Function at 0x48fa40
Capabilities:
Copy file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x48fa48
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x48fd4a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x48fd60
call fcn.00403b98
lea eax, [ebp - 0xc]
mov edx, 0x48fd70
call fcn.00403b98
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f44
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403f44
push eax
push 1
push 0x48fd7c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 8]
mov edx, 0x48fd88
call fcn.00403b98
lea eax, [ebp - 0xc]
mov edx, 0x48fd60
call fcn.00403b98
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f44
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403f44
push eax
push 1
push 0x48fd7c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov dl, 1
mov eax, dword [0x45fe40]
call fcn.0045ff40
mov ebx, eax
mov edx, 0x80000000
mov eax, ebx
call fcn.0045ffe0
xor ecx, ecx
mov edx, 0x48fd98
mov eax, ebx
call fcn.00460044
test al, al
je 0x48fb32
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, ebx
call fcn.0046020c
mov eax, ebx
call fcn.0045ffb0
mov eax, ebx
call fcn.00402e78
push dword [esi + 0x23784]
push 0x48fd70
push 0x48fdb0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403e40
mov eax, dword [ebp - 0x10]
mov edx, 0x48fdc0
call fcn.00403e90
jb 0x48fb7c
mov eax, dword [ebp - 0x14]
call fcn.00408fbc
test al, al
jne 0x48fc8b
mov eax, dword [esi + 0xa594]
call fcn.00408fbc
test al, al
je 0x48fbf3
push 0
mov eax, dword [ebp - 0x14]
call fcn.00403f44
push eax
mov eax, dword [esi + 0xa594]
call fcn.00403f44
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x48fbf3
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.00403f88
push 0
lea eax, [ebp - 0x20]
mov ecx, 0x48fdcc
mov edx, dword [ebp - 0x18]
call fcn.00403dcc
mov eax, dword [ebp - 0x20]
call fcn.00403f44
mov edx, eax
mov ecx, 0x48fddc
mov eax, dword [0x4a8b24]
mov eax, dword [eax]
call fcn.0044f194
jmp 0x48fd2f
lea eax, [ebp - 8]
mov edx, 0x48fd60
call fcn.00403b98
lea eax, [ebp - 0xc]
mov edx, 0x48fdc0
call fcn.00403b98
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f44
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00403f44
push eax
push 1
push 0x48fde4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 0x1c]
mov ecx, 0x48fdf4
mov edx, dword [esi + 0x23780]
call fcn.00403dcc
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
call fcn.00403f44
push eax
push dword [esi + 0x23784]
push 0x48fe08
push 0x48fdf4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403e40
mov eax, dword [ebp - 0x24]
call fcn.00403f44
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 8]
mov edx, 0x48fd60
call fcn.00403b98
lea eax, [ebp - 0xc]
mov ecx, 0x48fe18
mov edx, dword [ebp - 0x14]
call fcn.00403dcc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f44
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00403f44
push eax
push 1
push 0x48fe1c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 8]
mov edx, 0x48fd60
call fcn.00403b98
lea eax, [ebp - 0xc]
mov ecx, 0x48fe38
mov edx, dword [ebp - 0x14]
call fcn.00403dcc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f44
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00403f44
push eax
push 1
push 0x48fe3c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fd51
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00403b24
ret