Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Get common file path
Persist via run registry key
Set registry value

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push edi
push 0x407338
push 0x79
push 0
xor bl, bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov eax, dword [0x40800c]
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call ebp
push 0x407338
push 0x7e
push 0
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [0x40800c]
push eax
push ecx
call edi
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x12c
push 0x407ee0
mov dword [esp + 0x1c], eax
call edi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x407ee0
push str._scopyfstq.exe
push 0x408020
call esi
push 0x407324
push 0x408020
call fcn.00401b00
add esp, 0x14
mov dword [0x407ed8], eax
test eax, eax
je 0x4010de
mov edx, dword [esp + 0x10]
push eax
push 0x12000
push 1
push edx
call fcn.004019d6
add esp, 0x10
cmp eax, 0x12000
je 0x4010c8
push 0x408020
push 0x4072f8
push 0x407ee0
call esi
add esp, 0xc
mov bl, 1
mov eax, dword [0x407ed8]
push eax
call fcn.00401980
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 4
jmp 0x40110a
push 0x408020
push 0x4072f8
push 0x407ee0
call esi
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0xc
push 0
push 0x4072f0
push 0x407ee0
push 0
call ebp
mov bl, 1
push 0x12c
push 0x407ee0
call edi
push 0x407ee0
push str._sdropcpyr.dll
push 0x408020
call esi
add esp, 0xc
test bl, bl
jne 0x401462
push 0x407324
push 0x408020
call fcn.00401b00
add esp, 8
mov dword [0x407ed8], eax
test eax, eax
je 0x40143c
mov ecx, dword [esp + 0x14]
push eax
push 0x171ac
push 1
push ecx
call fcn.004019d6
add esp, 0x10
cmp eax, 0x171ac
je 0x401183
push 0x408020
push 0x4072f8
push 0x407ee0
call esi
add esp, 0xc
mov bl, 1
mov edx, dword [0x407ed8]
push edx
call fcn.00401980
add esp, 4
test bl, bl
jne 0x401462
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x407edc
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREClassesDirectory_shellexDragDropHandlersQCopy
push 0x80000002
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
mov eax, dword [0x407edc]
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
push 1
push 0
push 0
push eax
call edi
test eax, eax
je 0x4011ee
mov bl, 1
mov ecx, dword [0x407edc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x407edc
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREClassesFolder_shellexDragDropHandlersQCopy
push 0x80000002
call ebp
test eax, eax
je 0x401221
mov bl, 1
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
call esi
mov edx, dword [0x407edc]
inc eax
push eax
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
push 1
push 0
push 0
push edx
call edi
test eax, eax
je 0x401244
mov bl, 1
mov eax, dword [0x407edc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x407edc
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREClassesDrive_shellexDragDropHandlersQCopy
push 0x80000002
call ebp
test eax, eax
je 0x401276
mov bl, 1
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
call esi
mov ecx, dword [0x407edc]
inc eax
push eax
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
push 1
push 0
push 0
push ecx
call edi
test eax, eax
je 0x401299
mov bl, 1
mov edx, dword [0x407edc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x407edc
push 0
push 0xf003f
push 0
push 0
push 0
push str.CLSIDA4D78B20_6E05_1069_8758_4E73FD83DEAD
push 0x80000000
call ebp
test eax, eax
je 0x4012cc
mov bl, 1
push str.QCopy
call esi
inc eax
push eax
mov eax, dword [0x407edc]
push str.QCopy
push 1
push 0
push 0
push eax
call edi
test eax, eax
je 0x4012ee
mov bl, 1
mov ecx, dword [0x407edc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x407edc
push 0
push 0xf003f
push 0
push 0
push 0
push str.CLSIDA4D78B20_6E05_1069_8758_4E73FD83DEADInProcServer32
push 0x80000000
call ebp
test eax, eax
je 0x401321
mov bl, 1
push str.dropcpyr.dll
call esi
mov edx, dword [0x407edc]
inc eax
push eax
push str.dropcpyr.dll
push 1
push 0
push 0
push edx
call edi
test eax, eax
je 0x401344
mov bl, 1
push str.Apartment
call esi
inc eax
push eax
mov eax, dword [0x407edc]
push str.Apartment
push 1
push 0
push str.ThreadingModel
push eax
call edi
test eax, eax
je 0x401369
mov bl, 1
mov ecx, dword [0x407edc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x407edc
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
call ebp
test eax, eax
je 0x40139c
mov bl, 1
push str.QCopy
call esi
mov edx, dword [0x407edc]
inc eax
push eax
push str.QCopy
push 1
push 0
push str.A4D78B20_6E05_1069_8758_4E73FD83DEAD
push edx
call edi
test eax, eax
je 0x4013c2
mov bl, 1
mov eax, dword [0x407edc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebp
push 0x407edc
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.copyfstq.exe__startup
call esi
mov ecx, dword [0x407edc]
inc eax
push eax
push str.copyfstq.exe__startup
push 1
push 0
push str.Resume_copy
push ecx
call edi
test eax, eax
je 0x401412
mov bl, 1
mov edx, dword [0x407edc]
push edx
call ebp
cmp bl, 1
jne 0x401474
push 0
push 0x4072f0
push 0x4070a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0x408020
push 0x4072f8
push 0x407ee0
call esi
add esp, 0xc
push 0
push 0x4072f0
push 0x407ee0
push 0
call ebp
mov bl, 1
push 0
push 0x4072f0
push 0x407074
push 0
call ebp
jmp 0x401480
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test bl, bl
jne 0x4014b9
push 0x407068
push 0x408020
call esi
mov eax, dword [0x407d20]
add esp, 8
push 0x408020
push 0x3f5
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 0x40705c
push 0x407034
push 0
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret