Function at 0x45b91d
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x206c
call fcn.0046cf20
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x2014], ecx
mov dword [ebp - 0x2008], edx
je 0x45bd2b
call fcn.0047362e
test al, al
je 0x45b97b
sal al, 0x56
sti
mov edi, 0x6128f6ce
adc bl, byte [edx]
pop ss
and al, 0xd5
leave
xor eax, dword [eax - 0x51]
cld
sub eax, 0x90b06d20
add dword [esi + 0x252fc574], ecx
call fcn.00473925
test al, al
je 0x45b99e
mov ecx, gs
scasd eax, dword es:[edi]
dec esi
push ds
add al, 0
outsb dx, byte [esi]
into
xchg esp, eax
inc esp
scasb al, byte es:[edi]
mov edx, 0xc9ac619d
invalid
cmp byte [ebx], dh
shr byte [eax], 0x20
add byte [eax], al
xor eax, eax
push 0x2000
push eax
mov dword [ebp - 0x2010], eax
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x2004]
push eax
call fcn.004830b0
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push dword [ebp - 0x2014]
push str.__s___s
push eax
call fcn.00407e70
add esp, 0x1c
call fcn.00473856
test al, al
je 0x45b9fb
invalid
adc esi, dword [ebx]
push eax
ljmp 0x17b
call fcn.0047351a
test al, al
je 0x45ba18
inc esp
test eax, 0x5cbba819
dec eax
je 0x45ba49
sti
pop ebp
sub bl, byte [esi - 0x7d8006f8]
jge 0x45b99d
mov eax, ebp
movsb byte es:[edi], byte [esi]
jns 0x45ba1d
call fcn.004733c1
add byte [eax + eax*8 + 0x776f1474], al
rol dword [esi - 0x39], 1
adc byte [edx], cl
mov dh, 0xcc
xchg ebx, eax
and bl, ah
dec edx
invalid
test al, al
je 0x45ba35
outsd dx, dword [esi]
ja 0x45b9f5
inc esi
invalid
push str.EXPLORER.EXE
call fcn.0045d199
pop ecx
push eax
xor ebx, ebx
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2018], eax
test eax, eax
je 0x45bc15
lea ecx, [ebp - 0x2010]
mov esi, 0xf01ff
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45bc15
lea eax, [ebp - 0x200c]
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x45bc15
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x45bae9
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45bae2
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x45bc15
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x206c]
push ebx
push eax
call fcn.004830b0
push 0x10
lea eax, [ebp - 0x2028]
push ebx
push eax
call fcn.004830b0
add esp, 0x18
mov dword [ebp - 0x206c], esi
call fcn.0047362e
test al, al
je 0x45bb39
mov ebx, 0x75466599
retf
push 5
pop eax
mov dword [ebp - 0x2064], str.WinSta0Default
mov word [ebp - 0x203c], ax
mov dword [ebp - 0x2040], 1
mov dword [ebp - 0x2008], ebx
call fcn.00473856
test al, al
je 0x45bb7a
shr dword [ebx], 1
sub cl, byte [eax - 0x2f2d4a1e]
xchg bh, cl
sbb edx, ebx
mov dl, 0x41
mov al, 0xf8
and byte [esi], ah
in al, dx
adc al, ch
wait
jns 0x45bb7f
call fcn.0047351a
add byte [eax + eax*8 - 0x2fcaeb8c], al
les ebx, [edi + 0x6d6c8921]
jns 0x45bbda
test al, al
je 0x45bb97
xor eax, 0x219fc4d0
mov dword [ebp + ebp*2 + 0x79], ebp
dec ebp
lodsd eax, dword [esi]
test byte [edx], bh
leave
fdivr dword [esi + 0x5a]
cmp ch, al
and eax, 0x84000178
sal byte [esp + edx + 0xe], 0xc9
call fcn.004733c1
test al, al
je 0x45bbb4
push cs
leave
retf 0x6593
xor ebx, ebx
lea eax, [ebp - 0x2008]
push ebx
push dword [ebp - 0x200c]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
add byte [ebp - 0x72b78b40], al
test eax, ebx
invalid
test eax, eax
je 0x45bc15
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x206c]
push eax
push ebx
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push 0x430
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x45bc15
cmp dword [ebp - 0x2008], ebx
je 0x45bc15
push dword [ebp - 0x2008]
call sub.USERENV.dll_DestroyEnvironmentBlock
call fcn.0047362e
add dword [eax], eax
test al, al
je 0x45bc2f
cmpsd dword [esi], dword es:[edi]
jp 0x45bbc9
xchg edi, eax
push eax
sbb byte [ecx - 0x537030c1], dh
dec eax
je 0x45bbc8
mov al, 0x22
jge 0x45bc18
call fcn.004736b8
test al, al
je 0x45bc57
test byte [edx + 1], bh
add byte [eax + eax*8 - 0x6197e08c], al
inc eax
or byte [ecx], ah
push 0x2108409e
invalid
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x45bc6d
cmp eax, 0xffffffff
je 0x45bc6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0047337c
test al, al
je 0x45bc86
cmp al, byte [eax + 0x4b]
ret
call fcn.0047355f
test al, al
je 0x45bc9f
push ecx
xor dword [ecx + 0x7e7240fb], ebx
add cl, byte [edi + 0x19]
int3
call fcn.00473811
test al, al
je 0x45bcbd
add eax, 0x4cbaf3ac
mov cs, ebx
cdq
sar dword [eax + 0x63293a2f], 0x9e
invalid
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x45bcd3
cmp eax, 0xffffffff
je 0x45bcd3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2018], 0
jne 0x45bce5
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0047362e
test al, al
je 0x45bcff
push ss
dec esp
push eax
fcmovne st(0), st(6)
mov esi, 0xfdf09884
sar dword [edx + ecx*8 + 0x7d], cl
call fcn.004736b8
test al, al
je 0x45bd27
out dx, eax
add eax, 0x15cea71f
invalid
xor al, al
jmp 0x45bd3f
xor eax, eax
push eax
push eax
push eax
push edx
push ecx
call fcn.0045b658
add esp, 0x14
test eax, eax
setne al
mov ecx, dword [ebp - 4]