Function at 0x564914
Capabilities:
Create process on windows
Get session user name
Persist via run registry key
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x17
push 0
push 0
dec ecx
jne 0x56491c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56546a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x360]
mov al, byte [eax + 0x24c]
mov edx, dword [0x5a80a4]
mov byte [edx], al
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c0]
call fcn.0044d448
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x5a80a4]
add eax, 4
call fcn.00404d08
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
call fcn.0044d448
mov eax, dword [ebp - 0x30]
mov edx, 0x1f90
call fcn.0040c67c
mov edx, dword [0x5a80a4]
mov dword [edx + 8], eax
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c8]
call fcn.0044d448
mov edx, dword [ebp - 0x34]
mov eax, dword [0x5a80a4]
add eax, 0xc
call fcn.00404d08
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3cc]
call fcn.0044d448
mov edx, dword [ebp - 0x38]
mov eax, dword [0x5a80a4]
add eax, 0x10
call fcn.00404d08
lea edx, [ebp - 0x40]
mov eax, dword [0x5a8550]
mov eax, dword [eax]
call fcn.0046f7fc
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040cdc8
lea eax, [ebp - 0x3c]
mov edx, 0x565484
call fcn.00404f7c
mov ecx, dword [ebp - 0x3c]
mov dl, 1
mov eax, dword [0x439ee0]
call fcn.00439f90
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x5653c2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5653a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5a8ab8]
mov al, byte [eax]
push eax
mov ecx, 0x56549c
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a8658]
mov eax, dword [eax]
push eax
mov ecx, 0x5654c4
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x5a7e48]
mov al, byte [eax]
push eax
mov ecx, 0x5654e0
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a88c0]
mov eax, dword [eax]
cmp dword [eax + 0x10], 5
jle 0x564e4b
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x404]
cmp byte [ebx + 0x24c], 0
je 0x564e28
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x564e28
mov byte [ebp - 0x11], 0
lea edx, [ebp - 0x48]
mov eax, dword [0x5a8550]
mov eax, dword [eax]
call fcn.0046f7fc
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.0040cdc8
lea eax, [ebp - 0x44]
mov edx, 0x5654f4
call fcn.00404f7c
mov eax, dword [ebp - 0x44]
call fcn.0040ca40
test al, al
je 0x564d76
lea edx, [ebp - 0x50]
mov eax, dword [0x5a8550]
mov eax, dword [eax]
call fcn.0046f7fc
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.0040cdc8
lea eax, [ebp - 0x4c]
mov edx, 0x5654f4
call fcn.00404f7c
mov eax, dword [ebp - 0x4c]
call fcn.0040cb5c
mov ebx, eax
lea edx, [ebp - 0x58]
mov eax, dword [0x5a8550]
mov eax, dword [eax]
call fcn.0046f7fc
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.0040cdc8
lea eax, [ebp - 0x54]
mov edx, 0x5654f4
call fcn.00404f7c
mov eax, dword [ebp - 0x54]
mov edx, ebx
and edx, 0xfffffffe
call fcn.0040cb70
mov dword [ebp - 0x20], 0xff
mov eax, dword [ebp - 0x20]
call fcn.00402e04
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x564ba3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x564b8d
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
call fcn.00404eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x564baa
mov eax, dword [ebp - 0x18]
call fcn.00402e34
ret
lea edx, [ebp - 0xa0]
mov eax, dword [0x5a8450]
call fcn.004070b8
mov eax, dword [ebp - 0xa0]
mov dl, 1
call fcn.00593fcc
cmp byte [ebp - 0x11], 0
je 0x564e06
push 0
push 0
push 0x565570
lea edx, [ebp - 0xac]
mov eax, dword [0x5a8550]
mov eax, dword [eax]
call fcn.0046f7fc
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.0040cdc8
push dword [ebp - 0xa8]
push 0x565588
lea eax, [ebp - 0xa4]
mov edx, 3
call fcn.00405034
mov eax, dword [ebp - 0xa4]
call fcn.00405174
push eax
push 0x5655b0
push 0
mov eax, dword [ebp - 4]
call fcn.00453c68
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x564f6c
lea edx, [ebp - 0xb0]
mov eax, dword [0x5a8508]
call fcn.004070b8
mov eax, dword [ebp - 0xb0]
mov dl, 1
call fcn.00593fcc
jmp 0x564f6c
push 0
push 0
push 0x5655bc
push 0x5655b0
push 0
mov eax, dword [ebp - 4]
call fcn.00453c68
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x564f6c
mov dl, 1
mov eax, dword [0x43bb6c]
call fcn.0043bc6c
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x564f65
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x28]
call fcn.0043bd48
mov cl, 1
mov edx, 0x5655e0
mov eax, dword [ebp - 0x28]
call fcn.0043bdac
test al, al
je 0x564f4f
xor eax, eax
push ebp
push 0x564f48
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x404]
cmp byte [ebx + 0x24c], 0
je 0x564f25
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x564f25
xor eax, eax
push ebp
push 0x564f19
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x565618
lea edx, [ebp - 0xb8]
mov eax, dword [0x5a8550]
mov eax, dword [eax]
call fcn.0046f7fc
push dword [ebp - 0xb8]
push 0x565618
push 0x565624
lea eax, [ebp - 0xb4]
mov edx, 4
call fcn.00405034
mov ecx, dword [ebp - 0xb4]
mov edx, 0x565638
mov eax, dword [ebp - 0x28]
call fcn.0043c120
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x564f32
mov edx, 0x565638
mov eax, dword [ebp - 0x28]
call fcn.0043c088
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x564f4f
mov eax, dword [ebp - 0x28]
call fcn.0043bd18
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x564f6c
mov eax, dword [ebp - 0x28]
call fcn.00403d88
ret
mov eax, dword [0x5a7d9c]
mov al, byte [eax]
push eax
mov ecx, 0x56564c
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a7fd0]
mov al, byte [eax]
push eax
mov ecx, 0x565660
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a8234]
mov al, byte [eax]
push eax
mov ecx, 0x565674
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a7dac]
mov al, byte [eax]
push eax
mov ecx, 0x56568c
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a80a4]
mov al, byte [eax]
push eax
mov ecx, 0x5656a4
mov edx, 0x5656b8
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a80a4]
mov eax, dword [eax + 4]
push eax
mov ecx, 0x5656c8
mov edx, 0x5656b8
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x5a80a4]
mov eax, dword [eax + 8]
push eax
mov ecx, 0x5656d8
mov edx, 0x5656b8
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x5a80a4]
mov eax, dword [eax + 0xc]
push eax
mov ecx, 0x5656e8
mov edx, 0x5656b8
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x5a80a4]
mov eax, dword [eax + 0x10]
push eax
mov ecx, 0x5656fc
mov edx, 0x5656b8
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x5a883c]
mov al, byte [eax]
push eax
mov ecx, 0x565710
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a7f7c]
mov al, byte [eax]
push eax
mov ecx, 0x565740
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a8440]
mov al, byte [eax]
push eax
mov ecx, 0x565760
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a8400]
mov eax, dword [eax]
push eax
mov ecx, 0x565778
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x5a8400]
mov eax, dword [eax + 4]
push eax
mov ecx, 0x56578c
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x5a8400]
mov eax, dword [eax + 8]
push eax
mov ecx, 0x5657a0
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x5a8400]
mov eax, dword [eax + 0xc]
push eax
mov ecx, 0x5657bc
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x5a7de0]
mov al, byte [eax]
push eax
mov ecx, 0x5657d8
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a7dc8]
mov eax, dword [eax]
push eax
mov ecx, 0x5657f0
mov edx, 0x565730
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x5a86ec]
mov al, byte [eax]
push eax
mov ecx, 0x56580c
mov edx, 0x565824
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a861c]
mov eax, dword [eax]
push eax
mov ecx, 0x565838
mov edx, 0x565824
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x5a8aa0]
mov al, byte [eax]
push eax
mov ecx, 0x565858
mov edx, 0x565824
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a8028]
mov al, byte [eax]
push eax
mov ecx, 0x565874
mov edx, 0x565824
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a8230]
mov al, byte [eax]
push eax
mov ecx, 0x565890
mov edx, 0x565824
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a8204]
mov eax, dword [eax]
push eax
mov ecx, 0x5658ac
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [0x5a8a2c]
mov eax, dword [eax]
mov al, byte [eax + 8]
push eax
mov ecx, 0x5658c4
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a8a2c]
mov eax, dword [eax]
mov al, byte [eax + 0x30970]
push eax
mov ecx, 0x5658d8
mov edx, 0x5654b4
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x5a7e54]
mov eax, dword [eax]
push eax
mov ecx, 0x5658ec
mov edx, 0x565900
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x5a7d1c]
mov eax, dword [eax]
push eax
mov ecx, 0x565910
mov edx, 0x565900
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [0x5a8534]
push dword [eax + 4]
push dword [eax]
mov ecx, 0x565924
mov edx, 0x565938
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x43c]
cmp byte [eax + 0x24c], 0
je 0x5652af
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x440]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [ebx + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x18]
imul eax, eax, 0x3c
mov edx, dword [0x5a840c]
mov dword [edx], eax
jmp 0x5652ba
mov eax, dword [0x5a840c]
mov dword [eax], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
cmp byte [eax + 0x24c], 0
je 0x5652fa
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x458]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [ebx + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x18]
imul eax, eax, 0x3c
mov edx, dword [0x5a840c]
mov dword [edx + 0x10], eax
jmp 0x565306
mov eax, dword [0x5a840c]
mov dword [eax + 0x10], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x434]
cmp byte [eax + 0x24c], 0
je 0x565326
mov eax, dword [0x5a840c]
mov dword [eax + 0xc], 1
jmp 0x565330
mov eax, dword [0x5a840c]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x438]
cmp byte [eax + 0x24c], 0
je 0x565350
mov eax, dword [0x5a840c]
mov dword [eax + 4], 0xfffffffe
jmp 0x56535c
mov eax, dword [0x5a840c]
mov dword [eax + 4], 0xffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x430]
cmp byte [eax + 0x24c], 0
je 0x56537c
mov eax, dword [0x5a840c]
mov dword [eax + 8], 1
jmp 0x565386
mov eax, dword [0x5a840c]
xor edx, edx
mov dword [eax + 8], edx
mov edx, dword [0x5a840c]
mov eax, dword [0x5a8a34]
mov eax, dword [eax]
call fcn.00597544
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5653ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5653c9
mov eax, dword [ebp - 0x24]
call fcn.00403d88
ret