Function at 0x407bbb
Capabilities:
Create thread
Delete registry value
Persist via run registry key
Read .ini file
Set registry value

Disassembly:
mov eax, 0x30008
call fcn.00422eb0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x30004], eax
push ebx
push esi
push edi
sub ecx, 0x47d
je 0x407e85
sub ecx, 1
je 0x407e75
sub ecx, 1
je 0x407e65
sub ecx, 1
je 0x407e55
sub ecx, 1
je 0x407e1a
sub ecx, 1
jne 0x407e9b
xor eax, eax
mov esi, 0xfffc
push esi
mov word [esp + 0x20014], ax
xor ebx, ebx
lea eax, [esp + 0x20016]
push ebx
push eax
call fcn.00412740
push 0xfffa
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x22
push ebx
push eax
call fcn.00412740
xor eax, eax
push esi
mov word [esp + 0x1002c], ax
lea eax, [esp + 0x1002e]
push ebx
push eax
call fcn.00412740
add esp, 0x24
lea eax, [esp + 0x20010]
cmp dword [0x4bff08], ebx
jne 0x407caf
mov edi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x42a51c
push eax
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x10]
push 0x4aff08
push eax
call esi
push str.FFEncryptor.exe___x
lea eax, [esp + 0x14]
push eax
call esi
push 0x48fef0
lea eax, [esp + 0x10014]
push eax
call edi
jmp 0x407d13
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.ExtraDrivePro
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x10]
push 0x4aff08
push eax
call edi
push 0x5c
push ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
lea ecx, [esp + 0x10]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0xfffe
jae 0x407eb6
xor ecx, ecx
mov word [esp + eax + 0x10], cx
lea eax, [esp + 0x10]
push str.xdrvExtraDrivePro.exe___x
push eax
call edi
push 0x49ff08
lea eax, [esp + 0x10014]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [esp + 0x10010]
push ebp
push eax
push ebx
mov edi, str.StartUp_FD
mov ebp, str.OPTIONS
push edi
push ebp
call esi
test eax, eax
lea eax, [esp + 0x10014]
push eax
je 0x407d81
push 0x42a3c4
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407de8
lea eax, [esp + 0x20014]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x407dde
push 0x42a0d8
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407de8
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [esp + 0x18]
push eax
push 1
push ebx
lea eax, [esp + 0x20024]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [esp + 0x10018]
push eax
push ebx
push edi
push ebp
call esi
push eax
push 0xf1
push 0x482
push dword [0x49fefc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
jmp 0x407e9b
cmp dword [0x42e8dc], 1
push 0
jne 0x407e43
push 0x410e0a
push dword [0x49fefc]
push str.NAGSCREEN
push dword [0x49fef8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x407e9b
push 0x4085af
push dword [0x49fefc]
push str.IDD_NEWDRIVE
jmp 0x407e35
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x408d65
jmp 0x407e93
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x409059
jmp 0x407e93
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x409389
jmp 0x407e93
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x409574
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x30010]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
inc eax
call fcn.00411b03
add esp, 0x30008
ret
call fcn.00411c33
int3