Function at 0x406590
Capabilities:
Check if file exists
Create directory
Create process on windows
Get file attributes
Persist via run registry key
Set current directory

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406c2e
push eax
mov dword fs:[0], esp
sub esp, 0xce4
mov dword [ebp - 0x1c], 0
push ebx
mov dword [ebp - 0x10], ecx
push esi
mov eax, dword [ecx]
push edi
lea edx, [ebp - 0x3cc]
push 0x104
mov dword [ebp - 0x14], eax
push edx
push 0x46f
call dword [eax + 0xa8]
push 0
lea ecx, [ebp - 0x3cc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x3cc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406c43
test al, 0x10
je 0x406c43
push str.FastCopy.exe
lea eax, [ebp - 0x3cc]
push eax
lea ecx, [ebp - 0x5d4]
push ecx
call fcn.00403b50
add esp, 0xc
push 0x41
push str.Install
push 0
push 8
call fcn.00403990
add esp, 8
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
push eax
call dword [ebx + 0xdc]
cmp eax, 1
jne 0x406c63
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x9c], 0
jne 0x406791
push 0x104
lea eax, [ebp - 0x4d0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x4d0]
push eax
push eax
call fcn.00405c80
add esp, 8
cmp dword [str.FastCopy.exe], 0
je 0x406791
mov esi, 0x40bec0
mov eax, dword [esi]
lea ecx, [ebp - 0x4d0]
push eax
lea edx, [ebp - 0x140]
push ecx
push edx
call fcn.00403b50
add esp, 0xc
mov ecx, dword [esi]
lea edx, [ebp - 0x3cc]
lea eax, [ebp - 0x244]
push ecx
push edx
push eax
call fcn.00403b50
add esp, 0xc
lea ecx, [ebp - 0x244]
lea edx, [ebp - 0x140]
push ecx
push edx
call fcn.004061f0
add esp, 8
test eax, eax
jne 0x406785
lea eax, [ebp - 0x244]
lea ecx, [ebp - 0x140]
push eax
push ecx
call fcn.004060a0
add esp, 8
test eax, eax
jne 0x406785
mov eax, dword [esi]
mov ecx, str.FastExt1.dll
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x406723
or dl, dl
je 0x40671f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x406723
add eax, 2
add ecx, 2
or dl, dl
jne 0x406703
xor eax, eax
jmp 0x406728
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x406760
mov eax, dword [esi]
mov ecx, str.FastEx64.dll
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x406753
or dl, dl
je 0x40674f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x406753
add eax, 2
add ecx, 2
or dl, dl
jne 0x406733
xor eax, eax
jmp 0x406758
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4068f9
lea eax, [ebp - 0x244]
lea ecx, [ebp - 0x140]
push eax
push ecx
call fcn.00406320
add esp, 8
test eax, eax
je 0x4068f9
mov dword [ebp - 0x1c], 1
add esi, 4
cmp dword [esi], 0
jne 0x40668e
push 1
lea ecx, [ebp - 0x2c8]
push 0x80000001
call fcn.00401540
push 0
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 4], 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401580
test eax, eax
je 0x4069ad
mov dword [ebp - 0x30], str.Programs
mov dword [ebp - 0x2c], str.Desktop
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], 0
mov ecx, dword [eax + 0xa0]
mov edx, dword [eax + 0xa4]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
mov ecx, str.Programs
test ecx, ecx
je 0x4069a2
mov dword [ebp - 0x144], 0
push 0x104
lea eax, [ebp - 0x140]
push eax
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp + ecx - 0x30]
lea ecx, [ebp - 0x2c8]
push edx
call fcn.00401890
test eax, eax
je 0x40698a
cmp dword [ebp - 0x144], 0
jne 0x406853
lea eax, [ebp - 0x140]
mov ecx, dword [ebp - 0x10]
push eax
push eax
call fcn.004070b0
test eax, eax
jne 0x40687f
push str.FastCopy.lnk
lea edi, [ebp - 0x140]
push 0x40c0b0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx + ebp - 0x141]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x144]
cmp dword [ebp + eax - 0x3c], 0
je 0x40693d
cmp dword [0x40c6b4], 0
je 0x406920
push 1
lea eax, [ebp - 0x5d4]
push eax
call fcn.00403db0
add esp, 8
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
push 1
lea eax, [ebp - 0x140]
push eax
call fcn.00403db0
add esp, 8
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
push 0x40bbac
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00404270
mov byte [ebp - 4], 1
add esp, 0xc
call fcn.00406c0b
mov byte [ebp - 4], 0
call fcn.00406c13
jmp 0x40698a
push 0
push 0
push 7
call fcn.00403990
add esp, 8
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [ebx + 0xdc]
jmp 0x406c63
push 0x40bbac
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x5d4]
push ecx
call fcn.00404270
add esp, 0xc
jmp 0x40698a
cmp dword [0x40c6b4], 0
je 0x40697b
push 1
lea eax, [ebp - 0x140]
push eax
call fcn.00403db0
add esp, 8
mov dword [ebp - 0x3d0], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x3d0]
push eax
call fcn.00404390
mov byte [ebp - 4], 0
add esp, 4
call fcn.00406c1b
jmp 0x40698a
lea eax, [ebp - 0x140]
push eax
call fcn.00404390
add esp, 4
add dword [ebp - 0x144], 4
mov eax, dword [ebp - 0x144]
cmp dword [ebp + eax - 0x30], 0
jne 0x40680c
lea ecx, [ebp - 0x2c8]
call fcn.004016f0
push 0x104
lea eax, [ebp - 0xae8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0xae8]
push eax
push eax
call fcn.00405c80
add esp, 8
lea ecx, [ebp - 0x3cc]
lea edx, [ebp - 0x140]
push str.FastExt1.dll
push ecx
push edx
call fcn.00403b50
add esp, 0xc
lea ecx, [ebp - 0x140]
push ecx
call fcn.00403b20
add esp, 4
mov edi, eax
test edi, edi
je 0x406a32
push str.IsRegistServer
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
call esi
mov ebx, eax
push str.UpdateDll
push edi
call esi
mov esi, eax
test ebx, ebx
je 0x406a2b
test esi, esi
je 0x406a2b
call ebx
test eax, eax
je 0x406a2b
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
lea eax, [ebp - 0x3cc]
push eax
call fcn.00403580
add esp, 8
lea edi, [ebp - 0x9e2]
mov ecx, 0x81
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
mov ax, word [0x40bbac]
mov word [ebp - 0x9e4], ax
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x40bbac]
lea edi, [ebp - 0xcee]
mov word [ebp - 0xcf0], ax
mov ecx, 0x81
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x40bbac]
lea edi, [ebp - 0x7da]
mov word [ebp - 0x7dc], ax
mov ecx, 0x81
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp byte [0x40c25c], 6
jb 0x406b9b
cmp dword [0x40c25c], 0x80000000
jae 0x406b9b
call fcn.00403e80
test eax, eax
je 0x406b9b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00403fd0
add esp, 4
test eax, eax
je 0x406b9b
push 0
lea eax, [ebp - 0x9e4]
push 0x1a
push eax
push 0
call fcn.00403f70
add esp, 0x10
test eax, eax
je 0x406b9b
push 0x40c080
lea eax, [ebp - 0x9e4]
push eax
lea ecx, [ebp - 0x7dc]
push ecx
call dword [0x40c6d4]
add esp, 0xc
lea ecx, [ebp - 0x7dc]
push ecx
call dword [0x40c57c]
cmp eax, 0xffffffff
jne 0x406b3c
push 0
lea eax, [ebp - 0x7dc]
push eax
call dword [0x40c65c]
lea eax, [ebp - 0xcf0]
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.00404130
add esp, 8
test eax, eax
je 0x406b9b
push str.fastcopy.ini
lea eax, [ebp - 0x7dc]
push eax
lea ecx, [ebp - 0x9e4]
push ecx
call dword [0x40c6d4]
add esp, 0xc
lea ecx, [ebp - 0x9e4]
push ecx
call dword [0x40c57c]
cmp eax, 0xffffffff
jne 0x406b9b
lea eax, [ebp - 0xcf0]
lea ecx, [ebp - 0x7dc]
push eax
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.00406430
add esp, 0xc
cmp dword [ebp - 0x1c], 1
sbb eax, eax
push 0x41
push str.Install
and eax, 0xfffffffa
push 0
add eax, 9
push eax
call fcn.00403990
add esp, 8
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
push eax
call dword [ebx + 0xdc]
cmp eax, 1
jne 0x406be7
lea eax, [ebp - 0x3cc]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 5
lea ecx, [ebp - 0x5d4]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov byte [ebp - 4], 0
call fcn.00406c26
mov dword [ebp - 4], 0xffffffff
call fcn.00406c38
mov eax, 1
jmp 0x406c65
push 0
push 0x40c124
push 0
push 6
call fcn.00403990
add esp, 8
mov ecx, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call dword [eax + 0xdc]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret