Function at 0x4021b0
Capabilities:
Copy file
Create directory
Create shortcut via ishelllink
Delete file
Persist via run registry key
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43d243
mov eax, dword fs:[0]
push eax
sub esp, 0x868
mov eax, dword [0x450880]
xor eax, esp
mov dword [esp + 0x860], eax
push ebx
push esi
push edi
mov eax, dword [0x450880]
xor eax, esp
push eax
lea eax, [esp + 0x878]
mov dword fs:[0], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x38]
push eax
push 0xf003f
xor edi, edi
push edi
push 0x445800
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea ecx, [esp + 0x30]
push ecx
push 0xf003f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x38]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x40]
push edx
push edi
lea eax, [esp + 0x28]
push eax
push edi
push str.CommonFilesDir
push ecx
mov dword [esp + 0x38], 1
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
call esi
cmp eax, edi
jne 0x402277
lea edx, [esp + 0x40]
push edx
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x460]
push eax
lea ecx, [esp + 0x28]
push ecx
push edi
push str.CommonFilesDir
push edx
call esi
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x44]
push eax
push edi
lea ecx, [esp + 0x28]
push ecx
push edi
push str.Common_Desktop
push edx
call esi
cmp eax, edi
jne 0x4022af
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x28]
push edx
push edi
push str.Common_Desktop
push eax
call esi
mov eax, dword [esp + 0x38]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x4022c0
push eax
call esi
mov eax, dword [esp + 0x30]
cmp eax, edi
je 0x4022cb
push eax
call esi
call fcn.0040bc5f
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4022e5
push 0x80004005
call fcn.00401630
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x880], edi
call fcn.0040bc5f
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x402316
push 0x80004005
call fcn.00401630
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0x880], 1
call fcn.0040bc5f
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x402348
push 0x80004005
call fcn.00401630
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x880], 2
call fcn.0040bc5f
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x40237a
push 0x80004005
call fcn.00401630
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x880], 3
call fcn.0040bc5f
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4023ac
push 0x80004005
call fcn.00401630
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x45c]
push ecx
lea edx, [esp + 0x28]
push 0x44591c
mov bl, 4
push edx
mov byte [esp + 0x88c], bl
call fcn.00409bd0
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call fcn.00409ab0
push str.PengFeiSim_
lea esi, [esp + 0x2c]
call fcn.00408d30
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x38]
call fcn.00409ab0
push str.PengFeiSimSimSwitcherXIn1.exe
lea esi, [esp + 0x38]
call fcn.00408d30
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x1c]
push 0x44591c
push eax
call fcn.00409bd0
add esp, 0xc
push 0x6b
call fcn.0040c0ed
cmp eax, edi
je 0x402445
push 0x6b
push eax
lea ecx, [esp + 0x44]
call fcn.00401510
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x18]
push 0x445954
push edx
call fcn.004091c0
add esp, 0xc
mov byte [esp + 0x880], 5
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004094f0
mov byte [esp + 0x880], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40249b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x104
lea ecx, [esp + 0x258]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea edx, [esp + 0x254]
push edx
lea ecx, [esp + 0x30]
call fcn.00409860
mov byte [esp + 0x880], 6
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
push esi
push eax
call fcn.0042937a
add esp, 8
test eax, eax
je 0x4026c4
push edi
mov edi, dword [esp + 0x2c]
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0x80
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ecx, dword [esp + 0x2c]
push 0
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push 0
mov ebx, eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x4025e4
lea edx, [esp + 0x1c]
push edx
push 0x444cbc
push 1
push 0
push 0x444ccc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4025de
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push edi
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 5
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x444cfc
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x4025d2
mov esi, dword [esp + 0x18]
cmp dword [esi - 4], 1
jle 0x40259e
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401300
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, 0x2d
lea edi, [esp + 0x664]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 0
lea ecx, [esp + 0x668]
push ecx
push eax
call edx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp ebx, 1
jne 0x402641
cmp dword [esp + 0x48], 0
jne 0x402641
call fcn.0040bc5f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40260a
push 0x80004005
call fcn.00401630
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x6d
mov byte [esp + 0x884], 7
call fcn.0040c0ed
test eax, eax
je 0x402639
push 0x6d
push eax
lea ecx, [esp + 0x1c]
call fcn.00401510
push 0xffffffffffffffff
push 0
push 0x6d
jmp 0x402690
call fcn.0040bc5f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40265b
push 0x80004005
call fcn.00401630
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x6e
mov byte [esp + 0x884], 8
call fcn.0040c0ed
test eax, eax
je 0x40268a
push 0x6e
push eax
lea ecx, [esp + 0x1c]
call fcn.00401510
push 0xffffffffffffffff
push 0
push 0x6e
call fcn.0040c45e
mov byte [esp + 0x880], 6
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4026bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
call fcn.00428a15
mov byte [esp + 0x880], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4026eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x880], 3
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402713
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x880], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40273b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x880], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40275f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x880], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402787
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x880], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4027b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.004280b8
mov esp, ebp
pop ebp
ret