Function at 0x47da50
Capabilities:
Check if file exists
Copy file
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b9da9
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x4ff1a0]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
call fcn.0042c710
xor ebx, ebx
cmp eax, ebx
je 0x47dc85
cmp dword [edi + 0x14], 8
jb 0x47daaf
mov eax, dword [edi]
jmp 0x47dab1
mov eax, edi
push 5
push ebx
push ebx
push eax
push str.StartPin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x47e12d
push 1
push 2
lea ecx, [esp + 0x24]
call fcn.00413cc0
mov dword [esp + 0x170], ebx
push edi
push ecx
push str.._path:
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea eax, [esp + 0x34]
push str.ShellExecute_Failed._GetLastError:
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.004135f0
add esp, 4
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 8
push 0x1e
mov esi, 0xf
push str.CShellUtility::AttachStartmenu
lea ecx, [esp + 0xf8]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
call fcn.0040ebe0
mov byte [esp + 0x170], 1
mov edi, 0x10
push edi
push str.ShellUtility.cpp
lea ecx, [esp + 0xc0]
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
call fcn.0040ebe0
mov byte [esp + 0x170], 2
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x20]
call fcn.00413de0
mov byte [esp + 0x170], 3
push eax
lea edx, [esp + 0xf4]
push edx
push 0x180
lea eax, [esp + 0xc4]
push eax
push ebx
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x170], 2
cmp dword [esp + 0xe8], 8
jb 0x47dbe3
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00490458
add esp, 4
xor edx, edx
mov dword [esp + 0xe8], 7
mov dword [esp + 0xe4], ebx
mov word [esp + 0xd4], dx
mov byte [esp + 0x170], 1
cmp dword [esp + 0xcc], edi
jb 0x47dc20
mov eax, dword [esp + 0xb8]
push eax
call fcn.00490458
add esp, 4
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
mov byte [esp + 0x170], bl
cmp dword [esp + 0x104], edi
jb 0x47dc55
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00490458
add esp, 4
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov byte [esp + 0xf0], bl
mov dword [esp + 0x170], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00412cc0
xor al, al
jmp 0x47e12f
push 0xa
xor edx, edx
mov esi, 7
push str.Start_Menu
lea ecx, [esp + 0xdc]
mov dword [esp + 0xf0], esi
mov dword [esp + 0xec], ebx
mov word [esp + 0xdc], dx
call fcn.0040e680
mov dword [esp + 0x170], 4
push 0x40
xor eax, eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [esp + 0xf8]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov word [esp + 0xf8], ax
call fcn.0040e680
mov byte [esp + 0x170], 5
mov dword [esp + 0x18], SysReAllocStringLen
call fcn.00410830
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0xdc]
lea edx, [esp + 0xf8]
lea esi, [esp + 0xc0]
call fcn.00412810
mov byte [esp + 0x170], 7
mov esi, 8
cmp dword [esp + 0x104], esi
jb 0x47dd46
mov edx, dword [esp + 0xf0]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov dword [esp + 0x104], 7
mov dword [esp + 0x100], ebx
mov word [esp + 0xf0], ax
mov byte [esp + 0x170], 8
cmp dword [esp + 0xe8], esi
jb 0x47dd83
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00490458
add esp, 4
xor edx, edx
mov dword [esp + 0xe8], 7
mov dword [esp + 0xe4], ebx
mov word [esp + 0xd4], dx
cmp dword [esp + 0xc8], ebx
jne 0x47de43
call fcn.00410830
lea ebx, [esp + 0xd4]
mov ecx, eax
call fcn.00411e50
mov byte [esp + 0x170], 9
push eax
lea ecx, [esp + 0xbc]
