Function at 0x300131d5
Capabilities:
Check if file exists
Copy file
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.3000d430
lea ecx, [ebp - 0x10]
call fcn.3000d430
lea ecx, [ebp - 0x20]
call fcn.3000d430
call fcn.30011b5a
push 0x105
lea ecx, [ebp - 0x18]
call fcn.3000d531
mov esi, eax
cmp esi, edi
jne 0x30013504
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x3001356e
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
call fcn.3000eca0
test eax, eax
jne 0x300132b7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x30013289
push 0x30004e10
call fcn.300105be
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x30004dd4
call fcn.300106d0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x30004da4
call fcn.300106d0
add esp, 0x18
jmp 0x300132b7
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.3000d622
mov esi, eax
cmp esi, edi
je 0x300132a4
push 0x30004d74
jmp 0x30013439
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x30004d18
call fcn.300106d0
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.3000d67f
mov esi, eax
cmp esi, edi
je 0x300132cf
push 0x30004cdc
jmp 0x30013439
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.3000d622
mov esi, eax
cmp esi, edi
je 0x300132ea
push 0x30004ca8
jmp 0x30013439
cmp dword [0x30077284], edi
je 0x3001333f
push 0x30004c94
push dword [ebp - 0x10]
call fcn.300162a1
cmp eax, edi
push 0x30004c84
je 0x30013323
mov word [eax], di
lea ecx, [ebp - 0x10]
call fcn.3000d701
mov esi, eax
cmp esi, edi
je 0x30013336
push 0x30004c50
jmp 0x30013439
push dword [ebp - 0x10]
call fcn.300162a1
test eax, eax
jne 0x30013336
push 0x30004c3c
jmp 0x3001330b
mov dword [ebp - 8], SysStringLen
jmp 0x30013363
push 0x30004c28
lea ecx, [ebp - 0x10]
call fcn.3000d701
mov esi, eax
cmp esi, edi
je 0x3001335c
push 0x30004bf4
jmp 0x30013439
mov dword [ebp - 8], reloc.OLEAUT32.dll_SysReAllocString
cmp word [0x300360a8], di
mov ebx, 0x30003be8
je 0x3001340c
push 0x300360a8
lea ecx, [ebp - 0x18]
call fcn.3000d622
mov esi, eax
cmp esi, edi
jne 0x30013504
lea ecx, [ebp - 0x18]
call fcn.3000d67f
mov esi, eax
cmp esi, edi
je 0x300133a4
push 0x30004bcc
jmp 0x30013439
push 0x30004bc4
lea ecx, [ebp - 0x10]
call fcn.3000d701
mov esi, eax
cmp esi, edi
je 0x300133be
push 0x30004b98
jmp 0x30013439
cmp word [0x30024020], di
je 0x300133de
push 0x30024020
lea ecx, [ebp - 0x10]
call fcn.3000d701
mov esi, eax
cmp esi, edi
jne 0x30013504
push ebx
lea ecx, [ebp - 0x10]
call fcn.3000d701
mov esi, eax
cmp esi, edi
je 0x300133f4
push 0x30004b60
jmp 0x30013439
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.3000d701
mov esi, eax
cmp esi, edi
je 0x3001340c
push 0x30004b28
jmp 0x30013439
mov eax, dword [ebp + 8]
cmp word [eax], di
je 0x30013444
push ebx
lea ecx, [ebp - 0x10]
call fcn.3000d701
mov esi, eax
cmp esi, edi
jne 0x300133ed
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.3000d701
mov esi, eax
cmp esi, edi
je 0x30013444
push 0x30004af0
call fcn.30010597
pop ecx
jmp 0x30013504
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x2001b
push edi
push edi
push edi
push 0x30002958
push dword [ebp - 8]
call ebx
mov esi, eax
cmp esi, edi
je 0x30013473
push esi
push 0x300032e4
call fcn.30010642
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
cmp eax, 0x104
mov dword [ebp + 8], eax
jbe 0x3001349e
push 0x30004a50
call fcn.300105be
push 0x300049b0
call fcn.300105be
cmp esi, edi
jne 0x300134cf
push dword [ebp + 8]
push dword [ebp - 0x10]
push 1
push edi
call fcn.3001178d
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x30013565
push esi
push 0x30004994
call fcn.30010642
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x2001b
push edi
push edi
push edi
push 0x30002958
push SysReAllocString
call ebx
mov esi, eax
cmp esi, edi
je 0x3001353f
push esi
push 0x30004964
call fcn.30010642
push 0x300048e0
call fcn.300105be
cmp dword [ebp - 4], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x30013514
push dword [ebp - 4]
call ebx
cmp dword [ebp - 8], edi
je 0x3001351e
push dword [ebp - 8]
call ebx
lea ecx, [ebp - 0x20]
call fcn.3000d43a
lea ecx, [ebp - 0x10]
call fcn.3000d43a
lea ecx, [ebp - 0x18]
call fcn.3000d43a
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
push dword [ebp + 8]
push dword [ebp - 0x10]
push 1
push edi
call fcn.3001178d
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x30013565
push esi
push 0x300048b0
jmp 0x300134f5
cmp dword [ebp + 8], 0x104
ja 0x300134fa
push 0x30004840
call fcn.300105be
push dword [ebp - 0x10]
jmp 0x300134ff