Function at 0x4af21c
Capabilities:
Create process on windows
Get hostname
Initialize winsock library
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x52
push 0
push 0
dec ecx
jne 0x4af224
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4afce6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d3bb8]
add eax, 4
mov edx, 0x4afd00
call fcn.00405098
lea edx, [ebp - 0xc]
mov eax, 0x4afd10
call fcn.00449128
test al, al
jne 0x4af275
lea edx, [ebp - 0xc]
mov eax, 0x4afd24
call fcn.00449128
test al, al
jne 0x4af275
xor eax, eax
jmp 0x4af277
mov al, 1
mov edx, dword [0x4d38f0]
mov byte [edx], al
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
je 0x4af305
lea ecx, [ebp - 0x230]
mov dl, 1
xor eax, eax
call fcn.0043751c
mov edx, dword [ebp - 0x230]
mov eax, dword [0x4d3cf4]
call fcn.00405098
mov eax, dword [0x4d381c]
mov edx, dword [0x4d3cf4]
mov edx, dword [edx]
call fcn.00405098
lea edx, [ebp - 0x234]
mov eax, dword [0x4d3ce8]
mov eax, dword [eax]
dec eax
call fcn.0044a2b4
mov edx, dword [ebp - 0x234]
mov eax, dword [0x4d3e78]
call fcn.00405098
mov eax, dword [0x4d3994]
mov edx, dword [0x4d3e78]
mov edx, dword [edx]
call fcn.00405098
mov eax, dword [0x4d3c74]
mov dword [eax], 0x7d9
mov eax, dword [0x4d3c98]
mov dword [eax], 0x7da
lea edx, [ebp - 0xc]
mov eax, 0x4afd10
call fcn.00449128
test al, al
je 0x4af341
lea edx, [ebp - 0xc]
mov eax, 0x4afd3c
call fcn.00449128
test al, al
jne 0x4af341
mov edx, dword [0x4d3c98]
mov edx, dword [edx]
mov al, 1
call fcn.004accc0
test al, al
jne 0x4af341
xor eax, eax
call fcn.00449220
mov byte [ebp - 1], 1
cmp byte [ebp - 1], 0
jne 0x4af387
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
je 0x4af818
call fcn.00402ef0
dec eax
je 0x4af387
lea edx, [ebp - 0xc]
mov eax, 0x4afd4c
call fcn.00449128
test al, al
jne 0x4af387
lea edx, [ebp - 0xc]
mov eax, 0x4afd24
call fcn.00449128
test al, al
je 0x4af818
cmp byte [ebp - 1], 0
je 0x4af497
lea edx, [ebp - 0x238]
mov eax, 1
call fcn.00402f58
mov eax, dword [ebp - 0x238]
mov edx, 0x4afd4c
call fcn.00405450
jne 0x4af497
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402f58
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 8]
mov ecx, 0x4afd60
call fcn.00405350
call fcn.004ba53c
push ebp
lea eax, [ebp - 0x240]
call fcn.004aeff4
pop ecx
mov edx, dword [ebp - 0x240]
lea eax, [ebp - 0x14]
call fcn.004050dc
push 0x4afd6c
push dword [ebp - 0x10]
push 0x4afd78
lea eax, [ebp - 0x244]
mov edx, 3
call fcn.004053c4
mov eax, dword [ebp - 0x244]
call fcn.00405504
push eax
mov eax, dword [ebp - 8]
call fcn.00405504
lea ecx, [ebp - 0x14]
pop edx
call fcn.004ba6f4
mov byte [ebp - 0x16], al
cmp dword [ebp - 0x14], 0
je 0x4af489
mov eax, dword [0x4d3d04]
mov eax, dword [eax]
call eax
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.00409f94
push 0x4afd6c
push dword [ebp - 0x10]
push 0x4afd78
lea eax, [ebp - 0x248]
mov edx, 3
call fcn.004053c4
mov eax, dword [ebp - 0x248]
call fcn.00405504
push eax
mov eax, dword [ebp - 8]
call fcn.00405504
lea ecx, [ebp - 0x14]
pop edx
call fcn.004ba6f4
call fcn.004ba6c4
mov byte [ebp - 2], 1
jmp 0x4afcbb
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
je 0x4af5b4
lea edx, [ebp - 0x24c]
mov eax, dword [0x4d3dc8]
call fcn.004072b8
mov eax, dword [ebp - 0x24c]
xor ecx, ecx
xor edx, edx
call fcn.00463078
lea edx, [ebp - 0x250]
mov eax, 1
call fcn.00402f58
mov eax, dword [ebp - 0x250]
mov edx, 0x4afd4c
call fcn.00405450
jne 0x4af5b4
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402f58
call fcn.004ba53c
push ebp
lea eax, [ebp - 0x254]
call fcn.004aeff4
pop ecx
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x14]
call fcn.004050dc
push 0x4afd6c
push dword [ebp - 8]
push 0x4afd98
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.004053c4
mov eax, dword [ebp - 0x258]
call fcn.00405504
push eax
mov eax, dword [ebp - 8]
call fcn.00405504
lea ecx, [ebp - 0x14]
pop edx
call fcn.004ba6f4
mov byte [ebp - 0x16], al
cmp dword [ebp - 0x14], 0
je 0x4af5a6
mov eax, dword [0x4d3d04]
mov eax, dword [eax]
call eax
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.00409f94
push 0x4afd6c
push dword [ebp - 8]
push 0x4afd98
lea eax, [ebp - 0x25c]
mov edx, 3
call fcn.004053c4
mov eax, dword [ebp - 0x25c]
call fcn.00405504
push eax
mov eax, dword [ebp - 8]
call fcn.00405504
lea ecx, [ebp - 0x14]
pop edx
call fcn.004ba6f4
call fcn.004ba6c4
mov byte [ebp - 2], 1
jmp 0x4afcbb
cmp byte [ebp - 1], 0
je 0x4af670
lea edx, [ebp - 0x264]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 0x260]
call fcn.0040a90c
mov edx, dword [ebp - 0x260]
mov eax, 0x4afdb0
call fcn.00405648
test eax, eax
jle 0x4af5f7
push ebp
call fcn.004af0f8
pop ecx
mov eax, dword [0x4d3bb8]
call fcn.004b013c
test al, al
jne 0x4af670
lea edx, [ebp - 0x268]
mov eax, dword [0x4d3c74]
mov eax, dword [eax]
call fcn.0040a330
push dword [ebp - 0x268]
push 0x4afdbc
push 0x4afd60
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053c4
lea eax, [ebp - 0x14]
mov edx, 0x4afdcc
call fcn.004050dc
push 0x200010
lea eax, [ebp - 8]
call fcn.0040555c
push eax
mov eax, dword [ebp - 0x14]
call fcn.00405504
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 0x64
call sub.kernel32.dll_Sleep
mov eax, 1
call fcn.00449220
xor eax, eax
push ebp
push 0x4af6ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4d3c98]
mov edx, dword [edx]
mov al, 1
call fcn.004accc0
test al, al
jne 0x4af6a2
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4afcbb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4af6b6
mov byte [ebp - 0x16], 1
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4af6ce
cmp byte [ebp - 1], 0
je 0x4af776
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
je 0x4af6f1
call fcn.00402ef0
dec eax
jne 0x4af6f1
lea edx, [ebp - 0xc]
mov eax, 0x4afd10
call fcn.00449128
test al, al
jne 0x4af700
cmp byte [ebp - 1], 0
je 0x4af776
call fcn.00402ef0
test eax, eax
jne 0x4af776
call fcn.0044c510
test al, al
je 0x4af776
call fcn.004373d4
cmp al, 6
jbe 0x4af776
lea edx, [ebp - 0x26c]
xor eax, eax
call fcn.00402f58
mov edx, dword [ebp - 0x26c]
lea eax, [ebp - 8]
mov ecx, 0x4afd60
call fcn.00405350
call fcn.0044c35c
test al, al
je 0x4af743
call fcn.004ae7f0
mov byte [ebp - 0x16], al
cmp byte [ebp - 0x16], 0
je 0x4af758
push ebp
call fcn.004aedc4
pop ecx
call fcn.004ae384
mov byte [ebp - 0x16], al
push 0x3e8
call sub.kernel32.dll_Sleep
