Function at 0x4ad270
Capabilities:
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bde96
mov eax, dword fs:[0]
push eax
mov eax, 0x2830
call fcn.00467a60
mov eax, dword [0x4e5b00]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2834], ecx
mov dword [ebp - 0x27f4], 0x2710
mov byte [ebp - 0x27f0], 0x77
mov byte [ebp - 0x27ef], 0x6d
mov byte [ebp - 0x27ee], 0x69
mov byte [ebp - 0x27ed], 0x63
mov byte [ebp - 0x27ec], 0x20
mov byte [ebp - 0x27eb], 0x42
mov byte [ebp - 0x27ea], 0x61
mov byte [ebp - 0x27e9], 0x73
mov byte [ebp - 0x27e8], 0x65
mov byte [ebp - 0x27e7], 0x42
mov byte [ebp - 0x27e6], 0x6f
mov byte [ebp - 0x27e5], 0x61
mov byte [ebp - 0x27e4], 0x72
mov byte [ebp - 0x27e3], 0x64
mov byte [ebp - 0x27e2], 0x20
mov byte [ebp - 0x27e1], 0x67
mov byte [ebp - 0x27e0], 0x65
mov byte [ebp - 0x27df], 0x74
mov byte [ebp - 0x27de], 0x20
mov byte [ebp - 0x27dd], 0x53
mov byte [ebp - 0x27dc], 0x65
mov byte [ebp - 0x27db], 0x72
mov byte [ebp - 0x27da], 0x69
mov byte [ebp - 0x27d9], 0x61
mov byte [ebp - 0x27d8], 0x6c
mov byte [ebp - 0x27d7], 0x4e
mov byte [ebp - 0x27d6], 0x75
mov byte [ebp - 0x27d5], 0x6d
mov byte [ebp - 0x27d4], 0x62
mov byte [ebp - 0x27d3], 0x65
mov byte [ebp - 0x27d2], 0x72
mov byte [ebp - 0x27d1], 0
mov byte [ebp - 0x27d0], 0x53
mov byte [ebp - 0x27cf], 0x65
mov byte [ebp - 0x27ce], 0x72
mov byte [ebp - 0x27cd], 0x69
mov byte [ebp - 0x27cc], 0x61
mov byte [ebp - 0x27cb], 0x6c
mov byte [ebp - 0x27ca], 0x4e
mov byte [ebp - 0x27c9], 0x75
mov byte [ebp - 0x27c8], 0x6d
mov byte [ebp - 0x27c7], 0x62
mov byte [ebp - 0x27c6], 0x65
mov byte [ebp - 0x27c5], 0x72
mov byte [ebp - 0x27c4], 0
mov dword [ebp - 0x27fc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x27c0], 0
mov byte [ebp - 0x2744], 0
push 0x2710
push 0
lea eax, [ebp - 0x2743]
push eax
call fcn.00465660
add esp, 0xc
lea ecx, [ebp - 0x2770]
call fcn.0041b540
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2754], 0
push 0x80
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00465660
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.00465660
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x27bc]
push eax
call fcn.00465660
add esp, 0xc
push 0xc
push 0
lea ecx, [ebp - 0x2750]
push ecx
call fcn.00465660
add esp, 0xc
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x27bc], 0x44
mov dword [ebp - 0x2750], 0xc
mov dword [ebp - 0x274c], 0
mov dword [ebp - 0x2748], 1
push 0
lea edx, [ebp - 0x2750]
push edx
lea eax, [ebp - 0x27c0]
push eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x27fc], eax
cmp dword [ebp - 0x27fc], 0
jne 0x4ad53c
cmp dword [ebp - 0x27c0], 0
je 0x4ad503
mov edx, dword [ebp - 0x27c0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x4ad513
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x27fc]
mov dword [ebp - 0x2804], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2770]
call fcn.00401750
mov eax, dword [ebp - 0x2804]
jmp 0x4ad922
lea edx, [ebp - 0x27bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [ebp - 0x27c0]
mov dword [ebp - 0x277c], eax
mov ecx, dword [ebp - 0x27c0]
mov dword [ebp - 0x2780], ecx
xor edx, edx
mov word [ebp - 0x278c], dx
mov dword [ebp - 0x2790], 0x101
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x27bc]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x27f0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x27fc], eax
cmp dword [ebp - 0x27fc], 0
jne 0x4ad618
cmp dword [ebp - 0x27c0], 0
je 0x4ad5bf
mov eax, dword [ebp - 0x27c0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x4ad5cf
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x4ad5df
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
je 0x4ad5ef
