Function at 0x648431b0
Capabilities:
Acquire debug privileges
Check mutex on windows
Create thread
Encode data using xor
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x84c
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [esp + 4], 1
mov dword [esp], str.SeDebugPrivilege
call fcn.64842820
mov dword [ebp - 0x18], 0
mov dword [esp + 4], 0x3a
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x64843648
lea ecx, [ebp - 0x418]
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [ebp - 0x830], ecx
mov dword [esp], ecx
call sub.msvcrt.dll_strncpy
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x648433d0
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x648433d0
call sub.KERNEL32.dll_GetCurrentProcessId
lea edx, [ebp - 0x818]
mov dword [esp + 4], str._s_p_
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov eax, dword [str.Vdbd]
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
lea ecx, [ebp - 0x818]
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x824], eax
je 0x64843677
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x6484368d
movzx eax, byte [ebp - 0x418]
xor edx, edx
test al, al
je 0x64843306
lea edx, [ebp - 0x418]
xor esi, esi
mov dword [ebp - 0x820], edx
mov edi, 0x100
lea esi, [esi]
movsx ebx, al
mov ecx, 0x40
or ebx, edi
mov edx, esi
mov eax, ebx
add edi, 0x100
shr eax, 2
xor eax, ebx
and eax, 0x1f
sub ecx, eax
shr edx, cl
mov ecx, eax
shl esi, cl
or edx, esi
mov esi, ebx
imul esi, ebx
xor esi, edx
mov edx, dword [ebp - 0x820]
movzx eax, byte [edx + 1]
add edx, 1
mov dword [ebp - 0x820], edx
test al, al
jne 0x648432c0
mov edx, esi
mov eax, dword [str.PARAM_]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 4], str._s_p__s_p_
mov dword [esp + 0x10], eax
mov eax, dword [str.Vdbd]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
lea eax, [ebp - 0x818]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 0x818]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x8000004
mov dword [esp + 0x10], ecx
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.dll_CreateFileMappingA
mov dword [ebp - 0x828], eax
mov eax, dword [ebp + 0x14]
sub esp, 0x18
mov edx, dword [ebp - 0x828]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf001f
call sub.KERNEL32.dll_MapViewOfFileEx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov dword [ebp - 0x14], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memmove
jmp 0x648433e4
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x824], 0
mov ecx, dword [ebp + 8]
mov edi, 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0x2a
mov dword [esp + 8], ecx
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test esi, esi
mov dword [ebp - 0x82c], 0
je 0x648434d7
lea ecx, [ebp - 0x418]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x64843426
mov eax, edx
mov edi, 0xfffffffe
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea eax, [ecx + 2]
cmove ecx, eax
add dl, dl
sbb ecx, 3
sub ecx, dword [ebp - 0x830]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
lea ebx, [ecx + 1]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [ebp - 0x82c], 0
sub esp, 0x14
test eax, eax
mov dword [ebp - 0x10], eax
je 0x648434d7
lea edx, [ebp - 0x418]
mov di, 0xfffd
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [ebp - 0x82c], 0
sub esp, 0x14
test eax, eax
jne 0x64843573
mov ebx, dword [ebp - 0x824]
test ebx, ebx
je 0x64843503
mov eax, dword [ebp - 0x824]
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
mov edx, dword [ebp - 0x824]
sub esp, 4
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x64843529
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_VirtualFreeEx
sub esp, 0x10
mov ecx, dword [ebp - 0x82c]
test ecx, ecx
je 0x64843544
mov ecx, dword [ebp - 0x82c]
mov dword [esp], ecx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test esi, esi
je 0x64843553
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.SeDebugPrivilege
call fcn.64842820
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp], str.Kernel32
mov di, 0xfffc
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [ebp - 0x82c], 0
sub esp, 8
test eax, eax
mov edx, eax
je 0x648434d7
mov eax, dword [ebp - 0x10]
mov di, 0xfffb
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.KERNEL32.dll_CreateRemoteThread
sub esp, 0x1c
test eax, eax
mov dword [ebp - 0x82c], eax
je 0x648434d7
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObjectEx
mov eax, dword [ebp - 0x14]
sub esp, 0xc
test eax, eax
je 0x64843622
mov dword [esp], eax
call sub.KERNEL32.dll_UnmapViewOfFile
sub esp, 4
mov eax, dword [ebp - 0x828]
xor edi, edi
test eax, eax
je 0x648434d7
mov ecx, dword [ebp - 0x828]
mov dword [esp], ecx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x648434d7
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x418]
mov dword [ebp - 0x830], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFullPathNameA
sub esp, 0x10
jmp 0x64843220
mov edi, 0xffffffff
xor esi, esi
mov dword [ebp - 0x82c], 0
jmp 0x64843503
mov eax, dword [ebp - 0x824]
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObjectEx
sub esp, 0xc
jmp 0x6484329d