Function at 0x422120
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x88], 0
nop
lea rcx, [0x004228f0]
call fcn.00410790
nop
call fcn.00420b40
call fcn.00420f20
call sub.KERNEL32.DLL_GetTickCount
mov dword [0x004314b0], eax
lea rcx, [0x004227d0]
mov edx, 0xa
lea r8, [0x00431400]
call fcn.0041eea0
test al, al
je 0x42275b
call fcn.004202c0
cmp byte [0x00431411], 0
je 0x4221c9
lea rcx, [0x004227da]
mov dl, 1
call fcn.004134f0
cmp byte [0x00431410], 0
je 0x422264
mov rcx, qword [0x00431400]
call fcn.004130d0
mov dword [0x004313f0], eax
mov ecx, 0x1fffff
xor edx, edx
mov r8d, eax
call sub.KERNEL32.DLL_OpenProcess
mov qword [0x004313e0], rax
mov ecx, dword [0x004313f0]
call fcn.00413270
mov dword [0x004313f4], eax
mov ecx, 0x1f03ff
xor edx, edx
mov r8d, eax
call sub.KERNEL32.DLL_OpenThread
mov eax, eax
mov qword [0x004313e8], rax
cmp dword [0x004313f0], 0
jne 0x422734
cmp byte [0x00431414], 0
jne 0x42275b
xor ecx, ecx
lea rdx, [0x004227fc]
lea r8, [0x00422844]
mov r9d, 0x10
call sub.USER32.DLL_MessageBoxW
jmp 0x42275b
mov rcx, qword [0x004314a8]
call fcn.0040b4d0
xor ecx, ecx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [0x00431378]
mov qword [rsp + 0x40], rax
lea rax, [0x004313e0]
mov qword [rsp + 0x48], rax
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
jne 0x422734
cmp byte [0x00431414], 0
jne 0x42275b
xor ecx, ecx
lea rdx, [0x00422858]
lea r8, [0x00422844]
mov r9d, 0x10
call sub.USER32.DLL_MessageBoxW
jmp 0x42275b
lea rcx, [0x004314b8]
mov edx, dword [0x00431419]
call sub.KERNEL32.DLL_WaitForDebugEvent
test eax, eax
jne 0x422326
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x79
jne 0x422741
cmp dword [0x004313f0], 0
je 0x42275b
jmp 0x422734
mov eax, dword [0x004314b8]
sub eax, 1
test eax, eax
je 0x42254d
sub eax, 2
test eax, eax
je 0x422356
sub eax, 2
test eax, eax
je 0x422713
sub eax, 1
test eax, eax
jne 0x42271c
jmp 0x42238b
cmp qword [0x00431408], 0
jne 0x42236e
cmp byte [0x00431413], 0
jne 0x42236e
call fcn.00421530
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x10002
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x422734
cmp qword [0x00431408], 0
jne 0x4223a2
cmp byte [0x00431413], 0
je 0x422530
cmp word [0x004314e8], 1
sete al
mov byte [0x00431a58], al
lea rcx, [rbp + 0x88]
mov rdx, qword [0x004314e0]
mov r8, qword [0x004314d0]
lea r9, [0x00431a58]
call fcn.00421370
lea rcx, [0x00431a50]
mov rdx, qword [rbp + 0x88]
call fcn.0040ab20
cmp qword [0x00431a50], 0
je 0x422434
cmp byte [0x00431a58], 0
je 0x422417
lea rcx, [0x00431a50]
call fcn.0040ad10
lea rcx, [0x00431a48]
mov rdx, rax
call fcn.0040b570
jmp 0x42244f
lea rcx, [0x00431a50]
call fcn.0040ad10
lea rcx, [0x00431a48]
mov rdx, rax
call fcn.0040b540
jmp 0x42244f
lea rcx, [0x00431a50]
call fcn.0040ad10
lea rcx, [0x00431a48]
mov rdx, rax
call fcn.0040b540
cmp byte [0x00431413], 0
je 0x4224cf
lea rcx, [rbp + 0x78]
mov rdx, qword [0x00431a48]
call fcn.00413410
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x78]
call fcn.00413310
lea rcx, [rbp + 0x70]
lea rdx, [0x004228c4]
call fcn.00413310
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x70]
call fcn.0040ba90
test eax, eax
