Function at 0x409cc4
Capabilities:
Copy file
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x409ccc
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40a0cb
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
call sub.kernel32.dll_GetVersion_1
mov ebx, eax
and ebx, 0xff
cmp ebx, 4
jbe 0x40a098
mov eax, 0x40a0e4
call fcn.00409b9c
mov eax, 0x40a0fc
call fcn.00409b9c
mov eax, 0x40a114
call fcn.00409b9c
push 0x104
lea eax, [ebp - 0x128]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403980
push dword [ebp - 0x12c]
push 0x40a128
push 0x40a13c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403a6c
cmp dword [ebp - 4], 1
jne 0x409d8a
lea eax, [ebp - 0x130]
call fcn.00408f50
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0xc]
mov ecx, 0x40a150
call fcn.004039f8
jmp 0x409da8
lea eax, [ebp - 0x134]
call fcn.00408f50
mov edx, dword [ebp - 0x134]
lea eax, [ebp - 0xc]
mov ecx, 0x40a168
call fcn.004039f8
mov eax, dword [ebp - 0xc]
call fcn.00408f10
test al, al
jne 0x409e41
test edi, 0x10
jne 0x40a098
lea edx, [ebp - 0x138]
mov eax, 0x409a88
call fcn.00404690
push dword [ebp - 0x138]
push 0x40a180
push dword [ebp - 0xc]
push 0x40a180
lea edx, [ebp - 0x13c]
mov eax, 0x409aa8
call fcn.00404690
push dword [ebp - 0x13c]
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00403a6c
push 0x10
lea edx, [ebp - 0x140]
mov eax, 0x409a90
call fcn.00404690
mov eax, dword [ebp - 0x140]
call fcn.00403bac
push eax
mov eax, dword [ebp - 0x24]
call fcn.00403bac
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x40a098
push 0
mov eax, dword [ebp - 8]
call fcn.00403bac
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403bac
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x409ee9
test edi, 0x10
jne 0x40a098
lea edx, [ebp - 0x144]
mov eax, 0x409a98
call fcn.00404690
push dword [ebp - 0x144]
push dword [ebp - 0xc]
lea edx, [ebp - 0x148]
mov eax, 0x409aa0
call fcn.00404690
push dword [ebp - 0x148]
push 0x40a180
push dword [ebp - 8]
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00403a6c
push 0x10
lea edx, [ebp - 0x14c]
mov eax, 0x409a90
call fcn.00404690
mov eax, dword [ebp - 0x14c]
call fcn.00403bac
push eax
mov eax, dword [ebp - 0x24]
call fcn.00403bac
push eax
call sub.user32.dll_GetFocus
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x40a098
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0x40a184
push 0
push 0x40a188
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x40a098
mov dword [ebp - 0x18], 1
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x40a1b4
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x40a1bc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp ebx, 4
jbe 0x40a098
mov dword [ebp - 0x18], 3
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x40a1cc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
lea eax, [ebp - 0x10]
mov edx, 0x40a1dc
call fcn.004037c4
mov eax, dword [ebp - 0x10]
call fcn.004039ac
inc eax
push eax
lea eax, [ebp - 0x10]
call fcn.00403c04
push eax
push 1
push 0
push 0x40a1ec
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
lea eax, [ebp - 0x10]
mov edx, 0x40a1fc
call fcn.004037c4
mov eax, dword [ebp - 0x10]
call fcn.004039ac
inc eax
push eax
lea eax, [ebp - 0x10]
call fcn.00403c04
push eax
push 1
push 0
push 0x40a204
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x14]
push eax
push 0x40a210
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x40a098
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x40a260
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40a08f
lea eax, [ebp - 0x128]
mov ecx, 0x40a278
mov edx, dword [ebp - 0x20]
call fcn.00409ab0
test eax, eax
jne 0x40a08f
mov edx, 0x40a280
mov eax, dword [ebp - 0x20]
lea eax, [ebp + eax - 0x129]
call fcn.00408f34
mov eax, 0x40a280
call fcn.00408c80
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x128], 0
mov eax, dword [ebp - 0x20]
inc eax
push eax
lea eax, [ebp - 0x128]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0x40a260
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov esi, 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a0d2
lea eax, [ebp - 0x14c]
mov edx, 9
call fcn.00403750
lea eax, [ebp - 0x24]
call fcn.0040372c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403750
ret