Function at 0x4012d0
Capabilities:
Accept command line arguments
Copy file
Get common file path
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4166f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov eax, dword [0x41ca98]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x60], ebx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60], 1
call fcn.0040e65b
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 2
call fcn.004029b8
push ecx
mov byte [esp + 0x64], 3
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x41c418
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push 0x104
lea ecx, [esp + 0x18]
call fcn.0040e5e3
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
or ebp, 0xffffffff
lea ecx, [esp + 0x14]
push ebp
call fcn.0040e5bb
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x41c3fc
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040e08c
mov ecx, dword [esi + 8]
call fcn.00402780
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 0x14]
call fcn.0040e454
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x41c3e0
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0040e08c
mov ecx, dword [esi + 8]
call fcn.00402780
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x41c3c8
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, 0x22
push 1
jne 0x401432
push 0x22
lea ecx, [esp + 0x18]
call fcn.0040e603
dec eax
lea ecx, [esp + 0x24]
push eax
push 1
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040d659
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x64], 4
call fcn.0040e404
mov byte [esp + 0x60], 3
lea ecx, [esp + 0x24]
jmp 0x401468
push 0x20
lea ecx, [esp + 0x18]
call fcn.0040e603
cmp eax, ebx
jle 0x40146d
lea edx, [esp + 0x24]
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0040d6ef
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x64], 5
call fcn.0040e404
mov byte [esp + 0x60], 3
lea ecx, [esp + 0x24]
call fcn.0040e317
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x41c3a8
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040e08c
mov ecx, dword [esi + 8]
call fcn.00402780
mov eax, dword [esp + 0x14]
push 0x41c398
mov cl, byte [eax]
mov eax, dword [eax - 8]
cmp cl, 0x22
jne 0x4014b3
dec eax
push eax
lea ecx, [esp + 0x1c]
call fcn.0040d5a4
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x41c374
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0040e08c
mov ecx, dword [esi + 8]
call fcn.00402780
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edi, eax
cmp edi, ebx
jne 0x401584
mov edx, dword [0x41ca98]
mov dword [esp + 0x1c], edx
push ebx
lea eax, [esp + 0x20]
push 0x41c358
push eax
mov byte [esp + 0x6c], 6
call fcn.0040daed
add esp, 8
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0040e08c
mov ecx, dword [esi + 8]
call fcn.004028d0
mov eax, dword [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x44]
call fcn.00402a7b
push ecx
test eax, eax
mov ecx, esp
je 0x401734
mov dword [esp + 0x28], esp
push 0x41c33c
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea ecx, [esp + 0x1c]
mov edi, 1
mov byte [esp + 0x60], 3
call fcn.0040e317
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c310
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push ecx
cmp edi, ebx
mov ecx, esp
je 0x401952
mov dword [esp + 0x2c], esp
push 0x41c2f8
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov ecx, dword [0x41ca98]
mov dword [esp + 0x24], ecx
push 0x41c2cc
lea ecx, [esp + 0x28]
mov byte [esp + 0x64], 7
mov dword [esp + 0x24], ebx
call fcn.0040e454
lea edx, [esp + 0x20]
push edx
push 0xf003f
push ebx
push 0x41c2cc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4018c4
mov eax, dword [0x41ca98]
mov dword [esp + 0x18], eax
push ecx
mov byte [esp + 0x64], 8
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c2b0
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c2cc
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push 0x41c298
lea ecx, [esp + 0x1c]
call fcn.0040e454
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x18]
lea edi, [eax + 1]
push edi
call fcn.0040e56c
mov edx, dword [esp + 0x20]
push edi
push eax
push 2
push ebx
push 0x41c288
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebp
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.0040e5bb
cmp edi, ebx
je 0x4017bc
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c26c
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c248
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 7
call fcn.0040e317
lea ecx, [esp + 0x24]
mov byte [esp + 0x60], 3
call fcn.0040e317
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 2
call fcn.004029f5
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60], 1
call fcn.0040e750
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], bl
call fcn.0040e317
lea ecx, [esp + 0x10]
mov dword [esp + 0x60], ebp
call fcn.0040e317
mov eax, 0xfffffffc
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
mov dword [esp + 0x2c], esp
push 0x41c208
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c1e4
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 3
call fcn.0040e317
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 2
call fcn.004029f5
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60], 1
call fcn.0040e750
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], bl
call fcn.0040e317
lea ecx, [esp + 0x10]
mov dword [esp + 0x60], ebp
call fcn.0040e317
mov eax, ebp
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c1c0
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c288
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c1b8
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.004028d0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c298
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 7
call fcn.0040e317
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c1a0
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c17c
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea ecx, [esp + 0x24]
mov byte [esp + 0x60], 3
call fcn.0040e317
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 2
call fcn.004029f5
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60], 1
call fcn.0040e750
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], bl
call fcn.0040e317
lea ecx, [esp + 0x10]
mov dword [esp + 0x60], ebp
call fcn.0040e317
xor eax, eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c164
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x41c140
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea ecx, [esp + 0x24]
mov byte [esp + 0x60], 3
call fcn.0040e317
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 2
call fcn.004029f5
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60], 1
call fcn.0040e750
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], bl
call fcn.0040e317
lea ecx, [esp + 0x10]
mov dword [esp + 0x60], ebp
call fcn.0040e317
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
mov dword [esp + 0x2c], esp
push 0x41c11c
call fcn.0040e385
mov ecx, dword [esi + 8]
call fcn.00402780
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 2
call fcn.004029f5
lea ecx, [esp + 0x2c]
mov byte [esp + 0x60], 1
call fcn.0040e750
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], bl
call fcn.0040e317
lea ecx, [esp + 0x10]
mov dword [esp + 0x60], ebp
call fcn.0040e317
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
mov dword fs:[0], ecx
pop ebx
add esp, 0x54
ret