Function at 0x3ab182e9
Capabilities:
Copy file
Delete file
Delete registry value
Persist via run registry key

Disassembly:
push 0x860
mov eax, 0x3ab3ffe3
call fcn.3ab359d8
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x794], esi
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x788], edi
call fcn.3aa97887
xor ebx, ebx
cmp eax, ebx
jne 0x3ab1833a
xor al, al
call fcn.3ab35a6a
ret 0x14
cmp dword [eax + 4], 1
jne 0x3ab1870f
cmp esi, ebx
je 0x3ab18634
push esi
call fcn.3ab3c1f6
pop ecx
test eax, eax
je 0x3ab18634
cmp edi, ebx
je 0x3ab1870f
xor eax, eax
push 0x208
mov word [ebp - 0x2f4], ax
lea eax, [ebp - 0x2f2]
push ebx
push eax
call fcn.3ab033f0
add esp, 0xc
lea eax, [ebp - 0x2f4]
push eax
mov edi, 0x105
push edi
call fcn.3ab3c1f6
lea eax, [ebp - 0x2f4]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x3ab1839c
sub eax, ecx
sar eax, 1
mov esi, 0x104
mov ecx, esi
sub ecx, eax
push ecx
push 0x3aa53b64
lea eax, [ebp - 0x2f4]
push edi
push eax
call fcn.3ab3c1f6
xor eax, eax
push 0x206
mov word [ebp - 0x568], ax
lea eax, [ebp - 0x566]
push ebx
push eax
call fcn.3ab033f0
lea edi, [esi - 1]
push edi
push dword [ebp - 0x788]
lea eax, [ebp - 0x568]
push esi
push eax
call fcn.3ab3c1f6
add esp, 0x2c
push esi
lea eax, [ebp - 0x568]
push eax
call fcn.3ab3c1f6
lea eax, [ebp - 0x568]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x3ab18411
sub eax, ecx
sar eax, 1
sub edi, eax
push edi
push 0x3aa53b64
lea eax, [ebp - 0x568]
push esi
push eax
call fcn.3ab3c1f6
add esp, 0x10
push ebx
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.kernel32.dll_CopyFileW]
test eax, eax
je 0x3ab18330
mov dword [ebp - 0x798], ebx
mov dword [ebp - 0x794], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
push 0x2001f
push 0x3aa53ad8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x798]
call fcn.3ab3c1f6
test eax, eax
je 0x3ab18498
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x798]
call fcn.3aa9472b
jmp 0x3ab18330
push dword [ebp - 0x7a8]
lea ecx, [ebp - 0x818]
call fcn.3ab3c1f6
mov edi, eax
mov byte [ebp - 4], 2
push dword [ebp - 0x79c]
lea ecx, [ebp - 0x850]
call fcn.3ab3c1f6
mov dword [ebp - 0x788], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x7c4]
call fcn.3ab3c1f6
mov byte [ebp - 4], 4
push 0x3aa54264
push eax
lea eax, [ebp - 0x834]
push eax
call fcn.3aaa357c
mov byte [ebp - 4], 5
push dword [ebp - 0x788]
push eax
lea eax, [ebp - 0x7fc]
push eax
call fcn.3aa971a4
mov byte [ebp - 4], 6
push 0x3aa7c2bc
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.3aaa357c
mov byte [ebp - 4], 7
push edi
push eax
lea eax, [ebp - 0x86c]
push eax
call fcn.3aa971a4
mov byte [ebp - 4], 8
push 0x3aa6ae60
push eax
lea eax, [ebp - 0x784]
push eax
call fcn.3aaa357c
add esp, 0x3c
mov byte [ebp - 4], 0xa
push ebx
push esi
lea ecx, [ebp - 0x86c]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0xb
push ebx
push esi
lea ecx, [ebp - 0x7e0]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0xc
push ebx
push esi
lea ecx, [ebp - 0x7fc]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0xd
push ebx
push esi
lea ecx, [ebp - 0x834]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0xe
push ebx
push esi
lea ecx, [ebp - 0x7c4]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0xf
push ebx
push esi
lea ecx, [ebp - 0x850]
call fcn.3ab3c1f6
mov byte [ebp - 4], 0x10
push ebx
push esi
lea ecx, [ebp - 0x818]
call fcn.3ab3c1f6
cmp dword [ebp - 0x76c], 8
mov eax, dword [ebp - 0x780]
jae 0x3ab185d6
lea eax, [ebp - 0x780]
or edi, 0xffffffff
push edi
push ebx
push 0x3aa53b44
push eax
lea ecx, [ebp - 0x798]
call fcn.3ab3c1f6
test eax, eax
je 0x3ab1862b
mov byte [ebp - 0x78d], bl
lea ecx, [ebp - 0x798]
call fcn.3aa9472b
mov byte [ebp - 4], 1
push ebx
push esi
lea ecx, [ebp - 0x784]
call fcn.3ab3c1f6
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x798]
call fcn.3aa9472b
mov al, byte [ebp - 0x78d]
jmp 0x3ab18332
mov byte [ebp - 0x78d], 1
jmp 0x3ab185f6
mov dword [ebp - 0x798], ebx
mov dword [ebp - 0x794], ebx
mov dword [ebp - 4], ebx
push 0x2001f
push 0x3aa53ad8
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x798]
call fcn.3ab3c1f6
test eax, eax
jne 0x3ab1867d
push 0x3aa53b44
push dword [ebp - 0x798]
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x798]
call fcn.3aa9472b
xor eax, eax
push 0x208
mov word [ebp - 0x2f4], ax
lea eax, [ebp - 0x2f2]
push ebx
push eax
call fcn.3ab033f0
add esp, 0xc
lea eax, [ebp - 0x2f4]
push eax
mov edi, 0x105
push edi
call fcn.3ab3c1f6
lea esi, [edi - 1]
push esi
lea eax, [ebp - 0x2f4]
push eax
call fcn.3ab3c1f6
lea eax, [ebp - 0x2f4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x3ab186c6
sub eax, edx
sar eax, 1
sub esi, eax
push esi
push 0x3aa53b64
lea eax, [ebp - 0x2f4]
push edi
push eax
call fcn.3ab3c1f6
add esp, 0x10
lea eax, [ebp - 0x2f4]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x798]
call fcn.3aa9472b
mov al, 1
jmp 0x3ab18332
mov dword [ebp - 0x78c], ebx
mov dword [ebp - 0x788], ebx
mov dword [ebp - 4], 0x11
push 0x1b
pop ecx
push 8
mov esi, 0x3aa65558
lea edi, [ebp - 0x360]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 7
mov esi, 0x3aa54164
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x3aa53d98
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 8
pop ecx
push 9
mov esi, 0x3aa54184
lea edi, [ebp - 0xc4]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 9
mov esi, 0x3aa655c4
lea edi, [ebp - 0xe8]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x3aa5423c
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
push 0xa
movsw word es:[edi], word [esi]
pop ecx
mov esi, 0x3aa54210
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x1fe
mov word [ebp - 0x768], ax
lea eax, [ebp - 0x766]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.3ab033f0
add esp, 0xc
push 0x2001f
lea eax, [ebp - 0x360]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x78c]
mov dword [ebp - 0x7a4], 0x100
call fcn.3ab3c1f6
or edi, 0xffffffff
test eax, eax
jne 0x3ab188fa
push edi
push ebx
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0x7a8]
lea ecx, [ebp - 0x78c]
call fcn.3ab3c1f6
lea ecx, [ebp - 0x78c]
test eax, eax
je 0x3ab18818
call fcn.3aa9472b
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x78c]
jmp 0x3ab1848e
push edi
push ebx
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x794]
call fcn.3ab3c1f6
lea ecx, [ebp - 0x78c]
test eax, eax
jne 0x3ab18805
push edi
push ebx
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x79c]
call fcn.3ab3c1f6
lea ecx, [ebp - 0x78c]
test eax, eax
jne 0x3ab18805
push edi
push ebx
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x7a0]
call fcn.3ab3c1f6
lea ecx, [ebp - 0x78c]
test eax, eax
jne 0x3ab18805
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x768]
push eax
call fcn.3ab3c1f6
test eax, eax
jne 0x3ab188b3
push edi
push ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x79c]
lea ecx, [ebp - 0x78c]
call fcn.3ab3c1f6
test eax, eax
je 0x3ab188b3
lea ecx, [ebp - 0x78c]
jmp 0x3ab18805
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x768]
push eax
lea ecx, [ebp - 0x78c]
call fcn.3ab3c1f6
test eax, eax
jne 0x3ab1890f
push edi
push ebx
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x7a0]
lea ecx, [ebp - 0x78c]
call fcn.3ab3c1f6
test eax, eax
je 0x3ab1890f
lea ecx, [ebp - 0x78c]
call fcn.3aa9472b
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x78c]
call fcn.3aa9472b
mov al, bl
jmp 0x3ab18332
mov bl, 1
jmp 0x3ab188ef