call fcn.00409ad0
mov eax, 8
mov byte [esp + 0x170], al
cmp dword [esp + 0xe8], eax
jb 0x47ddf9
mov eax, dword [esp + 0xd4]
push eax
call fcn.00490458
add esp, 4
xor ecx, ecx
mov dword [esp + 0xe8], 7
mov dword [esp + 0xe4], 0
mov word [esp + 0xd4], cx
cmp dword [esp + 0xc8], ecx
jbe 0x47de35
push 7
push 0x4e8a10
lea ecx, [esp + 0xc0]
call fcn.00410dc0
xor ebx, ebx
lea esi, [ebx + 8]
cmp dword [esp + 0xc8], ebx
je 0x47de6b
mov eax, dword [esp + 0xb8]
cmp dword [esp + 0xcc], esi
jae 0x47de5a
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
cmp al, bl
jne 0x47deb2
mov dword [esp + 0x170], 0xffffffff
cmp dword [esp + 0xcc], esi
jb 0x47de8f
mov edx, dword [esp + 0xb8]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov word [esp + 0xb8], ax
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], ebx
xor al, al
jmp 0x47e12f
cmp dword [esp + 0xc8], ebx
jbe 0x47e0ed
push 0x4c4f30
push edi
mov edi, 1
call fcn.0041a550
cmp eax, 0xffffffff
jne 0x47deee
mov dword [esp + 0x170], eax
lea ecx, [esp + 0xb8]
call fcn.0040f320
xor al, al
jmp 0x47e12f
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0x10]
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x130]
push ecx
mov ecx, esi
call fcn.00413c40
mov byte [esp + 0x170], 0xa
push 0x4c4f30
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x114]
push eax
call fcn.00410b20
add esp, 0xc
mov byte [esp + 0x170], 0xb
lea ecx, [esp + 0x128]
push ecx
push eax
lea edx, [esp + 0xdc]
push edx
call fcn.00410c00
add esp, 0xc
mov byte [esp + 0x170], 0xd
lea ecx, [esp + 0x10c]
call fcn.0040f320
mov edi, 8
cmp dword [esi + 0x14], edi
jb 0x47df70
mov ecx, dword [esi]
jmp 0x47df72
mov ecx, esi
push 0x1505
call fcn.0047e880
movzx eax, al
add esp, 4
cmp eax, ebx
jne 0x47e07e
push 1
push 2
lea ecx, [esp + 0x24]
call fcn.00413cc0
mov byte [esp + 0x170], 0xe
lea eax, [esp + 0xd4]
push eax
push ecx
lea ecx, [esp + 0x24]
push str.WinXP_pin_startmenu_quick_error:
push ecx
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 8
push str.CShellUtility::AttachStartmenu
lea ecx, [esp + 0x110]
call fcn.0040ece0
mov byte [esp + 0x170], 0xf
push str.ShellUtility.cpp
lea ecx, [esp + 0xf4]
call fcn.0040ece0
mov byte [esp + 0x170], 0x10
lea edx, [esp + 0x144]
push edx
lea ecx, [esp + 0x20]
call fcn.00413de0
mov byte [esp + 0x170], 0x11
push eax
lea eax, [esp + 0x110]
push eax
push 0x1a2
lea ecx, [esp + 0xfc]
push ecx
push ebx
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x170], 0x10
lea ecx, [esp + 0x144]
call fcn.0040f320
mov byte [esp + 0x170], 0xf
lea ecx, [esp + 0xf0]
call fcn.0040f350
mov byte [esp + 0x170], 0xe
lea ecx, [esp + 0x10c]
call fcn.0040f350
mov byte [esp + 0x170], 0xd
lea ecx, [esp + 0x1c]
call fcn.00412cc0
mov eax, dword [esp + 0xd4]
cmp dword [esp + 0xe8], edi
jae 0x47e095
lea eax, [esp + 0xd4]
cmp dword [esi + 0x14], edi
jb 0x47e09c
mov esi, dword [esi]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
mov byte [esp + 0x170], 0xa
lea ecx, [esp + 0xd4]
call fcn.0040f320
mov byte [esp + 0x170], 8
lea ecx, [esp + 0x128]
call fcn.0040f320
mov dword [esp + 0x170], 0xffffffff
lea ecx, [esp + 0xb8]
call fcn.0040f320
mov al, bl
jmp 0x47e12f
mov dword [esp + 0x170], 0xffffffff
cmp dword [esp + 0xcc], esi
jb 0x47e111
mov edx, dword [esp + 0xb8]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], ebx
mov word [esp + 0xb8], ax
mov al, 1
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.004911d1
mov esp, ebp
pop ebp
ret