Function at 0x496407
Capabilities:
Copy file
Create directory
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512923
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x93c
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
lea eax, [ebp - 0x824]
push eax
push 0x20119
push 0
push 0x5613d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x496484
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString
jmp 0x496acb
mov dword [ebp - 0x820], 0
jmp 0x49649f
mov ecx, dword [ebp - 0x820]
add ecx, 1
mov dword [ebp - 0x820], ecx
mov dword [ebp - 0x414], 0x400
mov byte [ebp - 0x40c], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x820]
push ecx
mov edx, dword [ebp - 0x824]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x496aa5
push 0x5b8d4c
lea eax, [ebp - 0x40c]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4964fc
jmp 0x496490
push 0x561418
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x40c]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push str.InprocServer32
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x561430
push 0x5b6504
push 0x80000000
lea edx, [ebp - 0x928]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x938], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x938]
push ecx
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x928]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x410]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x924]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x924]
push eax
call fcn.00401fca
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x92c], esp
lea edx, [ebp - 0x924]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x93c], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 0
jne 0x4965ea
jmp 0x496490
push ecx
mov ecx, esp
mov dword [ebp - 0x930], esp
lea eax, [ebp - 0x924]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x944], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x948]
push ecx
lea edx, [ebp - 0x924]
push edx
call fcn.004f9b07
add esp, 8
test eax, eax
jne 0x49669d
lea eax, [ebp - 0x924]
push eax
mov ecx, 0x5b5bf0
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f680
lea edx, [ebp - 0x40c]
push edx
push 0x561434
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea eax, [ebp - 0x924]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push str.Key_Eliminada__SharedTaskScheduler___s_______s_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x496490
push str.BROWSEUI.DLL
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.CBDISKMNTNTF3.DLL
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.CBFSCONNECTMNTNTF2017.DLL
lea ecx, [ebp - 0x924]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.CBFSMNTNTF3.DLL
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.CBFSMNTNTF4.DLL
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.CBFSMNTNTF5.DLL
lea ecx, [ebp - 0x924]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.CBFSMNTNTF6.DLL
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.DESKSCAPES.DLL
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.DESKTOPCONTROLPANEL.DLL
lea ecx, [ebp - 0x924]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.DLL.DLL
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.DREAMCONTROL.DLL
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.FENCESMENU.DLL
lea ecx, [ebp - 0x924]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.FENCESMENU64.DLL
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.IEFRAME.DLL
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.ODMENU.DLL
lea ecx, [ebp - 0x924]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.ODMENU64.DLL
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.SCPLIB.DLL
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.SSCBFSMNTNTF3.DLL
lea ecx, [ebp - 0x924]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.TASKBARDOCKLOADER32.DLL
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.THEMERESOURCECHANGER.DLL
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.VISTAFOLDERBACKGROUND.DLL
lea ecx, [ebp - 0x924]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x496903
push str.WDFSCONNECTMNTNTF2017.DLL
lea edx, [ebp - 0x924]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x496908
jmp 0x496490
lea eax, [ebp - 0x924]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x81c], eax
mov dword [0x5b84b8], 0
jmp 0x496938
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0x100
jge 0x496954
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x814], 0
jmp 0x496929
mov eax, dword [ebp - 0x81c]
mov dword [0x5b84b8], eax
jmp 0x496970
mov ecx, dword [0x5b84b8]
sub ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0
jle 0x496990
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x924]
cmp eax, 0x5c
jne 0x49698e
jmp 0x496990
jmp 0x496961
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov dword [ebp - 0x818], 0
jmp 0x4969c9
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [ebp - 0x818]
add eax, 1
mov dword [ebp - 0x818], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x81c]
jge 0x4969f2
mov edx, dword [ebp - 0x818]
mov eax, dword [0x5b84b8]
mov cl, byte [ebp + eax - 0x924]
mov byte [ebp + edx - 0x814], cl
jmp 0x4969ab
push 0x5b7ba4
push 0x561668
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea edx, [ebp - 0x814]
push edx
push 0x5b7ba4
push str._sMuestras_s__SharedTaskScheduler_.vir
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x5b6504
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea ecx, [ebp - 0x814]
push ecx
push 0x5b7ba4
lea edx, [ebp - 0x40c]
push edx
push str._SharedTaskScheduler___s___n__Por_favor__envienos_el_INFOSAT.TXT_y_una_muestra_del_fichero_n___sMuestras_s__SharedTaskScheduler_.vir_n__a__virus_satinfo.es_._Gracias._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
cmp dword [0x5b851c], 0
jne 0x496a94
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x496aa7
jmp 0x496aac
jmp 0x496490
mov eax, dword [ebp - 0x824]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret