Function at 0x45e6c6
Capabilities:
Create process on windows

Disassembly:
push 0x98
mov eax, 0x5e5a32
call fcn.00470bca
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x44
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
pop esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0xa4]
push ebx
push eax
mov dword [ebp - 0x48], ebx
call fcn.00483520
push 0x10
lea eax, [ebp - 0x60]
mov dword [ebp - 0xa4], esi
push ebx
push eax
call fcn.00483520
add esp, 0x18
mov dword [ebp - 0x18], ebx
xor eax, eax
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 1
call fcn.00453b2b
test al, al
je 0x45e74d
pop esp
invalid
scasb al, byte es:[edi]
int1
std
lodsd eax, dword [esi]
jmp 0x911b7dfb
call fcn.004537ef
test al, al
je 0x45e771
rol byte [eax - 0x6a161398], cl
jnp 0x45e6ef
out dx, al
jp 0x45e783
adc eax, dword [edi - 0x5a3fe3de]
mov esi, 0xf5996ee9
and byte [edx + 0x3d], ch
mov cl, 0xe8
jns 0x45e7c4
call fcn.004537ef
test al, al
je 0x45e795
invalid
mov dh, al
mov bl, 0xce
dec ecx
mov cl, 0xe0
push esp
xor dh, byte [ecx]
dec eax
test ebp, edx
mov eax, dword [0x8e61129]
xor dword [eax - 0x7b], ecx
aad 0xa1
sub dword [ecx], edx
out 8, al
push edi
cmp byte [edi], ah
int3
mov ebx, dword [ebp - 0x4c]
xor esi, esi
test ebx, ebx
je 0x45e7b8
cmp word [ebx], si
jne 0x45e7a7
mov eax, esi
jmp 0x45e7ae
push ebx
call fcn.00491bc7
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00402b90
or edi, 0xffffffff
cmp dword [ebp - 0x30], 0
jne 0x45e7e0
mov ebx, dword [ebp - 0x44]
cmp word [ebx], si
jne 0x45e7cd
mov eax, esi
jmp 0x45e7d4
push ebx
call fcn.00491bc7
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402b90
jmp 0x45e836
mov esi, 0x5eb488
push esi
call fcn.00491bc7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402b90
mov ebx, dword [ebp - 0x44]
xor eax, eax
cmp word [ebx], ax
je 0x45e807
push ebx
call fcn.00491bc7
pop ecx
xor eax, dword [ebx]
add byte [ecx + 0x50], bl
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00405d30
mov esi, 0x5f0444
push esi
call fcn.00491bc7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00405d30
push edi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405c20
call fcn.00453720
test al, al
je 0x45e85f
pushfd
sbb dl, bl
shl byte [edx], 0xd2
or byte [ebx], dl
pop ebx
sub dh, byte [eax - 0x1b67f5aa]
cli
inc eax
je 0x45e803
push ebp
or dl, byte [ebp - 0x21]
push esi
push 0xfffffffffffffffd
in al, dx
jle 0x45e869
xor al, 0xce
call fcn.00453bb5
test al, al
je 0x45e887
and bl, 0xe
jecxz 0x45e879
cmpsb byte [esi], byte es:[edi]
je 0x45e8c6
mov eax, 0xe6ad63fc
stosb byte es:[edi], al
push ecx
mov esp, 0xc856621b
cmp esi, dword [edi + 0x3d]
enter 0x773b, 0x3d
pop edi
jns 0x45e8c2
fidiv dword [ebx]
mov ecx, 0xffcf833e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x67
call fcn.00459c08
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
xor ebx, ebx
pop ecx
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x45e8ce
add byte [ebp - 0x74f88a40], al
jmp 0x45e94f
pop es
mov esi, ebx
jmp 0x45e94f
cmp byte [ebp + 0x10], bl
je 0x45e8e4
cmp dword [ebp + 0x14], ebx
cmovg edi, dword [ebp + 0x14]
push edi
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x45e901
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x45e901
mov eax, dword [ebp - 0x48]
mov dword [esi], eax
call fcn.00453834
test al, al
je 0x45e91b
sub eax, 0xce83f5e8
dec edx
pop eax
movsw word es:[edi], word [esi]
mov esp, 0x7fdd6c63
adc dl, byte [bx]
call fcn.004537aa
test al, al
je 0x45e93a
nop
arpl word [eax], di
add ebx, ebp
mov ah, al
bound ecx, qword [eax - 0x1f]
jle 0x45e98e
push 0xc70b19b
push edi
inc ebx
mov edx, 0x75ff5f13
mov al, byte [0x9274358b]
pop esi
add bh, bh
salc
push dword [ebp - 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x5c]
call esi
xor esi, esi
inc esi
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0041ed70
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0041ed70
mov eax, esi
call fcn.00470b74
ret
test al, al
je 0x45e99c
hlt
pop ds
pop ebx
cmp bl, byte [ebp + 0x4b622d8b]
outsb dx, byte [esi]
scasb al, byte es:[edi]
in eax, 0xe9
out dx, eax
jae 0x45e985
call fcn.00453c3f
test al, al
je 0x45e9c0
sahf
push edx
invalid
adc bh, byte [edi - 0x2cc7622a]
invalid
call fcn.00453bfa
test al, al
je 0x45e9e2
cmp byte [0xe268686e], ah
movsd dword es:[edi], dword [esi]
les edx, ds:[ecx + eax*8]
xchg ecx, eax
and dword [eax], 0x980076d7
xchg ebp, eax
dec edi
jge 0x45ea35
out 0xf9, al
xor eax, eax
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
call int.0045e6c6
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret
je 0x45ea4e
or ebx, dword [ecx + 0x61]
dec eax
dec ebx
push edx
popfd
lds eax, [edx]
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
leave
iretd
call fcn.004537aa
test al, al
je 0x45ea6d
mov al, byte [0x16828737]
adc eax, 0x8b632895
inc edi
retf 0xf2e9
xor ebx, ebx
lea eax, [ebp - 0x2004]
push 0x2000
push ebx
push eax
mov dword [ebp - 0x2010], ebx
mov dword [ebp - 0x200c], ebx
call fcn.00483520
push dword [ebp - 0x2014]
lea eax, [ebp - 0x2004]
push edi
push str.__s___s
push eax
call fcn.00407e80
add esp, 0x1c
call fcn.004538be
test al, al
je 0x45ead2
invalid
cld
invalid
movsb byte es:[edi], byte [esi]
xchg ebx, eax
cmp edx, ebp
clc
mov esi, 0xbb286ae5
cmpsd dword [esi], dword es:[edi]
pop edi
sti
dec ebx
push edi
jge 0x45ea95
bound eax, qword [ecx]
and al, 0x84
sahf
fist word [edi + 0x55]
je 0x45ea72
cmp eax, 0x332c3ef7
fld xword [eax - 0x4c]
call [esi]
push str.EXPLORER.EXE
call fcn.0045fe41
pop ecx
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2018], eax
test eax, eax
je 0x45ecbd
lea ecx, [ebp - 0x2010]
mov esi, 0xf01ff
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45ecbd
lea eax, [ebp - 0x200c]
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x45ecbd
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x45eb84
push 0x5eff94
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45eb7d
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x45ecbd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x206c]
push ebx
push eax
call fcn.00483520
push 0x10
lea eax, [ebp - 0x2028]
push ebx
push eax
call fcn.00483520
add esp, 0x18
mov dword [ebp - 0x206c], esi
call fcn.004537ef
test al, al
je 0x45ebca
movsd dword es:[edi], dword [esi]
stosb byte es:[edi], al
sahf
mov al, 0x28
xor eax, 0x4bb1b70
mov dl, 0xc0
daa
cmp eax, 0x4925e5f0
xchg esp, eax
invalid
call fcn.00453aa1
test al, al
je 0x45ebef
dec ebp
stosd dword es:[edi], eax
lodsd eax, dword [esi]
mov fs, word [ecx + 0x6006edd]
dec esp
or dword [0x1677d8f3], esi
lahf
sbb al, 0x56
ret
call fcn.00453cc9
test al, al
je 0x45ec0d
popfd
loope 0x45eb7d
leave
int 0xa4
add byte [ebx + edi*2], cl
mov ebp, 0x7f0d2e8
stosd dword es:[edi], eax
popal
into
dec ebp
mov eax, dword [0x58056ad4]
push 5
pop eax
xor ebx, ebx
mov dword [ebp - 0x2064], str.WinSta0Default
mov word [ebp - 0x203c], ax
mov dword [ebp - 0x2040], 1
mov dword [ebp - 0x2008], ebx
call fcn.004538be
test al, al
je 0x45ec5d
xor eax, 0x37ab5792
das
xchg esi, eax
jae 0x45ec90
sal dword es:[edx - 0x4e], cl
push esi
xor dword [ecx], esi
xchg edi, eax
and dword [edi - 0x56ffa66e], ecx
fsubrp st(1)
dec esi
nop
dec edx
invalid
push ebx
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2008]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x45ecbd
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x206c]
push eax
push ebx
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push 0x430
push ebx
push ebx
xor byte [eax + eax], al
add byte [ebx + 0x53], dl
push ebx
push eax
push ebx
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x45ecbd
cmp dword [ebp - 0x2008], 0
je 0x45ecbd
push dword [ebp - 0x2008]
call sub.USERENV.dll_DestroyEnvironmentBlock
call fcn.00453bfa
test al, al
je 0x45ece2
mov al, 0x5c
pop esi
mov esp, 0x6235e900
xchg ebp, eax
sbb al, 0x40
xchg esp, eax
or dword [eax + 0x5ec1893d], edi
pop esi
das
shl dword [edx + ecx*2 + 0x5d], 1
jp 0x45ecd7
xchg ebp, eax
ror byte [ebx - 0x200b7b], 1
inc dword [ebp - 0x7cf38b40]
clc
push dword [edi + eax + 0x50]
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x45ecf8
cmp eax, 0xffffffff
je 0x45ecf8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00453cc9
test al, al
je 0x45ed1c
mov dword [0x97bb8e83], eax
inc ecx
popal
loope 0x45ed57
retf 0xf351
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x45ed32
cmp eax, 0xffffffff
je 0x45ed32
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2018], 0
jne 0x45ed43
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00453bfa
test al, al
je 0x45ed68
sub byte [0xf9c3fddd], ch
stc
inc ecx
or eax, 0xb224f846
and al, 0xb2
cmp dword [esi + 0x2b], 0xc908dd65
pop ebp
dec esi
shr byte [ebp - 0x28958f87], 1
xor al, al
jmp 0x45ed81
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret