Function at 0x48ae68
Capabilities:
Contain obfuscated stackstrings
Copy file
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48b1c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x120]
lea edx, [esi + 0xe204]
mov ecx, 0x80
call fcn.00404a38
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x11c]
call fcn.0040694c
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 8]
call fcn.00408f44
cmp dword [ebp - 8], 0
je 0x48b18c
push 0x105
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ca4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x115]
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x48b001
mov dl, 1
mov eax, dword [0x4822b8]
call fcn.0047bad0
mov edi, eax
mov eax, dword [0x4a1af4]
mov eax, dword [eax + 4]
sub eax, 1
jb 0x48af60
je 0x48af6f
dec eax
je 0x48af7e
jmp 0x48af8b
lea eax, [edi + 0x2c]
mov edx, 0x48b1e0
call fcn.0040481c
jmp 0x48af8b
lea eax, [edi + 0x2c]
mov edx, 0x48b1fc
call fcn.0040481c
jmp 0x48af8b
lea eax, [edi + 0x2c]
mov edx, 0x48b214
call fcn.0040481c
lea eax, [edi + 0x30]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00404a38
lea eax, [edi + 0x34]
call fcn.004047c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, edi
call fcn.00482958
lea eax, [ebp - 0x124]
lea edx, [esi + 0xe284]
mov ecx, 0x6400
call fcn.00404a38
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 8]
call fcn.0040694c
cmp dword [ebp - 8], 0
je 0x48affb
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00404aa4
push eax
lea eax, [ebp - 8]
call fcn.00404cfc
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00404a38
mov eax, dword [ebp - 0x128]
lea edx, [ebp - 8]
call fcn.004096ac
mov eax, dword [0x4a1a0c]
mov eax, dword [eax]
mov esi, dword [eax + 0x20]
dec esi
test esi, esi
jl 0x48b18c
inc esi
xor edi, edi
mov eax, dword [0x4a1a0c]
mov eax, dword [eax]
mov edx, edi
call fcn.0047bbc4
mov ebx, eax
cmp byte [ebx + 0x48], 0xf
jne 0x48b184
lea edx, [ebp - 0x12c]
mov eax, dword [ebx + 0x74]
call fcn.00480408
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0xc]
mov ecx, 0x48b22c
call fcn.00404af0
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x148], eax
mov byte [ebp - 0x144], 0xb
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x13c], 0xb
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0xb
lea edx, [ebp - 0x148]
mov ecx, 2
mov eax, 0x48b238
call fcn.00409eec
mov eax, dword [ebp - 0x130]
call fcn.004095f0
push 0xffffffffffffffff
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x148], eax
mov byte [ebp - 0x144], 0xb
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x13c], 0xb
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0xb
lea edx, [ebp - 0x148]
mov ecx, 2
mov eax, 0x48b238
call fcn.00409eec
mov eax, dword [ebp - 0x14c]
call fcn.00404ca4
push eax
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x148], eax
mov byte [ebp - 0x144], 0xb
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x13c], 0xb
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x138], eax
mov byte [ebp - 0x134], 0xb
lea edx, [ebp - 0x148]
mov ecx, 2
mov eax, 0x48b238
call fcn.00409eec
mov eax, dword [ebp - 0x150]
call fcn.00404ca4
push eax
call sub.kernel32.dll_CopyFileA
inc edi
dec esi
jne 0x48b03b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b1ce
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.004047ec
lea eax, [ebp - 0x130]
mov edx, 6
call fcn.004047ec
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004047ec
ret