Function at 0x401570
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Execute command
Persist via run registry key
Query or enumerate registry value
Read file on windows
Self delete
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8ec
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea esi, [esp + 0x50]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp], 0x80000001
mov ebp, eax
call ebx
sub esp, 0x14
test eax, eax
je 0x4017f0
lea eax, [esp + 0x56]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x11e]
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersion
mov dword [esp], 0x80000002
call ebx
sub esp, 0x14
test eax, eax
lea ebx, [esp + 0x1e6]
je 0x4018b0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
dec eax
cmp byte [esp + eax + 0x56], 0x5c
je 0x401910
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
dec eax
cmp byte [esp + eax + 0x11e], 0x5c
je 0x401930
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
dec eax
cmp byte [esp + eax + 0x1e6], 0x5c
je 0x401920
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x401667
mov byte [eax], 0
xor eax, eax
cmp byte [ebp], 0x22
sete al
add ebp, eax
mov dword [esp + 4], str..exe
mov dword [esp], ebp
call sub.msvcrt.dll_strstr
test eax, eax
je 0x40168a
mov byte [eax + 4], 0
mov eax, dword [str.MySkills0xZL28DGhr2_test_hun]
mov dword [esp + 8], ebx
lea ebx, [esp + 0x3ad]
mov dword [esp + 0xc], eax
mov dword [esp + 4], str._s_s
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
lea eax, [esp + 0x719]
mov dword [esp + 4], ebp
mov dword [esp], eax
lea edi, [esp + 0x3b0]
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call sub.msvcrt.dll_strchr
mov esi, eax
test eax, eax
je 0x401940
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [esp + 0x24], eax
nop
lea esi, [esi]
mov byte [esi], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
lea edi, [esi + 1]
call dword [esp + 0x24]
push ecx
push ecx
mov byte [esi], 0x5c
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call sub.msvcrt.dll_strchr
mov esi, eax
test eax, eax
jne 0x4016f0
mov dword [esp + 4], 0x2f
mov dword [esp], edi
call sub.msvcrt.dll_strchr
mov esi, eax
test eax, eax
jne 0x4016f0
lea ebp, [esp + 0x4ac]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.rd__Q__S__s_bin
mov dword [esp], ebp
call sub.msvcrt.dll_sprintf
mov dword [esp], ebp
call sub.msvcrt.dll_system
mov dword [esp + 8], ebx
mov dword [esp + 4], str.del__Q__sMySkills.exe
mov dword [esp], ebp
call sub.msvcrt.dll_sprintf
mov dword [esp], ebp
call sub.msvcrt.dll_system
mov dword [esp + 8], ebx
mov dword [esp + 4], str._s_bin
mov dword [esp], ebp
call sub.msvcrt.dll_sprintf
lea eax, [esp + 0x5d8]
mov dword [esp + 4], eax
mov dword [esp], ebp
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call esi
cmp eax, 0xffffffff
push edi
push edi
je 0x401960
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.MySkills
mov dword [esp + 4], str.A_myskills_jelenleg_fut__ez
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
add esp, 0x8ec
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea eax, [esp + 0x56]
lea ecx, [esp + 0x48]
lea edx, [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.Desktop
mov dword [esp], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x48], 0xc7
call edi
sub esp, 0x18
test eax, eax
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
je 0x40184f
mov byte [esp + 0x56], 0
lea eax, [esp + 0x11e]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.Programs
mov dword [esp], eax
mov dword [esp + 0x48], 0xc7
call edi
sub esp, 0x18
test eax, eax
je 0x401896
mov byte [esp + 0x11e], 0
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x4015cf
lea eax, [esp + 0x48]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProgramFilesDir
mov dword [esp], eax
mov dword [esp + 0x48], 0xc7
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
je 0x4018f8
mov byte [esp + 0x1e6], 0
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x401606
mov byte [esp + eax + 0x56], 0
jmp 0x40161e
mov byte [esp + eax + 0x1e6], 0
jmp 0x401650
mov byte [esp + eax + 0x11e], 0
jmp 0x401639
mov dword [esp + 4], 0x2f
mov dword [esp], edi
call sub.msvcrt.dll_strchr
mov esi, eax
test eax, eax
je 0x401736
jmp 0x4016e2
mov dword [esp + 8], ebx
mov dword [esp + 4], str._sMySkills.exe
mov dword [esp], ebp
call sub.msvcrt.dll_sprintf
lea eax, [esp + 0x5d8]
mov dword [esp + 4], eax
mov dword [esp], ebp
call esi
cmp eax, 0xffffffff
push edx
push edx
jne 0x4017aa
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 0x24], eax
call eax
push edi
push edi
lea eax, [esp + 0x2ae]
mov dword [esp + 8], ebx
mov dword [esp + 4], str._sinstall.bat
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [esp + 0x2ae]
mov dword [esp + 4], 0x405187
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x3c], eax
test eax, eax
je 0x402208
lea eax, [esp + 0x719]
mov dword [esp + 4], 0x4051af
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp + 0x34], eax
test eax, eax
je 0x4021e2
mov edi, dword [esp + 0x34]
mov dword [esp + 8], 2
mov dword [esp + 4], 0xffffffe0
mov dword [esp], edi
call sub.msvcrt.dll_fseek
mov dword [esp], edi
call sub.msvcrt.dll_ftell
mov dword [esp + 8], ebx
mov dword [esp + 4], str._sdebug.log
mov dword [esp], ebp
mov dword [esp + 0x48], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], 0x405187
mov dword [esp], ebp
call sub.msvcrt.dll_fopen
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x30], eax
test eax, eax
je 0x401be4
mov eax, dword [esp + 0x30]
mov dword [esp + 4], str.Keres
mov dword [esp + 8], eax
lea eax, [esp + 0x5d8]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea edx, [esp + 0x5d8]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x401a8e
test eax, 0x8080
jne 0x401ab2
shr eax, 0x10
add edx, 2
add al, al
lea eax, [esp + 0x5d8]
sbb edx, 3
mov dword [esp + 4], 1
sub edx, eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5d8]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
lea edi, [esp + 0x5d8]
xor eax, eax
mov ecx, 0x3f
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x34]
lea esi, [esp + 0x5d8]
mov word [edi], 0
mov byte [edi + 2], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5d8]
mov dword [esp + 8], 0x20
mov dword [esp + 4], 1
mov dword [esp], eax
mov edi, str.m7_qwYx_1e6_lP.lG.3t__Z_OKN_g
call sub.msvcrt.dll_fread
mov ecx, 0x21
repe cmpsb byte [esi], byte es:[edi]
je 0x402028
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
dec esi
mov dword [esp + 8], 0
mov dword [esp + 0x30], esi
mov dword [esp], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 4], edi
call sub.msvcrt.dll_fseek
lea eax, [esp + 0x5d8]
mov dword [esp + 8], edi
mov dword [esp + 4], str.Nincs_tal
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea edx, [esp + 0x5d8]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x401b83
test eax, 0x8080
jne 0x401ba7
shr eax, 0x10
add edx, 2
add al, al
lea eax, [esp + 0x5d8]
sbb edx, 3
mov dword [esp + 4], 1
sub edx, eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5d8]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x401a68
mov eax, dword [esp + 0x34]
mov dword [esp + 8], 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x406020
call sub.msvcrt.dll_fread
mov eax, dword [0x40602c]
mov dword [esp + 0x18], eax
mov eax, dword [0x406028]
mov dword [esp + 0x10], eax
mov eax, dword [0x406024]
mov dword [esp + 0xc], eax
mov eax, dword [0x406020]
mov dword [esp + 8], eax
lea eax, [esp + 0x5d8]
mov dword [esp + 0x14], 0x406030
mov dword [esp + 4], 0x405244
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea edx, [esp + 0x5d8]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x401c52
test eax, 0x8080
jne 0x401c76
shr eax, 0x10
add edx, 2
add al, al
lea eax, [esp + 0x5d8]
sbb edx, 3
mov edi, dword [esp + 0x38]
sub edx, eax
lea eax, [esp + 0x5d8]
mov dword [esp + 8], edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov edi, dword [0x406020]
mov eax, dword [esp + 0x34]
mov dword [esp + 4], edi
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov esi, dword [esp + 0x48]
lea eax, [esi + 0xff]
sub esi, edi
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 8], esi
mov ecx, eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x34]
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov edi, ecx
call sub.msvcrt.dll_fread
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov esi, dword [esp + 0x3c]
mov eax, dword [0x406024]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp + 8], ebx
mov dword [esp + 4], str._sinstdata.7z
mov dword [esp], ebp
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], 0x405187
mov dword [esp], ebp
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x4021c8
mov dword [esp + 0xc], eax
mov eax, dword [0x406028]
mov edx, dword [0x406024]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 1
add eax, edx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp + 8], ebx
mov dword [esp + 4], str._s7zr.exe
mov dword [esp], ebp
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], 0x405187
mov dword [esp], ebp