jne 0x4224cf
mov rcx, qword [0x004314d0]
lea rdx, [0x004228da]
call fcn.00411bd0
mov qword [0x00431a38], rax
mov rcx, qword [0x004313e0]
mov rdx, qword [0x00431a38]
call fcn.00421400
mov byte [0x00431a40], al
lea rcx, [rbp + 0x60]
mov rdx, qword [0x00431a48]
call fcn.00413410
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.00413310
lea rcx, [rbp + 0x58]
mov rdx, qword [0x00431408]
call fcn.00413310
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x58]
call fcn.0040ba90
test eax, eax
jne 0x422530
mov byte [0x0042aadd], 1
mov rax, qword [0x004314d0]
mov qword [0x00431a60], rax
cmp byte [0x00431413], 0
jne 0x422530
call fcn.00421530
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x10002
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x422734
mov eax, dword [0x004314c8]
add eax, 0x7ffffffd
test eax, eax
je 0x4225a8
sub eax, 1
test eax, eax
je 0x42268c
sub eax, 0x40000001
test eax, eax
jne 0x4226f9
cmp dword [0x00431560], 0
je 0x42259c
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x80010001
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x422734
mov byte [0x0042aadc], 1
jmp 0x422734
cmp dword [0x00431560], 0
je 0x42266f
mov rax, qword [0x004314d8]
cmp rax, qword [0x00431a38]
jne 0x422652
mov dword [0x00431598], 0x10003
mov rcx, qword [0x004313e8]
lea rdx, [0x00431568]
call sub.KERNEL32.DLL_GetThreadContext
mov rcx, qword [0x004313e0]
mov rdx, qword [0x00431a38]
lea r8, [0x00431a40]
mov r9d, 1
lea rax, [0x004313f8]
mov qword [rsp + 0x20], rax
call sub.KERNEL32.DLL_WriteProcessMemory
cmp qword [0x00431408], 0
je 0x42262d
cmp byte [0x0042aadd], 0
je 0x422632
call fcn.00421530
jmp 0x422632
call fcn.00421530
lea rax, [0x004315ac]
or dword [rax], 0x100
mov rcx, qword [0x004313e8]
lea rdx, [0x00431568]
call sub.KERNEL32.DLL_SetThreadContext
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x10002
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x422734
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x80010001
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x422734
cmp dword [0x00431560], 0
je 0x4226df
mov dword [0x00431598], 0x10001
mov rcx, qword [0x004313e8]
lea rdx, [0x00431568]
call sub.KERNEL32.DLL_GetThreadContext
mov rcx, qword [0x004313e8]
lea rdx, [0x00431568]
call sub.KERNEL32.DLL_SetThreadContext
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x10002
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x422734
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x80010001
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x422734
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x80010001
call sub.KERNEL32.DLL_ContinueDebugEvent
jmp 0x422734
mov byte [0x0042aadc], 1
jmp 0x422734
mov ecx, dword [0x004314bc]
mov edx, dword [0x004314c0]
mov r8d, 0x80010001
call sub.KERNEL32.DLL_ContinueDebugEvent
cmp byte [0x0042aadc], 0
je 0x4222f0
nop
mov rcx, qword [0x004313e0]
call sub.KERNEL32.DLL_CloseHandle
mov rcx, qword [0x004313e8]
call sub.KERNEL32.DLL_CloseHandle
nop
lea rcx, [rbp + 0x58]
mov edx, 6
call fcn.0040a590
lea rcx, [rbp + 0x88]
call fcn.0040a500
call fcn.0040a150
jmp 0x422785
lea rsp, [rbp + 0x90]
pop rbp
ret