Function at 0x46e1e4
Capabilities:
Copy file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x46e1ec
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x46ee3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x46ee54
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x14]
call fcn.0046f9c8
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x46ee90
call fcn.00404b20
mov edx, dword [ebp - 0x34]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebp - 0x15], 1
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
call fcn.004701fc
cmp dword [ebp - 0x3c], 0
je 0x46e26f
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x14]
call fcn.004701fc
mov eax, dword [ebp - 0x40]
call fcn.004093b0
test al, al
je 0x46eddb
mov dl, 1
mov eax, dword [0x416d68]
call fcn.00403a60
mov dword [ebp - 0x20], eax
mov dl, 1
mov eax, dword [0x416d68]
call fcn.00403a60
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x14]
call fcn.0046f9c8
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x20]
call fcn.004675fc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.004679cc
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x46e2ce
mov edx, 0x46eeb0
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46edc9
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x46edc9
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 4]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, byte [0x46eec4]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x14]
call fcn.0046f9c8
mov edx, dword [ebp - 0x50]
xor ecx, ecx
pop eax
call fcn.0040dcc8
mov eax, dword [ebp - 0x48]
push eax
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x14]
call fcn.0046fa60
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 8]
pop ecx
call fcn.00404b20
mov edx, 0x46ee54
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x58]
mov ecx, dword [ebp - 8]
mov edx, 0x46eed0
call fcn.00404b20
mov edx, dword [ebp - 0x58]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.00409338
inc eax
je 0x46e38f
mov edx, 0x46eee8
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46e39e
mov edx, 0x46ef10
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebp - 0x25], 0
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 8]
call fcn.00409718
mov eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x10]
call fcn.00404814
mov edx, eax
pop eax
call fcn.0046faf8
test al, al
je 0x46e48a
mov edx, 0x46ef3c
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 8]
call fcn.004096e4
mov eax, dword [ebp - 0x60]
call fcn.004093b0
test al, al
jne 0x46e473
mov edx, 0x46ef60
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 8]
call fcn.004096e4
mov eax, dword [ebp - 0x64]
call fcn.004093d4
mov ebx, eax
test bl, bl
je 0x46e449
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 8]
call fcn.004096e4
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
mov edx, 0x46ef90
call fcn.00404b20
mov edx, dword [ebp - 0x68]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov byte [ebp - 0x25], 1
jmp 0x46e4a5
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 8]
call fcn.004096e4
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
mov edx, 0x46efb8
call fcn.00404b20
mov edx, dword [ebp - 0x70]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46e4a5
mov edx, 0x46efdc
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov bl, 1
mov byte [ebp - 0x25], 1
jmp 0x46e4a5
mov edx, 0x46f008
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.00409338
inc eax
setne bl
test bl, bl
je 0x46ed93
mov edx, 0x46f030
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.00409514
test al, 1
je 0x46e4d6
movzx edx, ax
and edx, 0xfffffffe
mov eax, dword [ebp - 8]
call fcn.00409528
push 0x46f054
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
call fcn.00409718
push dword [ebp - 0x7c]
push 0x46f06c
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.00404b94
mov edx, dword [ebp - 0x78]
mov eax, dword [0x473c88]
mov eax, dword [eax + 0x358]
call fcn.0043bce8
call fcn.0046e1a4
push 0x46f054
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 4]
call fcn.00409718
push dword [ebp - 0x84]
push 0x46f07c
push dword [ebp - 8]
lea eax, [ebp - 0x80]
mov edx, 4
call fcn.00404b94
mov edx, dword [ebp - 0x80]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
call fcn.00409718
mov eax, dword [ebp - 0x88]
mov edx, 0x46f08c
call fcn.00408ac8
test al, al
je 0x46e6c4
push 0
lea eax, [ebp - 0x8c]
call fcn.00470464
lea eax, [ebp - 0x8c]
mov edx, 0x46f0a8
call fcn.00404adc
mov eax, dword [ebp - 0x8c]
call fcn.00404cd4
push eax
mov eax, dword [ebp - 4]
call fcn.00404cd4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x46e6b0
mov dl, 1
mov eax, dword [0x41ff90]
call fcn.00420090
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x46e65e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x30]
call fcn.00420130
xor ecx, ecx
mov edx, 0x46f0c8
mov eax, dword [ebp - 0x30]
call fcn.00420194
push 0x46f104
lea eax, [ebp - 0x94]
call fcn.00470464
push dword [ebp - 0x94]
push 0x46f120
lea eax, [ebp - 0x98]
call fcn.00470464
push dword [ebp - 0x98]
push 0x46f144
lea eax, [ebp - 0x90]
mov edx, 5
call fcn.00404b94
mov ecx, dword [ebp - 0x90]
mov edx, 0x46f160
mov eax, dword [ebp - 0x30]
call fcn.00420508
mov eax, dword [ebp - 0x30]
call fcn.00420100
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e665
mov eax, dword [ebp - 0x30]
call fcn.00403a90
ret
mov edx, 0x46f1c4
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46eda2
push 0
mov eax, dword [ebp - 8]
call fcn.00404cd4
push eax
mov eax, dword [ebp - 4]
call fcn.00404cd4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x46ed15
cmp byte [ebp - 0x25], 0
je 0x46e743
lea eax, [ebp - 0xa4]
mov ecx, dword [ebp - 8]
mov edx, 0x46f1f8
call fcn.00404b20
mov edx, dword [ebp - 0xa4]
mov eax, dword [0x473cb8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x46f208
push dword [ebp - 8]
push 0x46f218
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.00404b94
mov edx, dword [ebp - 0xa8]
mov eax, dword [0x473cb8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.0046f474
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 4]
call fcn.00409718
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
mov edx, 0x46f224
call fcn.00404b20
mov edx, dword [ebp - 0xac]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x46f054
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 4]
call fcn.00409718
push dword [ebp - 0xb8]
push 0x46f248
lea eax, [ebp - 0xb4]
mov edx, 3
call fcn.00404b94
mov edx, dword [ebp - 0xb4]
mov eax, dword [0x473c88]
mov eax, dword [eax + 0x358]
call fcn.0043bce8
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 0
je 0x46e7d8
cmp dword [ebp - 0x10], 0
jne 0x46e7d8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x14]
call fcn.004048ac
cmp dword [ebp - 0x10], 0
je 0x46ed0a
lea eax, [ebp - 0xbc]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46f25c
call fcn.00404b20
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x46f270
mov eax, dword [ebp - 0x10]
call fcn.00408ac8
test al, al
jne 0x46e84d
mov edx, 0x46f284
mov eax, dword [ebp - 0x10]
call fcn.00408ac8
test al, al
jne 0x46e84d
mov edx, 0x46f294
mov eax, dword [ebp - 0x10]
call fcn.00408ac8
test al, al
jne 0x46e84d
mov edx, 0x46f2a4
mov eax, dword [ebp - 0x10]
call fcn.00408ac8
test al, al
je 0x46ece7
push 0x46f2b4
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 4]
call fcn.00409718
push dword [ebp - 0xc4]
push 0x46f06c
lea eax, [ebp - 0xc0]
mov edx, 3
call fcn.00404b94
mov edx, dword [ebp - 0xc0]
mov eax, dword [0x473c88]
mov eax, dword [eax + 0x358]
call fcn.0043bce8
mov eax, dword [0x472804]
mov eax, dword [eax]
call fcn.0045d368
mov edx, 0x46f270
mov eax, dword [ebp - 0x10]
call fcn.00408ac8
test al, al
je 0x46ea38
call fcn.0046e1a4
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 8]
call fcn.00409750
mov eax, dword [ebp - 0xc8]
mov edx, 0x46f2d0
call fcn.00408ac8
test al, al
je 0x46e992
push 0x46f218
push dword [ebp - 8]
push 0x46f2e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b94
xor ecx, ecx
mov edx, dword [0x473c94]
mov eax, dword [ebp - 0xc]
call fcn.00467810
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
call fcn.00409718
mov edx, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc]
xor eax, eax
call fcn.0046df94
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 8]
call fcn.00409718
mov eax, dword [ebp - 0xd0]
xor edx, edx
call fcn.00467ad4
lea edx, [ebp - 0xd4]
mov eax, dword [ebp - 4]
call fcn.00409718
mov edx, dword [ebp - 0xd4]
mov ecx, 0x46f2f8
xor eax, eax
call fcn.0046df94
cmp byte [ebp - 0x25], 0
je 0x46ed0a
lea eax, [ebp - 0xd8]
mov ecx, dword [ebp - 8]
mov edx, 0x46f30c
call fcn.00404b20
mov edx, dword [ebp - 0xd8]
mov eax, dword [0x473cb8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46ed0a
push 0x46f318
push dword [ebp - 8]
push 0x46f218
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b94
xor eax, eax
push ebp
push 0x46e9d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, dword [0x473c94]
mov eax, dword [ebp - 0xc]
call fcn.00467810
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46e9e5
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 4]
call fcn.00409718
mov edx, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0046df94
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x25], 0
je 0x46ed0a
lea eax, [ebp - 0xe0]
mov ecx, dword [ebp - 8]
mov edx, 0x46f30c
call fcn.00404b20
mov edx, dword [ebp - 0xe0]
mov eax, dword [0x473cb8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46ed0a
mov edx, 0x46f284
mov eax, dword [ebp - 0x10]
call fcn.00408ac8
test al, al
je 0x46eb43
call fcn.0046e1a4
push 0x46f218
push dword [0x473cd0]
push 0x46f330
push dword [ebp - 8]
push 0x46f354
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00404b94
mov cl, 1
mov edx, dword [0x473c94]
mov eax, dword [ebp - 0xc]
call fcn.00467810
mov ebx, eax
lea edx, [ebp - 0xe4]
mov eax, dword [ebp - 4]
call fcn.00409718
mov edx, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0046df94
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x46ed0a
call fcn.0046e1a4
push 0x46f218
push dword [0x473cd0]
push 0x46f368
push dword [ebp - 8]
push 0x46f354
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00404b94
mov cl, 1
mov edx, dword [0x473c94]
mov eax, dword [ebp - 0xc]
call fcn.00467810
mov ebx, eax
lea edx, [ebp - 0xe8]
mov eax, dword [ebp - 4]
call fcn.00409718
mov edx, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0046df94
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x25], 0
je 0x46ed0a
lea eax, [ebp - 0xec]
mov ecx, dword [ebp - 8]
mov edx, 0x46f38c
call fcn.00404b20
mov edx, dword [ebp - 0xec]
mov eax, dword [0x473cb8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46ed0a
mov edx, 0x46f2a4
mov eax, dword [ebp - 0x10]
call fcn.00408ac8
test al, al
je 0x46ec4a
call fcn.0046e1a4
push 0x46f218
push dword [0x473cd0]
push 0x46f330
push dword [ebp - 8]
push 0x46f354
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00404b94
mov cl, 1
mov edx, dword [0x473c94]
mov eax, dword [ebp - 0xc]
call fcn.00467810
mov ebx, eax
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 4]
call fcn.00409718
mov edx, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0046df94
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x46ed0a
call fcn.0046e1a4
push 0x46f218
push dword [0x473cd0]
push 0x46f398
push dword [ebp - 8]
push 0x46f218
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00404b94
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00467810
mov ebx, eax
lea edx, [ebp - 0xf4]
mov eax, dword [ebp - 4]
call fcn.00409718
mov edx, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0046df94
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x25], 0
je 0x46ed0a
lea eax, [ebp - 0xf8]
mov ecx, dword [ebp - 8]
mov edx, 0x46f3bc
call fcn.00404b20
mov edx, dword [ebp - 0xf8]
mov eax, dword [0x473cb8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46ed0a
mov edx, 0x46f294
mov eax, dword [ebp - 0x10]
call fcn.00408ac8
test al, al
je 0x46ed0a
call fcn.0046e1a4
push 0x46f218
push dword [0x473cd0]
push 0x46f330
push dword [ebp - 8]
push 0x46f354
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00404b94
mov cl, 1
mov edx, dword [0x473c94]
mov eax, dword [ebp - 0xc]
call fcn.00467810
mov ebx, eax
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 4]
call fcn.00409718
mov edx, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0046df94
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x25], 0
je 0x46ed0a
lea eax, [ebp - 0x100]
mov ecx, dword [ebp - 8]
mov edx, 0x46f3c8
call fcn.00404b20
mov edx, dword [ebp - 0x100]
mov eax, dword [0x473cb8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x46ed0a
lea eax, [ebp - 0x104]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46f3d4
call fcn.00404b20
mov edx, dword [ebp - 0x104]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [0x473cac]
jmp 0x46eda2
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 4]
call fcn.00409718
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
mov edx, 0x46f3f0
call fcn.00404b20
mov edx, dword [ebp - 0x108]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x46f054
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
call fcn.00409718
push dword [ebp - 0x114]
push 0x46f410
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00404b94
mov edx, dword [ebp - 0x110]
mov eax, dword [0x473c88]
mov eax, dword [eax + 0x358]
call fcn.0043bce8
mov byte [ebp - 0x15], 0
jmp 0x46eda2
mov edx, 0x46f424
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [ebp - 0x15], 0
jne 0x46edb1
cmp byte [0x473cf1], 0
je 0x46edc9
mov eax, dword [0x472804]
mov eax, dword [eax]
call fcn.0045d368
inc dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jne 0x46e2ea
mov eax, dword [ebp - 0x1c]
call fcn.00403a90
mov eax, dword [ebp - 0x20]
call fcn.00403a90
jmp 0x46ee0f
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 0x14]
call fcn.004701fc
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
mov edx, 0x46f44c
call fcn.00404b20
mov edx, dword [ebp - 0x118]
mov eax, dword [0x473c8c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ee41
lea eax, [ebp - 0x11c]
mov edx, 0x3b
call fcn.00404838
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404838
ret