Function at 0x64f264
Capabilities:
Create process on windows

Disassembly:
xor ch, ah
add eax, dword [eax]
add byte [edx], al
add byte [esi], al
push edx
insd dword es:[edi], dx
outsd dx, dword [esi]
je 0x64ef46
lock add eax, dword [eax]
add byte [eax + eax], al
push es
push esp
imul ebp, dword [ebp + 0x65], 0x3f43172
add byte [eax], al
add byte [eax], al
or byte [edi + 0x65], dl
bound esi, qword [ebx + 0x69]
je 0x64ef61
xor eax, edi
add eax, dword [eax]
add byte [eax], al
add byte [esi], al
pop edx
push 0x31654375
cld
add eax, dword [eax]
add byte [eax], al
add byte [eax], cl
inc ebp
insd dword es:[edi], dx
popal
imul ebp, dword [ebp + edx*2 + 0x73], 0x40031
add byte [eax], al
add byte [edx], cl
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x64ef86
arpl word [ebp + edx*2 + 0x73], si
xor dword [esp + eax], eax
add byte [eax], al
add eax, 0x614c0b00
bound esp, qword [ebp + 0x6c]
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
or byte [eax + eax], al
add byte [0x614c0c00], al
bound esp, qword [ebp + 0x6c]
insb byte es:[edi], dx
pop edi
push edx
insd dword es:[edi], dx
outsd dx, dword [esi]
je 0x64efb4
or al, 4
add byte [eax], al
add eax, 0x614c0a00
bound esp, qword [ebp + 0x6c]
pop edi
inc esp
imul esp, dword [esi + 0x66], 0x410
push es
add al, 0
add byte [esi], al
add byte [eax], cl
bound esi, qword [esi + ebp*2 + 0x43]
push 0x146b6365
add al, 0
add byte [esi], al
add byte [ecx], cl
bound esi, qword [esi + ebp*2 + 0x41]
push 0x75
jae 0x64eff3
sbb byte [eax + eax], al
add byte [esi], al
add byte [esi], al
bound esi, qword [esi + ebp*2 + 0x4f]
jo 0x64f000
sbb al, 4
add byte [eax], al
pop es
add byte [esp + edx*2], al
jb 0x64eff7
jns 0x64efb8
add al, 0
add byte [eax], al
add byte [edx], al
dec esi
xor esp, dword [esp + eax]
add byte [eax], al
add byte [eax], al
or dl, byte [ebp + 0x6e]
imul ebp, dword [esi + 0x73], 0x6c6c6174
xor dword [eax], ebp
add al, 0
add byte [eax], cl
add byte [eax], cl
push esp
imul ebp, dword [ebp + 0x65], 0x31767253
sub al, 4
add byte [eax], al
or byte [eax], al
or eax, dword [ecx + 0x79]
push esp
imul ebp, dword [ebp + 0x65], 0x31767253
xor byte [eax + eax], al
add byte [eax], al
add byte [0x676e614c], al
xor dword [esp + eax], esi
add byte [eax], al
add eax, 0x78450800
je 0x64f05b
popal
dec esp
bound ebp, qword [eax + edi + 4]
add byte [eax], al
add eax, 0x654e0700
ja 0x64f06b
pop es
dec esi
ja 0x64f06b
jae 0x64f045
dec esp
bound ebp, qword [esp + edi + 4]
add byte [eax], al
add byte [eax], al
add eax, 0x6f6d6544
add byte [0x6f6d6544], al
xor dword [eax], eax
add byte [eax], bl
add byte [edx], dl
add byte [eax + ecx + 0x410b0065], ch
bound ebp, qword [edi + 0x75]
je 0x64f049
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xfa440014
add byte fs:[0x436e7462], cl
push 0x436b6365
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xbe80012
add byte gs:[ebx], cl
bound esi, qword [esi + ebp*2 + 0x4f]
jo 0x64f0b2
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xb100013
adc byte [ebx], cl
add byte gs:[edx + eax*2], cl
or al, 0x42
jne 0x64f0c6
dec esi
outsd dx, dword [esi]
ja 0x64f082
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xfe500013
add byte fs:[ebx + eax*2], cl
add byte [ebx + eax*2], cl
outsd dx, dword [esi]
outsb dx, byte [esi]
imul sp, word [edi + 0x31], 0x6c43
imul esp, dword [ebx + 0x6b], 0x8600011
add byte gs:[edx], cl
inc ebp
js 0x64f0dc
pushal
or byte [ebp], ah
or al, byte [ebp + 0x78]
imul esi, dword [ecx + esi + 0x43], 0x6b63696c
adc dword [eax], eax
or al, 0xff
je 0x64f0a6
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xff0c0011
add byte fs:[edx], cl
inc esi
outsd dx, dword [esi]
jb 0x64f0f2
inc ebx
jb 0x64f0ed
popal
je 0x64f0f0
adc al, byte [eax]
cmp al, 0xc
add byte gs:[ebx], cl
inc esi
outsd dx, dword [esi]
jb 0x64f103
dec ebx
jns 0x64f0de
outsd dx, dword [esi]
ja 0x64f10b
adc dword [eax], eax
inc eax
or ah, byte [ebp]
or cl, byte [eax + 0x65]
insb byte es:[edi], dx
jo 0x64f0da
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xf6900012
add byte fs:[ebx], cl
push esp
imul ebp, dword [ebp + 0x65], 0x69543172
insd dword es:[edi], dx
jb 0x64f0d1
add byte [eax], cl
or esp, dword [ebp]
or dword [edx + esi*2 + 0x61], edx
jns 0x64f10f
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0x10700014
add byte [eax + 0x10], dh
add byte gs:[0x73626557], cl
imul esi, dword [ebp + 0x31], 0x63696c43
imul edx, dword [edx], 0
add byte [ebx], cl
jae 0x64f145
je 0x64f143
xor dword [ebx + 0x6c], eax
imul esp, dword [ebx + 0x6b], 0xb000012
add byte gs:[ebx], cl
pop edx
push 0x31654375
inc ebx
jne 0x64f132
xor dword gs:[ebx + 0x6c], eax
xor dword [ebx + 0x6c], eax
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0x15300014
add byte gs:[0x69616d45], cl
insb byte es:[edi], dx
push ebp
jae 0x64f136
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0x21700010
add byte [eax + 0x21], dh
add byte gs:[ecx], cl
add byte [ecx], cl
inc esi
outsd dx, dword [esi]
jb 0x64f182
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x64f17f
push ss
add byte [eax + 0x10], bh
add byte gs:[edi], cl
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
xor dword [ebx + 0x6c], eax
imul esp, dword [ebx + 0x6b], 0xf9bc0015
add byte fs:[esi], cl
mov esp, 0xe0064f9
push cs
push esp
imul ebp, dword [ebp + 0x65], 0x31767253
inc ecx
arpl word [ebx + 0x65], sp
jo 0x64f1b9
push ss
add ah, bh
sbb dword [ebp], esp
rcpps xmm6, xmmword [edi + 0x69]
je 0x64f1b4
push 0x676e614c
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xf5e8001d
add byte fs:[esi], dl
dec esp
outsd dx, dword [esi]
popal
dec esp
popal
outsb dx, byte [esi]
jne 0x64f1cd
inc esi
imul ebp, dword [ebp + 0x31], 0x63696c43
imul edx, dword [edi], 0
add byte fs:[eax], dl
dec esp
popal
outsb dx, byte [esi]
inc ebp
imul esi, dword fs:[edi + ebp*2 + 0x72], 0x696c4331
arpl word [ebx + 0x12], bp
add al, bh
stc
add byte fs:[ebx], cl
inc esi
outsd dx, dword [esi]
jb 0x64f207
inc esp
jae 0x64f212
jb 0x64f20f
jns 0x64f1b1
add byte [eax], al
push cs
add byte gs:[eax], cl
inc esi
outsd dx, dword [esi]
jb 0x64f219
push ebx
push 0x13776f
cmp byte [eax], ah
add byte [eax], bh
and byte [ebp], ah
or al, 0x46
add byte gs:[esi + eax*2], cl
outsd dx, dword [esi]
jb 0x64f228
inc ecx
arpl word [ecx + ebp*2 + 0x76], si
popal
je 0x64f228
adc dword [eax], eax
push 0xa00651e
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
xor dword [ebx + 0x6c], eax
imul esp, dword [ebx + 0x6b], 0x4d0000
pop es
add byte [edx], dl
add ecx, dword [edx]
push ds
add byte [eax + 0xa04a604], ah
add al, 0xb
add al, 0xac
sub byte [ebp], ah
mov word [edi], fs
add al, bl
or byte [ebp], ah
jl 0x64f20a
add ah, cl
adc al, 0x65
add ah, al
adc al, 0x65
add byte [eax + ebp + 0x540b0065], ah
inc ecx
je 0x64f25c
jns 0x64f279
outsb dx, byte [esi]
arpl word [ebp + 0x61], cx
imul ebp, dword [esi + 9], 0x5883fc00
add byte [eax - 0x2bffafef], al
outsb dx, byte [esi]
or dword [eax], eax
cld
sbb dword [eax], 0xffffff80
adc dword [eax], edx
aam 0x10
push edx
add byte [edi + ebx*4], al
add ah, dl
adc byte [edx], dl
add al, 0x9f
pop eax
add ah, cl
sbb dword [ebp], edx
or al, 0x92
push ecx
add byte [eax], bl
fist word [ecx]
mov byte [ecx + 0x55], al
add byte [ecx + edi + 0x63], bl
add byte [eax], al
add byte [edx + esi*8], bh
add byte fs:[edi], al
or edx, dword [ecx + eax*2 + 0x74]
push ebx
jns 0x64f2b2
arpl word [ebp + 0x61], cx
imul ebp, dword [esi + 0x14], 0xfc0064ed
pop edx
pop ebp
add byte [eax], dh
add eax, 0x74696e55
xor dword [eax], eax
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ebp - 0x74aaffc0], cl
in al, dx
push 0
push 0
xor eax, eax
push ebp
push 0x64f2d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0061b9a0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x64f2ec
call fcn.00409ebc
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004202f0
test al, al
je 0x64f2ba
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00409c50
push eax
push 0x64f308
push 0
add byte [edx], ch
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64f2dc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408ebc
ret