Function at 0x498358
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x498360
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x498631
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x49ea3c]
mov edx, dword [edx]
call fcn.00404cf0
mov eax, dword [ebp - 0xc]
call fcn.004092f8
lea edx, [ebp - 8]
call fcn.0045ad14
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [0x49ede0]
mov edx, dword [edx]
call fcn.00404cf0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
pop edx
call fcn.00404e04
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402b38
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00408fa8
test eax, eax
je 0x498606
xor eax, eax
push ebp
push 0x49844f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409564
test al, al
je 0x498418
mov eax, dword [ebp - 4]
call fcn.00409798
mov eax, dword [ebp - 4]
call fcn.00409564
test al, al
je 0x498418
xor eax, eax
call fcn.00404a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498606
push 0
mov eax, dword [ebp - 4]
call fcn.00404fb0
mov ebx, eax
push ebx
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402b38
mov eax, dword [ebp - 0x18]
call fcn.00404fb0
push eax
call sub.kernel32.dll_CopyFileA
push 4
push ebx
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498459
xor eax, eax
push ebp
push 0x4985f7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x118]
mov edx, dword [0x49ed74]
mov edx, dword [edx]
call fcn.00403814
lea eax, [ebp - 0x118]
mov edx, 0x498640
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031cc
jne 0x49856f
xor eax, eax
push ebp
push 0x4984cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11c]
mov edx, dword [0x49e888]
mov edx, dword [edx]
call fcn.00404cf0
mov eax, dword [ebp - 0x11c]
call fcn.0045b3dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4984d5
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
push ebp
push 0x498565
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x120]
mov edx, dword [0x49edc4]
mov edx, dword [edx]
call fcn.00404cf0
mov eax, dword [ebp - 0x120]
push eax
lea eax, [ebp - 0x124]
mov edx, dword [0x49ec6c]
mov edx, dword [edx]
call fcn.00404cf0
mov eax, dword [ebp - 0x124]
push eax
lea eax, [ebp - 0x128]
mov edx, dword [0x49e888]
mov edx, dword [edx]
call fcn.00404cf0
mov eax, dword [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
mov ecx, 0x49864c
mov edx, dword [ebp - 4]
call fcn.00404e04
mov ecx, dword [ebp - 0x12c]
pop eax
pop edx
call fcn.0045b274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49856f
lea edx, [ebp - 0x130]
mov eax, 1
call fcn.00402b38
cmp dword [ebp - 0x130], 0
jne 0x498598
push 0
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x118]
mov edx, dword [0x49ea58]
mov edx, dword [edx]
call fcn.00403814
lea eax, [ebp - 0x118]
mov edx, 0x498640
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031cc
jne 0x4985e0
lea edx, [ebp - 0x134]
mov eax, 1
call fcn.00402b38
cmp dword [ebp - 0x134], 0
jne 0x4985e0
call fcn.0045a308
call fcn.0040498c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498606
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498638
lea eax, [ebp - 0x134]
mov edx, 7
call fcn.00404b24
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404b24
ret