Function at 0x407aee
Capabilities:
Copy file
Persist via run registry key
Read .ini file
Set file attributes
Set registry value

Disassembly:
mov eax, 0x41c534
call fcn.00412df4
mov eax, 0x1538
call fcn.00412fd0
push ebx
push esi
push edi
call fcn.00401046
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00407509
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
jne 0x407d3f
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x543]
mov byte [ebp - 0x544], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x4218a4
push edi
push dword [ebp + 8]
call fcn.004139e6
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
je 0x407bb2
lea eax, [ebp - 0x544]
push 0x4253a0
push eax
call fcn.004127d0
pop ecx
pop ecx
push dword [ebp + 8]
test eax, eax
jne 0x407b96
lea eax, [ebp - 0x544]
push 0x421170
push eax
call esi
add esp, 0xc
jmp 0x407bae
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x544]
push str._s_s
push eax
call esi
add esp, 0x10
push edi
push ebx
jmp 0x407b5b
cmp dword [ebp + 0xc], ebx
je 0x407bc9
lea eax, [ebp - 0x544]
push str._AFTERREBOOT1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x943]
mov byte [ebp - 0x944], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 0x1420]
dec eax
je 0x407c36
dec eax
je 0x407c28
dec eax
je 0x407c0e
dec eax
je 0x407c07
dec eax
je 0x407c00
push 0x4253a0
jmp 0x407c3b
push 0x421890
jmp 0x407c3b
push 0x42188c
jmp 0x407c3b
lea eax, [edi + 0x1424]
push eax
push str._j_s
lea eax, [ebp - 0x944]
push eax
call esi
add esp, 0xc
jmp 0x407c46
lea eax, [edi + 0x1424]
push eax
push str._f_s
jmp 0x407c1a
push 0x421468
lea eax, [ebp - 0x944]
push eax
call esi
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x144]
push ebx
push eax
call fcn.00412770
add esp, 0xc
mov ecx, edi
call fcn.0040bbc3
test eax, eax
je 0x407c78
lea eax, [ebp - 0x144]
push 0x421878
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x1143]
mov byte [ebp - 0x1144], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1144]
push 0x400
push eax
push dword [0x427054]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 0x10]
call fcn.0040bbc3
mov ecx, dword [ebp - 0x10]
test eax, eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x544]
push eax
push 0x4253a4
je 0x407ceb
call fcn.0040b533
push eax
lea eax, [ebp - 0x944]
push dword [0x42679c]
push eax
lea eax, [ebp - 0x1144]
push eax
push str.__s___k__s__l_d__t__s___e__s___w__v__s___s
jmp 0x407d0a
call fcn.0040b533
push eax
lea eax, [ebp - 0x944]
push dword [0x42679c]
push eax
lea eax, [ebp - 0x1144]
push eax
push str.__s___s__l_d__t__s___e__s___v__s___s
lea eax, [ebp - 0x1544]
push eax
call esi
mov edi, dword [str.Setup]
add esp, 0x24
lea eax, [ebp - 0x1544]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1544]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xd43]
mov byte [ebp - 0xd44], bl
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040bbc3
test eax, eax
jne 0x407e92
lea ecx, [ebp - 0x2c]
call fcn.004013aa
push dword [0x421c28]
lea eax, [ebp - 0xd44]
mov byte [ebp - 4], 1
push 0x4253a4
push eax
call fcn.0040dae4
lea eax, [ebp - 0xd44]
push ebx
push eax
push 0x426180
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0xd44]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0xd44]
lea ecx, [ebp - 0x2c]
push eax
call fcn.00401505
xor eax, eax
lea edi, [ebp - 0x3f]
mov byte [ebp - 0x40], bl
push dword [0x42679c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x40]
push str._04x
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x1144]
push eax
lea eax, [ebp - 0x944]
push eax
push 0x426180
call fcn.0040d935
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x1144]
push eax
call fcn.0040dae4
lea eax, [ebp - 0x1144]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x543]
mov byte [ebp - 0x544], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x544]
push 0x4253a4
push eax
call fcn.0040dae4
lea eax, [ebp - 0x544]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x544]
push ebx
push eax
lea eax, [ebp - 0x1144]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x544]
lea ecx, [ebp - 0x2c]
push eax
call fcn.00401505
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.004013d7
jmp 0x407ea4
lea eax, [ebp - 0xd44]
push 0x426180
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xd44]
push eax
push ebx
push dword [0x41d5a0]
push dword [0x41d5b0]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, dword [ebp - 0x10]
cmp dword [edi + 0x2064], ebx
jne 0x407ede
cmp eax, 1
je 0x407ede
cmp eax, 2
jne 0x407f0b
push 4
lea eax, [ebp - 0x20]
push 0x421820
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xd44]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [0x41d5a0]
push dword [0x41d5b0]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0xd44]
lea eax, [edi + 0x810]
push ecx
push ebx
push dword [0x41d5a0]
mov dword [ebp + 8], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [edi + 0x1c60], ebx
jne 0x407f3b
cmp eax, 1
je 0x407f3b
cmp eax, 2
jne 0x407f65
push 4
lea eax, [ebp - 0x20]
push 0x421820
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xd44]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [0x41d5a0]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x427050], ebx
je 0x407f74
call fcn.0040df0a
jmp 0x407f7f
push 0x453
call fcn.0040d466
pop ecx
cmp dword [ebp - 0x14], ebx
pop edi
pop esi
pop ebx
je 0x407f90
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8