Function at 0x478e20
Capabilities:
Create process on windows
Log keystrokes via polling
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push 0
push str.cmd.exe__c_del.exe_._bincgpuk3.bin
call dword [sym.imp.kernel32.dll_WinExec]
push 0
push str.cmd.exe__c_del.exe_._bincgpuk3_1.bin
call dword [sym.imp.kernel32.dll_WinExec]
push 0
push str.cmd.exe__c_del.exe_._bincgpuk3_2.bin
call dword [sym.imp.kernel32.dll_WinExec]
push 0
push 0x5ea7cc
call dword [sym.imp.kernel32.dll_WinExec]
call fcn.00479780
test eax, eax
jne 0x478e6a
xor eax, eax
jmp 0x4795a1
push 0x5ea7f0
call fcn.005bab40
add esp, 4
call fcn.005bb3d0
mov eax, 1
test eax, eax
je 0x47959f
movsx ecx, byte [0x6ba901]
movsx edx, byte [0x6ba900]
cmp ecx, edx
je 0x478ee9
call fcn.0047b4e0
call fcn.004933e0
mov eax, dword [0x6ba8fc]
cmp dword [eax + 0x90], 0
je 0x478ee9
cmp dword [0x9cf360], 0
je 0x478ee9
push 0x6b9ee0
push 0x100
push 0
push 0
mov ecx, dword [0x6ba8fc]
mov edx, dword [ecx + 0x90]
mov eax, dword [0x6ba8fc]
mov ecx, dword [eax + 0x90]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0x18]
call eax
cmp dword [0x6bc070], 0
je 0x478f46
call fcn.004650a0
test eax, eax
je 0x478f46
call fcn.004933e0
mov ecx, dword [0x6ba8fc]
cmp dword [ecx + 0x90], 0
je 0x478f46
cmp dword [0x9cf360], 0
je 0x478f46
push 0x6b9ee0
push 0x100
push 0
push 0
mov edx, dword [0x6ba8fc]
mov eax, dword [edx + 0x90]
mov ecx, dword [0x6ba8fc]
mov edx, dword [ecx + 0x90]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x18]
call ecx
call fcn.004936a0
test eax, eax
jne 0x478f60
call fcn.00479c10
call fcn.005bac30
xor eax, eax
jmp 0x4795a1
call fcn.00479c70
push 0x7d2344
call fcn.0047ba80
add esp, 4
xor edx, edx
mov word [0x124bc40], dx
mov dword [0x7d12b0], 0
call fcn.00478a10
call fcn.00576cf0
mov eax, dword [0x631148]
push eax
call fcn.005b0520
add esp, 4
call fcn.00599940
cmp dword [0x607ee0], 0
je 0x478fba
call fcn.005751e0
call fcn.0059fd60
call fcn.00575650
call fcn.0046c8c0
cmp dword [0x607ee0], 0
je 0x478fcd
call fcn.0045e930
call fcn.0047c950
cmp dword [0x7d22c8], 0
jne 0x479130
cmp dword [0x607ee0], 0
jne 0x4790a1
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x47900d
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0xc], edx
jmp 0x479016
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0
fild qword [ebp - 0x14]
fcomp qword [0x7d12b8]
fnstsw ax
test ah, 0x41
jp 0x479080
push 1
call dword [sym.imp.kernel32.dll_Sleep]
cmp dword [0x6bbc48], 1
jne 0x47907b
push 0x6b9ee0
push 0x100
push 0
push 0
mov eax, dword [0x6ba8fc]
mov ecx, dword [eax + 0x90]
mov edx, dword [0x6ba8fc]
mov eax, dword [edx + 0x90]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x18]
call edx
mov dword [0x6bbc48], 0
jmp 0x478fec
fld qword [0x7d12b8]
fadd qword [0x604ac0]
fstp qword [0x7d12b8]
mov dword [0x604ac8], 1
jmp 0x478e7c
cmp dword [0x607ee0], 1
jne 0x4790b4
mov dword [0x607ee0], 2
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4790d5
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x18], edx
jmp 0x4790de
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
fld qword [0x7d12b8]
fadd qword [0x604ab8]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0
fild qword [ebp - 0x20]
fcompp
fnstsw ax
test ah, 0x41
jne 0x479130
cmp dword [0x604ac8], 0x14
jge 0x479130
fld qword [0x7d12b8]
fadd qword [0x604ac0]
fstp qword [0x7d12b8]
mov eax, dword [0x604ac8]
add eax, 1
mov dword [0x604ac8], eax
jmp 0x478e7c
push 0x5ea800
call fcn.005bad40
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x479169
call fcn.00585160
cmp eax, 1
jne 0x47915f
push 4
mov edx, dword [0xfd5768]
push edx
call fcn.00587db0
add esp, 8
push 0xb
call fcn.00599ef0
add esp, 4
call fcn.005bb3f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x479194
call fcn.00585160
cmp eax, 1
jne 0x479194
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0xfd5768]
push ecx
call fcn.00587db0
add esp, 8
mov dword [0x7d22c8], 0
mov edx, dword [0x7d22c4]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
je 0x4791b7
cmp dword [ebp - 0x24], 3
je 0x4791c0
jmp 0x4791c5
call fcn.0046d480
jmp 0x4791c5
call fcn.00428e00
call fcn.005a0c00
