Function at 0x40f120
Capabilities:
Create process on windows
Delete directory
Delete file
Delete registry value
Move file
Persist via run registry key

Disassembly:
sub esp, 0x130
push ebx
push ebp
push esi
push edi
push str.Desinstalar
push 1
call fcn.0040c720
push 0x429438
lea eax, [esp + 0x20]
push str._shear_usr.exe__kill
push eax
call fcn.00416129
lea ecx, [esp + 0x28]
push ecx
push str.ejecutara__s
push 1
call fcn.0040c720
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x20
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x429438
lea eax, [esp + 0x18]
push str.__s_nmgmt.exe___kill
push eax
call fcn.00416129
lea ecx, [esp + 0x20]
push ecx
push str.ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x429438
lea eax, [esp + 0x18]
push str.__s_sleepy.exe___kill
push eax
call fcn.00416129
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x429438
lea edx, [esp + 0x18]
push str.__s_sleepy3.exe___kill
push edx
call fcn.00416129
add esp, 0xc
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x429438
lea ecx, [esp + 0x18]
push str.__sWinide.exe___kill
push ecx
call fcn.00416129
add esp, 0xc
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x429438
lea eax, [esp + 0x18]
push str.__shelp.exe___kill
push eax
call fcn.00416129
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x429438
push str._sicodisc.exe__kill
lea edx, [esp + 0x1c]
push edx
call fcn.00416129
add esp, 0xc
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x429438
lea ecx, [esp + 0x18]
push str._sPrChk.exe__kill
push ecx
call fcn.00416129
add esp, 0xc
lea edx, [esp + 0x14]
push 5
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc350
call edi
push 0x429438
lea eax, [esp + 0x18]
push str.__shelp.exe___kill
push eax
call fcn.00416129
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x429438
lea edx, [esp + 0x18]
push str._sicodisc.exe__kill
push edx
call fcn.00416129
add esp, 0xc
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x1388
call edi
push 0x429438
lea ecx, [esp + 0x18]
push str.__scclient.exe___Remove
push ecx
call fcn.00416129
add esp, 0xc
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x429438
lea eax, [esp + 0x18]
push str.__s_sleepy3.exe___Remove
push eax
call fcn.00416129
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x429438
lea edx, [esp + 0x18]
push str.__sWinide.exe___kill
push edx
call fcn.00416129
add esp, 0xc
lea eax, [esp + 0x14]
push 5
push eax
call esi
push 0x1388
call edi
push 0x429438
lea ecx, [esp + 0x18]
push str.__sWinide.exe___kill
push ecx
call fcn.00416129
add esp, 0xc
lea edx, [esp + 0x14]
push 5
push edx
call esi
push 0x429438
lea eax, [esp + 0x18]
push str.__scclient.exe___kill
push eax
call fcn.00416129
add esp, 0xc
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x1388
call edi
push 0x429438
lea edx, [esp + 0x18]
push str.__shear_usr.exe___kill
push edx
call fcn.00416129
lea eax, [esp + 0x20]
push eax
push str.ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x429438
lea edx, [esp + 0x18]
push str.__s_nmgmt.exe___kill
push edx
call fcn.00416129
lea eax, [esp + 0x20]
push eax
push str.ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x1f40
call edi
push 0x429438
lea edx, [esp + 0x18]
push str.__s_nmgmt.exe___kill
push edx
call fcn.00416129
lea eax, [esp + 0x20]
push eax
push str.ejecutara__s
push 1
call fcn.0040c720
add esp, 0x18
lea ecx, [esp + 0x14]
push 5
push ecx
call esi
push 0x7d0
call edi
lea edx, [esp + 0x14]
push 0x186
push edx
push str.TempDir
call fcn.0040d260
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0xc
test eax, eax
je 0x40f46a
lea eax, [esp + 0x14]
push str.LEVTEMP
push eax
call fcn.00417180
add esp, 8
test eax, eax
je 0x40f46a
push str.si_levtemp
push 2
call fcn.0040c720
lea ecx, [esp + 0x1c]
push 0x42a24c
push ecx
call fcn.00410600
add esp, 0x10
lea edx, [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
call fcn.0040eee0
add esp, 4
push 0x1388
call edi
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040ee00
push str.SoftwareLeverITChat
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040ee00
push str.SoftwareLeverITAgent
push closesocket
call fcn.0040ee00
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f4e7
mov edx, dword [esp + 0x10]
push str.BossD
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x429438
call fcn.0041fa79
push str.LEVERIT_
push 0x429438
call fcn.00417180
add esp, 0xc
test eax, eax
je 0x40f54d
push 2
push 0x429439
push 0x42a2d4
call fcn.00416710
add esp, 0xc
test eax, eax
jne 0x40f54d
mov edi, 0x429438
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xa
jbe 0x40f54d
push 0x42a24c
push 0x429438
call fcn.00410600
push 0x429438
call fcn.0040eee0
add esp, 0xc
mov edi, 0x429438
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call fcn.0041fa79
lea edx, [esp + 0x18]
push str.LEVERIT
push edx
call fcn.00417180
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x40f602
mov edi, str.Discovery
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + 8], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00410570
add esp, 4
test eax, eax
jne 0x40f602
lea ecx, [esp + 0x14]
mov byte [ebp + 8], al
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call fcn.00410570
add esp, 4
test eax, eax
je 0x40f602
push 4
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x14]
push str.c:_res.txt
push ecx
call fcn.00416129
lea edx, [esp + 0x1c]
push edx
call fcn.004105c0
lea eax, [esp + 0x20]
push eax
call fcn.00411500
lea ecx, [esp + 0x24]
push 0x42a24c
push ecx
call fcn.00410600
add esp, 0x18
lea edx, [esp + 0x14]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
call fcn.0040eee0
lea ecx, [esp + 0x18]
push ecx
push 0x28
call fcn.0040bc10
mov al, byte [esp + 0x20]
add esp, 0xc
xor esi, esi
test al, al
je 0x40f684
cmp esi, 0x12c
jge 0x40f684
movsx edx, byte [esp + esi + 0x14]
push edx
call fcn.00416a0f
add esp, 4
mov byte [esp + esi + 0x14], al
mov al, byte [esp + esi + 0x15]
inc esi
test al, al
jne 0x40f661
lea eax, [esp + 0x14]
push str.USERS_
push eax
call fcn.00417180
add esp, 8
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x40f6af
lea ecx, [esp + 4]
mov byte [eax + 6], 0
push ecx
call fcn.0040eff0
add esp, 4
mov eax, 1
add esp, 0x130
ret