Function at 0x417ff6
Capabilities:
Copy file
Set file attributes
Set registry value

Disassembly:
mov eax, 0x440022
call fcn.00432c38
mov eax, 0x1c08
call fcn.00433360
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
call fcn.00401046
mov esi, eax
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x120b]
mov byte [ebp - 0x120c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
mov dword [ebp - 0x28], esi
stosb byte es:[edi], al
call fcn.0042187b
test eax, eax
jne 0x418181
lea ecx, [ebp - 0x40]
call fcn.00401972
push dword [0x44c8b0]
lea eax, [ebp - 0x120c]
mov dword [ebp - 4], ebx
push 0x453ac8
push eax
call fcn.0042b708
lea eax, [ebp - 0x120c]
push ebx
push eax
push 0x452be8
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x120c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x120c]
lea ecx, [ebp - 0x40]
push eax
call fcn.00401dde
xor eax, eax
lea edi, [ebp - 0xa3]
mov byte [ebp - 0xa4], bl
push dword [0x453204]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa4]
push 0x44baac
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xe0c]
push eax
lea eax, [ebp - 0xa0c]
push eax
push 0x452be8
call fcn.0042b4c7
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xe0c]
push eax
call fcn.0042b708
lea eax, [ebp - 0xe0c]
push 0x44babc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x60b]
mov byte [ebp - 0x60c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x60c]
push 0x453ac8
push eax
call fcn.0042b708
lea eax, [ebp - 0x60c]
push 0x44babc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x60c]
push ebx
push eax
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x60c]
lea ecx, [ebp - 0x40]
push eax
call fcn.00401dde
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040199f
jmp 0x418193
lea eax, [ebp - 0x120c]
push 0x452be8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1814]
push 0x104
push eax
push ebx
push dword [0x44263c]
lea ecx, [esi + 0x4030]
push dword [0x44260c]
call fcn.004075db
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x160b]
mov byte [ebp - 0x160c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 1
sub eax, ebx
je 0x418204
dec eax
je 0x4181f0
dec eax
jne 0x418216
push 0x44b86c
jmp 0x4181f5
push 0x44c270
lea eax, [ebp - 0x160c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x418220
lea eax, [ebp - 0x160c]
push 0x44b5d8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x20], 3
je 0x4186db
lea eax, [ebp - 0x160c]
push 0xf003f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.004109fd
test eax, eax
jne 0x4186db
mov ecx, 0xff
lea edi, [ebp - 0x60b]
mov byte [ebp - 0x60c], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x60c]
push eax
call fcn.00432770
cmp dword [ebp + 0xc], ebx
pop ecx
pop ecx
je 0x41827f
lea eax, [ebp - 0x60c]
push 0x44c260
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xa0b]
mov byte [ebp - 0xa0c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x14cc]
dec eax
je 0x4182ed
dec eax
je 0x4182df
dec eax
je 0x4182c1
dec eax
je 0x4182ba
dec eax
je 0x4182b3
push 0x450eb0
jmp 0x4182f2
push 0x44c25c
jmp 0x4182f2
push 0x44c258
jmp 0x4182f2
lea eax, [esi + 0x14d0]
push eax
push 0x44c250
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x418301
lea eax, [esi + 0x14d0]
push eax
push 0x44c248
jmp 0x4182cd
push 0x44b9a4
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004334a0
add esp, 0xc
mov ecx, esi
call fcn.0042187b
test eax, eax
je 0x418333
lea eax, [ebp - 0x20c]
push 0x44c244
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xe0b]
mov byte [ebp - 0xe0c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
stosb byte es:[edi], al
call fcn.00420434
push eax
lea eax, [ebp - 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, esi
call fcn.0042187b
test eax, eax
je 0x4183a9
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x38], ebx
jne 0x4183a9
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
lea eax, [ebp - 0x60c]
push eax
push 0x453ac8
call fcn.004205f9
push eax
lea eax, [ebp - 0xa0c]
push dword [0x453204]
push eax
lea eax, [ebp - 0xe0c]
push eax
push 0x44c218
jmp 0x4183dd
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
lea eax, [ebp - 0x60c]
push eax
push 0x453ac8
call fcn.004205f9
push eax
lea eax, [ebp - 0xa0c]
push dword [0x453204]
push eax
lea eax, [ebp - 0xe0c]
push eax
push 0x44c1f0
lea eax, [ebp - 0x1c14]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
push 1
pop edi
cmp dword [ebp - 0x20], edi
jne 0x418445
lea eax, [ebp - 0x160c]
push 0x44c1e8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0xc]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x160c]
