Function at 0x4180c5
Capabilities:
Check if file exists
Create process on windows
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423f7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x79c
push edi
mov dword [ebp - 0x7a8], ecx
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x744], 0
mov al, byte [0x439b08]
mov byte [ebp - 0x538], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x537]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439b0c]
mov byte [ebp - 0x430], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x42f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x439b10]
mov byte [ebp - 0x220], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x21f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x439b14]
mov byte [ebp - 0x324], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x323]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439b18]
mov byte [ebp - 0x110], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x439b1c]
mov byte [ebp - 0x740], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x73f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x439b20]
mov byte [ebp - 0x63c], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x63b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x114], 0
lea ecx, [ebp - 0x11c]
call fcn.0041d630
mov dword [ebp - 4], 0
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x434], 0
mov ecx, dword [ebp - 0x7a8]
call fcn.004164be
test eax, eax
je 0x418233
mov dword [ebp - 0x7a0], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.0041d651
mov eax, dword [ebp - 0x7a0]
jmp 0x418625
lea ecx, [ebp - 0x63c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x418268
push 0
push 0x435b70
call fcn.00410257
add esp, 8
jmp 0x4185f6
push 0x104
lea edx, [ebp - 0x740]
push edx
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x41829f
push 0
push str.CopyFileProcess_GetShortPathName_WindowsTempPath_Fail
call fcn.00410257
add esp, 8
push str.CopyFile.EXE
lea ecx, [ebp - 0x740]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x740]
push edx
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x740]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4183f1
mov dword [ebp - 0x79c], 0x103
mov dword [ebp - 0x798], 0x44
mov dword [ebp - 0x794], 0
mov dword [ebp - 0x790], 0
mov dword [ebp - 0x78c], 0
mov dword [ebp - 0x76c], 0
mov word [ebp - 0x766], 0
mov dword [ebp - 0x764], 0
push 0x10
push 0
lea edx, [ebp - 0x754]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x754]
push eax
lea ecx, [ebp - 0x798]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x740]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x4183f1
cmp dword [ebp - 0x79c], 0x103
jne 0x4183d7
lea eax, [ebp - 0x79c]
push eax
mov ecx, dword [ebp - 0x754]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x4183d5
push 0
push str.KANUpdate2::CopyFileProcess_GetExitCodeProcess_Fail_
call fcn.00410257
add esp, 8
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x750]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4185f6
jmp 0x418378
mov ecx, dword [ebp - 0x754]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x750]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x538]
push eax
call fcn.0040ea68
add esp, 8
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x418428
push 0
push str.CopyFileProcess_GetCurAppPath___Fail
call fcn.00410257
add esp, 8
jmp 0x4185f6
push 0x104
push 0
lea ecx, [ebp - 0x220]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x435c40
lea edx, [ebp - 0x538]
push edx
push str._s_s
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push str.KANUpdate2::CopyFileProcess_service_update
call fcn.00410257
add esp, 8
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
lea ecx, [ebp - 0x11c]
call fcn.0041d66d
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x4184a6
push 0
push str.KANUpdate2::CopyFileProcess_RegKey.Open_Error
call fcn.00410257
add esp, 8
jmp 0x4185f6
lea ecx, [ebp - 0x220]
push ecx
push str.KANSvr
lea ecx, [ebp - 0x11c]
call fcn.0041d752
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x4184db
push 0
push str.KANUpdate2::CopyFileProcess_RegKey.Write_KAN_REGISTER_SERVICE_KEY_Error
call fcn.00410257
add esp, 8
lea ecx, [ebp - 0x11c]
call fcn.0041d6c6
push 0
push str.KANUpdate2::CopyFileProcess_start_key_update
call fcn.00410257
add esp, 8
push 0x435d68
push 0x80000002
lea ecx, [ebp - 0x11c]
call fcn.0041d66d
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x41852d
push 0
push str.KANUpdate2::CopyFileProcess_RegKey.Open_KAN_REGISTER_AUTORUN_PATH_fail
call fcn.00410257
add esp, 8
jmp 0x4185f6
push str.KANCOPYFILE
lea ecx, [ebp - 0x11c]
call fcn.0041d9b9
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x41855b
push 0
push str.KANUpdate2::CopyFileProcess_RegKey.DeleteValue_KAN_REGISTER_AUTORUN_COPYFILE_KEY_fail
call fcn.00410257
add esp, 8
push 0x104
push 0
lea edx, [ebp - 0x220]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x435e44
lea eax, [ebp - 0x538]
push eax
push str.__s_s___s
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x220]
push edx
push 0x435e5c
lea ecx, [ebp - 0x11c]
call fcn.0041d752
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x4185c7
push 0
push str.KANUpdate2::CopyFileProcess_RegKey.Write_KAN_REGISTER_AUTORUN_KANGUI_KEY_fail
call fcn.00410257
add esp, 8
call fcn.00419bee
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x4185ec
push 0
push str.KANUpdate2::CopyFileProcess_StartKANService_fail
call fcn.00410257
add esp, 8
jmp 0x4185f6
mov dword [ebp - 0x744], 1
lea ecx, [ebp - 0x11c]
call fcn.0041d6c6
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x7a4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.0041d651
mov eax, dword [ebp - 0x7a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret