Function at 0x4177e1
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov byte [ebp - 0x38], 0
lea eax, [ebp - 0x1c]
push eax
push 0x5c2804
push 0
push 0xf003f
push 0
push 0
push 0
push 0x550978
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x41783d
push 0x10007
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
push 1
lea eax, [ebp - 0x38]
push eax
push 3
push 0
push str.Start
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417881
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
push 0x5509b0
lea eax, [ebp - 0x18]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.00420150
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.StaticVxD
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x4178e1
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
push 0x5509c8
lea eax, [ebp - 0x18]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.00420150
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.Version
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417941
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
push 2
call fcn.00416af8
add esp, 4
cmp eax, 2
jne 0x417960
mov dword [ebp - 0x20], 2
jmp 0x417967
mov dword [ebp - 0x20], 1
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push 0
push str.HWType
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x4179ab
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5c2808], eax
cmp dword [0x5c2808], 0
jne 0x4179dc
push 1
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
push str.GetDateFormatA
mov eax, dword [0x5c2808]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5c2800], eax
cmp dword [0x5c2800], 0
jne 0x417a13
push 2
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
push 0x14
lea eax, [ebp - 0x34]
push eax
push str.MMMM_d___yyyy
push 0
push 0
push 0x409
call dword [0x5c2800]
mov dword [ebp - 4], eax
mov eax, dword [0x5c2808]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x417a65
push 0x2001000
call fcn.00406c68
add esp, 4
push 3
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
cmp dword [ebp - 4], 0
jne 0x417a83
push 6
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.00420150
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.Date
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417ae2
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
push 0x200
push 0x5c2600
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x550a18
push 0x5c2600
call fcn.004202e0
add esp, 8
push 0x5c2600
call fcn.00420150
add esp, 4
inc eax
push eax
push 0x5c2600
push 1
push 0
push str.ImagePath
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417b56
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
mov eax, dword [0x5c2804]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c23e0], eax
cmp dword [0x5c23e0], 0
je 0x417b8b
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x417b92
xor eax, eax
jmp 0x417b92
pop edi
pop esi
pop ebx
leave
ret