call fcn.00495b20
call fcn.00464ea0
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4791f5
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x28], edx
jmp 0x4791fe
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0
fild qword [ebp - 0x30]
fcomp qword [0x7d12b8]
fnstsw ax
test ah, 0x41
jp 0x479225
push 1
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4791d4
cmp dword [0x6bbc48], 1
jne 0x479265
push 0x6b9ee0
push 0x100
push 0
push 0
mov eax, dword [0x6ba8fc]
mov ecx, dword [eax + 0x90]
mov edx, dword [0x6ba8fc]
mov eax, dword [edx + 0x90]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x18]
call edx
mov dword [0x6bbc48], 0
fld qword [0x7d12b8]
fadd qword [0x604ac0]
fstp qword [0x7d12b8]
mov dword [0x604ac8], 1
mov eax, dword [0x62f950]
add eax, 1
mov dword [0x62f950], eax
call fcn.0059ff90
push 0x79
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x4792ac
mov dword [0x7d22d0], 1
mov eax, 0
cmp eax, 1
jne 0x479359
cmp dword [0x7d22dc], 3
jl 0x479359
mov dword [0x7d22d0], 0
mov dword [0x7d22dc], 0
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x4792fc
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x34], edx
jmp 0x479305
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov dword [0x7d22e8], edx
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x47932f
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x38], edx
jmp 0x479338
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, 0xa
div ecx
add edx, 0xa
imul edx, edx, 0xea60
add edx, dword [0x7d22e8]
mov dword [0x7d22e8], edx
cmp dword [0x7d22d8], 0
jle 0x4793c9
call fcn.00585160
cmp eax, 1
jne 0x4793c9
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x47938d
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x3c], edx
jmp 0x479396
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
cmp edx, dword [0x7d22e8]
jbe 0x4793c9
cmp dword [0x7d22e8], 0
jle 0x4793c9
mov eax, dword [0x7d22d8]
push eax
mov ecx, dword [0xfd5768]
push ecx
call fcn.00587db0
add esp, 8
mov dword [0x7d22e8], 0xffffffff
call fcn.00585160
cmp eax, 1
jne 0x479442
mov edx, dword [0x7d22f0]
or edx, dword [0x7d22f4]
jne 0x479442
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x479402
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x40], edx
jmp 0x47940b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
push edx
call fcn.005cbcca
add esp, 4
call fcn.0047b1b0
mov dword [0x7d22f0], eax
mov dword [0x7d22f4], edx
call fcn.005cbcdc
cdq
mov ecx, 0xc8
idiv ecx
add edx, 0x4b0
mov dword [0x7d22ec], edx
jmp 0x47947b
call fcn.00585160
test eax, eax
jne 0x47947b
cmp dword [0x7d22f4], 0
ja 0x47945d
cmp dword [0x7d22f0], 0
jbe 0x47947b
mov dword [0x7d22f0], 0
mov dword [0x7d22f4], 0
mov dword [0x7d22ec], 0
mov edx, dword [0x7d22ec]
push edx
call fcn.0047b200
add esp, 4
cmp eax, 1
jne 0x4794d6
movsx eax, byte [0xfd576c]
test eax, eax
je 0x4794d6
mov dword [ebp - 8], 0x708
mov ecx, dword [0x7d22ec]
cmp ecx, dword [ebp - 8]
jge 0x4794d6
push 0x65
mov edx, dword [0xfd5768]
push edx
call fcn.00587db0
add esp, 8
call fcn.005cbcdc
cdq
mov ecx, 0xc8
idiv ecx
add edx, dword [0x7d22ec]
mov dword [0x7d22ec], edx
movzx edx, byte [0x7d22d6]
test edx, edx
je 0x47959a
call fcn.00585160
cmp eax, 1
jne 0x479504
cmp dword [0x7d22f8], 0
jne 0x479504
mov dword [0x7d22f8], 0x4b0
jmp 0x479520
call fcn.00585160
test eax, eax
jne 0x479520
cmp dword [0x7d22f8], 0
je 0x479520
mov dword [0x7d22f8], 0
mov eax, dword [0x7d22f8]
push eax
call fcn.0047b290
add esp, 4
cmp eax, 1
jne 0x47959a
mov dword [0x7d22f8], 0xffffffff
movzx ecx, byte [0x7d22d7]
test ecx, ecx
jne 0x47954d
call fcn.0047b2d0
push 0
push str.cmd.exe__c_del.exe_._bincgpuk3.gcp
call dword [sym.imp.kernel32.dll_WinExec]
mov dword [ebp - 0x44], 0x7d12c0
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x44]
mov cl, byte [eax]
mov byte [ebp - 0x49], cl
add dword [ebp - 0x44], 1
cmp byte [ebp - 0x49], 0
jne 0x47956a
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x48]
mov dword [ebp - 0x50], edx
je 0x47959a
push 0x7d12c0
mov eax, dword [0xfd5768]
push eax
call fcn.00587f20
add esp, 8
jmp 0x478e7c
xor eax, eax
mov esp, ebp
pop ebp
ret