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x402194
mov dword [esp + 0xc], eax
mov eax, dword [0x40602c]
mov edi, dword [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [0x406028]
mov ecx, dword [0x406024]
add eax, edi
mov dword [esp + 4], 1
add eax, ecx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, dword [0x406024]
mov esi, dword [0x406028]
add esi, eax
mov eax, dword [0x40602c]
add esi, eax
mov eax, dword [0x406030]
add esi, eax
mov eax, dword [0x406034]
add esi, eax
mov eax, dword [0x406038]
add esi, eax
mov eax, dword [0x40603c]
add esi, eax
add esi, edi
xor edi, edi
mov edx, dword [edi + 0x404024]
test edx, edx
je 0x401e49
cmp dword [edi + 0x40603c], 0xfff
jg 0x401ec2
sub edi, 4
cmp edi, 0xfffffff0
jne 0x401e33
mov eax, dword [str.MySkills.exe]
mov dword [esp + 0x14], 2
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2ae]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.MySkills
mov dword [esp + 4], str.A_telep
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
jmp 0x4017dc
mov eax, dword [edi + 0x404014]
mov dword [esp + 4], str._s_s.exe
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp], ebp
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], 0x405187
mov dword [esp], ebp
call sub.msvcrt.dll_fopen
test eax, eax
je 0x402174
mov dword [esp + 0x34], eax
mov eax, dword [edi + 0x404024]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x719]
mov dword [esp + 8], ebx
mov dword [esp + 4], str._s_s
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [esp + 0x719]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov eax, dword [edi + 0x40603c]
mov edx, dword [esp + 0x34]
sub esi, eax
add eax, 0xff
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x34]
mov dword [esp], edx
call sub.msvcrt.dll_fclose
mov eax, dword [str.MySkills_Test]
lea ecx, [esp + 0x719]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
call sub.msvcrt.dll_sprintf
lea ecx, [esp + 0x719]
mov dword [esp], ecx
mov dword [esp + 4], 0
call dword [esp + 0x24]
push eax
push eax
mov eax, dword [edi + 0x404014]
mov dword [esp + 4], str._s_s_s.exe
mov dword [esp + 0x10], eax
mov eax, dword [str.MySkills_Test]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp], ebp
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], 0x405187
mov dword [esp], ebp
call sub.msvcrt.dll_fopen
test eax, eax
je 0x40213e
mov dword [esp + 0xc], eax
mov dword [esp + 0x34], eax
mov eax, dword [edi + 0x40603c]
mov dword [esp + 4], 1
add eax, 0xff
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x34]
mov dword [esp], edx
call sub.msvcrt.dll_fclose
jmp 0x401e49
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 0x405205
mov dword [esp + 8], eax
lea eax, [esp + 0x5d8]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea edx, [esp + 0x5d8]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x40204e
test eax, 0x8080
jne 0x402072
shr eax, 0x10
add edx, 2
add al, al
lea eax, [esp + 0x5d8]
sbb edx, 3
mov dword [esp + 4], 1
sub edx, eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5d8]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov esi, dword [esp + 0x30]
sub esi, 0x20
mov eax, dword [esp + 0x34]
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_fseek
lea eax, [esp + 0x5d8]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x405212
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea edx, [esp + 0x5d8]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x4020e4
test eax, 0x8080
jne 0x402108
shr eax, 0x10
add edx, 2
add al, al
lea eax, [esp + 0x5d8]
sbb edx, 3
mov dword [esp + 4], 1
sub edx, eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5d8]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
jmp 0x401be4
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Installer_error
mov dword [esp + 4], str.File_system_error_6_
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
mov dword [esp], 0
call sub.msvcrt.dll_exit
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Installer_error
mov dword [esp + 4], str.File_system_error_5_
jmp 0x40215c
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Installer_error
mov dword [esp + 4], str.File_system_error_4_
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Installer_error
mov dword [esp + 4], str.File_system_error_3_
jmp 0x4021ac
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Installer_error
mov dword [esp + 4], str.File_system_error_2_
jmp 0x4021ac
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Installer_error
mov dword [esp + 4], str.File_system_error_1_
jmp 0x4021ac