Function at 0x49ffc4
Capabilities:
Copy file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x49ffcc
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0386
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x4a039c
call fcn.00403c58
lea eax, [ebp - 0xc]
mov edx, 0x4a03ac
call fcn.00403c58
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404004
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404004
push eax
push 1
push 0x4a03b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 8]
mov edx, 0x4a03c4
call fcn.00403c58
lea eax, [ebp - 0xc]
mov edx, 0x4a039c
call fcn.00403c58
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404004
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404004
push eax
push 1
push 0x4a03b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov dl, 1
mov eax, dword [0x4606a4]
call fcn.004607a4
mov esi, eax
mov edx, 0x80000000
mov eax, esi
call fcn.00460844
xor ecx, ecx
mov edx, 0x4a03d4
mov eax, esi
call fcn.004608a8
test al, al
je 0x4a00b5
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, esi
call fcn.00460a70
mov eax, esi
call fcn.00460814
mov eax, esi
call fcn.00402f38
push dword [ebx + 0x4fa90]
push 0x4a03ac
push 0x4a03ec
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403f00
mov eax, dword [ebp - 0x10]
mov edx, 0x4a03fc
call fcn.00403f50
jb 0x4a00ff
mov eax, dword [ebp - 0x14]
call fcn.0040931c
test al, al
jne 0x4a021f
mov eax, dword [ebx + 0xa4b0]
call fcn.0040931c
test al, al
je 0x4a0144
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404004
push eax
mov eax, dword [ebx + 0xa4b0]
call fcn.00404004
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x4a0144
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.00404048
lea eax, [ebp - 8]
mov edx, 0x4a039c
call fcn.00403c58
lea eax, [ebp - 0xc]
mov edx, 0x4a03fc
call fcn.00403c58
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404004
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00404004
push eax
push 1
push 0x4a0404
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
push 0xffffffffffffffff
mov eax, dword [ebx + 0xa510]
call fcn.00404004
push eax
push dword [ebx + 0x4fa90]
push 0x4a0414
push 0x4a0424
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403f00
mov eax, dword [ebp - 0x1c]
call fcn.00404004
push eax
call sub.kernel32.dll_CopyFileA
push 0
lea eax, [ebp - 0x20]
mov ecx, 0x4a0438
mov edx, dword [ebx + 0x4fa90]
call fcn.00403e8c
mov eax, dword [ebp - 0x20]
call fcn.00404004
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044fd68
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00409400
lea eax, [ebp - 0x24]
mov edx, 0x4a0438
call fcn.00403e48
mov eax, dword [ebp - 0x24]
call fcn.00404004
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 8]
mov edx, 0x4a039c
call fcn.00403c58
lea eax, [ebp - 0xc]
mov ecx, 0x4a044c
mov edx, dword [ebp - 0x14]
call fcn.00403e8c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404004
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00404004
push eax
push 1
push 0x4a0450
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 8]
mov edx, 0x4a039c
call fcn.00403c58
lea eax, [ebp - 0xc]
mov ecx, 0x4a046c
mov edx, dword [ebp - 0x14]
call fcn.00403e8c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404004
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00404004
push eax
push 1
push 0x4a0470
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 0x2c]
mov ecx, 0x4a0484
mov edx, dword [ebx + 0x4fa8c]
call fcn.00403e8c
mov eax, dword [ebp - 0x2c]
call fcn.00409368
lea eax, [ebp - 0x30]
mov ecx, 0x4a0498
mov edx, dword [ebx + 0x4fa8c]
call fcn.00403e8c
mov eax, dword [ebp - 0x30]
call fcn.00409368
lea eax, [ebp - 0x34]
mov ecx, 0x4a0438
mov edx, dword [ebx + 0x4fa90]
call fcn.00403e8c
mov eax, dword [ebp - 0x34]
call fcn.0040931c
test al, al
jne 0x4a036b
push 0
lea eax, [ebp - 0x38]
mov ecx, 0x4a0438
mov edx, dword [ebx + 0x4fa90]
call fcn.00403e8c
mov eax, dword [ebp - 0x38]
call fcn.00404004
push eax
lea edx, [ebp - 0x40]
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044fd68
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00409400
lea eax, [ebp - 0x3c]
mov edx, 0x4a0438
call fcn.00403e48
mov eax, dword [ebp - 0x3c]
call fcn.00404004
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a038d
lea eax, [ebp - 0x40]
mov edx, 0xf
call fcn.00403be4
ret