Function at 0x409700
Capabilities:
Create process on windows
Get common file path
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0xa
mov dword [ebp - 0x14], 0xa
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
push 0x65
mov eax, dword [0x411100]
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
and ecx, 0x1000000
test ecx, ecx
je 0x409836
push 0x7f00
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f01
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f02
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f03
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f04
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f80
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f81
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f82
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f83
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f84
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f85
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f86
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f88
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f89
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f8a
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetSystemCursor]
push 0x7f8b
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_SetSystemCursor]
jmp 0x409844
push 0
push 0
push 0
push 0x57
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp + 8]
and eax, 0x2000000
test eax, eax
je 0x409871
cmp dword [0x4103e4], 0
je 0x40986f
push 0
push 1
push 0x617
mov ecx, dword [0x4103e4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x409890
cmp dword [0x4103e4], 0
je 0x409890
push 0
push 0
push 0x617
mov edx, dword [0x4103e4]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp + 8]
and eax, 0x4000000
test eax, eax
je 0x4098d0
push 0x104
push 0x4103ec
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Event.exe
push 0x4103ec
call fcn.00409db0
add esp, 8
push 1
push 0x4103ec
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4099b8
cmp dword [0x4103e8], 0
je 0x4099b8
push 0
push 0
push 2
mov ecx, dword [0x4103e8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x10]
push edx
push 0x20006
push 0
push str.SoftwareFujitsu_ComponentFIDTPUV1.9Parameters
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409959
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0x40fea8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
push 0x40feb0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4099b8
lea ecx, [ebp - 0x10]
push ecx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesFIDTPUParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4099b8
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.WinPosX
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.WinPosTop
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret