Function at 0x40183b
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push 0x9c
mov eax, 0x41a7b7
call fcn.00419ff7
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x88], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], edx
call fcn.00402d2d
call fcn.00402d2d
mov dword [ebp - 0xa8], eax
call fcn.00402d2d
mov dword [ebp - 0xa4], eax
call fcn.00401098
mov edi, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0xa0], edi
call fcn.00401098
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x9c], eax
call fcn.00402d2d
mov ecx, eax
test ecx, ecx
jne 0x4018b5
mov esi, ebx
jmp 0x4018de
mov edx, dword [ebp - 0x18]
lea eax, [ecx + edx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jbe 0x4018cc
mov edx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x4018d1
sub eax, ecx
mov dword [ebp - 0x14], eax
shr ecx, 1
dec ecx
push ecx
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x98], esi
call fcn.00401098
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x94], eax
cmp ecx, dword [ebp - 0x90]
ja 0x401a62
cmp byte [0x424558], bl
jne 0x40191a
push 0x420f50
call fcn.0040ad7d
pop ecx
push edi
mov ecx, 0x4238c0
call fcn.004029bb
cmp byte [0x42455a], bl
je 0x40193f
push 6
mov ecx, 0x42455c
call fcn.00401458
mov byte [0x42455a], bl
push edi
mov ecx, 0x42455c
call fcn.0040152b
push 0x40
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x70], 0x44
push ebx
push eax
call fcn.00404c10
add esp, 0xc
mov dword [ebp - 0x84], ebx
lea eax, [ebp - 0x74]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x94]
push esi
push dword [ebp - 0xa4]
push ebx
push ebx
push ebx
push dword [ebp - 0x9c]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
jne 0x4019b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
test edi, edi
jne 0x4019fa
cmp dword [0x4245f8], 8
mov eax, 0x4245e4
mov ecx, 0x42455c
cmovae eax, dword [0x4245e4]
push eax
call fcn.0040152b
push ebx
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401a62
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x7c]
mov dword [0x424604], eax
mov eax, edx
not eax
mov dword [0x424608], ecx
and eax, 1
mov dword [0x42460c], eax
test dl, 2
jne 0x401a3d
push 9
mov ecx, 0x42455c
call fcn.00401458
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
push ebx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
push 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push dword [ebp - 0x88]
mov dword [ebp - 0x28], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
call fcn.00419fb5
ret 4