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x27fc]
mov dword [ebp - 0x2808], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2770]
call fcn.00401750
mov eax, dword [ebp - 0x2808]
jmp 0x4ad922
push 0x1f4
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
lea eax, [ebp - 0x10]
push eax
push 0x2710
lea ecx, [ebp - 0x2744]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x27fc], eax
cmp dword [ebp - 0x27fc], 0
jne 0x4ad6c1
cmp dword [ebp - 0x27c0], 0
je 0x4ad668
mov eax, dword [ebp - 0x27c0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x4ad678
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x4ad688
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
je 0x4ad698
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x27fc]
mov dword [ebp - 0x280c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2770]
call fcn.00401750
mov eax, dword [ebp - 0x280c]
jmp 0x4ad922
mov dword [ebp - 0x27fc], 0
lea edx, [ebp - 0x2744]
push edx
lea ecx, [ebp - 0x2770]
call fcn.004028f0
push 0
lea eax, [ebp - 0x27d0]
push eax
lea ecx, [ebp - 0x2770]
call fcn.0041b630
mov dword [ebp - 0x2754], eax
mov ecx, dword [ebp - 0x2754]
cmp ecx, dword [0x4d0ec8]
jne 0x4ad776
cmp dword [ebp - 0x27c0], 0
je 0x4ad71b
mov edx, dword [ebp - 0x27c0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x4ad72b
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x4ad73b
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
je 0x4ad74b
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x27fc]
mov dword [ebp - 0x2810], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2770]
call fcn.00401750
mov eax, dword [ebp - 0x2810]
jmp 0x4ad922
mov ecx, dword [0x4d0ec8]
push ecx
lea edx, [ebp - 0x27d0]
push edx
call fcn.00465dc0
add esp, 4
add eax, dword [ebp - 0x2754]
push eax
lea eax, [ebp - 0x282c]
push eax
lea ecx, [ebp - 0x2770]
call fcn.0041b6c0
mov dword [ebp - 0x2838], eax
mov ecx, dword [ebp - 0x2838]
mov dword [ebp - 0x283c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x283c]
push edx
lea ecx, [ebp - 0x2770]
call fcn.0041b560
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x282c]
call fcn.00401750
push 0x2711
push 0
lea eax, [ebp - 0x2744]
push eax
call fcn.00465660
add esp, 0xc
lea ecx, [ebp - 0x2770]
call fcn.00401780
push eax
lea ecx, [ebp - 0x2744]
push ecx
call sub.ntdll.dll_strcpy
add esp, 8
mov dword [ebp - 0x27f8], 0
mov dword [ebp - 0x2800], 0
jmp 0x4ad832
mov edx, dword [ebp - 0x2800]
add edx, 1
mov dword [ebp - 0x2800], edx
lea eax, [ebp - 0x2744]
push eax
call fcn.00465dc0
add esp, 4
cmp dword [ebp - 0x2800], eax
jge 0x4ad8ae
mov ecx, dword [ebp - 0x2800]
movsx edx, byte [ebp + ecx - 0x2744]
cmp edx, 0x20
je 0x4ad8a9
mov eax, dword [ebp - 0x2800]
movsx ecx, byte [ebp + eax - 0x2744]
cmp ecx, 0xa
je 0x4ad8a9
mov edx, dword [ebp - 0x2800]
movsx eax, byte [ebp + edx - 0x2744]
cmp eax, 0xd
je 0x4ad8a9
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x27f8]
mov edx, dword [ebp - 0x2800]
mov al, byte [ebp + edx - 0x2744]
mov byte [ecx], al
mov ecx, dword [ebp - 0x27f8]
add ecx, 1
mov dword [ebp - 0x27f8], ecx
jmp 0x4ad823
mov dword [ebp - 0x27fc], 1
cmp dword [ebp - 0x27c0], 0
je 0x4ad8ce
mov edx, dword [ebp - 0x27c0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x4ad8de
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x4ad8ee
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
je 0x4ad8fe
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x27fc]
mov dword [ebp - 0x2830], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2770]
call fcn.00401750
mov eax, dword [ebp - 0x2830]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004606fe
mov esp, ebp
pop ebp
ret 8