Function at 0x41a324
Capabilities:
Delete file
Get common file path
Move file
Persist via ginadll registry key
Persist via run registry key
Persist via winlogon helper dll registry key
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x17
push 0
push 0
dec ecx
jne 0x41a32c
push ecx
push ebx
mov eax, 0x41a26c
call fcn.004063d0
mov ebx, 0x41da30
xor eax, eax
push ebp
push 0x41ab53
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402958
mov eax, dword [ebp - 0x14]
mov edx, 0x41ab68
call fcn.004045c0
jne 0x41ab35
call fcn.00419608
test al, al
jne 0x41a393
push 0x40
push 0x41ab84
push 0x41ab8c
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x41ab35
push 0x24
push 0x41abc4
push 0x41abcc
push 0
call sub.user32.dll_MessageBoxA_1
cmp eax, 7
je 0x41ab35
push 0
push 5
push 0x98d
push 0
push 0x41abf8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SendMessageA
push 0x7d0
call sub.kernel32.dll_Sleep
mov eax, 0xff
push eax
push 0x41da3c
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x41da34
mov edx, 0x41da3c
mov ecx, pe_nt_image_headers32
call fcn.0040442c
call fcn.004196f0
mov dl, 1
mov eax, dword [0x418c74]
call fcn.00418d74
mov dword [ebx], eax
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00418e14
mov cl, 1
mov edx, 0x41ac0c
mov eax, dword [ebx]
call fcn.00418e7c
mov edx, 0x41ac4c
mov eax, dword [ebx]
call fcn.00419118
mov ecx, 0x41ac5c
mov edx, 0x41ac68
mov eax, dword [ebx]
call fcn.00419218
mov ecx, 0x41ac80
mov edx, 0x41ac98
mov eax, dword [ebx]
call fcn.00419218
mov eax, dword [ebx]
call fcn.00418de4
mov cl, 1
mov edx, 0x41acb0
mov eax, dword [ebx]
call fcn.00418e7c
mov edx, 0x41ace8
mov eax, dword [ebx]
call fcn.00419118
mov eax, dword [ebx]
call fcn.00418de4
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00418e14
mov cl, 1
mov edx, 0x41acfc
mov eax, dword [ebx]
call fcn.00418e7c
mov edx, 0x41ad40
mov eax, dword [ebx]
call fcn.00419118
mov eax, dword [ebx]
call fcn.00418de4
mov cl, 1
mov edx, 0x41ad54
mov eax, dword [ebx]
call fcn.00418e7c
mov edx, 0x41ad98
mov eax, dword [ebx]
call fcn.00419118
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00418e14
mov edx, 0x41adb8
mov eax, dword [ebx]
call fcn.00418fa0
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00418e14
mov edx, 0x41adb8
mov eax, dword [ebx]
call fcn.00418fa0
mov eax, dword [ebx]
call fcn.00418de4
mov edx, 0x80000002
mov eax, dword [ebx]
call fcn.00418e14
mov cl, 1
mov edx, 0x41addc
mov eax, dword [ebx]
call fcn.00418e7c
lea ecx, [ebp - 0x18]
mov edx, 0x41ae28
mov eax, dword [ebx]
call fcn.00419244
mov edx, dword [ebp - 0x18]
mov eax, 0x41da38
call fcn.00404218
mov eax, dword [ebx]
call fcn.00418de4
mov eax, dword [ebx]
call fcn.0040348c
call fcn.0041983c
lea eax, [ebp - 0x1c]
mov ecx, 0x41ae40
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x1c]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x20]
mov ecx, 0x41ae58
mov edx, dword [0x41da38]
call fcn.004044c8
mov eax, dword [ebp - 0x20]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x24]
mov ecx, 0x41ae70
mov edx, dword [0x41da38]
call fcn.004044c8
mov eax, dword [ebp - 0x24]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x28]
mov ecx, 0x41ae8c
mov edx, dword [0x41da38]
call fcn.004044c8
mov eax, dword [ebp - 0x28]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x2c]
mov ecx, 0x41aea8
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x2c]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
push 0x41aeb4
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x30]
mov ecx, 0x41aecc
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x30]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x34]
mov ecx, 0x41aee8
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x34]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x38]
mov ecx, 0x41aefc
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x38]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x3c]
mov ecx, 0x41af10
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x3c]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x40]
mov ecx, 0x41af24
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x40]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x44]
mov ecx, 0x41af3c
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x44]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x48]
mov ecx, 0x41af54
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x48]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x4c]
mov ecx, 0x41af6c
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x4c]
call fcn.00404674
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x50]
mov ecx, 0x41af84
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x50]
call fcn.0041a1dc
lea eax, [ebp - 0x54]
mov ecx, 0x41af98
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x54]
call fcn.0041a1dc
lea eax, [ebp - 0x58]
mov ecx, 0x41afac
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x58]
call fcn.0041a1dc
lea eax, [ebp - 0x5c]
mov ecx, 0x41afc0
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x5c]
call fcn.0041a1dc
lea eax, [ebp - 0x60]
mov ecx, 0x41afd4
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x60]
call fcn.0041a1dc
lea eax, [ebp - 0x64]
mov ecx, 0x41afe8
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x64]
call fcn.0041a1dc
lea eax, [ebp - 0x68]
mov ecx, 0x41affc
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x68]
call fcn.0041a1dc
lea eax, [ebp - 0x6c]
mov ecx, 0x41b010
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x6c]
call fcn.0041a1dc
lea eax, [ebp - 0x70]
mov ecx, 0x41b028
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x70]
call fcn.0041a1dc
lea eax, [ebp - 0x74]
mov ecx, 0x41b040
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x74]
call fcn.0041a1dc
push 5
lea eax, [ebp - 0x78]
mov ecx, 0x41ae40
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x78]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x7c]
mov ecx, 0x41aea8
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x7c]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x80]
mov ecx, 0x41aecc
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x80]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x84]
mov ecx, 0x41aee8
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x84]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x88]
mov ecx, 0x41b058
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x88]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x8c]
mov ecx, 0x41b06c
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x8c]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x90]
mov ecx, 0x41aefc
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x90]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x94]
mov ecx, 0x41af10
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x94]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x98]
mov ecx, 0x41b084
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x98]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0x9c]
mov ecx, 0x41af24
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0x9c]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0xa0]
mov ecx, 0x41af3c
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0xa0]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0xa4]
mov ecx, 0x41af54
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0xa4]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0xa8]
mov ecx, 0x41b09c
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0xa8]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0xac]
mov ecx, 0x41b0b4
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0xac]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0xb0]
mov ecx, 0x41b0cc
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0xb0]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0xb4]
mov ecx, 0x41b0e0
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0xb4]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0xb8]
mov ecx, 0x41b0f4
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0xb8]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
push 5
lea eax, [ebp - 0xbc]
mov ecx, 0x41b108
mov edx, dword [0x41da34]
call fcn.004044c8
mov eax, dword [ebp - 0xbc]
call fcn.00404674
push eax
push 0
call sub.kernel32.dll_MoveFileExA
mov al, 1
call fcn.004197d8
xor eax, eax
call fcn.0041979c
mov al, 1
call fcn.00419724
push 0x40
push 0x41b118
push 0x41b120
push 0
call sub.user32.dll_MessageBoxA_1
call fcn.0041a12c
test al, al
je 0x41ab35
push 0
push 6
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ab5a
lea eax, [ebp - 0xbc]
mov edx, 0x2b
call fcn.004041e8
ret