Function at 0x1004a17
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Get installed programs
Persist via application shimming
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe8c
mov eax, dword [0x100700c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0xe68], eax
xor eax, eax
cmp dword [ebp + 0xc], ebx
lea edi, [ebp - 0xe70]
mov dword [ebp - 0xe74], ebx
mov dword [ebp - 0xe78], esi
mov dword [ebp - 0xe60], ebx
mov dword [ebp - 0xe64], ebx
mov dword [ebp - 0xe5c], 1
stosd dword es:[edi], eax
jne 0x1004a90
lea eax, [ebp - 0xe8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0xe8c]
mov dword [ebp - 0xe74], eax
mov eax, dword [ebp - 0xe88]
mov dword [ebp - 0xe70], eax
cmp esi, ebx
je 0x1004dfc
cmp dword [ebp - 0xe68], ebx
je 0x1004dfc
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0x40c]
push esi
rep stosd dword es:[edi], eax
call fcn.010024db
cmp eax, ebx
jne 0x1004acc
push 0x3e9
call fcn.010029d1
jmp 0x10051b6
push eax
push 0x104
lea eax, [ebp - 0xa24]
push eax
call fcn.01002275
test eax, eax
jge 0x1004af1
push 0x408
call fcn.0100292f
jmp 0x10051b6
lea eax, [ebp - 0xa24]
push 0x1002180
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x1004bbe
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004b33
push esi
call fcn.01002501
test eax, eax
je 0x1004b33
cmp dword [ebp + 0xc], ebx
jne 0x1004b61
push esi
push 0x3ee
jmp 0x1005301
cmp dword [ebp + 0xc], 1
jne 0x1004b44
push esi
push 0x3ef
jmp 0x1005301
cmp dword [ebp + 0xc], ebx
jne 0x1004b61
push dword [ebp + 0x14]
push dword [ebp - 0xe68]
push esi
call fcn.010040dd
test eax, eax
jne 0x1004b92
jmp 0x10051b7
cmp dword [ebp + 0xc], 2
jne 0x1004b7b
push dword [ebp - 0xe68]
call fcn.010024db
test eax, eax
jne 0x1004b92
jmp 0x1004abd
push esi
push dword [ebp + 0x14]
push dword [ebp - 0xe68]
call fcn.010028a6
test eax, eax
jl 0x1004ae2
lea eax, [ebp - 0xe58]
push eax
push esi
call fcn.01002b10
test eax, eax
jne 0x1004bae
mov dword [ebp - 0xe5c], ebx
jmp 0x10052b8
lea eax, [ebp - 0xe58]
push eax
call fcn.0100253d
test eax, eax
je 0x1004bc8
push 0x3ed
jmp 0x1004ae7
lea eax, [ebp - 0xe80]
push eax
lea eax, [ebp - 0xe58]
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
jl 0x1004ba3
movzx eax, word [ebp - 0xe80]
mov esi, dword [ebp - 0xe7c]
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
shr eax, 1
rep movsb byte es:[edi], byte [esi]
mov word [ebp + eax*2 - 0x20c], bx
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp dword [ebp + 0xc], ebx
jne 0x1004cb7
push ebx
lea eax, [ebp - 0xe64]
push eax
push ebx
call fcn.010023ea
or eax, 0xf003f
push eax
push ebx
push ebx
push ebx
mov esi, 0x1002108
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x1004c69
cmp eax, 5
jne 0x1004c5e
push 0x3f0
jmp 0x1004ae7
push esi
push 0x3f1
jmp 0x10051b0
push dword [ebp - 0xe64]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push ebx
lea eax, [ebp - 0xe64]
push eax
push ebx
mov dword [ebp - 0xe64], ebx
call fcn.010023ea
or eax, 0xf003f
push eax
push ebx
push ebx
push ebx
mov esi, 0x1001cc8
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1004c5e
push dword [ebp - 0xe64]
call edi
mov dword [ebp - 0xe64], ebx
push ebx
push dword [ebp - 0xe78]
call sub.apphelp.dll_SdbOpenDatabase
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0xe60], esi
jne 0x1004cdf
push dword [ebp - 0xe78]
push 0x3ea
jmp 0x10051f0
push 0x7001
push ebx
push esi
call sub.apphelp.dll_SdbFindFirstTag
cmp eax, ebx
mov dword [ebp - 0xe6c], eax
jne 0x1004d05
push dword [ebp - 0xe78]
push 0x3eb
jmp 0x10051f0
mov edi, 0x6001
push edi
push eax
push esi
call sub.apphelp.dll_SdbFindFirstTag
cmp eax, ebx
je 0x1004d58
push eax
push esi
call sub.apphelp.dll_SdbGetStringTagPtr
cmp eax, ebx
je 0x1004d58
push eax
lea eax, [ebp - 0x40c]
push 0x100
push eax
call fcn.01002275
test eax, eax
jl 0x1005233
push 0x7007
push dword [ebp - 0xe6c]
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbFindFirstTag
mov esi, eax
jmp 0x1004e6b
lea eax, [ebp - 0xa24]
jmp 0x1004d21
push edi
push esi
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbFindFirstTag
cmp eax, ebx
jne 0x1004d92
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0xe5c], ebx
je 0x1004e49
cmp dword [ebp + 0xc], 1
je 0x1004e49
push 0x3f2
jmp 0x1004dc1
push eax
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbGetStringTagPtr
cmp eax, ebx
jne 0x1004dc9
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0xe5c], ebx
je 0x1004e49
cmp dword [ebp + 0xc], 1
je 0x1004e49
push 0x3f3
call fcn.0100292f
pop ecx
jmp 0x1004e02
cmp dword [ebp + 0xc], ebx
lea ecx, [ebp - 0x20c]
push ebx
jne 0x1004e3e
push dword [ebp - 0xe70]
push dword [ebp - 0xe74]
push ecx
push eax
call fcn.01004127
test eax, eax
je 0x1004dfc
push esi
push dword [ebp - 0xe60]
call fcn.01003268
test eax, eax
jne 0x1004e49
mov dword [ebp - 0xe5c], ebx
cmp dword [ebp - 0xe60], ebx
je 0x1004e15
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbCloseDatabase
cmp dword [ebp - 0xe64], ebx
pop edi
pop esi
pop ebx
je 0x1004e2c
push dword [ebp - 0xe64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xe5c]
call fcn.01005b2e
leave
ret 0x10
push ecx
push eax
call fcn.0100427b
test eax, eax
je 0x1004e02
push esi
push dword [ebp - 0xe6c]
mov dword [ebp - 0xe84], esi
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbFindNextTag
mov esi, eax
cmp esi, dword [ebp - 0xe84]
je 0x1004e73
cmp esi, ebx
jne 0x1004d60
push 0x700b
push dword [ebp - 0xe6c]
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbFindFirstTag
mov esi, eax
cmp esi, ebx
jne 0x1004f19
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xe70]
push dword [ebp - 0xe74]
push eax
push dword [ebp - 0xe6c]
push dword [ebp - 0xe60]
call fcn.010048b2
test eax, eax
je 0x1004dfc
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbCloseDatabase
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0xe60], ebx
jne 0x1004fce
push ebx
push 0x1007018
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push dword [ebp - 0xe68]
push dword [ebp - 0xe78]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1005003
push dword [ebp - 0xe68]
push 0x3f9
jmp 0x10051b0
mov edi, 0x6001
push edi
push esi
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbFindFirstTag
cmp eax, ebx
jne 0x1004f42
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0xe5c], ebx
je 0x1004fa3
cmp dword [ebp + 0xc], 1
jne 0x1004d8b
jmp 0x1004fa3
push eax
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbGetStringTagPtr
cmp eax, ebx
jne 0x1004f6a
cmp dword [ebp + 0xc], 2
mov dword [ebp - 0xe5c], ebx
je 0x1004fa3
cmp dword [ebp + 0xc], 1
jne 0x1004dbc
jmp 0x1004fa3
cmp dword [ebp + 0xc], ebx
lea ecx, [ebp - 0x20c]
push 1
jne 0x1004f94
push dword [ebp - 0xe70]
push dword [ebp - 0xe74]
push ecx
push eax
call fcn.01004127
test eax, eax
je 0x1004dfc
jmp 0x1004fa3
push ecx
push eax
call fcn.0100427b
test eax, eax
je 0x1004e02
push esi
push dword [ebp - 0xe6c]
mov edi, esi
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbFindNextTag
mov esi, eax
cmp esi, edi
je 0x1004e93
cmp esi, ebx
jne 0x1004f14
jmp 0x1004e93
push 0x80
