Function at 0x100049c0
Capabilities:
Copy file
Encode data using xor
Enumerate files on windows
Get common file path
Get file version info
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe88
mov eax, dword [0x1002bea0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x104
push eax
push dword [0x1002d79c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0xd38]
push eax
push 0xa28
push 0
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10004a53
lea eax, [ebp - 0xe88]
push eax
lea eax, [ebp - 0xe84]
push eax
push 0x10022480
lea eax, [ebp - 0xd38]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10004a53
mov ecx, dword [ebp - 0xe84]
movzx eax, word [ecx + 0xa]
mov dword [0x1002cbbc], eax
movzx eax, word [ecx + 8]
mov dword [0x1002d0f0], eax
movzx eax, word [ecx + 0xe]
mov dword [0x1002d0f4], eax
lea eax, [ebp - 0xe7c]
mov ecx, 0x200
push eax
xor eax, eax
cmp byte [0x1002d7ac], al
cmovne eax, ecx
or eax, 0x20019
push eax
push 0
push str.SoftwareDeskSoft
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004af1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xe80], eax
lea eax, [ebp - 0xe80]
push eax
push 0
push 0
push 0
push ebx
push dword [ebp - 0xe7c]
call esi
mov eax, dword [ebp - 0xe80]
test eax, eax
je 0x10004ae5
push eax
push 1
call fcn.10015891
mov edi, eax
add esp, 8
test edi, edi
je 0x10004ae5
lea eax, [ebp - 0xe80]
push eax
push edi
push 0
push 0
push ebx
push dword [ebp - 0xe7c]
call esi
test eax, eax
je 0x10004b04
push edi
call fcn.1001408b
add esp, 4
push dword [ebp - 0xe7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001025d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xe80]
mov esi, 0x52e
cmp eax, esi
cmovb esi, eax
push esi
push edi
push 0x1002cbc0
call fcn.10011600
push edi
call fcn.1001408b
add esp, 0x10
push dword [ebp - 0xe7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x52e
jne 0x10004af1
call fcn.10004890
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10004b47
mov edi, ebx
mov edx, 0xffffffff
sub esi, ecx
je 0x10004b7a
nop dword [eax]
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1002d0f8]
sub esi, 1
jne 0x10004b60
not edx
cmp dword [0x1002cbc6], edx
jne 0x10004bac
movsx eax, word [0x1002cbca]
cmp eax, dword [0x1002cbbc]
jne 0x10004bac
movsx eax, word [0x1002cbcc]
cmp eax, dword [0x1002d0f0]
jne 0x10004bac
xor dword [0x1002cbc2], 0x5a72bc91
cmp word [0x1002cbd0], 0
jne 0x10004c48
lea eax, [ebp - 0xe7c]
mov byte [0x1002cab8], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x10004c16
lea eax, [ebp - 0xe80]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x10004c0a
push 0x1002cab8
push dword [ebp - 0xe80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 0xe7c]
push dword [ebp - 0xe80]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0xe7c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
push str.DeskSoft_s
lea eax, [ebp - 0xd38]
push 0xa28
push eax
call fcn.10001fc0
lea eax, [ebp - 0xd38]
push eax
push 0x104
push 0x1002cab8
call fcn.10015828
add esp, 0x1c
jmp 0x10004cb7
push 0x1002ccd8
push 0x104
push 0x1002cab8
call fcn.1001557c
add esp, 0xc
cmp word [0x1002cbd2], 0
je 0x10004cb7
push 0x10022480
push 0x104
push 0x1002cab8
call fcn.10015828
add esp, 0xc
mov dword [ebp - 0xe80], 0x104
lea eax, [ebp - 0xe80]
push eax
lea eax, [ebp - 0xd38]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xd38]
push eax
push 0x104
push 0x1002cab8
call fcn.10015828
add esp, 0xc
push 0x1002cbd4
push str._sInit.
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.10001fc0
add esp, 0x10
lea eax, [ebp - 0xe78]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004d67
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [eax]
lea eax, [ebp - 0xe4c]
push eax
push 0x1002cbd4
push str._sInit_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.10001fc0
lea eax, [ebp - 0xe4c]
push eax
push 0x1002cab8
push 0x100224d0
lea eax, [ebp - 0x310]
push 0x104
push eax
call fcn.10001fc0
add esp, 0x28
lea eax, [ebp - 0x310]
push 1
push eax
lea eax, [ebp - 0x108]
push eax
call edi
lea eax, [ebp - 0xe78]
push eax
push esi
call ebx
test eax, eax
jne 0x10004d00
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001025d
mov esp, ebp
pop ebp
ret