Function at 0x415ee0
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov byte [ebp - 0x38], 0
lea eax, [ebp - 0x1c]
push eax
push 0x5abb24
push 0
push 0xf003f
push 0
push 0
push 0
push 0x53f0c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x415f3c
push 0x10007
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
push 1
lea eax, [ebp - 0x38]
push eax
push 3
push 0
push str.Start
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x415f80
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
push 0x53f0f8
lea eax, [ebp - 0x18]
push eax
call fcn.0041e930
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.0041e7b0
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.StaticVxD
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x415fe0
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
push 0x53f110
lea eax, [ebp - 0x18]
push eax
call fcn.0041e930
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.0041e7b0
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.Version
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x416040
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
push 2
call fcn.00415218
add esp, 4
cmp eax, 2
jne 0x41605f
mov dword [ebp - 0x20], 2
jmp 0x416066
mov dword [ebp - 0x20], 1
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push 0
push str.HWType
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x4160aa
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5abb28], eax
cmp dword [0x5abb28], 0
jne 0x4160db
push 1
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
push str.GetDateFormatA
mov eax, dword [0x5abb28]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5abb20], eax
cmp dword [0x5abb20], 0
jne 0x416112
push 2
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
push 0x14
lea eax, [ebp - 0x34]
push eax
push str.MMMM_d___yyyy
push 0
push 0
push 0x409
call dword [0x5abb20]
mov dword [ebp - 4], eax
mov eax, dword [0x5abb28]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x416164
push 0x2001000
call fcn.00406c68
add esp, 4
push 3
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
cmp dword [ebp - 4], 0
jne 0x416182
push 6
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041e930
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.0041e7b0
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.Date
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x4161e1
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
push 0x200
push 0x5ab920
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x53f160
push 0x5ab920
call fcn.0041e940
add esp, 8
push 0x5ab920
call fcn.0041e7b0
add esp, 4
inc eax
push eax
push 0x5ab920
push 1
push 0
push str.ImagePath
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x416255
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
mov eax, dword [0x5abb24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ab700], eax
cmp dword [0x5ab700], 0
je 0x41628a
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x416291
xor eax, eax
jmp 0x416291
pop edi
pop esi
pop ebx
leave
ret