Function at 0x403050
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403507
push eax
mov dword fs:[0], esp
mov al, byte [0x40b240]
sub esp, 0xae8
mov dword [ebp - 0x10], ecx
mov ecx, 0x40
mov byte [ebp - 0x1e0], al
push edi
xor eax, eax
lea edi, [ebp - 0x1df]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1e0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x1e0]
push ecx
push ecx
call fcn.00401cb0
add esp, 8
lea ecx, [ebp - 0x1e0]
push 0
push ecx
call fcn.00402fc0
add esp, 8
mov dword [ebp - 0x4f0], eax
test eax, eax
je 0x40310a
cmp byte [0x40d104], 6
jb 0x40310a
cmp dword [0x40d104], 0x80000000
jae 0x40310a
call fcn.00404a00
test eax, eax
jne 0x40310a
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00402660
mov eax, 1
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
push 0x41
push 0x40b428
push 0
mov ecx, dword [eax]
push 8
mov edx, dword [ecx + 0xdc]
mov dword [ebp - 0x2e8], edx
call fcn.00404400
add esp, 8
mov ecx, dword [ebp - 0x10]
push eax
call dword [ebp - 0x2e8]
cmp eax, 1
je 0x403141
xor eax, eax
jmp 0x4030fb
push 1
lea ecx, [ebp - 0xdc]
push 0x80000001
call fcn.00404f50
push 0
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00404f90
test eax, eax
je 0x40326e
mov dword [ebp - 0x1c], str.Programs
mov dword [ebp - 0x18], str.Desktop
mov dword [ebp - 0x14], 0
mov eax, str.Programs
test eax, eax
je 0x403263
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0x104
lea eax, [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
lea ecx, [ebp - 0xdc]
push edx
call fcn.00405120
test eax, eax
je 0x403253
lea eax, [ebp - 0x1c]
cmp dword [ebp - 0x20], eax
jne 0x4031da
push 0
lea eax, [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004035f0
push str.FastCopy.lnk
lea edi, [ebp - 0x2e4]
push 0x40b3c8
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx + ebp - 0x2e5]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [0x40f294], 0
je 0x403244
push 1
lea eax, [ebp - 0x2e4]
push eax
call fcn.00404930
add esp, 8
mov dword [ebp - 0x6f8], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x6f8]
push eax
call fcn.00404e00
mov byte [ebp - 4], 0
add esp, 4
call fcn.00403375
jmp 0x403253
lea eax, [ebp - 0x2e4]
push eax
call fcn.00404e00
add esp, 4
add dword [ebp - 0x20], 4
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jne 0x40319c
lea ecx, [ebp - 0xdc]
call fcn.00405100
push 1
lea eax, [ebp - 0x1e0]
push eax
call fcn.00402fc0
add esp, 8
cmp dword [0x40f294], 0
je 0x4032e4
call fcn.004049b0
test eax, eax
je 0x4032e4
lea edi, [ebp - 0x54]
xor eax, eax
mov ecx, 0xe
push str.DllUnregisterServer
mov dword [ebp - 0x58], 0x3c
rep stosd dword es:[edi], eax
push str.FastEx64.dll
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0xaf4]
push str.__s_s___s
push ecx
call dword [sym.imp.MSVCRT40.dll_sprintf]
add esp, 0x14
lea ecx, [ebp - 0xaf4]
mov dword [ebp - 0x48], str.rundll32.exe
lea edx, [ebp - 0x58]
mov dword [ebp - 0x44], ecx
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0
lea ecx, [ebp - 0xdc]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
call fcn.00404f90
test eax, eax
je 0x403366
push 0
lea ecx, [ebp - 0xdc]
push 0x40b2cc
call fcn.00404f90
test eax, eax
je 0x40334b
push 0x104
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0xdc]
push str.UninstallString
call fcn.00405120
test eax, eax
je 0x403340
lea eax, [ebp - 0x1e0]
push eax
push eax
call fcn.00401cb0
add esp, 8
lea ecx, [ebp - 0xdc]
call fcn.00405100
push 0x40b2cc
lea ecx, [ebp - 0xdc]
call fcn.004052e0
lea ecx, [ebp - 0xdc]
call fcn.00405100
cmp dword [ebp - 0x4f0], 0
push 0
je 0x403380
push 5
jmp 0x403382
push 4
call fcn.00404400
add esp, 8
mov ecx, dword [ebp - 0x10]
push 0
push 0x40b3e4
push eax
call dword [ebp - 0x2e8]
lea eax, [ebp - 0x1e0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4033c4
push 5
lea eax, [ebp - 0x1e0]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x40d104], 6
jb 0x4034e6
cmp dword [0x40d104], 0x80000000
jae 0x4034e6
mov ax, word [0x40b180]
lea edi, [ebp - 0x6f2]
mov word [ebp - 0x6f4], ax
mov ecx, 0x81
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x40b180]
lea edi, [ebp - 0x4ea]
mov word [ebp - 0x4ec], ax
mov ecx, 0x81
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x40b180]
lea edi, [ebp - 0x8fa]
mov word [ebp - 0x8fc], ax
mov ecx, 0x81
xor eax, eax
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 0x20], eax
push ecx
call fcn.004053b0
add esp, 8
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
push eax
call fcn.00404aa0
add esp, 4
test eax, eax
je 0x4034dd
push 0
lea eax, [ebp - 0x6f4]
push 0x1a
push eax
push 0
call fcn.00404a40
add esp, 0x10
test eax, eax
je 0x4034dd
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x8fc]
push eax
mov edx, dword [ebp - 0x10]
push ecx
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x6f4]
push ecx
lea eax, [ebp - 0x4ec]
push edx
push eax
call dword [0x40f2b4]
add esp, 0xc
lea ecx, [ebp - 0x4ec]
push ecx
call dword [0x40f14c]
cmp eax, 0xffffffff
je 0x4034dd
push 5
lea eax, [ebp - 0x4ec]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0
call fcn.004034ff
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 4], 0xffffffff
call fcn.00403511
jmp 0x4030f6