Function at 0x4f3940
Capabilities:
Copy file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x22
push 0
push 0
dec ecx
jne 0x4f3948
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040569c
xor eax, eax
push ebp
push 0x4f3eb0
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 0
call sub.ole32.dll_CoInitializeEx
push 0x4f3ebc
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [ebp - 0x34], eax
push 0x4f3ec8
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x10]
push eax
push 0x14
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x14]
mov edx, 0x104
call fcn.00405934
mov eax, dword [ebp - 0x14]
call fcn.004056ac
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 0x14]
call fcn.004056ac
push eax
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00405934
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 0x14]
call fcn.0040ead0
mov edx, dword [ebp - 0xf0]
lea eax, [ebp - 0x14]
call fcn.00405280
mov eax, dword [ebp - 0x14]
call fcn.0040a2cc
test al, al
je 0x4f3e75
lea eax, [ebp - 0x2c]
push eax
push 0x4f3ee0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov dword [ebp - 0x44], eax
test byte [ebp - 0x41], 0x80
setne byte [ebp - 0x45]
cmp byte [ebp - 0x45], 0
jne 0x4f3e75
mov eax, dword [ebp - 4]
call fcn.004f370c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f3e6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4f3e2e
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xf8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.0040a800
mov ecx, dword [ebp - 0xf4]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.004054f8
push 0xffffffffffffffff
mov eax, dword [ebp - 0x18]
call fcn.004056ac
push eax
lea ecx, [ebp - 0xfc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xfc]
call fcn.004056ac
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4f3e22
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.0040a800
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x20]
call fcn.0040a838
mov eax, dword [ebp - 0x100]
lea edx, [ebp - 0x24]
call fcn.00409758
cmp dword [ebp - 0x30], 0
je 0x4f3c3a
lea eax, [ebp - 0x104]
mov ecx, 0x4f3f1c
mov edx, dword [ebp - 0x18]
call fcn.004054f8
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x38]
call fcn.00405b5c
mov dword [ebp - 0x3c], 0x80
push 0
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00405b6c
push eax
call dword [ebp - 0x30]
test eax, eax
je 0x4f3bf3
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
call fcn.00405dc0
mov eax, dword [ebp - 0x38]
call fcn.00405b6c
mov edx, eax
mov ecx, dword [ebp - 0x3c]
shr ecx, 1
lea eax, [ebp - 0xec]
call fcn.00403014
lea eax, [ebp - 0x108]
lea edx, [ebp - 0xec]
mov ecx, 0x40
call fcn.00405344
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x1c]
call fcn.00409b80
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x4f3b9f
mov eax, dword [ebp - 0x4c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x4f3c7f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x4f3bc0
mov eax, dword [ebp - 0x50]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4f3bd7
mov eax, dword [ebp - 0x54]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x54]
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040570c
jmp 0x4f3c7f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x4f3c0a
mov eax, dword [ebp - 0x58]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4f3c21
mov eax, dword [ebp - 0x5c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x58]
sub ecx, dword [ebp - 0x5c]
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040570c
jmp 0x4f3c7f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x4f3c51
mov eax, dword [ebp - 0x60]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x4f3c68
mov eax, dword [ebp - 0x64]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x60]
sub ecx, dword [ebp - 0x64]
mov edx, 1
mov eax, dword [ebp - 0x20]
call fcn.0040570c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f3f28
call fcn.004055f8
jne 0x4f3ca0
lea eax, [ebp - 0x28]
mov edx, 0x4f3f38
call fcn.00405280
jmp 0x4f3d9c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f3f48
call fcn.004055f8
jne 0x4f3cc1
lea eax, [ebp - 0x28]
mov edx, 0x4f3f58
call fcn.00405280
jmp 0x4f3d9c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f3f6c
call fcn.004055f8
jne 0x4f3ce2
lea eax, [ebp - 0x28]
mov edx, 0x4f3f58
call fcn.00405280
jmp 0x4f3d9c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f3f7c
call fcn.004055f8
jne 0x4f3d03
lea eax, [ebp - 0x28]
mov edx, 0x4f3f8c
call fcn.00405280
jmp 0x4f3d9c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f3fa0
call fcn.004055f8
jne 0x4f3d21
lea eax, [ebp - 0x28]
mov edx, 0x4f3f8c
call fcn.00405280
jmp 0x4f3d9c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f3fb0
call fcn.004055f8
jne 0x4f3d3f
lea eax, [ebp - 0x28]
mov edx, 0x4f3f8c
call fcn.00405280
jmp 0x4f3d9c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f3fc0
call fcn.004055f8
jne 0x4f3d5d
lea eax, [ebp - 0x28]
mov edx, 0x4f3fd0
call fcn.00405280
jmp 0x4f3d9c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f3fe4
call fcn.004055f8
jne 0x4f3d7b
lea eax, [ebp - 0x28]
mov edx, 0x4f3ff4
call fcn.00405280
jmp 0x4f3d9c
mov eax, dword [ebp - 0x24]
mov edx, 0x4f4008
call fcn.004055f8
jne 0x4f3d94
lea eax, [ebp - 0x28]
call fcn.004051e8
jmp 0x4f3d9c
lea eax, [ebp - 0x28]
call fcn.004051e8
push dword [ebp - 0x1c]
push 0x4f4018
push dword [ebp - 0x28]
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.0040556c
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.00409b80
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x1c]
call fcn.00405280
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x4f3ded
mov eax, dword [ebp - 0x68]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x20]
call fcn.004056ac
push eax
push 1
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004056ac
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.advapi32.dll_RegSetValueExA
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.004056ac
push eax
call sub.gdi32.dll_AddFontResourceExA
inc dword [ebp - 0xc]
dec dword [ebp - 0x40]
jne 0x4f3a5d
mov eax, dword [ebp - 0x2c]
push eax
call sub.advapi32.dll_RegCloseKey_1
call sub.ole32.dll_CoUninitialize
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4f3e58
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3e75
mov eax, dword [ebp - 8]
call fcn.004042c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3eb7
lea eax, [ebp - 0x110]
mov edx, 9
call fcn.0040520c
lea eax, [ebp - 0x38]
call fcn.004059f4
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.0040520c
lea eax, [ebp - 4]
call fcn.004051e8
ret