Function at 0x635dfc
Capabilities:
Create process on windows

Disassembly:
imul esp, dword [ebx + 0x68], 0x74696445
xor esp, ebp
add eax, dword [eax]
add byte [ecx], al
add byte [edi], al
inc edx
jne 0x635c60
je 0x635c5d
outsb dx, byte [esi]
xor eax, esi
add eax, dword [eax]
add byte [edx], al
add byte [esi], al
dec esp
popal
bound esp, qword [ebp + 0x6c]
xor esp, esi
add eax, dword [eax]
add byte [edx], al
add byte [esi], al
dec esp
push eax
jb 0x635c71
outsb dx, byte [esi]
je 0x635c0f
add byte [ebx], al
mov ah, 0x59
arpl word [eax], ax
call 0x9635c19
push edx
imul esp, dword [ebx + 0x68], 0x74696445
xor dword [edx], eax
add byte [ebx], al
pushfd
pushfd
push esi
add ah, ch
add eax, dword [eax]
add byte [edi], al
inc edx
jne 0x635ca2
je 0x635c9f
outsb dx, byte [esi]
xor dword [edx], eax
add byte [ebx], al
pushal
inc ecx
push esi
add al, dh
add eax, dword [eax]
add byte [esi], al
dec esp
popal
bound esp, qword [ebp + 0x6c]
xor dword [edx], eax
add byte [ebx], al
pushal
inc ecx
push esi
add ah, dh
add eax, dword [eax]
add byte [esi], al
dec esp
push eax
jb 0x635cbd
outsb dx, byte [esi]
je 0x635c59
add byte [ebx], al
add byte [ebx], dl
add byte [edi + ebx*2 + 0x420c0063], ah
pop edi
arpl word [eax], ax
or al, 0x42
jne 0x635cd8
je 0x635cd5
outsb dx, byte [esi]
xor dword [ebx + 0x6c], eax
imul esp, dword [ebx + 0x6b], 0x5f040012
arpl word [eax], ax
or ecx, dword [eax + edx*2 + 0x72]
imul ebp, dword [esi + 0x74], 0x63696c43
imul edx, dword [ebx], 0
invalid
add byte [edx], ah
hlt
push esi
add byte [eax], cl
inc eax
push esi
add byte [eax + eax], bh
movsb byte es:[edi], byte [esi]
pop edi
arpl word [eax], ax
or al, 0x42
jne 0x635d41
je 0x635d3e
outsb dx, byte [esi]
xor dword [ebx + 0x6c], eax
imul esp, dword [ebx + 0x6b], 3
imul eax, dword [ebx], 0
add byte [eax], al
add byte [eax], al
or byte [eax], al
add cl, byte [eax]
test byte [ebp + 0x63], bl
add byte [eax], al
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
or byte [edi + ebx + 0x10040], dh
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x635cfe
add byte [edx], al
add byte [ebx], bh
add byte [edi + ebx*2], al
arpl word [eax], ax
or ecx, dword [eax + edx*2 + 0x72]
imul ebp, dword [esi + 0x74], 0x63696c43
imul eax, dword [ebx], 0
add byte [eax], al
add byte [eax], al
or byte [eax], al
add cl, byte [eax]
test byte [ebp + 0x63], bl
add byte [eax], al
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
or byte [edi + ebx + 0x10040], dh
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x635d39
add byte [edx], al
add byte [ecx], cl
invalid
arpl word [eax], ax
or al, 0x46
inc esi
outsd dx, dword [esi]
jb 0x635db2
dec ebx
jns 0x635d99
jb 0x635db0
jae 0x635dc0
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add ecx, dword [eax]
test byte [ebp + 0x63], bl
add byte [eax], al
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
or byte [edi + ebx + 0x10040], dh
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x635d75
add byte [ecx], al
dec esp
adc byte [eax], al
add al, byte [eax]
add ecx, dword [ebx + 0x65]
jns 0x635d82
add byte [edx], al
add byte [eax], al
mov byte [ebp + 0x63], bl
add byte [edi], al
push es
push esp
inc esi
outsd dx, dword [esi]
jb 0x635dfc
xor esi, dword [edx + ebx*2]
arpl word [eax], ax
mov al, byte [0x72005f70]
add byte [0x74696e55], al
xor eax, dword [eax]
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ebx - 0x75], dl
fmul dword [ebx - 0x5ffd173d]
cmc
jmp [edx]
push 0
push 1
push 0x45b
mov eax, ebx
call fcn.0055a1e0
push eax
call sub.user32.dll_SendMessageW
bnd call dword [eax - 0x18]
cld
pop ds
fdivp st(7)
push 0
push 0
push 0x43b
mov eax, ebx
call fcn.0055a1e0
push eax
call sub.user32.dll_SendMessageW
or eax, 0x4000000
push eax
push 0
push 0x445
mov eax, ebx
call fcn.0055a1e0
push eax
call sub.user32.dll_SendMessageW
pop ebx
ret
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x635ed4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
cmp dword [eax + 8], 0x70b
jne 0x635eb1
mov esi, eax
lea edi, [ebp - 0x2c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x20], 0x201
jne 0x635eb1
xor eax, eax
push ebp
push 0x635ea7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0
push 0x437
mov eax, dword [ebp - 8]
call fcn.0055a1e0
push eax
call sub.user32.dll_SendMessageW
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x168]
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040bf9c
push eax
push 0x635ee4
mov eax, dword [ebp - 8]
call fcn.0055a1e0
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x635eb1
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00590eb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x635edb
lea eax, [ebp - 4]
call fcn.0040b424
pop eax
jmp eax