push dword [ebp - 0xe68]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0xe68]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10051c2
push dword [ebp - 0xe68]
push 0x3fa
jmp 0x10051f0
mov esi, 0x104
push esi
lea eax, [ebp - 0x81c]
push eax
mov word [ebp - 0x81c], bx
call fcn.010023a9
push 0x10020d8
push esi
lea eax, [ebp - 0x81c]
push eax
call fcn.010028f6
test eax, eax
jl 0x1004ae2
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1005076
push esi
lea eax, [ebp - 0x81c]
push eax
mov word [ebp - 0x81c], bx
call fcn.010023a9
push 0x10020ac
push esi
lea eax, [ebp - 0x81c]
push eax
call fcn.010028f6
test eax, eax
jl 0x1004ae2
lea eax, [ebp - 0x20c]
push eax
push 0x1002040
push 0x1002028
lea eax, [ebp - 0x614]
push esi
push eax
call fcn.010028c8
add esp, 0x14
test eax, eax
jl 0x1004ae2
push ebx
lea eax, [ebp - 0xe64]
push eax
push ebx
call fcn.010023ea
or eax, 0xf003f
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x614]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10050d8
lea eax, [ebp - 0x614]
push eax
jmp 0x1004c5f
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x40c]
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x40c]
push eax
push 1
push ebx
push 0x1002010
push dword [ebp - 0xe64]
call edi
test eax, eax
je 0x100511f
lea eax, [ebp - 0x614]
push eax
push 0x3f4
jmp 0x10051b0
push dword [ebp - 0xe68]
lea eax, [ebp - 0x81c]
push eax
push 0x1001ff8
lea eax, [ebp - 0xe48]
push 0x212
push eax
call fcn.010028c8
add esp, 0x14
test eax, eax
jl 0x100510e
lea eax, [ebp - 0xe48]
push eax
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xe48]
push eax
push 1
push ebx
push 0x1001fd8
push dword [ebp - 0xe64]
call edi
test eax, eax
jne 0x100510e
push dword [ebp - 0xe64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xe74]
push eax
push 0x10000
push dword [ebp - 0xe68]
mov dword [ebp - 0xe64], ebx
call sub.apphelp.dll_SdbRegisterDatabaseEx
test eax, eax
lea eax, [ebp - 0x40c]
push eax
jne 0x10052fc
push 0x409
call fcn.0100292f
pop ecx
pop ecx
mov dword [ebp - 0xe5c], ebx
jmp 0x1004e15
lea eax, [ebp - 0xe64]
push eax
call fcn.010023ea
or eax, 0xf003f
push eax
push ebx
mov esi, 0x1002040
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1005200
push esi
push 0x3f6
call fcn.0100292f
mov dword [ebp - 0xe5c], ebx
jmp 0x10052b6
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x614]
push eax
call fcn.01002275
test eax, eax
jl 0x1005233
push 0x1001c98
push edi
lea eax, [ebp - 0x614]
push eax
call fcn.010028f6
test eax, eax
jge 0x1005245
push 0x408
call fcn.0100292f
mov dword [ebp - 0xe5c], ebx
jmp 0x10052b7
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xe64]
call fcn.01002594
test eax, eax
je 0x1005270
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x3f7
call fcn.0100292f
add esp, 0xc
push dword [ebp - 0xe64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xe58]
push eax
mov dword [ebp - 0xe64], ebx
call sub.apphelp.dll_SdbUnregisterDatabase
test eax, eax
jne 0x10052a5
lea eax, [ebp - 0x40c]
push eax
push 0x40a
call fcn.0100292f
pop ecx
pop ecx
lea eax, [ebp - 0x40c]
push eax
push 0x3fc
call fcn.010029d1
pop ecx
pop ecx
cmp dword [ebp + 0xc], ebx
je 0x1004e02
cmp dword [ebp - 0xe60], ebx
je 0x10052da
push dword [ebp - 0xe60]
call sub.apphelp.dll_SdbCloseDatabase
mov dword [ebp - 0xe60], ebx
push 0x80
push dword [ebp - 0xe68]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0xe68]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1004e02
push 0x3fb
call fcn.010029d1
pop ecx
pop ecx
jmp 0x1004e15