Function at 0x406690
Capabilities:
Copy file
Create service
Disable system features via registry on windows
Get common file path
Persist via windows service
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x130
lea ecx, [esp + 8]
push ebx
push ebp
push esi
push edi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov ebx, dword [esp + 0x14c]
lea eax, [esp + 0x10]
push ebx
push str.System32Drivers_s.sys
push eax
call sub.MFC42.DLL_CString::Format
push ebx
push 0
call sym.BDSetup.exe_ControlSecSCDriver
mov esi, dword [esp + 0x164]
add esp, 0x14
test esi, esi
je 0x406736
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x406736
lea ecx, [esp + 0x3c]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x406ad7
lea edx, [esp + 0x3c]
push ebx
push edx
lea eax, [esp + 0x1c]
push str._sDrivers_s.sys
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x24]
add esp, 0x10
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x406ad7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x406ad7
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x144]
mov ecx, dword [esp + 0x148]
push 0
push 0
push 0
push 0
push 0
push edx
push 1
push eax
push ecx
push 0xf01ff
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
je 0x406793
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
push esi
call edi
jmp 0x406b1c
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.SYSTEMCurrentControlSetServices_
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
push ebx
lea ecx, [esp + 0x20]
call fcn.0040c9dc
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push 0xf003f
push 0
push 0x4277e4
push 0
push 0
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::GetBuffer
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push 0x80000002
call ebp
test eax, eax
jne 0x406ace
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
dec ecx
push ecx
mov ecx, dword [esp + 0x24]
push ebx
push 1
push eax
push str.DisplayName
push ecx
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
inc eax
push eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esp + 0x28]
push 2
push 0
push str.ImagePath
push eax
call esi
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push 4
push ecx
push 4
push 0
push str.ErrorControl
push edx
mov dword [esp + 0x40], 1
call esi
test eax, eax
jne 0x406ace
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x144]
lea ecx, [esp + 0x28]
push 4
push ecx
push 4
push 0
push str.Start
push edx
mov dword [esp + 0x40], eax
call esi
test eax, eax
jne 0x406ace
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x148]
lea ecx, [esp + 0x28]
push 4
push ecx
push 4
push 0
push str.Type
push edx
mov dword [esp + 0x40], eax
call esi
test eax, eax
jne 0x406ace
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetServicesEventLogSystem
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x30]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0x4277e4
push 0
push 0
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x80000002
call ebp
test eax, eax
jne 0x406ace
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x38]
push eax
push 0
push ecx
push 0
push str.Sources
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406ace
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x24]
not ecx
dec ecx
mov dword [esp + 0x34], ecx
lea eax, [eax + ecx + 1]
push eax
mov dword [esp + 0x28], eax
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0x24]
mov ebp, eax
mov eax, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x3c]
push ebp
push edx
push 0
push str.Sources
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406ace
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push ebp
call fcn.00406b50
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4069e4
or ecx, eax
mov edi, ebx
xor eax, eax
mov edx, dword [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [edx + ebp - 1]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x34]
add eax, esi
mov dword [esp + 0x24], eax
mov byte [eax + ebp], 0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push ebp
push 7
push 0
push str.Sources
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x406ace
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
lea eax, [esp + 0x20]
push str.SYSTEMCurrentControlSetServicesEventLogSystem_s
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x30]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0x4277e4
push 0
push 0
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x406ace
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push 4
push eax
push 4
push 0
push str.TypesSupported
push ecx
mov dword [esp + 0x40], 7
call esi
test eax, eax
jne 0x406ace
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString_2
push 0x105
push 0x105
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push str._SystemRoot__system32
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jbe 0x406ac5
mov eax, dword [esp + 0x2c]
push ebx
push eax
push eax
lea edx, [esp + 0x24]
push str._sIoLogMsg.dll__sDrivers_s.sys
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x18]
push 0
call sub.MFC42.DLL_CString::GetBuffer
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 2
push eax
mov eax, dword [esp + 0x30]
push str.EventMessageFile
push eax
call esi
test eax, eax
je 0x406aff
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x130
ret
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x130
ret