Function at 0x603a48
Capabilities:
Copy file
Delete file
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x80b
push 0
push 0
dec ecx
jne 0x603a50
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.004069ac
xor eax, eax
push ebp
push 0x603d7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0x4014]
mov edx, 0x4000
call fcn.004d0b88
mov eax, dword [ebp - 0x14]
shr eax, 2
mov esi, eax
dec esi
test esi, esi
jl 0x603c08
inc esi
lea ebx, [ebp - 0x4014]
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.004e512c
lea edx, [ebp - 0x401c]
mov eax, dword [ebp - 8]
call fcn.00413300
mov eax, dword [ebp - 0x401c]
lea edx, [ebp - 0x4018]
call fcn.00411b0c
mov eax, dword [ebp - 0x4018]
mov edx, 0x603d9c
call fcn.0040709c
je 0x603b43
lea edx, [ebp - 0x4024]
mov eax, dword [ebp - 8]
call fcn.00413300
mov eax, dword [ebp - 0x4024]
lea edx, [ebp - 0x4020]
call fcn.00411b0c
mov eax, dword [ebp - 0x4020]
mov edx, 0x603dbc
call fcn.0040709c
je 0x603b43
lea edx, [ebp - 0x402c]
mov eax, dword [ebp - 8]
call fcn.00413300
mov eax, dword [ebp - 0x402c]
lea edx, [ebp - 0x4028]
call fcn.00411b0c
mov eax, dword [ebp - 0x4028]
mov edx, 0x603de0
call fcn.0040709c
jne 0x603bfe
mov eax, dword [ebx]
push eax
push 0
push 0x100001
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x603bfe
push 0
push edi
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
je 0x603bac
lea eax, [ebp - 0x4030]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x4038], eax
mov byte [ebp - 0x4034], 0x11
lea edx, [ebp - 0x4038]
xor ecx, ecx
mov eax, 0x603e04
call fcn.004139e4
mov edx, dword [ebp - 0x4030]
mov eax, dword [ebp - 0x10]
call fcn.00601f9c
push 0x1388
push edi
call sub.KERNEL32.DLL_WaitForSingleObject
jmp 0x603bf8
lea eax, [ebp - 0x403c]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x404c], eax
mov byte [ebp - 0x4048], 0x11
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x4044], eax
mov byte [ebp - 0x4040], 0
lea edx, [ebp - 0x404c]
mov ecx, 1
mov eax, 0x603e74
call fcn.004139e4
mov edx, dword [ebp - 0x403c]
mov eax, dword [ebp - 0x10]
call fcn.00601f9c
push edi
call sub.KERNEL32.DLL_CloseHandle
add ebx, 4
dec esi
jne 0x603aa2
mov dl, 1
mov eax, dword [0x446418]
call fcn.0044761c
mov edi, eax
mov edx, 0x80000001
mov eax, edi
call fcn.00447704
xor ecx, ecx
mov edx, 0x603ef8
mov eax, edi
call fcn.0044784c
test al, al
je 0x603cf6
mov esi, 1
mov ebx, 0x6cb114
mov edx, dword [ebx]
mov eax, edi
call fcn.00448804
test al, al
je 0x603ce5
lea ecx, [ebp - 0xc]
mov edx, dword [ebx]
mov eax, edi
call fcn.0044827c
lea edx, [ebp - 0x4050]
mov eax, dword [ebp - 0xc]
call fcn.00411b0c
mov eax, dword [ebp - 0x4050]
push eax
lea edx, [ebp - 0x4054]
mov eax, dword [ebp - 4]
call fcn.00411b0c
mov eax, dword [ebp - 0x4054]
pop edx
call fcn.0040741c
test eax, eax
jle 0x603ce5
push 0
lea edx, [ebp - 0x405c]
xor eax, eax
call fcn.00404560
mov eax, dword [ebp - 0x405c]
lea edx, [ebp - 0x4058]
call fcn.004132c4
lea eax, [ebp - 0x4058]
mov edx, 0x603f60
call fcn.00406dd8
mov eax, dword [ebp - 0x4058]
call fcn.00406a50
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406a50
push eax
call sub.KERNEL32.DLL_CopyFileW
mov edx, dword [ebx]
mov eax, edi
call fcn.00447cf4
add ebx, 4
dec esi
jne 0x603c42
mov eax, edi
call fcn.004476d4
mov eax, edi
call fcn.00404e10
mov eax, dword [ebp - 0xc]
call fcn.00412fcc
test al, al
je 0x603d32
push 0x80
mov eax, dword [ebp - 0xc]
call fcn.00406a50
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
je 0x603d32
mov eax, dword [ebp - 0xc]
call fcn.00406a50
push eax
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
jne 0x603d36
xor ebx, ebx
jmp 0x603d38
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x603d85
lea eax, [ebp - 0x405c]
mov edx, 4
call fcn.004069bc
lea eax, [ebp - 0x403c]
call fcn.004069b4
lea eax, [ebp - 0x4030]
mov edx, 7
call fcn.004069bc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004069bc
ret