea eax, [ebp - 0x14]
push eax
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 8]
push eax
push esi
push esi
push ebx
push 0x2000000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov eax, dword [ebp - 8]
jmp 0x4349f0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
push esi
push eax
lea eax, [ebp - 0xc]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x434a10
cmp dword [ebp + 0x10], 0
mov eax, 0x404
cmovne edi, eax
mov dword [ebp - 0x10], edi
jmp 0x434a16
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00447ad0
push 0x10
push ebx
push dword [ebp + 0xc]
call fcn.00447ad0
push 5
pop eax
push 0x10
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], ax
call fcn.00447ad0
add esp, 0x24
call fcn.004263a7
test al, al
je 0x434a6b
ret
call fcn.004261c4
test al, al
je 0x434a92
and al, dl
cmp dword [ecx + 0x1d8afc40], 0x7f
mov ebx, cs
pop eax
insb byte es:[edi], dx
jae 0x434acb
add al, 0xd1
and al, 0x20
mov dword [0xccb07725], eax
mov eax, ecx
and ah, byte [edx - 0x3177279]
pop ss
invalid
call fcn.00426293
test al, al
je 0x434aba
out 0xe2, eax
push edx
mov al, byte [0xbfe5ed90]
stosd dword es:[edi], eax
sub al, 0xc6
push 0x59
adc eax, edi
adc eax, 0x5f665898
push es
push 0x6d
xlatb
movsd dword es:[edi], dword [esi]
lds edi, [eax - 0x1636f8c5]
push dword [ebp + 0xc]
xor ebx, ebx
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
push 1
pop eax
cmovne ebx, eax
cmp dword [ebp - 8], 0
je 0x434af1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x434b00
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret