Function at 0x422049
Capabilities:
Copy file
Create process on windows
Persist via default file association registry key
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff730
mov esi, eax
lea eax, [esi + 0xd]
push eax
push 0x4555f3
lea edx, [esp + 0x90]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
lea ecx, [esp + 0x8c]
push ecx
call sub.KERNEL32.dll_WinExec
xor edi, edi
mov ebx, 0x455034
jmp 0x421fc8
xor eax, eax
xor edx, edx
mov dword [esp + 0x190], eax
mov dword [esp + 0x194], edx
mov dword [esp + 0x18c], 0x455605
mov dword [esp + 0x18c], 0x455613
push edi
lea ecx, [esi + 0xd]
push ecx
push 0x45562d
lea eax, [esp + 0x1a4]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea edx, [esp + 0x198]
mov eax, esp
call fcn.0043ac2e
mov edx, esp
lea eax, [esp + 0x190]
call fcn.004249f0
mov ebp, dword [esp]
test ebp, ebp
je 0x421cfb
dec word [ebp + 0xe]
mov ax, word [ebp + 0xe]
test ax, ax
jne 0x421cfb
mov edx, dword [esp]
test edx, edx
je 0x421cfb
mov edx, 3
mov eax, dword [esp]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [esp + 0x190]
test eax, eax
je 0x421d14
test byte [eax + 0xd], 1
setne dl
and edx, 1
test dl, dl
je 0x421d18
xor ecx, ecx
jmp 0x421d1d
mov ecx, 1
test cl, cl
je 0x421f45
mov byte [esp + 0x50], 6
mov dword [esp + 0x54], 0x450384
mov dword [esp + 0x54], 0x453040
mov al, byte [esp + 0x50]
lea edx, [esp + 0x54]
mov byte [esp + 0x58], al
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
lea eax, [esp + 0x5c]
mov ebp, dword [ecx]
lea ecx, [esp + 0x190]
call dword [ebp]
lea edx, [esp + 0x5c]
lea eax, [esp + 0x190]
call fcn.004249f0
mov ebp, dword [esp + 0x5c]
test ebp, ebp
je 0x421d9c
dec word [ebp + 0xe]
mov ax, word [ebp + 0xe]
test ax, ax
jne 0x421d9c
mov edx, dword [esp + 0x5c]
test edx, edx
je 0x421d9c
mov edx, 3
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
call dword [ecx]
push dword [ebx + 4]
push dword [ebx]
lea eax, [esi + 0xd]
push eax
push 0x455637
lea edx, [esp + 0x2ac]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x14
mov ecx, 0x1f40
push 1
push 0x10
push 0
lea edx, [esp + 0x2a8]
lea eax, [esp + 0x6c]
call fcn.00425f12
lea edx, [esp + 0x60]
lea eax, [esp + 0x194]
call fcn.0043f27c
mov ebp, dword [esp + 0x60]
test ebp, ebp
je 0x421e0f
dec word [ebp + 0x12]
mov ax, word [ebp + 0x12]
test ax, ax
jne 0x421e0f
mov edx, dword [esp + 0x60]
test edx, edx
je 0x421e0f
mov edx, 3
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
call dword [ecx]
mov dword [esp + 0x8c8], edi
xor eax, eax
mov dword [esp + 0x8cc], eax
mov ebp, esi
fild qword [esp + 0x8c8]
fmul qword [0x42245a]
fstp qword [esp + 0x64]
mov dword [esp + 0x3a0], ebp
lea eax, [esp + 0x3a0]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x3a4], edx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x3a8], edx
lea edx, [esp + 0x18c]
mov dword [esp + 0x3ac], 0x594af4f1
mov dword [esp + 0x3b0], 0x3f963886
call fcn.00422d9c
test eax, eax
je 0x421ef3
mov ebx, dword [esp + 0x194]
test ebx, ebx
je 0x421eaf
dec word [ebx + 0x12]
mov ax, word [ebx + 0x12]
test ax, ax
jne 0x421eaf
mov edx, dword [esp + 0x194]
test edx, edx
je 0x421eaf
mov edx, 3
mov eax, dword [esp + 0x194]
mov ecx, dword [eax]
call dword [ecx]
mov ebx, dword [esp + 0x190]
test ebx, ebx
