Function at 0x40e070
Capabilities:
Check os version
Enumerate files on windows
Get common file path
Query or enumerate registry value
Read .ini file
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x411b80
push 0x4026f0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x5a90
call fcn.0040a9d0
mov eax, dword [0x413018]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x202c], 0
mov dword [ebp - 0x5a98], 0
mov dword [ebp - 0x3838], 0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x820]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x820]
push ecx
push str._sK7ZeroAccessScanReport.log
push 0x400
push 0x416088
call fcn.00401238
add esp, 0x10
push 0x4106c0
push 0x416088
push 0x426bc4
call fcn.004011e5
add esp, 0xc
cmp dword [0x426bc4], 0
jne 0x40e143
mov dword [0x426bb8], 0xee
mov dword [ebp - 4], 0xfffffffe
jmp 0x40e72e
call fcn.0040d650
call fcn.0040cc20
call fcn.0040cee0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xee
jne 0x40e179
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_get_privileges__Running_in_unprivileged_mode____08X_n
mov edx, dword [0x426bc4]
push edx
call fcn.00401481
add esp, 0xc
push 0x400
lea eax, [ebp - 0x5040]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.0040d010
mov dword [ebp - 0x383c], eax
cmp dword [ebp - 0x383c], 0xee
jne 0x40e1ae
mov dword [ebp - 4], 0xfffffffe
jmp 0x40e72e
cmp dword [ebp - 0x383c], 0x10
jne 0x40e1d9
lea ecx, [ebp - 0x5040]
push ecx
push str._sSysnative
push 0x400
lea edx, [ebp - 0x3830]
push edx
call fcn.00401238
add esp, 0x10
jmp 0x40e1f9
lea eax, [ebp - 0x5040]
push eax
push str._sSystem32
push 0x400
lea ecx, [ebp - 0x3830]
push ecx
call fcn.00401238
add esp, 0x10
lea edx, [ebp - 0x5040]
push edx
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov dword [0x416888], 0x114
push 0x416888
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x41688c], 5
ja 0x40e266
lea eax, [ebp - 0x5040]
push eax
push str._sRECYCLER
push 0x400
lea ecx, [ebp - 0x4840]
push ecx
call fcn.00401238
add esp, 0x10
lea edx, [ebp - 0x5040]
push edx
push str._sWindows_system32dllcache
push 0x400
lea eax, [ebp - 0x3030]
push eax
call fcn.00401238
add esp, 0x10
jmp 0x40e2a6
lea ecx, [ebp - 0x5040]
push ecx
push str._s_Recycle.Bin
push 0x400
lea edx, [ebp - 0x4840]
push edx
call fcn.00401238
add esp, 0x10
lea eax, [ebp - 0x5040]
push eax
push str._sWindowsWinsxs
push 0x400
lea ecx, [ebp - 0x3030]
push ecx
call fcn.00401238
add esp, 0x10
lea edx, [ebp - 0x3830]
push edx
push str._s_services.exe
push 0x400
lea eax, [ebp - 0x5840]
push eax
call fcn.00401238
add esp, 0x10
lea ecx, [ebp - 0x5840]
push ecx
call fcn.0040d530
add esp, 4
cmp eax, 1
jne 0x40e37f
push 0x410850
mov edx, dword [0x426bc4]
push edx
call fcn.00401481
add esp, 8
mov dword [0x426bb8], 1
cmp dword [0x414000], 0
je 0x40e37a
push str.Services.exe_modified__Replacing_it_from_backup_path_n
mov eax, dword [0x426bc4]
push eax
call fcn.00401481
add esp, 8
mov dword [0x426bb8], 1
cmp dword [0x414000], 0
je 0x40e346
push str.services.exe
lea ecx, [ebp - 0x3830]
push ecx
lea edx, [ebp - 0x3030]
push edx
call fcn.0040d6d0
add esp, 0xc
cmp dword [0x426bb8], 0xee
jne 0x40e35e
mov dword [ebp - 4], 0xfffffffe
jmp 0x40e72e
cmp dword [0x426bb8], 1
jne 0x40e37a
push 0x410938
mov eax, dword [0x426bc4]
push eax
call fcn.00401481
add esp, 8
jmp 0x40e40b
lea ecx, [ebp - 0x5040]
push ecx
push str._sWindowsSystem32drivers
push 0x400
lea edx, [ebp - 0x1020]
push edx
call fcn.00401238
add esp, 0x10
lea eax, [ebp - 0x1020]
push eax
call fcn.0040ca00
add esp, 4
test eax, eax
jne 0x40e3c8
push str.Taking_driver_backup_failed__Scanning_ZAccess_folders_n
mov ecx, dword [0x426bc4]
push ecx
call fcn.00401515
add esp, 8
jmp 0x40e40b
lea edx, [ebp - 0x5840]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x5840]
push eax
push 0x410a38
lea ecx, [ebp - 0x3030]
push ecx
call fcn.00401000
add esp, 0xc
lea edx, [ebp - 0x1020]
push edx
lea eax, [ebp - 0x3030]
push eax
call fcn.0040da40
add esp, 8
lea ecx, [ebp - 0x4840]
push ecx
call fcn.0040df00
add esp, 4
cmp eax, 0xee
jne 0x40e42d
mov dword [ebp - 4], 0xfffffffe
jmp 0x40e72e
cmp dword [0x426bbc], 3
jl 0x40e4cb
push str.ZeroAccess_Infection_symptoms_found_under__Recycle.Bin_n
mov edx, dword [0x426bc4]
push edx
call fcn.00401481
add esp, 8
cmp dword [0x426bb8], 0
jne 0x40e461
mov dword [0x426bb8], 1
cmp dword [0x414000], 0
je 0x40e48a
cmp dword [0x426bb8], 1
jne 0x40e47f
call fcn.0040cc60
mov dword [0x426bb8], eax
jmp 0x40e48a
call fcn.0040cc60
mov dword [ebp - 0x202c], eax
cmp dword [0x426bb8], 0xee
je 0x40e4a2
cmp dword [ebp - 0x202c], 0xee
jne 0x40e4cb
push str.Removing_ZeroAccess_folders_inside_Recycle_Bin_failed_n
mov eax, dword [0x426bc4]
push eax
call fcn.00401481
add esp, 8
mov dword [0x426bb8], 0xee
mov dword [ebp - 4], 0xfffffffe
jmp 0x40e72e
mov dword [0x426bbc], 0
lea ecx, [ebp - 0x5040]
push ecx
push str._sWindows
push 0x400
lea edx, [ebp - 0x1820]
push edx
call fcn.00401238
add esp, 0x10
lea eax, [ebp - 0x1820]
push eax
push 0x4108bc
push 0x400
lea ecx, [ebp - 0x5840]
push ecx
call fcn.00401238
add esp, 0x10
lea edx, [ebp - 0x5a90]
push edx
lea eax, [ebp - 0x5840]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x5a94], eax
cmp dword [ebp - 0x5a94], 0xffffffff
jne 0x40e55f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_remove_files_under__NtUninstall___Error__08X_n
mov ecx, dword [0x426bc4]
push ecx
call fcn.00401481
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x40e72e
push 0x410934
lea edx, [ebp - 0x5a64]
push edx
call fcn.00401aae
add esp, 8
test eax, eax
je 0x40e58f
push 0x410bc0
lea eax, [ebp - 0x5a64]
push eax
call fcn.00401aae
add esp, 8
test eax, eax
jne 0x40e591
jmp 0x40e5ec
mov ecx, dword [ebp - 0x5a90]
and ecx, 0x10
je 0x40e5ec
push 0xc
push str._NtUninstall
lea edx, [ebp - 0x5a64]
push edx
call fcn.00401a77
add esp, 0xc
test eax, eax
jne 0x40e5ec
lea eax, [ebp - 0x5a64]
push eax
lea ecx, [ebp - 0x1820]
push ecx
push 0x410be4
push 0x400
lea edx, [ebp - 0x5840]
push edx
call fcn.00401238
add esp, 0x14
lea eax, [ebp - 0x5840]
push eax
call fcn.0040dca0
add esp, 4
lea ecx, [ebp - 0x5a90]
push ecx
