Function at 0x40fbf0
Capabilities:
Create process on windows
Delete directory
Delete file
Delete registry value
Move file
Persist via run registry key

Disassembly:
sub esp, 0x25c
push esi
push str.Desinstalar2
push 1
call fcn.0040d050
mov esi, dword [esp + 0x26c]
add esp, 8
test esi, esi
je 0x40fc5e
push esi
push str.conClave_d
push 2
call fcn.0040d050
lea eax, [esp + 0x140]
push eax
push str.UNINP
call fcn.00412e50
lea ecx, [esp + 0x148]
push ecx
push esi
call fcn.00422610
add esp, 0x1c
test eax, eax
je 0x40fc5e
push str.no_ig
push 2
call fcn.0040d050
add esp, 8
xor eax, eax
pop esi
add esp, 0x25c
ret
mov eax, dword [0x4344dc]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x40fcd6
push 0x42c4e0
lea edx, [esp + 0x18]
push str._sgo
push edx
call fcn.00418db9
lea eax, [esp + 0x20]
push 0x42d5a4
push eax
call fcn.00412000
push 0x42c4e0
lea ecx, [esp + 0x2c]
push str.__sdiscover.exe___QUIT
push ecx
call fcn.00418db9
lea edx, [esp + 0x34]
push edx
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x2c
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x3a98
call edi
call fcn.0040f1d0
push 0x42c4e0
lea ecx, [esp + 0x18]
push str._shear_usr.exe__kill
push ecx
call fcn.00418db9
lea edx, [esp + 0x20]
push edx
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x42c4e0
lea ecx, [esp + 0x18]
push str.__s_nmgmt.exe___kill
push ecx
call fcn.00418db9
lea edx, [esp + 0x20]
push edx
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x42c4e0
lea ecx, [esp + 0x18]
push str.__sleveback.exe___kill
push ecx
call fcn.00418db9
push 0x433b7c
push str.Ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x42c4e0
lea eax, [esp + 0x18]
push str.__s_sleepy.exe___kill
push eax
call fcn.00418db9
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x42c4e0
lea edx, [esp + 0x18]
push str.__s_sleepy3.exe___kill
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x42c4e0
lea ecx, [esp + 0x18]
push str.__sWinide.exe___kill
push ecx
call fcn.00418db9
add esp, 0xc
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x42c4e0
lea eax, [esp + 0x18]
push str.__shelp.exe___kill
push eax
call fcn.00418db9
add esp, 0xc
push 5
lea ecx, [esp + 0x18]
push ecx
call esi
push 0x42c4e0
lea edx, [esp + 0x18]
push str._sicodisc.exe__kill
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x42c4e0
lea ecx, [esp + 0x18]
push str._sPrChk.exe__kill
push ecx
call fcn.00418db9
add esp, 0xc
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0xc350
call edi
push 0x42c4e0
lea eax, [esp + 0x18]
push str.__shelp.exe___kill
push eax
call fcn.00418db9
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x42c4e0
lea edx, [esp + 0x18]
push str._sicodisc.exe__kill
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x1388
call edi
push 0x42c4e0
lea ecx, [esp + 0x18]
push str.__scclient.exe___Remove
push ecx
call fcn.00418db9
add esp, 0xc
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x42c4e0
lea eax, [esp + 0x18]
push str.__s_sleepy3.exe___Remove
push eax
call fcn.00418db9
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x42c4e0
lea edx, [esp + 0x18]
push str.__sWinide.exe___kill
push edx
call fcn.00418db9
add esp, 0xc
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x1388
call edi
push 0x42c4e0
push str.__sWinide.exe___kill
lea ecx, [esp + 0x1c]
push ecx
call fcn.00418db9
add esp, 0xc
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x42c4e0
lea eax, [esp + 0x18]
push str.__scclient.exe___kill
push eax
call fcn.00418db9
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x1388
call edi
push 0x42c4e0
lea edx, [esp + 0x18]
push str.__shear_usr.exe___kill
push edx
call fcn.00418db9
lea eax, [esp + 0x20]
push eax
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x42c4e0
lea edx, [esp + 0x18]
push str.__s_nmgmt.exe___kill
push edx
call fcn.00418db9
lea eax, [esp + 0x20]
push eax
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x1f40
call edi
push 0x42c4e0
lea edx, [esp + 0x18]
push str.__s_nmgmt.exe___kill
push edx
call fcn.00418db9
lea eax, [esp + 0x20]
push eax
push str.ejecutara__s
push 1
call fcn.0040d050
add esp, 0x18
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x7d0
call edi
lea edx, [esp + 0x14]
push 0x186
push edx
push str.TempDir
call fcn.0040de40
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0xc
test eax, eax
je 0x41002f
lea eax, [esp + 0x14]
push str.LEVTEMP
push eax
call fcn.00419e10
add esp, 8
test eax, eax
je 0x41002f
push str.si_levtemp
push 2
call fcn.0040d050
lea ecx, [esp + 0x1c]
push 0x42d5a4
push ecx
call fcn.00412000
add esp, 0x10
lea edx, [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
call fcn.0040f9b0
add esp, 4
push 0x1388
call edi
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040f8d0
push str.SoftwareLeverITChat
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040f8d0
push str.SoftwareLeverITAgent
push closesocket
call fcn.0040f8d0
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4100ac
mov edx, dword [esp + 0x10]
push str.BossD
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x42c4e0
call fcn.00422719
push str.LEVERIT_
push 0x42c4e0
call fcn.00419e10
add esp, 0xc
test eax, eax
je 0x410112
push 2
push 0x42c4e1
push 0x42d62c
call fcn.004193d0
add esp, 0xc
test eax, eax
jne 0x410112
mov edi, 0x42c4e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xa
jbe 0x410112
push 0x42d5a4
push 0x42c4e0
call fcn.00412000
push 0x42c4e0
call fcn.0040f9b0
add esp, 0xc
mov edi, 0x42c4e0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call fcn.00422719
lea edx, [esp + 0x18]
push str.LEVERIT
push edx
call fcn.00419e10
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x4101c7
mov edi, str.Discovery
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + 8], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00411f30
add esp, 4
test eax, eax
jne 0x4101c7
lea ecx, [esp + 0x14]
mov byte [ebp + 8], al
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call fcn.00411f30
add esp, 4
test eax, eax
je 0x4101c7
push 4
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x14]
push str.c:_res.txt
push ecx
call fcn.00418db9
lea edx, [esp + 0x1c]
push edx
call fcn.00411fc0
lea eax, [esp + 0x20]
push eax
call fcn.00413070
lea ecx, [esp + 0x24]
push 0x42d5a4
push ecx
call fcn.00412000
add esp, 0x18
lea edx, [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
call fcn.0040f9b0
lea ecx, [esp + 0x18]
push ecx
push 0x28
call fcn.0040c370
mov al, byte [esp + 0x20]
add esp, 0xc
xor esi, esi
pop edi
pop ebp
test al, al
pop ebx
je 0x41024c
cmp esi, 0x12c
jge 0x41024c
movsx edx, byte [esp + esi + 8]
push edx
call fcn.004196cf
add esp, 4
mov byte [esp + esi + 8], al
mov al, byte [esp + esi + 9]
inc esi
test al, al
jne 0x410229
lea eax, [esp + 8]
push str.USERS_
push eax
call fcn.00419e10
add esp, 8
test eax, eax
je 0x410273
lea ecx, [esp + 8]
mov byte [eax + 6], 0
push ecx
call fcn.0040fac0
add esp, 4
mov eax, 1
pop esi
add esp, 0x25c
ret