Function at 0x4fe1a0
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567a85
mov eax, dword fs:[0]
push eax
sub esp, 0x50c
mov eax, dword [0x5ca1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x28
push 0x8e53b8
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4fe260
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x414]
push str.USERPROFILE
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.0053e5f8
add esp, 0xc
test eax, eax
jne 0x4fe4b2
mov edx, dword [ebp - 0x4a8]
test edx, edx
je 0x4fe4b2
xor ecx, ecx
mov eax, edx
cmp word [edx], cx
je 0x4fe4b2
nop dword [eax]
add eax, 2
inc ecx
cmp word [eax], 0
jne 0x4fe230
test ecx, ecx
je 0x4fe4b2
push edx
push 0x400
push 0x8e53b8
call fcn.0053e2a5
push dword [ebp - 0x4a8]
call fcn.0053bd7d
add esp, 0x10
mov ecx, 0x8e53b8
mov dword [ebp - 0x41c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x418], 0
movups xmmword [ebp - 0x42c], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4fe286
sub ecx, edx
sar ecx, 1
push ecx
push 0x8e53b8
lea ecx, [ebp - 0x42c]
call fcn.00419b60
mov edx, 0x5de620
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4a4]
call fcn.004fecb0
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 1
call fcn.004d2150
mov esi, dword [ebp - 0x41c]
test esi, esi
je 0x4fe329
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x42c]
mov edx, dword [ebp - 0x42c]
cmp ecx, 7
mov edi, 0x5c
cmova eax, edx
dec esi
cmp di, word [eax + esi*2]
mov edi, 0x2f
je 0x4fe311
cmp ecx, 7
lea eax, [ebp - 0x42c]
cmova eax, edx
cmp di, word [eax + esi*2]
jne 0x4fe329
cmp ecx, 7
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x42c]
cmova eax, edx
xor ecx, ecx
mov word [eax + esi*2], cx
push 0x5c
lea ecx, [ebp - 0x42c]
call fcn.00500130
push str.DesktopCTF_custom_maps_auto_downloader.lnk
lea ecx, [ebp - 0x42c]
call fcn.00500490
push 0x25
push str.CTF_custom_maps_auto_downloader.exe
lea edx, [ebp - 0x4a4]
lea ecx, [ebp - 0x474]
call fcn.0050b440
mov byte [ebp - 4], 2
lea eax, [ebp - 0x474]
cmp dword [ebp - 0x460], 7
mov byte [ebp - 0x414], 0
cmova eax, dword [ebp - 0x474]
push dword [ebp - 0x414]
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0050d130
add esp, 0x14
lea eax, [ebp - 0x45c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x4e0]
call fcn.004a1590
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 5
call fcn.00417590
lea ecx, [ebp - 0x4e0]
call fcn.004a1660
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 0x4fd], al
mov byte [ebp - 4], 2
call fcn.00417590
cmp byte [ebp - 0x4fd], 0
jne 0x4fe811
cmp dword [ebp - 0x460], 7
lea eax, [ebp - 0x474]
cmova eax, dword [ebp - 0x474]
push eax
push ecx
call fcn.004102b0
test al, al
jne 0x4fe4b9
push 0x8d
xorps xmm0, xmm0
mov dword [ebp - 0x434], 0
push str.3Could_not_download_CTF_game_servers_custom_maps_auto_downloader_from_n_5ftp:__85.222.189.119_tinyrcon_CTF_custom_maps_auto_downloader.exe_n
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x430], 0
movups xmmword [ebp - 0x444], xmm0
call fcn.0040f680
push 1
push ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x444]
cmp dword [ebp - 0x430], 0xf
push 1
cmova edx, dword [ebp - 0x444]
push 1
push ecx
mov ecx, dword [0x5de260]
call fcn.004dbe00
mov ecx, dword [ebp - 0x430]
add esp, 0x14
cmp ecx, 0xf
jbe 0x4fe7c8
mov edx, dword [ebp - 0x444]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4fe7be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4feb3c
jmp 0x4fe7be
xor al, al
jmp 0x4feb21
cmp dword [ebp - 0x460], 7
lea eax, [ebp - 0x474]
cmova eax, dword [ebp - 0x474]
push eax
push str.__s___NP
push 0x400
push 0x90dbc8
call fcn.004a0510
add esp, 0x10
mov dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x490], 7
lea ecx, [ebp - 0x4fc]
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4ec], 0x44
cmova eax, dword [ebp - 0x4a4]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x4ec]
movlpd qword [ebp - 0x4e8], xmm0
push ecx
push eax
push 0
push 0x30
push 0
push 0
push 0
push 0x90dbc8
push 0
movlpd qword [ebp - 0x4e0], xmm0
movlpd qword [ebp - 0x4d8], xmm0
movlpd qword [ebp - 0x4d0], xmm0
movlpd qword [ebp - 0x4c8], xmm0
movlpd qword [ebp - 0x4bc], xmm0
movlpd qword [ebp - 0x4b4], xmm0
mov dword [ebp - 0x4c0], 0x80
movups xmmword [ebp - 0x4fc], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4fe7d4
push 0x200
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00532960
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x210]
push 0x200
push eax
call fcn.0053dabd
add esp, 0xc
mov dword [ebp - 0x508], 0
xorps xmm0, xmm0
mov dword [ebp - 0x504], 0
lea ecx, [ebp - 0x518]
movups xmmword [ebp - 0x518], xmm0
push 1
push 0x597424
call fcn.0040f680
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x444]
push 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x434], 0
push str.3Launching_CTF_game_servers_custom_maps_auto_downloader_failed:_1
movups xmmword [ebp - 0x444], xmm0
mov dword [ebp - 0x430], 0
call fcn.0040f680
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4fe628
sub ecx, edx
lea eax, [ebp - 0x210]
push ecx
push eax
lea ecx, [ebp - 0x444]
call fcn.004177a0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x45c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x44c], xmm0
mov dword [eax + 0x10], 0
lea ecx, [ebp - 0x48c]
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x45c]
mov byte [ebp - 4], 9
push eax
push dword [ebp - 0x414]
call fcn.0041aac0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x448]
cmp ecx, 0xf
jbe 0x4fe6cd
mov edx, dword [ebp - 0x45c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4fe6c3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4feb41
push ecx
push edx
call fcn.00524a57
add esp, 8
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x430]
cmp ecx, 0xf
jbe 0x4fe70b
mov edx, dword [ebp - 0x444]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4fe701
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4feb41
push ecx
push edx
call fcn.00524a57
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x504]
cmp ecx, 0xf
jbe 0x4fe764
mov edx, dword [ebp - 0x518]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4fe75a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4feb41
push ecx
push edx
call fcn.00524a57
add esp, 8
cmp dword [ebp - 0x478], 0xf
lea edx, [ebp - 0x48c]
push 1
cmova edx, dword [ebp - 0x48c]
push ecx
push 1
push 1
push ecx
mov ecx, dword [0x5de260]
call fcn.004dbe00
mov ecx, dword [ebp - 0x478]
add esp, 0x14
cmp ecx, 0xf
jbe 0x4fe7c8
mov edx, dword [ebp - 0x48c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4fe7be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4feb46
push ecx
push edx
call fcn.00524a57
add esp, 8
mov byte [ebp - 0x4fd], 0
jmp 0x4feafa
mov eax, dword [ebp - 0x4ac]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4fe7e7
push eax
call esi
mov eax, dword [ebp - 0x4b4]
test eax, eax
je 0x4fe7f4
push eax
call esi
mov eax, dword [ebp - 0x4b0]
test eax, eax
je 0x4fe801
push eax
call esi
push dword [ebp - 0x4f8]
call esi
push dword [ebp - 0x4fc]
call esi
cmp dword [ebp - 0x418], 7
lea eax, [ebp - 0x42c]
mov byte [ebp - 0x414], 0
cmova eax, dword [ebp - 0x42c]
push dword [ebp - 0x414]
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0050d130
add esp, 0xc
lea eax, [ebp - 0x45c]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x4e0]
call fcn.004a1590
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x10
call fcn.00417590
lea ecx, [ebp - 0x4e0]
call fcn.004a1660
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 0x4fd], al
mov byte [ebp - 4], 2
call fcn.00417590
cmp byte [ebp - 0x4fd], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
jne 0x4fe901
cmp dword [ebp - 0x418], 7
lea edx, [ebp - 0x42c]
lea ecx, [ebp - 0x474]
cmova edx, dword [ebp - 0x42c]
cmp dword [ebp - 0x460], 7
push str.CTF_game_servers_custom_map_auto_downloader
cmova ecx, dword [ebp - 0x474]
call fcn.004feb50
add esp, 4
lea eax, [ebp - 0x474]
cmp dword [ebp - 0x460], 7
cmova eax, dword [ebp - 0x474]
push 0x1a
push str._RUNASADMIN
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push closesocket
call edi
push 0x8e53b8
lea ecx, [ebp - 0x42c]
call fcn.00500260
lea ecx, [ebp - 0x42c]
call fcn.004d2150
mov esi, dword [ebp - 0x41c]
test esi, esi
je 0x4fe985
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x42c]
mov edx, dword [ebp - 0x42c]
cmp ecx, 7
mov edi, 0x5c
cmova eax, edx
dec esi
cmp di, word [eax + esi*2]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
je 0x4fe96d
cmp ecx, 7
lea eax, [ebp - 0x42c]
mov edi, 0x2f
cmova eax, edx
cmp di, word [eax + esi*2]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
jne 0x4fe985
cmp ecx, 7
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x42c]
cmova eax, edx
xor ecx, ecx
mov word [eax + esi*2], cx
push 0x5c
lea ecx, [ebp - 0x42c]
call fcn.00500130
push str.DesktopTinyRcon.lnk
lea ecx, [ebp - 0x42c]
call fcn.00500490
cmp dword [ebp - 0x418], 7
lea eax, [ebp - 0x42c]
mov byte [ebp - 0x414], 0
cmova eax, dword [ebp - 0x42c]
push dword [ebp - 0x414]
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0050d130
add esp, 0xc
lea eax, [ebp - 0x45c]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x4e0]
call fcn.004a1590
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x13
call fcn.00417590
lea ecx, [ebp - 0x4e0]
call fcn.004a1660
lea ecx, [ebp - 0x4c0]
mov byte [ebp - 0x4fd], al
mov byte [ebp - 4], 2
call fcn.00417590
cmp byte [ebp - 0x4fd], 0
jne 0x4feaf3
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00532960
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5ce2b4
lea ecx, [ebp - 0x48c]
call fcn.004fecb0
push 0xc
push str.TinyRcon_v
mov edx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x45c]
call fcn.0050b440
add esp, 8
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0x16
call fcn.00417590
cmp dword [ebp - 0x448], 7
lea eax, [ebp - 0x45c]
lea edx, [ebp - 0x42c]
cmova eax, dword [ebp - 0x45c]
lea ecx, [ebp - 0x410]
cmp dword [ebp - 0x418], 7
push eax
cmova edx, dword [ebp - 0x42c]
call fcn.004feb50
add esp, 4
lea eax, [ebp - 0x410]
push 0x1a
push str._RUNASADMIN
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push closesocket
call edi
lea ecx, [ebp - 0x45c]
call fcn.00417590
mov byte [ebp - 0x4fd], 1
lea ecx, [ebp - 0x474]
call fcn.00417590
lea ecx, [ebp - 0x4a4]
call fcn.00417590
lea ecx, [ebp - 0x42c]
call fcn.00417590
mov al, byte [ebp - 0x4fd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052450f
mov esp, ebp
pop ebp
ret
call fcn.0053ce3a
call fcn.0053ce3a
call fcn.0053ce3a
int3