call fcn.004ae7f0
cmp byte [ebp - 0x16], 0
je 0x4af776
mov byte [ebp - 2], 1
jmp 0x4afcbb
cmp byte [ebp - 1], 0
je 0x4af7e5
lea edx, [ebp - 0xc]
mov eax, 0x4afe54
call fcn.00449128
test al, al
jne 0x4af79c
call fcn.00402ef0
test eax, eax
je 0x4af79c
cmp byte [ebp - 0x16], 0
jne 0x4af7e5
lea edx, [ebp - 0x270]
mov eax, 0x7d0
call fcn.0040a330
lea eax, [ebp - 0x270]
mov edx, 0x4afe70
call fcn.0040530c
mov eax, dword [ebp - 0x270]
push eax
lea edx, [ebp - 0x274]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x274]
pop edx
call fcn.00449234
mov byte [ebp - 2], 0
jmp 0x4afcbb
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
je 0x4af82a
lea edx, [ebp - 0xc]
mov eax, 0x4afd24
call fcn.00449128
test al, al
jne 0x4af80f
call fcn.00402ef0
test eax, eax
je 0x4af80f
cmp byte [ebp - 0x16], 0
jne 0x4af82a
mov byte [ebp - 2], 0
jmp 0x4afcbb
call fcn.00402ef0
test eax, eax
jne 0x4af82a
mov byte [ebp - 2], 0
jmp 0x4afcbb
lea edx, [ebp - 0xc]
mov eax, 0x4afe94
call fcn.00449128
test al, al
je 0x4af870
mov eax, dword [ebp - 0xc]
mov edx, 0x4afea8
call fcn.00405450
jne 0x4af85c
push 2
push 0x4afeac
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
jmp 0x4af869
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
call fcn.00449220
lea edx, [ebp - 0xc]
mov eax, 0x4afeb8
call fcn.00449128
test al, al
je 0x4af8de
lea edx, [ebp - 0x27c]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x27c]
lea edx, [ebp - 0x278]
call fcn.0040a824
push dword [ebp - 0x278]
push 0x4afed4
push 0x4afee0
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053c4
push 1
push 0
push 0
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4afef4
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
call fcn.00449220
lea edx, [ebp - 0xc]
mov eax, 0x4afd3c
call fcn.00449128
test al, al
je 0x4af945
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4af911
lea edx, [ebp - 0xc]
mov eax, 0x4aff04
call fcn.00449128
test al, al
je 0x4af911
xor eax, eax
call fcn.00449220
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4af937
call fcn.0044c510
test al, al
jne 0x4af937
call fcn.0044c35c
test al, al
je 0x4af937
mov eax, 1
call fcn.00449220
call fcn.004ade60
mov byte [ebp - 2], 1
jmp 0x4afcbb
lea edx, [ebp - 0xc]
mov eax, 0x4aff14
call fcn.00449128
test al, al
je 0x4af994
cmp dword [ebp - 0xc], 0
je 0x4af994
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x280]
xor edx, edx
xor eax, eax
call fcn.004498bc
lea eax, [ebp - 0x280]
mov edx, 0x4aff28
call fcn.0040530c
mov eax, dword [ebp - 0x280]
mov ecx, 0x4aff44
mov edx, 0x4aff5c
call fcn.0044c694
lea edx, [ebp - 0xc]
mov eax, 0x4aff70
call fcn.00449128
test al, al
je 0x4afa29
cmp dword [ebp - 0xc], 0
je 0x4afa29
mov eax, dword [0x4d3d00]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x56]
push eax
call sub.wsock32.dll_gethostname
inc eax
je 0x4af9ee
lea eax, [ebp - 0x284]
lea edx, [ebp - 0x56]
mov ecx, 0x40
call fcn.004052b4
mov edx, dword [ebp - 0x284]
lea eax, [ebp - 0xc]
call fcn.0040530c
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x288]
xor edx, edx
xor eax, eax
call fcn.004498bc
lea eax, [ebp - 0x288]
mov edx, dword [0x4d3d5c]
mov edx, dword [edx]