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x418445
cmp dword [ebp - 0x14], ebx
je 0x41843f
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xb]
push edi
push eax
lea eax, [ebp - 0x1c14]
push eax
lea ecx, [ebp - 0x108]
call fcn.004014ff
lea eax, [ebp + 0xf]
push edi
push eax
lea eax, [ebp - 0x60c]
push eax
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 2
call fcn.004014ff
lea eax, [ebp - 0x21]
push edi
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.004205f9
push eax
lea ecx, [ebp - 0xb8]
call fcn.004014ff
lea eax, [ebp - 0xd]
push edi
push eax
push 0x453ac8
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 4
call fcn.004014ff
cmp dword [ebp - 0xac], ebx
mov byte [ebp - 4], 5
je 0x4184d0
lea eax, [ebp - 0x68]
push ebx
push eax
lea ecx, [ebp - 0xb8]
call fcn.0041bd50
lea ecx, [ebp - 0x68]
call fcn.00401915
cmp dword [ebp - 0x84], ebx
je 0x4184f0
lea eax, [ebp - 0x68]
push ebx
push eax
lea ecx, [ebp - 0x90]
call fcn.0041bd50
lea ecx, [ebp - 0x68]
call fcn.00401915
mov dword [ebp - 0x18], ebx
push 0xf003f
push 0x44b580
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.004109fd
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x418657
lea ecx, [ebp - 0xb8]
call fcn.004016f0
push eax
mov dword [ebp - 0x1c], eax
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push 0x44b8ac
push dword [ebp - 0x18]
call edi
lea ecx, [ebp - 0x90]
call fcn.004016f0
push eax
mov dword [ebp - 0x1c], eax
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push 0x44b998
push dword [ebp - 0x18]
call edi
cmp dword [ebp - 0xd4], ebx
je 0x418593
lea ecx, [ebp - 0xe0]
call fcn.004016f0
push eax
mov dword [ebp - 0x1c], eax
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push 0x44b854
push dword [ebp - 0x18]
call edi
cmp dword [ebp - 0x18], ebx
je 0x4185a4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0xd]
push 1
push eax
push 0x44b8ac
lea ecx, [ebp - 0x68]
call fcn.0041bb4e
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x108]
push eax
lea eax, [ebp - 0xb8]
push eax
mov byte [ebp - 4], 7
call fcn.0040b7dc
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.00401915
lea eax, [ebp - 0xd]
push 1
push eax
push 0x44b998
lea ecx, [ebp - 0x68]
call fcn.0041bb4e
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x108]
push eax
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 8
call fcn.0040b7dc
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.00401915
cmp dword [ebp - 0xd4], ebx
je 0x418657
lea eax, [ebp - 0xd]
push 1
push eax
push 0x44b854
lea ecx, [ebp - 0x68]
call fcn.0041bb4e
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x108]
push eax
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 9
call fcn.0040b7dc
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.00401915
lea ecx, [ebp - 0x108]
call fcn.004016f0
push eax
mov dword [ebp - 0x1c], eax
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push 0x44b864
push dword [ebp - 0x14]
call edi
cmp dword [ebp - 0x14], ebx
je 0x41868b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x18], ebx
je 0x41869c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 4
call fcn.00401915
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.00401915
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 2
call fcn.00401915
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 1
call fcn.00401915
mov esi, dword [ebp - 0x28]
xor eax, eax
lea edi, [ebp - 0x33]
mov byte [ebp - 0x34], bl
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x1710]
lea edi, [esi + 0x8bc]
push eax
push ebx
push dword [0x44261c]
lea ecx, [esi + 0x4030]
push edi
call fcn.004075db
cmp dword [esi + 0x1d0c], ebx
jne 0x41871d
cmp eax, 1
je 0x41871d
cmp eax, 2
jne 0x418790
push 4
lea eax, [ebp - 0x34]
push 0x44b57c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.004023bf
lea eax, [ebp - 0x120c]
lea ecx, [ebp - 0x88]
push eax
mov byte [ebp - 4], 0xa
call fcn.00402407
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x88]
push eax
push dword [0x44261c]
push edi
call fcn.00402446
lea ecx, [ebp - 0x88]
call fcn.00402433
push 1
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0xb
call fcn.00402882
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.00403872
cmp dword [ebp - 0x20], 3
je 0x4187b0
cmp dword [0x453ed0], ebx
je 0x4187a5
call fcn.0042bc2a
jmp 0x4187b0
push 0x453
call fcn.0042af8a
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x4187be
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8