Function at 0x401490
Capabilities:
Create process on windows
Query or enumerate registry value
Read .ini file
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x432b03
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push ebp
push esi
push edi
mov eax, dword [0x441720]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov dword [esp + 0x3c], ecx
call fcn.0040d1d5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4014e1
push 0x80004005
call fcn.00402350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0xb0], 0
call fcn.0040d1d5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401516
push 0x80004005
call fcn.00402350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0xb0], 1
call fcn.0040d1d5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401548
push 0x80004005
call fcn.00402350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x34], ebx
mov byte [esp + 0xb0], 2
call fcn.0040d1d5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40157a
push 0x80004005
call fcn.00402350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
push 0x439048
lea ecx, [esp + 0x24]
mov byte [esp + 0xb4], 3
call fcn.004029c0
push 0x439048
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 4
call fcn.004029c0
push 0x439048
lea ecx, [esp + 0x28]
mov byte [esp + 0xb4], 5
call fcn.004029c0
mov byte [esp + 0xb0], 6
call fcn.0040d1d5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4015ee
push 0x80004005
call fcn.00402350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
push 0x438a78
push 0
push str.allaccount
mov byte [esp + 0xbc], 7
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.ACCOUNTNUM
call esi
mov edx, dword [esp + 0x20]
mov dword [esp + 0x44], eax
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x40164d
push 0x104
lea ecx, [esp + 0x24]
call fcn.00402930
mov edx, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x438a78
push 0x104
push edx
push 0x439048
push str.includingpath
push str.FILESTODEL
call edi
mov edx, dword [esp + 0x1c]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x401699
push 0x104
lea ecx, [esp + 0x20]
call fcn.00402930
mov edx, dword [esp + 0x1c]
push 0x438a78
push 0x104
push edx
push 0x439048
push str.filename
push str.FILESTODEL
call edi
push 0x438a78
push 0
push str.delsharereg
push str.PATHTODEL
call esi
mov edx, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x4016f6
push 0x104
lea ecx, [esp + 0x28]
call fcn.00402930
mov edx, dword [esp + 0x24]
push 0x438a78
push 0x104
push edx
push 0x439048
push str.targetstr
push str.PATHTODEL
call edi
mov edx, dword [esp + 0x20]
test edx, edx
jne 0x40171e
xor eax, eax
jmp 0x401738
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401723
sub eax, esi
sar eax, 1
js 0x401ca9
cmp eax, dword [edx - 8]
jg 0x401ca9
mov dword [edx - 0xc], eax
mov ecx, dword [esp + 0x20]
mov word [ecx + eax*2], 0
mov edx, dword [esp + 0x1c]
test edx, edx
jne 0x40175a
xor eax, eax
jmp 0x401775
mov eax, edx
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401760
sub eax, esi
sar eax, 1
js 0x401ca9
cmp eax, dword [edx - 8]
jg 0x401ca9
mov dword [edx - 0xc], eax
mov edx, dword [esp + 0x1c]
mov word [edx + eax*2], 0
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x401797
xor eax, eax
jmp 0x4017b5
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4017a0
sub eax, esi
sar eax, 1
js 0x401ca9
cmp eax, dword [edx - 8]
jg 0x401ca9
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edx - 0xc], eax
mov ecx, dword [esp + 0x24]
push str.RegDifShell.dll
mov word [ecx + eax*2], 0
call edi
push str.EncLib.dll
mov esi, eax
call edi
test esi, esi
mov ebp, eax
jne 0x401955
mov ecx, dword [esp + 0x3c]
push esi
push 0x438b80
push 0x438b88
call fcn.00408a7a
mov byte [esp + 0xb0], 6
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401827
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 5
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40184f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401877
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 3
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40189f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 1
lea eax, [ebx - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4018eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401913
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xb0], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40193e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push str.RegisterServer
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
push str.Decrypt
push ebp
mov edi, eax
call esi
mov dword [esp + 0x40], eax
call edi
cmp eax, 1
jne 0x401cb3
test ebp, ebp
jne 0x4019b5
mov ecx, dword [esp + 0x3c]
push ebp
push 0x438b80
push 0x438bdc
call fcn.00408a7a
mov byte [esp + 0xb0], 6
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40181b
push 0x44
lea ecx, [esp + 0x60]
push 0
push ecx
call fcn.0041e6d0
xor eax, eax
add esp, 0xc
cmp dword [esp + 0x44], eax
mov dword [esp + 0x5c], 0x44
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
jle 0x40207c
add eax, 1
push eax
lea edx, [esp + 0x3c]
push 0x439040
push edx
mov dword [esp + 0x34], eax
call fcn.00402890
add esp, 0xc
push 0x438c12
lea ecx, [esp + 0x1c]
call fcn.004027f0
push 0x438c12
lea ecx, [esp + 0x18]
call fcn.004027f0
push 0x438c12
lea ecx, [esp + 0x38]
call fcn.004027f0
mov esi, dword [esp + 0x18]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x401a58
push 0x104
lea ecx, [esp + 0x1c]
call fcn.00402930
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x38]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x438a78
push 0x104
push esi
push 0x439048
push str.username
push edi
call ebp
mov eax, dword [esp + 0x14]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
jge 0x401aa0
push 0x104
lea ecx, [esp + 0x18]
call fcn.00402930
mov eax, dword [esp + 0x14]
push 0x438a78
push 0x104
push eax
push 0x439048
push str.domain
push edi
call ebp
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, 0x104
or eax, ecx
jge 0x401ae6
push 0x104
lea ecx, [esp + 0x38]
call fcn.00402930
mov ebx, dword [esp + 0x34]
push 0x438a78
push 0x104
push ebx
push 0x439048
push str.password
push edi
call ebp
test esi, esi
jne 0x401b06
xor eax, eax
jmp 0x401b25
mov eax, esi
lea edx, [eax + 2]
jmp 0x401b10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401b10
sub eax, edx
sar eax, 1
js 0x401ca9
cmp eax, dword [esi - 8]
jg 0x401ca9
mov edx, dword [esp + 0x14]
test edx, edx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], 0
jne 0x401b43
xor eax, eax
jmp 0x401b65
mov eax, edx
lea esi, [eax + 2]
jmp 0x401b50
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401b50
sub eax, esi
sar eax, 1
js 0x401ca9
cmp eax, dword [edx - 8]
jg 0x401ca9
test ebx, ebx
mov dword [edx - 0xc], eax
mov word [edx + eax*2], 0
jne 0x401b7f
xor eax, eax
jmp 0x401b99
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401b84
sub eax, edx
sar eax, 1
js 0x401ca9
cmp eax, dword [ebx - 8]
jg 0x401ca9
mov dword [ebx - 0xc], eax
push 0xff
mov word [ebx + eax*2], 0
call fcn.00402cbf
push 0xff
mov esi, eax
call fcn.00402cbf
add esp, 8
push 0
push 0
mov edi, eax
mov eax, dword [ebx - 0xc]
push eax
push esi
push 0xffffffffffffffff
push ebx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push esi
call dword [esp + 0x48]
push edi
lea ecx, [esp + 0x34]
call fcn.004025f0
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xb4], 8
call fcn.00402700
mov byte [esp + 0xb0], 7
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
cmp dword [eax - 0xc], 0
jne 0x401c42
push 0x438c12
lea ecx, [esp + 0x30]
call fcn.004027f0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
jne 0x401c6d
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x60]
push edx
push 0
push 0
push 0x4000000
push 0
push str.ClientAutoReg.exe
push 1
push eax
push 0
jmp 0x401c8b
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x60]
push edx
push 0
push 0
push 0x4000000
push 0
push str.ClientAutoReg.exe
push 1
push eax
push ecx
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x44]
jl 0x4019ea
jmp 0x40207c
push 0x80070057
call fcn.00402350
cmp dword [esp + 0x30], 1
jne 0x40207c
call fcn.0040d1d5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401cd8
push 0x80004005
call fcn.00402350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x28], esi
mov bl, 9
mov byte [esp + 0xb0], bl
xor edi, edi
push str.SYSTEMControlSet001ControlSession_ManagerEnvironment
lea ecx, [esp + 0x34]
mov dword [esp + 0x44], edi
call fcn.004029c0
mov byte [esp + 0xb0], 0xa
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x40]
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x401e6d
mov ecx, dword [esp + 0x3c]
push edi
push 0x438b80
push 0x438ce4
call fcn.00408a7a
mov byte [esp + 0xb0], bl
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0xb0], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 6
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401db9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 5
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401de1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401e09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 3
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401e31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401e59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xb0], 1
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
jmp 0x4018d2
mov eax, dword [esp + 0x40]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x44]
push ecx
push edi
lea edx, [esp + 0x50]
push edx
push edi
push str.Path
push eax
call esi
test eax, eax
je 0x401f18
push edi
push 0x438b80
push 0x438d04
mov ecx, dword [esp + 0x48]
call fcn.00408a7a
lea ecx, [esp + 0x30]
call fcn.00402c30
lea ecx, [esp + 0x28]
call fcn.00402c30
lea ecx, [esp + 0x38]
call fcn.00402c30
lea ecx, [esp + 0x24]
call fcn.00402c30
lea ecx, [esp + 0x1c]
call fcn.00402c30
lea ecx, [esp + 0x20]
call fcn.00402c30
lea ecx, [esp + 0x2c]
call fcn.00402c30
lea ecx, [esp + 0x34]
call fcn.00402c30
lea ecx, [esp + 0x14]
call fcn.00402c30
lea ecx, [esp + 0x18]
call fcn.00402c30
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x44]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402cbf
mov ecx, dword [esp + 0x44]
add esp, 4
mov ebp, eax
lea eax, [esp + 0x44]
push eax
push ebp
push edi
push edi
push str.Path
push ecx
call esi
test eax, eax
je 0x401f61
push edi
push 0x438b80
push 0x438d18
jmp 0x401e9e
push ebp
lea ecx, [esp + 0x2c]
call fcn.00402460
mov esi, dword [esp + 0x28]
cmp dword [esi - 0xc], edi
jl 0x40203e
push 0x438d2c
push esi
call fcn.0041d827
add esp, 8
test eax, eax
je 0x40203e
sub eax, esi
sar eax, 1
mov edi, eax
js 0x40203e
mov ecx, edi
mov edx, 0x438d34
lea esi, [esp + 0x28]
call fcn.00402150
sub eax, edi
mov edx, esi
add eax, 1
push edx
mov ecx, edi
call fcn.004020a0
mov eax, dword [esp + 0x28]
mov eax, dword [eax - 0xc]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402cbf
add esp, 4
mov ecx, esi
call fcn.00402200
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x12c
push eax
mov eax, dword [esp + 0x48]
push 2
push 0
push str.Path
push eax
call esi
test eax, eax
je 0x402013
push 0
push 0x438b80
push 0x438d38
jmp 0x401e9e
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push ecx
push ebp
push 2
push 0
push str.Path1
push edx
call esi
test eax, eax
je 0x40203e
push 0
push 0x438b80
push 0x438d58
jmp 0x401e9e
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40205e
push 0
push 0x438b80
push 0x438d6c
jmp 0x401e9e
lea ecx, [esp + 0x30]
call fcn.00402c30
lea ecx, [esp + 0x28]
mov byte [esp + 0xb0], 7
call fcn.00402c30
mov ebx, dword [esp + 0x34]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x150]
call eax
jmp 0x401994