call fcn.0040530c
mov eax, dword [ebp - 0x288]
mov ecx, 0x4aff80
mov edx, 0x4aff94
call fcn.0044c694
lea edx, [ebp - 0xc]
mov eax, 0x4affac
call fcn.00449128
test al, al
je 0x4afa54
xor ecx, ecx
mov edx, 0x4affc0
mov eax, 0x80000001
call fcn.004adfe4
mov byte [ebp - 2], 1
jmp 0x4afcbb
mov eax, dword [0x4d3f24]
cmp dword [eax], 1
jne 0x4afa7d
lea edx, [ebp - 0xc]
mov eax, 0x4afd4c
call fcn.00449128
test al, al
je 0x4afa7d
call fcn.004ae128
mov byte [ebp - 2], 0
jmp 0x4afcbb
lea edx, [ebp - 0xc]
mov eax, 0x4afff8
call fcn.00449128
test al, al
je 0x4afab5
mov eax, dword [0x4d3f24]
cmp dword [eax], 2
je 0x4afab5
mov ecx, 0x4b000c
mov edx, 0x4b0020
mov eax, 0x80000002
call fcn.004adfe4
mov byte [ebp - 2], 1
jmp 0x4afcbb
lea edx, [ebp - 0xc]
mov eax, 0x4afff8
call fcn.00449128
test al, al
je 0x4afade
mov eax, dword [0x4d3f24]
cmp dword [eax], 2
jne 0x4afade
mov byte [ebp - 2], 1
call fcn.004ae384
jmp 0x4afcbb
lea edx, [ebp - 0xc]
mov eax, 0x4b0060
call fcn.00449128
test al, al
je 0x4afbcd
mov byte [ebp - 2], 1
call fcn.0044c510
test al, al
jne 0x4afb2d
call fcn.0044c35c
test al, al
je 0x4afb2d
push 0x10
mov ecx, 0x4b0074
mov dl, 1
mov eax, dword [0x44df70]
call fcn.0044dff4
push 0x64
call sub.kernel32.dll_Sleep
mov eax, 1
call fcn.00449220
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4afbab
cmp byte [ebp - 1], 0
jne 0x4afbab
lea edx, [ebp - 0x28c]
mov eax, 0x7d4
call fcn.0040a330
mov edx, dword [ebp - 0x28c]
lea eax, [ebp - 8]
mov ecx, 0x4afd60
call fcn.00405350
push 0
push 0
push 0x408
push 0
lea eax, [ebp - 8]
call fcn.0040555c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_PostMessageA
call fcn.004373d4
cmp al, 6
jb 0x4afba6
mov edx, 1
mov eax, 0x4b00c4
call fcn.00449c58
mov edx, 1
mov eax, 0x4b00ec
call fcn.00449c58
call fcn.004aea5c
mov eax, dword [0x4d3f24]
cmp dword [eax], 2
jne 0x4afcbb
push 0x190
call sub.kernel32.dll_Sleep
call fcn.004ae7f0
jmp 0x4afcbb
lea edx, [ebp - 0xc]
mov eax, 0x4b0110
call fcn.00449128
mov byte [ebp - 0x15], al
lea edx, [ebp - 0xc]
mov eax, 0x4b0120
call fcn.00449128
test al, al
je 0x4afc48
lea edx, [ebp - 0xc]
mov eax, 0x4aff14
call fcn.00449128
test al, al
jne 0x4afc38
push 0x4b012c
lea ecx, [ebp - 0x290]
xor edx, edx
xor eax, eax
call fcn.004498bc
lea eax, [ebp - 0x290]
mov edx, 0x4aff28
call fcn.0040530c
mov eax, dword [ebp - 0x290]
mov edx, 0x4aff5c
mov ecx, 0x4aff44
call fcn.0044c694
mov dl, byte [ebp - 0x15]
mov al, 1
call fcn.004aec14
mov byte [ebp - 2], 1
jmp 0x4afcbb
lea edx, [ebp - 0xc]
mov eax, 0x4b0138
call fcn.00449128
test al, al
je 0x4afcb3
lea edx, [ebp - 0xc]
mov eax, 0x4aff14
call fcn.00449128
test al, al
jne 0x4afca3
push 0x4b012c
lea ecx, [ebp - 0x294]
xor edx, edx
xor eax, eax
call fcn.004498bc
lea eax, [ebp - 0x294]
mov edx, 0x4aff28
call fcn.0040530c
mov eax, dword [ebp - 0x294]
mov edx, 0x4aff5c
mov ecx, 0x4aff44
call fcn.0044c694
mov dl, byte [ebp - 0x15]
xor eax, eax
call fcn.004aec14
mov byte [ebp - 2], 1
jmp 0x4afcbb
call fcn.004bb708
mov byte [ebp - 2], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afced
lea eax, [ebp - 0x294]
mov edx, 0x1a
call fcn.00405068
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405068
ret