Function at 0x5172c4
Capabilities:
Copy file
Get disk information
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x68
push 0
push 0
dec ecx
jne 0x5172cc
push ecx
push ebx
push esi
push edi
mov esi, 0x52b338
xor eax, eax
push ebp
push 0x5179a8
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x5172f4
xor eax, eax
push ebp
push 0x51796e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
jne 0x517350
mov ebx, 0x44
lea eax, [ebp - 0x2ec]
mov edx, ebx
call fcn.00408bb0
lea eax, [ebp - 0x2ec]
mov edx, 0x5179c4
call fcn.00408d84
mov eax, dword [ebp - 0x2ec]
call fcn.00408b98
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x51734a
mov eax, esi
mov edx, ebx
call fcn.00408bb0
jmp 0x517350
inc ebx
cmp ebx, 0x5b
jne 0x51730c
cmp dword [esi], 0
jne 0x517361
mov eax, esi
mov edx, 0x5179d8
call fcn.004083cc
mov edx, dword [0x52b340]
mov eax, 0x5179e8
call fcn.004090f8
test eax, eax
jne 0x517493
lea ecx, [ebp - 0x2f0]
xor edx, edx
mov eax, 0x517a08
call fcn.00516c14
mov edx, dword [ebp - 0x2f0]
mov eax, 0x52b340
call fcn.004083cc
mov edx, dword [0x52b340]
mov eax, 0x5179e8
call fcn.004090f8
test eax, eax
je 0x517493
lea eax, [ebp - 0x2f4]
push eax
mov ecx, 0x517a50
mov edx, 0x517a6c
mov eax, dword [0x52b340]
call fcn.00517200
mov edx, dword [ebp - 0x2f4]
mov eax, 0x52b33c
call fcn.004083cc
lea eax, [ebp - 0x2f8]
mov ecx, 0x517a8c
mov edx, dword [esi]
call fcn.00408ddc
mov edx, dword [ebp - 0x2f8]
xor ecx, ecx
lea eax, [ebp - 0x2e8]
call fcn.00404dec
call fcn.004046a8
lea eax, [ebp - 0x2e8]
call fcn.00404aac
call fcn.004046a8
mov edx, dword [0x52b33c]
mov eax, 0x517ae0
call fcn.004090f8
test eax, eax
je 0x517469
push 0x517af8
push dword [0x52b33c]
push 0x517bd0
lea eax, [ebp - 0x2fc]
mov edx, 3
call fcn.00408e64
mov edx, dword [ebp - 0x2fc]
lea eax, [ebp - 0x2e8]
call fcn.00405f28
call fcn.00406028
call fcn.004046a8
jmp 0x517483
mov edx, 0x517c80
lea eax, [ebp - 0x2e8]
call fcn.00405f28
call fcn.00406028
call fcn.004046a8
lea eax, [ebp - 0x2e8]
call fcn.00404eec
call fcn.004046a8
mov edx, dword [0x52b348]
mov eax, 0x5179e8
call fcn.004090f8
test eax, eax
jne 0x5175ed
lea ecx, [ebp - 0x300]
xor edx, edx
mov eax, 0x517a08
call fcn.00516c14
mov edx, dword [ebp - 0x300]
mov eax, 0x52b348
call fcn.004083cc
mov edx, dword [0x52b348]
mov eax, 0x5179e8
call fcn.004090f8
test eax, eax
je 0x5175ed
lea eax, [ebp - 0x304]
push eax
mov ecx, 0x517e28
mov edx, 0x517e48
mov eax, dword [0x52b348]
call fcn.00517200
mov edx, dword [ebp - 0x304]
mov eax, 0x52b344
call fcn.004083cc
mov eax, dword [0x52b344]
mov edx, 0x517e6c
call fcn.00408f14
jne 0x517582
lea eax, [ebp - 0x308]
mov ecx, 0x517e80
mov edx, dword [esi]
call fcn.00408ddc
mov edx, dword [ebp - 0x308]
xor ecx, ecx
lea eax, [ebp - 0x2e8]
call fcn.00404dec
call fcn.004046a8
lea eax, [ebp - 0x2e8]
call fcn.00404aac
call fcn.004046a8
xor edx, edx
lea eax, [ebp - 0x2e8]
call fcn.00405f28
call fcn.00406028
call fcn.004046a8
lea eax, [ebp - 0x2e8]
call fcn.00404eec
call fcn.004046a8
mov edx, dword [0x52b344]
mov eax, 0x517ae0
call fcn.004090f8
test eax, eax
je 0x5175ed
movzx eax, byte [0x517eb8]
push eax
lea eax, [ebp - 0x30c]
push eax
mov ecx, 0x517ec8
mov edx, 0x517ed8
mov eax, dword [0x52b344]
call fcn.00426840
mov edx, dword [ebp - 0x30c]
mov eax, 0x52b344
call fcn.004083cc
lea eax, [ebp - 0x310]
mov ecx, 0x517e80
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x310]
push eax
mov eax, dword [0x52b344]
push eax
call fcn.00516dd0
lea eax, [ebp - 0x314]
mov ecx, 0x517ef0
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x314]
mov dl, 1
call fcn.00420430
test al, al
jne 0x517705
mov edx, dword [0x52b350]
mov eax, 0x5179e8
call fcn.004090f8
test eax, eax
jne 0x517723
lea ecx, [ebp - 0x318]
xor edx, edx
mov eax, 0x517f38
call fcn.00516c14
mov edx, dword [ebp - 0x318]
mov eax, 0x52b350
call fcn.004083cc
mov edx, dword [0x52b350]
mov eax, 0x5179e8
call fcn.004090f8
test eax, eax
je 0x517723
lea eax, [ebp - 0x31c]
push eax
mov ecx, 0x517f8c
mov edx, 0x517fa8
mov eax, dword [0x52b350]
call fcn.00517200
mov edx, dword [ebp - 0x31c]
mov eax, 0x52b34c
call fcn.004083cc
mov edx, dword [0x52b34c]
mov eax, 0x517ae0
call fcn.004090f8
test eax, eax
je 0x517723
movzx eax, byte [0x517eb8]
push eax
lea eax, [ebp - 0x320]
push eax
mov ecx, 0x517ec8
mov edx, 0x517ed8
mov eax, dword [0x52b34c]
call fcn.00426840
mov edx, dword [ebp - 0x320]
mov eax, 0x52b34c
call fcn.004083cc
lea eax, [ebp - 0x324]
mov ecx, 0x517ef0
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x324]
push eax
mov eax, dword [0x52b34c]
push eax
call fcn.00516dd0
push 0x64
call sub.kernel32.dll_Sleep_2
jmp 0x517723
lea eax, [ebp - 0x328]
mov ecx, 0x517ef0
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x328]
push eax
call fcn.00516f60
mov edx, dword [0x52b344]
mov eax, 0x517ae0
call fcn.004090f8
test eax, eax
je 0x517843
lea eax, [ebp - 0x32c]
mov ecx, 0x517e80
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x32c]
mov dl, 1
call fcn.00420430
test al, al
je 0x517843
mov dl, 1
mov eax, 0x517fc4
call fcn.00420430
test al, al
je 0x517819
xor ecx, ecx
mov edx, 0x517fc4
lea eax, [ebp - 0x2e8]
call fcn.00404dec
call fcn.004046a8
lea eax, [ebp - 0x2e8]
call fcn.00404aa0
call fcn.004046a8
lea edx, [ebp - 4]
lea eax, [ebp - 0x2e8]
call fcn.004058e8
lea eax, [ebp - 0x2e8]
call fcn.004059f4
call fcn.004046a8
lea eax, [ebp - 0x2e8]
call fcn.00404eec
call fcn.004046a8
mov edx, dword [ebp - 4]
mov eax, 0x51801c
call fcn.004090f8
test eax, eax
je 0x5177ed
mov edx, dword [ebp - 4]
mov eax, 0x518074
call fcn.004090f8
test eax, eax
je 0x517843
push 0
push 0x518078
lea eax, [ebp - 0x330]
mov ecx, 0x517e80
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x330]
call fcn.00408b98
push eax
call sub.kernel32.dll_CopyFileW
jmp 0x517843
push 0
push 0x518078
lea eax, [ebp - 0x334]
mov ecx, 0x517e80
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x334]
call fcn.00408b98
push eax
call sub.kernel32.dll_CopyFileW
cmp dword [0x52b334], 5
je 0x517942
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0x5180c4
push 0
push 0x5180d0
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
push 0x2a
push 0x518124
push 1
push 0
push 0x518150
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dl, 1
mov eax, 0x518174
call fcn.00420430
test al, al
jne 0x5178ed
lea eax, [ebp - 0x338]
mov ecx, 0x5181f4
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x338]
mov dl, 1
call fcn.00420430
test al, al
je 0x5178ed
push 0xffffffffffffffff
push 0x51822c
lea eax, [ebp - 0x33c]
mov ecx, 0x5181f4
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x33c]
call fcn.00408b98
push eax
call sub.kernel32.dll_CopyFileW
lea eax, [ebp - 0x340]
mov ecx, 0x5182ac
mov edx, dword [esi]
call fcn.00408ddc
mov eax, dword [ebp - 0x340]
mov dl, 1
call fcn.00420430
test al, al
je 0x517938
push 0x5182f0
push dword [esi]
push 0x518328
lea eax, [ebp - 0x344]
mov edx, 3
call fcn.00408e64
mov eax, dword [ebp - 0x344]
push eax
call fcn.00516f60
mov dword [0x52b334], 5
push 0x518370
push 0x80000002
call fcn.00516f28
test al, al
jne 0x51795a
call fcn.00517040
push 0x1f4
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x517978
jmp 0x517982
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5179af
lea eax, [ebp - 0x344]
mov edx, 0x17
call fcn.0040804c
lea eax, [ebp - 4]
call fcn.00407fec
ret