Function at 0x401460
Capabilities:
Copy file
Create process on windows
Enumerate process modules
Get disk information
Get process image filename
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
mov eax, 0x6a3c
push esi
push ebx
call fcn.004031e0
mov ecx, 0x100
sub esp, eax
xor eax, eax
lea edi, [esp + 0x230]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x630]
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea edi, [esp + 0xa30]
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea edi, [esp + 0xe30]
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea edi, [esp + 0x130]
mov ecx, 0x40
rep stosd dword es:[edi], eax
lea edi, [esp + 0x1a30]
mov ecx, 0x400
rep stosd dword es:[edi], eax
lea edi, [esp + 0x1230]
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea eax, [esp + 0x230]
mov dword [esp + 8], 0x400
mov dword [esp], str.WINDIR
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
lea eax, [esp + 0x230]
mov dword [esp + 4], str._sSRMon.exe
mov dword [esp], 0x40a840
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
lea eax, [esp + 0x50]
mov dword [esp + 4], eax
lea eax, [esp + 0x4c]
mov dword [esp], eax
call fcn.004022f0
cmp dword [esp + 0x4c], 9
lea eax, [esp + 0x44]
mov dword [esp + 0xc], 0x2001b
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
jle 0x4019f2
mov dword [esp + 4], str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun_
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x401695
xor ebx, ebx
lea esi, [esp + 0x1630]
lea ebp, [esp + 0x48]
lea edi, [esp + 0xb0]
jmp 0x40159c
mov dword [esp + 4], 0x40a840
mov dword [esp], esi
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x401b77
add ebx, 1
lea eax, [esp + 0x58]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x54]
mov dword [esp + 4], ebx
mov dword [esp + 0x58], 0x400
mov dword [esp + 0x54], pe_nt_image_headers32
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumValueA
sub esp, 0x20
test eax, eax
je 0x401581
mov eax, dword [0x40a02c]
mov dword [esp + 8], 0x39
mov dword [esp + 4], 1
mov dword [esp], str.Proper_auto_run_entry_NOT_found_in_registry__creating..._n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, 0x40a840
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x40161e
test eax, 0x8080
jne 0x401641
shr eax, 0x10
add edx, 2
mov ecx, eax
mov dword [esp + 0x10], 0x40a840
mov dword [esp + 0xc], 1
add cl, al
mov eax, dword [esp + 0x44]
mov dword [esp + 8], 0
sbb edx, 0x40a842
mov dword [esp + 4], str.SRMon
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x401bae
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
lea eax, [esp + 0x1230]
mov dword [esp], 0x400
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetLogicalDriveStringsA
sub esp, 8
cmp byte [esp + 0x1230], 0
je 0x401764
lea edi, [esp + 0x130]
lea ebp, [esp + 0x1230]
xor esi, esi
mov ebx, edi
nop
mov dword [esp + 4], ebp
mov dword [esp], ebx
add esi, 1
call sub.msvcrt.dll_strcpy
mov byte [ebx + 2], 0
mov dword [esp], ebp
add ebx, 8
call sub.msvcrt.dll_strlen
lea ebp, [ebp + eax + 1]
cmp byte [ebp], 0
jne 0x4016d0
lea ebp, [esp + 0x1a30]
lea ebx, [esp + esi*8 + 0x130]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], ebp
mov dword [esp], edi
add edi, 8
mov dword [esp + 8], pe_nt_image_headers32
sub ebp, 0xffffff80
call sub.KERNEL32.dll_QueryDosDeviceA
sub esp, 0xc
cmp ebx, edi
jne 0x401710
movzx edx, byte [esp + 0x230]
cmp byte [esp + 0x130], dl
je 0x401bd9
xor eax, eax
jmp 0x40175d
cmp byte [esp + eax*8 + 0x130], dl
je 0x401a10
add eax, 1
cmp esi, eax
jne 0x401750
lea eax, [esp + 0x630]
mov dword [esp + 4], str._sSRMon.exe
mov dword [esp], 0x40a040
lea esi, [esp + 0x2a30]
mov ebx, 1
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
call sub.KERNEL32.dll_GetCurrentProcessId
mov edi, eax
lea eax, [esp + 0x40]
mov dword [esp + 4], 0x4000
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.PSAPI.DLL_EnumProcesses
sub esp, 0xc
test eax, eax
je 0x4019e5
mov ebx, dword [esp + 0x40]
xor ebp, ebp
shr ebx, 2
test ebx, ebx
je 0x40185b
lea esi, [esi]
mov eax, dword [esi + ebp*4]
cmp edi, eax
je 0x401850
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x400
mov byte [esp + 0xe30], 0
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
test eax, eax
mov edx, eax
je 0x401831
lea eax, [esp + 0xe30]
mov dword [esp], edx
mov dword [esp + 8], 0x400
mov dword [esp + 0x3c], edx
mov dword [esp + 4], eax
call sub.PSAPI.DLL_GetProcessImageFileNameA
sub esp, 0xc
mov edx, dword [esp + 0x3c]
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea eax, [esp + 0xe30]
mov dword [esp + 4], 0x40a040
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x401a8d
add ebp, 1
cmp ebx, ebp
jne 0x4017d0
lea eax, [esp + 0xa30]
mov dword [esp + 8], 0x400
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
lea eax, [esp + 0xa30]
mov dword [esp + 4], str.Current_exe:__s_n
mov dword [esp + 8], eax
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
lea eax, [esp + 0xa30]
mov dword [esp + 4], 0x40a840
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
mov ebx, eax
je 0x401a4e
mov eax, dword [0x40a02c]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.NOT_standard_image_name__n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x40a840
call fcn.00402290
test eax, eax
je 0x401b26
lea edx, [esp + 0x6c]
xor eax, eax
mov ecx, 0x11
lea ebx, [esp + 0x5c]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov edi, edx
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x230]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x40a840
mov dword [esp + 0x6c], 0x44
mov dword [esp + 0x98], 1
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
jne 0x401acc
mov eax, dword [0x40a02c]
mov dword [esp + 8], 0x20
xor ebx, ebx
mov dword [esp + 4], 1
mov dword [esp], str.Error_creating_standard_process_n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x6a3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
jmp 0x401563
lea ecx, [esp + 0x1a30]
shl eax, 7
add eax, ecx
mov dword [esp + 4], eax
lea eax, [esp + 0x630]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [esp + 0x232]
mov dword [esp + 4], eax
lea eax, [esp + 0x630]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401764
mov eax, dword [0x40a02c]
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 1
mov dword [esp], str.SRMon_Running__alone__from_standard_directory_n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x6a3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + ebp*4 + 0x2a30]
mov dword [esp + 4], str.SRmon_found_already_running_from_standard_path__PID__ld_._nExit_n
mov ebx, 1
mov dword [esp + 8], eax
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x6a3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x64]
mov dword [esp + 4], str.Run_process_from_standard_directory__PID_ld__and_Exit_n
mov ebx, 1
mov dword [esp + 8], eax
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, ebx
add esp, 0x6a3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x40a02c]
mov dword [esp + 8], 0x40a840
mov dword [esp + 4], str.Windows_image_not_fount__copy_to:__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
lea eax, [esp + 0xa30]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40a840
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
jmp 0x401911
mov eax, dword [0x40a02c]
mov dword [esp + 8], 0x28
mov dword [esp + 4], 1
mov dword [esp], str.Proper_auto_run_entry_found_in_registry_n
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
jmp 0x401686
mov dword [esp + 8], eax
mov eax, dword [0x40a02c]
mov dword [esp + 4], str.ERROR___ld__Creating_Proper_auto_run_entry_in_registry_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x40a02c]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
jmp 0x401686
lea eax, [esp + 0x1a30]
jmp 0x401a1c