Function at 0x427f30
Capabilities:
Create process on windows
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x12a8
call fcn.00609180
mov eax, dword [0x6d3438]
xor eax, esp
mov dword [esp + 0x12a4], eax
push esi
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], ecx
push eax
push 0x1000
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
mov eax, dword [esp + 0x1c]
xor edi, edi
shr eax, 2
mov dword [esp + 0x24], eax
test eax, eax
je 0x42807b
mov eax, dword [0x68e074]
movups xmm0, xmmword [str._unknown_]
push 0x1f4
mov dword [esp + 0x10b4], eax
lea eax, [esp + 0x10b8]
push 0
push eax
movups xmmword [esp + 0x10ac], xmm0
call fcn.0060a8e0
add esp, 0xc
push dword [esp + edi*4 + 0xa0]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
je 0x428070
lea eax, [esp + 0x2c]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x428069
push 0x104
lea eax, [esp + 0x10a4]
push eax
push dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x428069
lea ecx, [esp + 0x10a0]
mov edx, 0x68d924
mov esi, 0x16
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x428031
add ecx, 4
add edx, 4
sub esi, 4
jae 0x428020
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x428058
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x428058
cmp esi, 0xfffffffe
je 0x428054
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x428058
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x428058
xor eax, eax
jmp 0x42805d
sbb eax, eax
or eax, 1
test eax, eax
je 0x42820b
mov esi, dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esp + 0x24]
jl 0x427f81
push str.__uipipe
push 0x400
push 0x6d3ec8
call fcn.0060e249
push 0x6e3408
push 0x400
push 0x6d3ec8
call fcn.0060e249
xorps xmm0, xmm0
mov dword [esp + 0x58], 0x44
add esp, 0x18
movlpd qword [esp + 0x44], xmm0
lea eax, [esp + 0x18]
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
push eax
push 0xf01ff
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movaps xmmword [esp + 0x38], xmm0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x428284
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0xa000000
push 1
push 0
push 0
push 0x6d3ec8
push 0x68d924
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x42832a
push dword [0x6e368c]
mov edx, dword [0x6e3838]
lea ecx, [esp + 0x8c]
push 0x415
call fcn.00432160
mov esi, eax
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x42816f
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4281ae
push 0x10
push esi
push dword [esp + 0x1c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x88]
call fcn.0042f900
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0xa000000
push 1
push 0
push 0
push 0x6d3ec8
push 0x68d924
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42832a
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x12a4]
xor ecx, esp
call fcn.00608185
mov esp, ebp
pop ebp
ret
push dword [0x6e368c]
mov edx, dword [0x6e3838]
lea ecx, [esp + 0x8c]
push 0x414
call fcn.00432160
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x428233
mov eax, dword [eax]
push 0
push 0x191
push 0x111
push dword [esp + 0x34]
mov dword [0x6d46c8], 0x6e
mov dword [0x6e33fc], 1
mov dword [0x6e366c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x88]
call fcn.0042f900
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x12a4]
xor ecx, esp
call fcn.00608185
mov esp, ebp
pop ebp
ret
push dword [0x6e368c]
mov edx, dword [0x6e3838]
lea ecx, [esp + 0x8c]
push 0x416
call fcn.00432160
mov esi, eax
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x4282ae
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4282ed
push 0x10
push esi
push dword [esp + 0x1c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x88]
call fcn.0042f900
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0xa000000
push 1
push 0
push 0
push 0x6d3ec8
push 0x68d924
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42826e
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x12ac]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.00608185
mov esp, ebp
pop ebp
ret