Function at 0x4014d0
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push 0x12c
push 0x407ee0
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
call esi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 0x407ee0
push str._scopyfstq.exe
push 0x408020
call ebx
push 0x408020
call fcn.00401b13
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
push eax
call edi
test eax, eax
jne 0x401526
mov byte [esp + 0xf], 1
push 0x12c
push 0x407ee0
call esi
push 0x407ee0
push str._sdropcpyr.dll
push 0x408020
call ebx
push 0x408020
call fcn.00401b13
add esp, 0x10
push eax
call edi
test eax, eax
jne 0x40155c
mov byte [esp + 0xf], 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push 0x407edc
push 0xf003f
push 0
push str.SOFTWAREClassesDirectory_shellexDragDropHandlers
push 0x80000002
call esi
mov eax, dword [0x407edc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.QCopy
push eax
call ebp
mov ecx, dword [0x407edc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ebx, eax
call edi
test ebx, ebx
je 0x4015a8
mov byte [esp + 0x12], 1
push 0x407edc
push 0xf003f
push 0
push str.SOFTWAREClassesFolder_shellexDragDropHandlers
push 0x80000002
call esi
mov edx, dword [0x407edc]
push str.QCopy
push edx
call ebp
mov ebx, eax
mov eax, dword [0x407edc]
push eax
call edi
test ebx, ebx
je 0x4015e1
mov byte [esp + 0x12], 1
push 0x407edc
push 0xf003f
push 0
push str.SOFTWAREClassesDrive_shellexDragDropHandlers
push 0x80000002
call esi
mov ecx, dword [0x407edc]
push str.QCopy
push ecx
call ebp
mov edx, dword [0x407edc]
mov ebx, eax
push edx
call edi
test ebx, ebx
je 0x40161b
mov byte [esp + 0x12], 1
push 0x407edc
push 0xf003f
push 0
push 0x4073f4
push 0x80000000
call esi
mov eax, dword [0x407edc]
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
push eax
call ebp
mov ecx, dword [0x407edc]
mov ebx, eax
push ecx
call edi
test ebx, ebx
je 0x401654
mov byte [esp + 0x12], 1
push 0x407edc
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
call esi
mov edx, dword [0x407edc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
push edx
call ebp
mov ebx, eax
mov eax, dword [0x407edc]
push eax
call edi
test ebx, ebx
mov bl, 1
jne 0x401694
mov bl, byte [esp + 0x12]
push 0x407edc
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
mov ecx, dword [0x407edc]
push str.Resume_copy
push ecx
call ebp
mov edx, dword [0x407edc]
mov esi, eax
push edx
call edi
test esi, esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
je 0x4016db
mov byte [esp + 0xe], 1
mov bl, byte [esp + 0xe]
jmp 0x4016e0
cmp bl, 1
jne 0x4016f0
push 0
push 0x4073e0
push 0x4073a4
push 0
call esi
cmp byte [esp + 0xf], 1
jne 0x401707
push 0
push 0x4073e0
push 0x407364
push 0
call esi
test bl, bl
jne 0x401744
push 0x40735c
push 0x408020
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x407d20]
add esp, 8
push 0x408020
push 0x3f5
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 0x40705c
push 0x40733c
push 0
call esi
pop edi
pop esi
pop ebx
pop ecx
ret