Function at 0x40ced7
Capabilities:
Copy file
Delete registry value
Get common file path
Persist via app paths registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1490
call fcn.00412030
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0x208
mov word [ebp - 0x218], ax
xor esi, esi
lea eax, [ebp - 0x216]
mov dword [ebp - 0x1490], ecx
push esi
push eax
mov edi, edx
call sub.msvcrt.dll_memset
add esp, 0xc
test edi, edi
je 0x40d161
xor eax, eax
cmp ax, word [edi]
je 0x40d161
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40d161
sub esp, 0xc
lea ecx, [ebp - 0x218]
mov edx, 0x105
push 0x401338
call fcn.0040c8f2
lea eax, [ebp - 0x218]
push eax
push 0x40380c
push 0x900
push esi
push esi
lea eax, [ebp - 0x848]
push 0x105
push eax
call fcn.00410f98
add esp, 0x1c
lea eax, [ebp - 0x218]
push eax
push 0x403828
push 0x900
push esi
push esi
lea eax, [ebp - 0xa58]
push 0x105
push eax
call fcn.00410f98
add esp, 0x1c
lea ecx, [ebp - 0x848]
call fcn.00410767
test eax, eax
jne 0x40d005
push ebx
push 0x40380c
push 0x900
push esi
push esi
lea eax, [ebp - 0x848]
push 0x105
push eax
call fcn.00410f98
add esp, 0x1c
lea eax, [ebp - 0xa58]
push ebx
push 0x403828
push 0x900
push esi
push esi
mov ebx, 0x105
push ebx
push eax
call fcn.00410f98
add esp, 0x1c
jmp 0x40d00a
mov ebx, 0x105
push esi
lea eax, [ebp - 0xa58]
push eax
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40d15d
push edi
lea ecx, [ebp - 0x1488]
call fcn.0040eb66
lea eax, [ebp - 0x1274]
mov edi, 0x900
push eax
lea eax, [ebp - 0x127e]
push eax
push 0x401f98
push edi
push esi
push esi
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.00410f98
add esp, 0x20
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40d07c
inc eax
jmp 0x40d163
push edi
push ecx
push ecx
push 0x4010e8
mov edx, ebx
lea ecx, [ebp - 0xc68]
call fcn.004064d3
lea eax, [ebp - 0x148c]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0xc68]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d15d
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, 0x403848
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x428]
push eax
push 1
push esi
push edi
push dword [ebp - 0x148c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40d151
push 0x208
mov word [ebp - 0x638], ax
lea eax, [ebp - 0x636]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x638]
push 0x104
push eax
push 0xd2
push dword [ebp - 0x1490]
call dword [sym.imp.USER32.dll_LoadStringW]
push 1
lea eax, [ebp - 0x638]
xor ecx, ecx
push eax
push 0x403858
lea edx, [ebp - 0xa58]
call fcn.00410068
push edi
push dword [ebp - 0x148c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor esi, esi
inc esi
push dword [ebp - 0x148c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40d163
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 4