Function at 0x4010c0
Capabilities:
Contain obfuscated stackstrings
Delete directory
Delete file
Delete registry key
Move file

Disassembly:
sub esp, 0x208
mov eax, 0x6e6e6f70
push ebx
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x70755320
push esi
mov dword [esp + 0x11c], eax
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x114], ecx
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x110]
push 0x24
lea ecx, [esp + 0x10]
push eax
mov esi, 0xd8d4b6d0
mov edi, 0x74726f70
mov edx, 0x6d6f4320
push ecx
push 0
mov dword [esp + 0x120], esi
mov dword [esp + 0x128], edi
mov dword [esp + 0x12c], edx
mov dword [esp + 0x134], 0x7465
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], 0xba207465
mov dword [esp + 0x34], 0xd3add4f3
mov dword [esp + 0x38], 0xc4a6b9d0
mov dword [esp + 0x3c], 0xb2abbddc
mov dword [esp + 0x40], 0xd3c9bfbb
mov dword [esp + 0x44], 0xcaaca3c3
mov dword [esp + 0x48], 0xbcf1b7c7
mov dword [esp + 0x4c], 0xb1f8d0cc
mov dword [esp + 0x50], 0xa3f4c1a3
mov word [esp + 0x54], 0xbf
call ebx
cmp eax, 6
je 0x401466
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
push 0
lea edx, [esp + 0x10]
push 0x100
mov edi, 0x65727275
push edx
push 0x80000002
mov dword [esp + 0x1c], 0x54464f53
mov dword [esp + 0x20], 0x45524157
mov dword [esp + 0x24], 0x63694d5c
mov dword [esp + 0x28], 0x6f736f72
mov dword [esp + 0x2c], 0x575c7466
mov dword [esp + 0x30], 0x6f646e69
mov dword [esp + 0x34], 0x435c7377
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 0x6556746e
mov dword [esp + 0x40], 0x6f697372
mov dword [esp + 0x44], 0x6e555c6e
mov dword [esp + 0x48], 0x74736e69
mov dword [esp + 0x4c], 0x5c6c6c61
mov dword [esp + 0x50], 0x70707553
mov dword [esp + 0x54], 0x2074726f
mov dword [esp + 0x58], 0x706d6f43
mov dword [esp + 0x5c], 0x656e6e6f
mov word [esp + 0x60], 0x74
call esi
push 0
lea eax, [esp + 0x10]
push 0
push eax
push 0x80000002
call esi
push 0
push 0
mov dword [esp + 0x14], 0x54535953
mov dword [esp + 0x18], 0x435c4d45
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 0x6f43746e
mov dword [esp + 0x24], 0x6f72746e
mov dword [esp + 0x28], 0x7465536c
mov dword [esp + 0x2c], 0x7265535c
mov dword [esp + 0x30], 0x65636976
mov dword [esp + 0x34], 0x70735c73
mov dword [esp + 0x38], 0x6d6f6374
mov byte [esp + 0x3c], 0
mov dword [esp + 0x118], 0x6e696e75
mov dword [esp + 0x11c], 0x6c617473
mov dword [esp + 0x120], 0x69745f6c
mov dword [esp + 0x124], 0x656d
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
lea ecx, [esp + 0x114]
lea edx, [esp + 0x10]
push eax
push ecx
push edx
push 0x80000002
call section..text
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x20]
add esp, 0x14
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push 0x103
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x110]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x401362
mov byte [eax], 0
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401388
push 4
lea eax, [esp + 0x114]
push 0
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4013a1
push 4
lea edx, [esp + 0x10]
push eax
push edx
call esi
lea eax, [esp + 0x110]
push 0x40
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
mov dword [esp + 0x120], 0xd8d4b6d0
mov dword [esp + 0x124], 0x70755320
mov dword [esp + 0x128], 0x74726f70
mov dword [esp + 0x12c], 0x6d6f4320
mov dword [esp + 0x130], 0x6e6e6f70
mov dword [esp + 0x134], 0x7465
mov dword [esp + 0x1c], 0x70707553
mov dword [esp + 0x20], 0x2074726f
mov dword [esp + 0x24], 0x706d6f43
mov dword [esp + 0x28], 0x656e6e6f
mov dword [esp + 0x2c], 0xd1d22074
mov dword [esp + 0x30], 0xa6b9c9b3
mov dword [esp + 0x34], 0xfdb3c6d2
mov dword [esp + 0x38], 0xdad4aca3
mov dword [esp + 0x3c], 0xceb4c2cf
mov dword [esp + 0x40], 0xf4c6d8d6
mov dword [esp + 0x44], 0xe3cbc6bc
mov dword [esp + 0x48], 0xf3bafabb
mov dword [esp + 0x4c], 0xa7d0fac9
mov dword [esp + 0x50], 0xa3a1
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x208
ret 0x10