Function at 0x4291c8
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
pop edi
pop esi
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
mov eax, 0x206c
call fcn.00437070
mov eax, dword [0x62e10c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2008], edi
mov dword [ebp - 0x2014], eax
je 0x42953c
call fcn.00424c7f
test al, al
je 0x42921e
mov esp, dword [ebx]
xchg ebx, eax
and al, 0x40
xor dword [ecx - 0x7e], eax
mov ebx, esi
jnp 0x4291c3
pop edi
aas
sub dword [esp + eax*2 - 0x75], edi
mov ebp, 0xffffdff8
call fcn.00424bf5
test al, al
je 0x42923d
mov dl, 0xf7
rol edi, 1
retf
xor ebx, ebx
lea eax, [ebp - 0x2004]
push 0x2000
push ebx
push eax
mov dword [ebp - 0x2010], ebx
mov dword [ebp - 0x200c], ebx
call fcn.00446a10
push dword [ebp - 0x2014]
lea eax, [ebp - 0x2004]
push edi
push str.__s___s
push eax
call fcn.004074d0
add esp, 0x1c
call fcn.00424d09
test al, al
je 0x4292a2
outsd dx, dword [esi]
xchg dh, cl
mov edi, 0x22b88729
push ecx
nop
dec ecx
push ecx
adc al, 0x74
mov ebx, 0x6b6c9e57
pop eax
mov esp, 0x6c45ce4c
rcl dword [ebp + 0x6eda5320]
xor ebx, ebx
push str.EXPLORER.EXE
call fcn.004285f8
pop ecx
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2018], eax
test eax, eax
je 0x42948d
lea ecx, [ebp - 0x2010]
mov esi, 0xf01ff
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42948d
lea eax, [ebp - 0x200c]
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x42948d
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x429354
push 0x5a88c4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42934d
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x42948d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
inc esp
pop esi
push esi
lea eax, [ebp - 0x206c]
push ebx
push eax
call fcn.00446a10
push 0x10
lea eax, [ebp - 0x2028]
push ebx
push eax
call fcn.00446a10
add esp, 0x18
mov dword [ebp - 0x206c], esi
call fcn.00424c3a
test al, al
je 0x42939a
in al, 0xbb
invalid
call fcn.00424eec
test al, al
je 0x4293bf
sal byte [edx + edi], cl
test dword [ecx + 0x67], ebp
mov ebx, 0x3ca43e48
jle 0x429424
loope 0x429355
salc
xlatb
sti
inc edi
xchg ebx, eax
fsubrp st(4)
outsb dx, byte [esi]
xor dword [edi - 0x2b], esp
cmpsb byte [esi], byte es:[edi]
sub al, 0x50
mov ebp, 0xc084ffff
call fcn.00425114
test al, al
je 0x4293dd
sbb ah, dl
and ecx, dword [esi]
mov al, 0xe6
stosb byte es:[edi], al
rol dword [edi], 1
popal
dec ebx
mov al, byte [0xe82b885f]
xor byte fs:[ebx], ch
salc
scasd eax, dword es:[edi]
push 5
pop eax
xor ebx, ebx
mov dword [ebp - 0x2064], str.WinSta0Default
mov word [ebp - 0x203c], ax
mov dword [ebp - 0x2040], 1
mov dword [ebp - 0x2008], ebx
call fcn.00424d09
test al, al
je 0x42942d
lds esi, fs:[ecx]
test ah, 0x93
int1
xor ecx, dword [ebx - 0x33]
call 0xaf43e8ff
or esi, dword [edx - 0x117c5a2a]
pop esi
outsb dx, byte cs:[esi]
xlatb
iretd
push ebx
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2008]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x42948d
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x206c]
push eax
push ebx
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push 0x430
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x42948d
cmp dword [ebp - 0x2008], 0
je 0x42948d
push dword [ebp - 0x2008]
call sub.USERENV.dll_DestroyEnvironmentBlock
call fcn.00425045
test al, al
je 0x4294b2
lodsd eax, dword [esi]
mov word [ebx + eax*2], ds
or esp, esp
mov ah, 0x89
mov edi, 0xf1d2abf7
sbb ch, byte [ebx + ebx*8]
invalid
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x4294c8
cmp eax, 0xffffffff
je 0x4294c8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00425114
test al, al
je 0x4294ec
ljmp 0x705e:0x24f988e4
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x429502
cmp eax, 0xffffffff
je 0x429502
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2018], 0
jne 0x429513
mov ebp, 0xffffdfe8
add byte [ebp + 8], dh
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00425045
test al, al
je 0x429538
push ebx
push es
sbb al, 0xc4
push ecx
xor al, 0xc4
insd dword es:[edi], dx
mov dword [eax], eax
fcmovbe st(0), st(6)
sub ch, dh
cmp al, 0x81
and ch, byte [edx + 0x2fb81811]
cmp cl, byte [edx + 0x37]
aas
jno 0x429503
xor al, al
jmp 0x429551
push 0
push 0
push 0
push eax
push edi
call fcn.00428e96
add esp, 0x14
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043671f
mov esp, ebp
pop ebp
ret