Function at 0x4be0bc
Capabilities:
Create process on windows

Disassembly:
popal
jbe 0x4bdf49
push ss
add byte [ecx + esi*8], al
dec ebx
add byte [edi], cl
insb byte es:[edi], dx
bound ebp, qword [edx + edx*2 + 0x65]
jb 0x4bdf58
jae 0x4bdf5d
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xe9a80018
dec ebx
add byte [ecx], dl
ja 0x4bdf65
xor dword [eax + 0x72], edx
outsd dx, dword [esi]
jb 0x4bdf6f
jae 0x4bdf7f
inc ebx
push 0x65676e61
adc eax, dword [eax]
clc
invalid
outsd dx, dword [esi]
jae 0x4bdfb1
sbb al, 0
xor al, 0xf4
dec ebx
add byte [0x65486770], dl
popal
jb 0x4bdf8d
push esp
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
inc edx
je 0x4bdfd1
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xe9000015
dec ebx
add byte [esi], cl
ja 0x4bdfd3
xor dword [edi + 0x65], eax
je 0x4bdfbb
js 0x4bdfec
jb 0x4bdfe9
popal
insb byte es:[edi], dx
sbb dword [eax], eax
pushfd
loope 0x4bdfcd
add byte [edx], dl
inc ecx
arpl word [edi + ebx*2 + 0x41], si
jne 0x4bdfff
outsd dx, dword [esi]
push edx
jne 0x4bdffd
inc ebp
js 0x4bdff7
arpl word [ebp + 0x74], si
pop ss
add byte [eax - 0x1c], cl
dec ebx
add byte [eax], dl
je 0x4be00c
jb 0x4bdfee
popal
jae 0x4be00f
dec eax
imul esp, dword [ebp + 0x54], 0x72656d69
sbb byte [eax], al
enter 0x4bf0, 0
adc dword [ecx + 0x6d], ebp
dec esp
outsd dx, dword [esi]
outsd dx, dword [si]
dec ebx
add byte [ecx], dl
imul ebp, dword [ebp + 0x67], 0x6f676f4c
dec ebp
outsd dx, dword [esi]
jne 0x4be032
inc ebp
outsb dx, byte [esi]
je 0x4be029
jb 0x4bdfd9
add byte [eax + esi*8 + 0x690c004b], dh
insd dword es:[edi], dx
dec esp
outsd dx, dword [esi]
outsd dx, dword [si]
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0xe4440010
dec ebx
add byte [esp + 0x4b], al
add byte [ecx], cl
bound esi, qword [esi + ebp*2 + 0x31]
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0x214000b
add byte [edx + eax], dl
adc al, byte [ecx]
adc al, byte [ebx]
test byte [eax], al
and al, 0
dec edx
add bh, bh
pop es
sbb cl, byte [eax]
adc eax, 0xce081608
or dh, cl
or byte [eax + 1], cl
dec esp
add ah, cl
add dword [eax + eax - 0x50], ecx
cli
dec ebx
add byte [eax], dh
dec byte [ebx]
pop esp
cli
dec ebx
xor dh, bh
dec ebx
add byte [edx + edi*8 + 0x4b], bl
add byte [eax + edi*8 - 0x1fffb5], dl
dec ebx
add byte [eax - 0x2fffb3ff], bh
cli
dec ebx
add byte [eax], al
std
dec ebx
add byte [esi + edi*8 + 0x4b], bh
add byte [ebx], dl
push esp
pop eax
imul esp, dword [ecx + 0x6f], 0x31617548
xor byte [eax], dh
dec ebp
popal
dec byte [ebx]
adc edx, dword [eax + ebx*2 + 0x69]
popal
outsd dx, dword [esi]
dec eax
jne 0x4be096
xor dword [eax], esi
xor byte [ebp + 0x61], cl
imul ebp, dword [esi + 0x46], 0x126d726f
add byte [edi + esi*4 + 0x45], al
add byte [ebx + edi*4], dh
inc ebp
add byte [esi + ecx*4], al
inc ebx
add al, al
loop 0x4be094
add byte [edx + ebx*8 + 0x6be80043], bh
inc ebx
add byte [ebp + ebx*2 + 0x43], bh
add byte [eax], ah
dec eax
dec ecx
add al, ah
ror dword [ebx], cl
shl byte [ecx + ecx*2], 0
xchg esp, eax
xor dword [edx], ecx
jl 0x4be0c7
inc ebx
add byte [ebp + ecx*2 + 0x38480049], al
dec edx
add byte [eax - 0x2bffb607], ch
ror byte [ebx], cl
inc eax
dec ecx
add byte [eax], ch
sahf
dec ebx
add byte [ebx + 0x4be090c0], cl
add byte [edi], al
adc edx, dword [eax + ebx*2 + 0x69]
popal
imul esp, dword [ecx + 0x6f], 0x31617548
xor byte [eax], dh
dec ebp
popal
outsd dx, dword [esi]
dec eax
jne 0x4be0fb
xor dword [eax], esi
xor byte [ebp + 0x61], cl
imul ebp, dword [esi + 0x46], 0x7c6d726f
aad 0x4b
add byte [eax + 0x68004a6a], ah
add byte [edi], al
jb 0x4be120
dec ebp
popal
imul ebp, dword [esi], 0x408d00
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4be11e
push dword fs:[eax]
push ds
loope 0x4be115
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
push 5
lea edx, [ebp - 8]
xor eax, eax
call fcn.00403390
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040a134
lea eax, [ebp - 4]
mov edx, 0x4be134
call fcn.00405174
mov eax, dword [ebp - 4]
call fcn.00405338
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be125
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404eb0
ret
hlt
add byte [eax], al
add al, ch
xchg ebx, eax
insd dword es:[edi], dx
hlt
hlt