Function at 0x414be0
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov byte [ebp - 0x38], 0
lea eax, [ebp - 0x1c]
push eax
push 0x42cce4
push 0
push 0xf003f
push 0
push 0
push 0
push 0x505480
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [0x42c8d0], eax
cmp dword [0x42c8d0], 0
je 0x414c3c
push 0x10007
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
push 1
lea eax, [ebp - 0x38]
push eax
push 3
push 0
push str.Start
mov eax, dword [0x42cce4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x42c8d0], eax
cmp dword [0x42c8d0], 0
je 0x414c80
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
push 0x5054b8
lea eax, [ebp - 0x18]
push eax
call fcn.0041d13c
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.0041d0c4
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.StaticVxD
mov eax, dword [0x42cce4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x42c8d0], eax
cmp dword [0x42c8d0], 0
je 0x414ce0
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
push 0x5054d0
lea eax, [ebp - 0x18]
push eax
call fcn.0041d13c
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.0041d0c4
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.Version
mov eax, dword [0x42cce4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x42c8d0], eax
cmp dword [0x42c8d0], 0
je 0x414d40
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
push 2
call fcn.00413f18
add esp, 4
cmp eax, 2
jne 0x414d5f
mov dword [ebp - 0x20], 2
jmp 0x414d66
mov dword [ebp - 0x20], 1
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push 0
push str.HWType
mov eax, dword [0x42cce4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x42c8d0], eax
cmp dword [0x42c8d0], 0
je 0x414daa
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x42cce8], eax
cmp dword [0x42cce8], 0
jne 0x414ddb
push 1
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
push str.GetDateFormatA
mov eax, dword [0x42cce8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42cce0], eax
cmp dword [0x42cce0], 0
jne 0x414e12
push 2
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
push 0x14
lea eax, [ebp - 0x34]
push eax
push str.MMMM_d___yyyy
push 0
push 0
push 0x409
call dword [0x42cce0]
mov dword [ebp - 4], eax
mov eax, dword [0x42cce8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x414e64
push 0x2001000
call fcn.0040648e
add esp, 4
push 3
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
cmp dword [ebp - 4], 0
jne 0x414e82
push 6
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041d13c
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.0041d0c4
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.Date
mov eax, dword [0x42cce4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x42c8d0], eax
cmp dword [0x42c8d0], 0
je 0x414ee1
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
push 0x200
push 0x42cae0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x505520
push 0x42cae0
call fcn.0041d138
add esp, 8
push 0x42cae0
call fcn.0041d0c4
add esp, 4
inc eax
push eax
push 0x42cae0
push 1
push 0
push str.ImagePath
mov eax, dword [0x42cce4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x42c8d0], eax
cmp dword [0x42c8d0], 0
je 0x414f55
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
mov eax, dword [0x42cce4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x42c8d0], eax
cmp dword [0x42c8d0], 0
je 0x414f8a
push 0x10002
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x414f91
xor eax, eax
jmp 0x414f91
pop edi
pop esi
pop ebx
leave
ret