Function at 0x629ecc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
imul esi, dword fs:[ecx + esi - 0x14], 0x1000003
add byte [edi], al
inc edx
jne 0x629e0c
je 0x629e09
outsb dx, byte [esi]
xor eax, esi
add eax, dword [eax]
add byte [ecx], al
add byte [edi], al
inc edx
jne 0x629e1a
je 0x629e17
outsb dx, byte [esi]
xor al, byte [ebx]
add byte [ebx], al
sbb byte [edx], al
push ebp
add al, ch
add eax, dword [eax]
add byte [0x74696445], al
xor dword [edx], eax
add byte [ebx], al
ror byte [ecx + 0x55], 1
add ah, ch
add eax, dword [eax]
add byte [edi], al
inc edx
jne 0x629e3e
je 0x629e3b
outsb dx, byte [esi]
xor dword [edx], eax
add byte [ebx], al
ror byte [ecx + 0x55], 1
add al, dh
add eax, dword [eax]
add byte [edi], al
inc edx
jne 0x629e51
je 0x629e4e
outsb dx, byte [esi]
xor al, byte [edx]
add byte [edx], al
add byte [ebx], dl
add al, bh
lahf
bound eax, qword [eax]
or al, 0x42
jne 0x629e63
je 0x629e60
outsb dx, byte [esi]
xor dword [ebx + 0x6c], eax
imul esp, dword [ebx + 0x6b], 0xa0f80013
bound eax, qword [eax]
or al, 0x42
jne 0x629e76
je 0x629e73
outsb dx, byte [esi]
xor al, byte [ebx + 0x6c]
imul esp, dword [ebx + 0x6b], 0x9e300002
arpl word [ebx + 2], bp
add byte [eax], dh
sahf
bound eax, qword [eax]
bound eax, qword [eax]
hlt
bound eax, qword [eax]
bound eax, qword [eax]
hlt
add ah, dh
jmp dword [esi]
outsd dx, dword [esi]
outsb dx, byte [esi]
xor dword [ebx + 0x6c], eax
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 3
add byte [eax], al
or byte [eax], al
add cl, byte [eax]
test al, 0x9e
sahf
bound eax, qword [eax]
add byte [eax], al
add al, 0x53
insb byte es:[edi], dx
add al, byte [eax]
or byte [edi + ebx + 0x10040], dh
push es
add byte [esi], al
push ebx
outsb dx, byte gs:[esi]
jb 0x629e6b
add byte [edx], al
add byte [eax + eax], bh
clc
mov al, byte [0x420c0062]
inc edx
jne 0x629eea
je 0x629ee7
outsb dx, byte [esi]
xor al, byte [ebx + 0x6c]
imul esp, dword [ebx + 0x6b], 3
add byte [eax], al
or byte [eax], al
add cl, byte [eax]
test al, 0x9e
bound eax, qword [eax]
add byte [eax], al
add al, 0x53
insb byte es:[edi], dx
add al, byte [eax]
or byte [edi + ebx + 0x10040], dh
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x629ea7
add byte [edx], al
add byte [esi + ebx*4 + 0x6070062], ch
push esp
inc esi
outsd dx, dword [esi]
jb 0x629f20
xor al, 0xe4
wait
bound eax, qword [eax]
adc dh, bh
pop ebp
add byte [edx], dh
add eax, 0x74696e55
xor al, 0
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x629fc3
push dword fs:[eax]
ret
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
push 0x629fe0
push ebx
push 0x629ff0
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040ae28
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407aa8
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], di
mov eax, dword [0x663378]
mov eax, dword [eax]
call fcn.005f4030
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00425d88
mov eax, dword [ebp - 0x5c]
call fcn.0040ab3c
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040ab3c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x629fa3
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
push 0x66b0e8
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x629fca
lea eax, [ebp - 0x5c]
call fcn.0040a06c
lea eax, [ebp - 4]
call fcn.0040a06c
pop eax
jmp eax