Function at 0x449047
Capabilities:
Create directory
Persist via run registry key

Disassembly:
mov eax, 0x4eb86e
call fcn.0047b598
sub esp, 0x9a4
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x20], esi
cmp dword [esi + 0x8c], 1
jne 0x4492b6
push dword [esi + 0x90]
lea ebx, [esi + 0x90]
call fcn.004097de
test eax, eax
pop ecx
je 0x44909a
mov ebx, dword [ebx]
mov edi, str.psnetwork.ini
push edi
push ebx
push str.pgfpath
mov esi, str.vodnet
jmp 0x4492e1
mov edx, dword [ebx]
cmp dword [edx - 8], 0x104
jg 0x449295
mov ax, word [0x5345c0]
push 0x40
mov word [ebp - 0x160], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x15e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x160]
push edx
push eax
call fcn.0047b680
pop ecx
lea eax, [ebp - 0x160]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0x14]
push eax
call fcn.004dc6dc
and dword [ebp - 4], 0
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x18]
call fcn.004dc6dc
lea eax, [ebp - 0x160]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
push eax
lea ecx, [ebp - 0x10]
call fcn.004dc6dc
push 0x534198
lea ecx, [ebp - 0x18]
push dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004d5dfb
mov eax, dword [0x52ba98]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
mov byte [ebp - 4], 3
call fcn.00449539
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push dword [ebp - 0x18]
push str._s_s
push eax
call fcn.004d64b3
push dword [ebp - 0x14]
lea eax, [ebp - 0x160]
push eax
call fcn.0047b680
mov edi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
add esp, 0x18
lea eax, [ebp - 0x160]
push eax
call edi
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0x14]
push eax
call fcn.004dc7f7
push 2
mov esi, 0x52584c
push esi
lea ecx, [ebp - 0x14]
call fcn.004d613b
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x4491ef
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.004d6093
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004dc7a7
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004dc66e
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathIsRootA]
test eax, eax
jne 0x4491e1
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xffffffff
lea eax, [ecx + 1]
je 0x4491ef
push eax
jmp 0x449193
push dword [ebp - 0x1c]
call fcn.004097de
test eax, eax
pop ecx
je 0x449239
push dword [ebp - 0x1c]
lea eax, [ebp - 0x160]
push eax
call fcn.0047b680
pop ecx
lea eax, [ebp - 0x160]
pop ecx
push eax
call edi
lea eax, [ebp - 0x160]
mov ecx, ebx
push eax
call fcn.004dc7f7
mov ebx, dword [ebx]
mov edi, str.psnetwork.ini
push edi
push ebx
push str.pgfpath
mov esi, str.vodnet
jmp 0x44925d
mov edi, str.psnetwork.ini
mov esi, str.vodnet
push edi
push 0x534198
push str.pgfpath
push esi
call fcn.00403bf4
mov ebx, dword [ebx]
push edi
push ebx
push str.pgfpath2
push esi
call fcn.00403bf4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004dc66e
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004dc66e
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004dc66e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dc66e
jmp 0x4492e7
mov edi, str.psnetwork.ini
mov esi, str.vodnet
push edi
push 0x534198
push str.pgfpath
push esi
call fcn.00403bf4
mov ebx, dword [ebx]
push edi
push ebx
jmp 0x4492dc
mov edi, str.psnetwork.ini
mov esi, str.vodnet
push edi
push 0x534198
push str.pgfpath
push esi
call fcn.00403bf4
mov eax, dword [ebp - 0x20]
push edi
mov eax, dword [eax + 0x90]
push eax
push str.pgfpath2
push esi
call fcn.00403bf4
mov eax, dword [ebp - 0x20]
mov ebx, 0x52617c
cmp dword [eax + 0x98], 0
jne 0x449307
push edi
push ebx
push 0x52994c
push esi
call fcn.00403bf4
jmp 0x44935d
mov ecx, dword [0x52ba98]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 0x9c]
add eax, 0x9c
cmp ecx, 0x78
mov dword [ebp - 4], 5
jg 0x44932c
cmp ecx, 1
jge 0x44932f
and dword [eax], 0
push dword [eax]
lea eax, [ebp - 0x18]
push 0x525838
push eax
call fcn.004d64b3
add esp, 0xc
push edi
push dword [ebp - 0x18]
push 0x52994c
push esi
call fcn.00403bf4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004dc66e
mov eax, dword [ebp - 0x20]
push edi
cmp dword [eax + 0x94], 0
je 0x449429
push 0x526180
push 0x529950
push esi
call fcn.00403bf4
push 0
lea ecx, [ebp - 0x5c]
call fcn.0040969c
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 6
call fcn.00409b83
push eax
lea ecx, [ebp - 0x10]
call fcn.004dc6dc
push str.ppsap.exe
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.004dca4a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5c]
call fcn.004097f8
test eax, eax
je 0x44940f
push bind
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x5a0]
call fcn.00406d71
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9b0]
mov byte [ebp - 4], 8
call fcn.004400fd
lea eax, [ebp - 0x9b0]
lea ecx, [ebp - 0x5a0]
push eax
push str.PPS_Accelerator
push 0
call fcn.0040683c
lea ecx, [ebp - 0x5a0]
mov byte [ebp - 4], 7
call fcn.00406e4a
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.004dc66e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.0040978c
jmp 0x449483
push ebx
push 0x529950
push esi
call fcn.00403bf4
push bind
push str.SoftwareMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x5a0]
call fcn.00406d71
push str.PPS_Accelerator
push 0x529990
lea ecx, [ebp - 0x5a0]
mov dword [ebp - 4], 9
call fcn.00406c75
push 1
push str.PPSAP.EXE
call fcn.00448fb3
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x5a0]
call fcn.00406e4a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret