Function at 0x4010b1
Capabilities:
Accept command line arguments
Create process on windows
Create tcp socket
Create udp socket
Get common file path
Initialize winsock library
Query or enumerate registry value
Resolve function by parsing pe exports
Schedule task via at
Set socket configuration
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x12b4
call fcn.004019d0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x12b0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x8b0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Timwp.log
lea eax, [esp + 0x8b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor ebx, ebx
lea eax, [esp + 0x8b0]
push ebx
push bind
push 4
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x28], edi
cmp edi, 0xffffffff
je 0x401839
push 2
pop eax
push eax
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, str.wWinMain_n
mov ecx, edi
call fcn.00401003
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ecx, edi
test esi, esi
jne 0x401158
mov edx, str.GetCommandLineW_fail_n
jmp 0x401834
mov edx, esi
call fcn.00401003
push ebx
lea eax, [esp + 0x44]
push eax
push 2
push 0x4021a4
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x44]
mov dword [esp + 0x44], ebx
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x44], 2
mov esi, eax
mov dword [esp + 0x40], esi
je 0x4011af
test esi, esi
jne 0x4011a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4021a8
jmp 0x40181a
mov edx, str.CommandLineToArgvW_argsnum_invalid_n
jmp 0x401832
push str.tencent:__QQMusic
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, dword [esi + 4]
jne 0x40127b
push ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x24]
push eax
push 0x4020f8
push 0x17
push ebx
push 0x402108
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4011ff
mov edx, str.QQMusic_not_install_n
jmp 0x401832
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
mov ebx, 0x402118
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
js 0x40126c
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x401262
mov eax, dword [esi + 4]
add eax, 0x14
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [esp + 0x1c]
mov esi, eax
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x48]
mov ecx, dword [esp + 0x1c]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, str.lanuch_QQMusic_n
mov ecx, edi
call fcn.00401003
mov eax, dword [esp + 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4017eb
lea eax, [esp + 0xc8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4012a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WSAStartup_fail:_d_n
jmp 0x40181a
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4012c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateIoCompletionPort_fail:_d_n
jmp 0x40181a
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4012e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateWaitableTimerW_fail:_d_n
jmp 0x40181a
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [esi + 4]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [esi + 4]
mov dword [esp + 0x24], eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea ecx, [ebx + 1]
push ecx
push 8
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40133f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HeapAlloc_utf8_fail:_d_n
jmp 0x40181a
xor ecx, ecx
push ecx
push ecx
push ebx
push eax
push dword [esp + 0x1c]
mov byte [eax + ebx], cl
push dword [esi + 4]
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebx + 0x428]
push eax
push 8
push dword [esp + 0x24]
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x40138b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HeapAlloc_http_fail:_d_n
jmp 0x40181a
push dword [esp + 0x14]
push ebx
push str.POST__tencent_HTTP_1.1_r_nHost:_127.0.0.1:9210_r_nConnection:_close_r_nContent_Length:__d_r_n_r_n_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
and dword [esp + 0x34], 0
add esp, 0x10
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x25a207b9
mov dword [esp + 0x50], 0x4660ddf3
push str.ntdll.dll
mov dword [esp + 0x58], 0xe576e98e
mov dword [esp + 0x5c], 0x3e06748c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.memset
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
lea eax, [esp + 0x258]
push 0x28
push 0
push eax
mov dword [esp + 0x1c], ebx
call ebx
push 0x28
lea eax, [esp + 0x290]
push 0
push eax
call ebx
push 0x10
lea eax, [esp + 0x88]
push 0
push eax
call ebx
add esp, 0x24
push 2
pop eax
push str.127.0.0.1
mov word [esp + 0x70], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x70], eax
xor ebx, ebx
push 1
push 0
push 0
push 6
push 1
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [esp + ebx*4 + 0x258], eax
cmp eax, 0xffffffff
je 0x40180e
push dword [esp + 0x3c]
push 8
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + ebx*4 + 0x280], eax
test eax, eax
je 0x401800
push 0x10
lea eax, [esp + 0x30]
push 0
push eax
call dword [esp + 0x1c]
add esp, 0xc
