Function at 0x408c77
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
push esi
push edi
push 0x45435c
push 0x4230d0
call fcn.0041a850
add esp, 8
push 0x454380
push 0x4230d0
call fcn.0041a84c
add esp, 8
push 0x454388
push 0x422f70
call fcn.0041a850
add esp, 8
push 0x4543c8
push 0x422ec0
call fcn.0041a850
add esp, 8
push 0x4230bc
push 0x4230d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408d04
push 0x10007
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push 0x4543dc
push 0x422f50
call fcn.0041a850
add esp, 8
push 5
push 0x4543e4
push 1
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408d56
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push 0x4543ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x422f68], eax
cmp dword [0x422f68], 0
jne 0x408d87
push 1
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push 0x4543fc
mov eax, dword [0x422f68]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x422f4c], eax
cmp dword [0x422f4c], 0
jne 0x408dbe
push 2
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push 0x50
lea eax, [ebp - 0x58]
push eax
push 0x45440c
push 0
push 0
push 0x409
call dword [0x422f4c]
mov dword [ebp - 4], eax
mov eax, dword [0x422f68]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x408e10
push 0x2001000
call fcn.00405434
add esp, 4
push 3
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
cmp dword [ebp - 4], 0
jne 0x408e2e
push 6
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push 0x45441c
push 0x422f50
call fcn.0041a850
add esp, 8
lea eax, [ebp - 0x58]
push eax
call fcn.0041a7d8
add esp, 4
push eax
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408e8a
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push str.Type
push 0x422f50
call fcn.0041a850
add esp, 8
mov dword [0x42314c], 1
push 4
push 0x42314c
push 4
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408ee6
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push 0x45442c
push 0x422f50
call fcn.0041a850
add esp, 8
mov dword [0x42314c], 2
push 4
push 0x42314c
push 4
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408f42
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push 0x454434
push 0x422f50
call fcn.0041a850
add esp, 8
mov dword [0x42314c], 1
push 4
push 0x42314c
push 4
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408f9e
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push str.Group
push 0x422f50
call fcn.0041a850
add esp, 8
push 0x14
push 0x454440
push 1
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408ff0
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
push str.ErrorControl
push 0x422f50
call fcn.0041a850
add esp, 8
mov dword [0x42314c], 1
push 4
push 0x42314c
push 4
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40904c
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
cmp dword [ebp + 8], 0
je 0x409090
push 0x454464
push 0x423050
call fcn.0041a850
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x423050
call fcn.0041a84c
add esp, 8
push 0x454474
push 0x423050
call fcn.0041a84c
add esp, 8
jmp 0x4090d7
push str.DosDevices_
push 0x423050
call fcn.0041a850
add esp, 8
push 0x64
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xbc]
push eax
push 0x423050
call fcn.0041a84c
add esp, 8
push 0x454488
push 0x423050
call fcn.0041a84c
add esp, 8
push 0x454494
push 0x423050
call fcn.0041a84c
add esp, 8
push 0x45449c
push 0x423050
call fcn.0041a84c
add esp, 8
push 0x4544a4
push 0x422f50
call fcn.0041a850
add esp, 8
push 0x423050
call fcn.0041a7d8
add esp, 4
inc eax
push eax
push 0x423050
push 2
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40915a
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40918a
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409191
xor eax, eax
jmp 0x409191
pop edi
pop esi
pop ebx
leave
ret