Function at 0x401c20
Capabilities:
Create process on windows
Persist via run registry key
Read .ini file

Disassembly:
mov eax, 0x10c8
call fcn.00411120
sub rsp, rax
mov rax, qword [0x00417b90]
xor rax, rsp
mov qword [rsp + 0x10a0], rax
mov qword [rsp + 0x10e8], rbp
mov rbp, rcx
mov rcx, rdx
mov qword [rsp + 0x10c0], rsi
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x401c69
xor eax, eax
jmp 0x40241b
lea r9, [rsp + 0x630]
lea r8, [0x00412649]
lea rdx, str.StatusMonitor
lea rcx, str.LPRMonitor
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x401cb5
mov eax, 1
jmp 0x40241b
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
lea rcx, [rsp + 0x630]
mov byte [rsp + 0x140], 0
call fcn.00409ba0
test rax, rax
je 0x401cab
lea rcx, [rsp + 0x120]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
je 0x401cab
lea rcx, [rsp + 0x140]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401cab
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
je 0x401cab
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
je 0x401cab
lea rcx, [rsp + 0x160]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
je 0x401d9b
lea rcx, [rsp + 0x200]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x401da3
mov byte [rsp + 0x200], 0
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
je 0x401dce
lea rcx, [rsp + 0x180]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x401dd6
mov byte [rsp + 0x180], 0
movzx eax, word [0x00419714]
add eax, 0xffffffff
cmp eax, 7
ja case.0x401df8.6
lea rdx, [0x00400000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x2444]
add rcx, rdx
jmp rcx
lea rdx, str.Files9x
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x401e54
lea rdx, str.FilesNT
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x401e54
lea rdx, str.FilesXP
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x401e54
lea rdx, str.FilesX64
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.File_03d
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x10e0], rbx
xor r8d, r8d
mov qword [rsp + 0x10b8], rdi
xor edi, edi
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x300]
lea r8, [0x00412649]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401f74
nop
nop
nop
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
lea rcx, [rsp + 0x300]
call fcn.00409ba0
lea rcx, [rsp + 0x120]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x120]
movsxd r8, eax
mov rdx, rbx
call fcn.0040a420
test eax, eax
je 0x401f74
add edi, 1
lea rdx, str.File_03d
lea rcx, [rsp + 0x100]
mov r8d, edi
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x300]
lea r8, [0x00412649]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x401ed0
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rdi, qword [rsp + 0x10b8]
test eax, eax
jle 0x4022a6
lea r9, [rsp + 0x300]
lea r8, [0x00412649]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
lea rcx, [rsp + 0x300]
call fcn.00409ba0
test rax, rax
je 0x4022a6
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
mov rbx, rax
je 0x402108
lea rcx, [rsp + 0x520]
mov r9d, 1
mov r8, rax
mov edx, 0x104
call fcn.00407970
cmp byte [rbx], 0x5c
jne 0x402057
lea rdx, [rsp + 0xc80]
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x520]
lea rcx, [rsp + 0x850]
mov edx, 0x104
call fcn.00407790
jmp 0x40206d
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x50]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
mov rbx, rax
je 0x4020f1
lea rcx, [rsp + 0x520]
mov r9d, 1
mov r8, rax
mov edx, 0x104
call fcn.00407970
cmp byte [rbx], 0x5c
jne 0x4020d9
lea rdx, [0x00418c60]
lea rcx, [rsp + 0x740]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x520]
lea rcx, [rsp + 0x740]
mov edx, 0x104
call fcn.00407790
jmp 0x402133
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x740]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402133
lea rdx, [0x00418c60]
lea rcx, [rsp + 0x740]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402133
lea rdx, [rsp + 0xc80]
lea rcx, [rsp + 0x850]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x00418c60]
lea rcx, [rsp + 0x740]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rsp + 0x740]
lea rcx, [rsp + 0x410]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x120]
lea rcx, [rsp + 0x410]
mov edx, 0x104
call fcn.00407790
lea rcx, [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x402194
lea r8, [rsp + 0x410]
lea rdx, [0x00412730]
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x4021b9
lea r9, [rsp + 0x200]
lea r8, [rsp + 0x410]
lea rdx, str._s__s
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x160]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x60]
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov rcx, rbp
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x280]
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], rax
call fcn.00401ab0
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0xe90]
lea r9, [rsp + 0xa70]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd90]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x410]
mov r8d, 3
mov qword [rsp + 0x20], 0x100
call fcn.00409e40
lea r9, [rsp + 0xa70]
lea r8, [rsp + 0x58]
lea rdx, [0x004126ec]
lea rcx, [rsp + 0xb70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0xf90]
lea rcx, [rsp + 0x410]
xor edx, edx
call qword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jg 0x4022ad
xor eax, eax
jmp 0x402413
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x70]
call fcn.00409d50
lea rax, str.open
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x410]
mov dword [rsp + 0x70], 0x70
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xb70]
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0xa0], 5
mov dword [rsp + 0x74], 0x8040
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x180]
test eax, eax
cmovle rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], rcx
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0xd8]
mov edx, 0xffffffff
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x402366
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rsp + 0x630]
lea r8, [0x00412649]
lea rdx, str.StatusMonitor
lea rcx, str.LPRMonitor
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40240e
lea r9, [rsp + 0x960]
lea r8, [0x00412649]
lea rdx, str.UnInstLog
lea rcx, str.UnInstLog
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x960]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40240e
lea r9, [rsp + 0x960]
lea r8, [rsp + 0x630]
lea rdx, str.StatusMonitor
lea rcx, [0x004126d0]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, 1
mov rbx, qword [rsp + 0x10e0]
mov rsi, qword [rsp + 0x10c0]
mov rbp, qword [rsp + 0x10e8]
mov rcx, qword [rsp + 0x10a0]
xor rcx, rsp
call fcn.00409d20
add rsp, 0x10c8
ret