mov edx, dword [ebp - 0x5a94]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40e55f
mov eax, dword [ebp - 0x5a94]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x426bbc], 3
jl 0x40e6a8
push str.ZeroAccess_Infection_symptoms_found_under__Ntuninstall_n
mov ecx, dword [0x426bc4]
push ecx
call fcn.00401481
add esp, 8
cmp dword [0x426bb8], 0
jne 0x40e649
mov dword [0x426bb8], 1
cmp dword [0x414000], 0
je 0x40e672
cmp dword [0x426bb8], 1
jne 0x40e667
call fcn.0040cc60
mov dword [0x426bb8], eax
jmp 0x40e672
call fcn.0040cc60
mov dword [ebp - 0x202c], eax
cmp dword [ebp - 0x202c], 0xee
jne 0x40e6a8
push str.Removing_ZeroAccess_folders_inside__NtUninstall_failed_n
mov edx, dword [0x426bc4]
push edx
call fcn.00401481
add esp, 8
mov dword [0x426bb8], 0xee
mov dword [ebp - 4], 0xfffffffe
jmp 0x40e72e
mov dword [ebp - 4], 0xfffffffe
jmp 0x40e726
xor eax, eax
jne 0x40e0ce
mov ecx, dword [0x426bb8]
mov dword [ebp - 0x5aa8], ecx
cmp dword [ebp - 0x5aa8], 0xee
ja case.0x40e757.1
mov edx, dword [ebp - 0x5aa8]
movzx eax, byte [edx + 0x40e924]
jmp dword [eax*4 + 0x40e910]
push str._nNo_Infection_symptoms_found__Generic_cleanup_performed_n
mov ecx, dword [0x426bc4]
push ecx
call fcn.00401481
add esp, 8
mov dword [0x426bc0], 1
jmp case.0x40e757.1
push str.ZeroAccess_Infection_Successfully_removed__Reboot_suggested_n
mov edx, dword [0x426bc4]
push edx
call fcn.00401481
add esp, 8
mov dword [0x426bc0], 1
jmp case.0x40e757.1
push str.Unable_to_Remove_ZeroAccess_infection_n
mov eax, dword [0x426bc4]
push eax
call fcn.00401481
add esp, 8
jmp case.0x40e757.1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Internal_Error____08X_n
mov ecx, dword [0x426bc4]
push ecx
call fcn.00401481
add esp, 0xc
mov edx, dword [0x426bc4]
push edx
call fcn.00401861
add esp, 4
cmp dword [0x426bc0], 0
je 0x40e8d2
mov dword [ebp - 0x3834], 0x800
lea eax, [ebp - 0x3834]
push eax
lea ecx, [ebp - 0x2028]
push ecx
lea edx, [ebp - 0x1824]
push edx
push str.DirProductBase
push str.SOFTWAREK7_ComputingK7TotalSecurity
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x5a9c], eax
cmp dword [ebp - 0x5a9c], 0
jne 0x40e891
lea eax, [ebp - 0x2028]
push eax
push str._sK7CmnRes.dat
push 0x400
lea ecx, [ebp - 0x4040]
push ecx
call fcn.00401238
add esp, 0x10
lea edx, [ebp - 0x4040]
push edx
push 0x400
lea eax, [ebp - 0x2830]
push eax
push 0
push str.GenRebootText
push str.AdvCleanup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x40e88f
push 0x410f50
push 0x400
lea ecx, [ebp - 0x2830]
push ecx
call fcn.00401ae5
add esp, 0xc
jmp 0x40e8aa
push str.Advance_Cleanup_tool_requires_a_restart_to_complete_the_cleaning._n_nWould_you_like_to_restart_now_
push 0x400
lea edx, [ebp - 0x2830]
push edx
call fcn.00401ae5
add esp, 0xc
push 1
push str.Message
lea eax, [ebp - 0x2830]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x40e8d2
push 0x80020003
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp dword [0x426bc4], 0
je 0x40e8ea
mov ecx, dword [0x426bc4]
push ecx
call fcn.00401bcb
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00401110
mov esp, ebp
pop ebp
ret 0x10