je 0x421fd2
dec word [ebx + 0xe]
mov ax, word [ebx + 0xe]
test ax, ax
jne 0x421fd2
mov edx, dword [esp + 0x190]
test edx, edx
je 0x421fd2
mov edx, 3
mov eax, dword [esp + 0x190]
mov ecx, dword [eax]
call dword [ecx]
jmp 0x421fd2
push 0x4552de
push dword [ebx]
call fcn.004461dc
add esp, 8
test eax, eax
jne 0x421f45
lea eax, [esp + 0x194]
call fcn.0043f2b7
push dword [ebx + 4]
lea edx, [esi + 0xd]
push edx
push 0x455644
lea ecx, [esp + 0x3c0]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0
lea eax, [esp + 0x3b8]
push eax
lea edx, [esp + 0x2a4]
push edx
call sub.KERNEL32.dll_CopyFileA
lea eax, [esp + 0x190]
call fcn.00424a2b
lea edx, [esp + 0x198]
push edx
call sub.KERNEL32.dll_DeleteFileA
inc edi
add ebx, 8
mov ebp, dword [esp + 0x194]
test ebp, ebp
je 0x421f95
dec word [ebp + 0x12]
mov ax, word [ebp + 0x12]
test ax, ax
jne 0x421f95
mov edx, dword [esp + 0x194]
test edx, edx
je 0x421f95
mov edx, 3
mov eax, dword [esp + 0x194]
mov ecx, dword [eax]
call dword [ecx]
mov ebp, dword [esp + 0x190]
test ebp, ebp
je 0x421fc8
dec word [ebp + 0xe]
mov ax, word [ebp + 0xe]
test ax, ax
jne 0x421fc8
mov edx, dword [esp + 0x190]
test edx, edx
je 0x421fc8
mov edx, 3
mov eax, dword [esp + 0x190]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebx]
test eax, eax
jne 0x421c76
lea ebx, [esi + 0xd]
push ebx
push 0x455665
lea eax, [esp + 0x90]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
lea edx, [esp + 0x8c]
push edx
call sub.KERNEL32.dll_WinExec
push ebx
push 0x455673
lea ecx, [esp + 0x4c0]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0xc
lea eax, [esi + 0x111]
push 0x45567e
lea ecx, [esp + 0x4bc]
mov edx, dword [esi + 4]
call fcn.00443dc4
lea eax, [esp + 0x5bc]
call fcn.0044428b
push 0
call sub.OLE32.dll_CoInitialize
lea edx, [esp + 0x6c]
push edx
push 0x45b64c
push 1
push 0
push 0x45b5ec
call sub.OLE32.dll_CoCreateInstance
mov ebx, eax
test ebx, ebx
jl 0x4220d0
lea eax, [esp + 0x4b8]
push eax
mov edx, dword [esp + 0x70]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
lea eax, [esp + 0x70]
push eax
push 0x45aefc
mov edx, dword [esp + 0x74]
push edx
mov ecx, dword [edx]
call dword [ecx]
mov ebx, eax
test ebx, ebx
jl 0x4220c6
push 0x104
lea eax, [esp + 0x6c4]
push eax
push 0xffffffffffffffff
lea edx, [esp + 0x5c8]
push edx
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
push 1
lea ecx, [esp + 0x6c4]
push ecx
mov eax, dword [esp + 0x78]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
mov ebx, eax
mov ecx, dword [esp + 0x70]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [esp + 0x6c]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
call sub.OLE32.dll_CoUninitialize
lea eax, [esi + 0xd]
push eax
push 0x455696
lea edx, [esp + 0x90]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
lea ecx, [esp + 0x8c]
push ecx
lea eax, [esp + 0x4c0]
push eax
call sub.KERNEL32.dll_CopyFileA
xor edx, edx
mov dword [esp + 0x74], edx
lea ecx, [esp + 0x74]
push ecx
push 0x2001f
push 0
push 0x4556a4
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4221db
xor eax, eax
mov dword [esp + 0x78], eax
xor edx, edx
mov dword [esp + 0x7c], edx
lea ecx, [esp + 0x78]
push ecx
lea eax, [esp + 0x80]
push eax
push 0
push 0xf003f
push 0
push 0x4551d3
push 0
push 0x4556ce
push dword [esp + 0x94]
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x4221d2
mov edx, dword [esp + 0x78]
cmp edx, 1
jne 0x4221c9
push 0x4556e8
call fcn.00446238
pop ecx
inc eax
push eax
push 0x4556e8
push 1
push 0
push 0x4556dc
push dword [esp + 0x90]
call sub.ADVAPI32.dll_RegSetValueExA
lea ecx, [esp + 0x88]
push ecx
call fcn.00446238
pop ecx
inc eax
push eax
lea eax, [esp + 0x8c]
push eax
push 1
push 0
push 0x45570a
push dword [esp + 0x90]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [esp + 0x7c]
call sub.ADVAPI32.dll_RegCloseKey
push dword [esp + 0x74]
call sub.ADVAPI32.dll_RegCloseKey
push 0x45571a
lea ebx, [esi + 0x111]
mov eax, ebx
lea ecx, [esp + 0x8c]
mov edx, dword [esi + 4]
call fcn.00443dc4
lea eax, [esp + 0x4b8]
xor edx, edx
call fcn.004449cc
lea eax, [esp + 0x88]
mov edx, 0xf0f00f0f
call fcn.004449cc
lea edi, [esi + 0xd]
push edi
push 0x45573c
lea eax, [esp + 0x90]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, ebx
push 0x455747
lea ecx, [esp + 0x8c]
mov edx, dword [esi + 4]
call fcn.00443dc4
lea ecx, [esp + 0x84]
push ecx
lea eax, [esp + 0x84]
push eax
push 0
push 0xf003f
push 0
push 0x4551d3
push 0
push 0x455764
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x4222a8
push 0x455769
call fcn.00446238
pop ecx
inc eax
push eax
push 0x455769
push 1
push 0
push 0
push dword [esp + 0x94]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [esp + 0x80]
call sub.ADVAPI32.dll_RegCloseKey
lea edx, [esp + 0x84]
push edx
lea ecx, [esp + 0x84]
push ecx
push 0
push 0xf003f
push 0
push 0x4551d3
push 0
push 0x455769
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x42230b
push 0x455771
call fcn.00446238
pop ecx
inc eax
push eax
push 0x455771
push 1
push 0
push 0
push dword [esp + 0x94]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [esp + 0x80]
call sub.ADVAPI32.dll_RegCloseKey
lea eax, [esp + 0x84]
push eax
lea edx, [esp + 0x84]
push edx
push 0
push 0xf003f
push 0
push 0x4551d3
push 0
push 0x45579e
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x42239a
push edi
lea ecx, [esp + 0x8c]
push ecx
call fcn.00446208
add esp, 8
push 0x4557b2
lea eax, [esp + 0x8c]
push eax
call fcn.00446178
add esp, 8
lea edx, [esp + 0x88]
push edx
call fcn.00446238
pop ecx
inc eax
push eax
lea ecx, [esp + 0x8c]
push ecx
push 1
push 0
push 0
push dword [esp + 0x94]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [esp + 0x80]
call sub.ADVAPI32.dll_RegCloseKey
lea eax, [esp + 0x84]
push eax
lea edx, [esp + 0x84]
push edx
push 0
push 0xf003f
push 0
push 0x4551d3
push 0
push 0x4557bd
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x422429
push edi
lea ecx, [esp + 0x8c]
push ecx
call fcn.00446208
add esp, 8
push 0x4557d8
lea eax, [esp + 0x8c]
push eax
call fcn.00446178
add esp, 8
lea edx, [esp + 0x88]
push edx
call fcn.00446238
pop ecx
inc eax
push eax
lea ecx, [esp + 0x8c]
push ecx
push 1
push 0
push 0
push dword [esp + 0x94]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [esp + 0x80]
call sub.ADVAPI32.dll_RegCloseKey
push 0x4557e4
lea eax, [esp + 0x4bc]
push eax
call fcn.00446178
add esp, 8
push 1
lea edx, [esp + 0x4bc]
push edx
call sub.KERNEL32.dll_WinExec
add esp, 0x8d0
pop ebp
pop edi
pop esi
pop ebx
ret