push 2
pop eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x2c]
push 0x10
push eax
push dword [esp + ebx*4 + 0x260]
call dword [sym.imp.WS2_32.dll_bind]
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 1
push eax
push 0x8004667e
push dword [esp + ebx*4 + 0x260]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp dword [esp + 0x24], 0
jne 0x4014ec
push 0
push 0
lea eax, [esp + 0x84]
push eax
push 4
lea eax, [esp + 0x34]
push eax
push 0x10
lea eax, [esp + 0x64]
push eax
push 0xc8000006
push dword [esp + ebx*4 + 0x278]
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 0
push 0
push dword [esp + 0x28]
push dword [esp + ebx*4 + 0x264]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
lea eax, [ebx + 0x23fa]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x6e], ax
mov eax, dword [esp + ebx*4 + 0x280]
and dword [eax + 0x14], 0
mov ecx, dword [esp + ebx*4 + 0x280]
lea eax, [ecx + 0x28]
mov dword [ecx + 0x1c], eax
mov eax, dword [esp + ebx*4 + 0x280]
mov ecx, dword [esp + 0x48]
mov dword [eax + 0x18], ecx
mov eax, dword [esp + 0xc]
push eax
add byte [eax + 0x2b], bl
mov eax, dword [esp + ebx*4 + 0x284]
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + ebx*4 + 0x280]
push ecx
lea eax, [ecx + 0x24]
push eax
push dword [ecx + 0x18]
lea eax, [esp + 0x78]
push dword [ecx + 0x1c]
push 0x10
push eax
push dword [esp + ebx*4 + 0x270]
call dword [esp + 0x40]
test eax, eax
jne 0x40157f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
inc ebx
cmp ebx, 0xa
jb 0x40142b
or dword [esp + 0x64], 0xffffffff
xor eax, eax
push eax
push eax
push section..text
push eax
mov ebx, eax
mov dword [esp + 0x70], 0xffe17b80
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
and dword [esp + 0x3c], 0
lea eax, [esp + 0x4b0]
push 0xa0
push 0
push eax
call dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x3c]
push 1
push 0xffffffffffffffff
push eax
push 0xa
lea eax, [esp + 0x4c0]
push eax
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatusEx]
test eax, eax
jne 0x4015fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc0
je 0x401620
mov edx, dword [esp + 0x3c]
test edx, edx
je 0x4015b1
lea edi, [esp + 0x4b4]
mov eax, dword [edi]
lea ecx, [ebx + 1]
lea edi, [edi + 0x10]
cmp dword [eax], 0
cmovne ecx, ebx
mov ebx, ecx
sub edx, 1
jne 0x401609
jmp 0x4015b1
mov esi, dword [esp + 0x1c]
xor edi, edi
push dword [esp + edi + 0x258]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esp + edi + 0x280]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
add edi, 4
cmp edi, 0x28
jb 0x401626
push dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push esi
call edi
push dword [esp + 0xc]
push 0
push esi
call edi
push dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esp + 0x18]
call edi
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x40]
test ebx, ebx
jne 0x4017c6
lea eax, [esp + 0x28]
mov dword [esp + 0x40], 0x400
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWARETencentQQNT
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017b8
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x4b4]
push eax
lea eax, [esp + 0x50]
push eax
push ebx
push str.Install
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401781
push str.QQ.exe
lea eax, [esp + 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x4b4]
push eax
lea eax, [esp + 0xac0]
push str.__s____s_
push eax
call esi
push 0x44
pop eax
push eax
mov dword [esp + 0x94], eax
lea eax, [esp + 0x94]
push ebx
push eax
call dword [esp + 0x2c]
add esp, 0x1c
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x84]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xad8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401769
push dword [esp + 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esp + 0x2c]
call ebx
mov edx, str.CreateProcessW_success_n
jmp 0x4017a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x2ac]
push str.CreateProcessW_fail:_d_n
push eax
call esi
jmp 0x40179b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x2ac]
push str.RegQueryValueExW_fail:_d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x2b4]
add esp, 0xc
mov ecx, edi
call fcn.00401003
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4017eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegOpenKeyExW_fail:_d_n
jmp 0x4017cc
push ebx
push str.http_send_success:_d_n
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [esp + 0x2a8]
mov ecx, edi
call fcn.00401003
mov edx, str.done_n
mov ecx, edi
call fcn.00401003
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401839
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HeapAlloc_buff_fail:_d_n
jmp 0x40181a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WSASocketW_fail:_d_n
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x2b4]
add esp, 0xc
mov ecx, edi
call fcn.00401003
mov ecx, dword [esp + 0x12bc]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401898
mov esp, ebp
pop ebp
ret 8