Function at 0x490b04
Capabilities:
Copy file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x490b0c
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x490ec3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x490ed8
call fcn.00403b88
lea eax, [ebp - 0xc]
mov edx, 0x490ee8
call fcn.00403b88
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f34
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403f34
push eax
push 1
push 0x490ef4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 8]
mov edx, 0x490f00
call fcn.00403b88
lea eax, [ebp - 0xc]
mov edx, 0x490ed8
call fcn.00403b88
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f34
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403f34
push eax
push 1
push 0x490ef4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov dl, 1
mov eax, dword [0x45f708]
call fcn.0045f808
mov esi, eax
mov edx, 0x80000000
mov eax, esi
call fcn.0045f8a8
xor ecx, ecx
mov edx, 0x490f10
mov eax, esi
call fcn.0045f90c
test al, al
je 0x490bf6
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, esi
call fcn.0045fad4
mov eax, esi
call fcn.0045f878
mov eax, esi
call fcn.00402e68
push dword [ebx + 0x237ec]
push 0x490ee8
push 0x490f28
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403e30
mov eax, dword [ebp - 0x10]
mov edx, 0x490f38
call fcn.00403e80
jb 0x490c40
mov eax, dword [ebp - 0x14]
call fcn.00408f14
test al, al
jne 0x490d92
mov eax, dword [ebx + 0xa348]
call fcn.00408f14
test al, al
je 0x490cb7
push 0
mov eax, dword [ebp - 0x14]
call fcn.00403f34
push eax
mov eax, dword [ebx + 0xa348]
call fcn.00403f34
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x490cb7
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.00403f78
push 0
lea eax, [ebp - 0x1c]
mov ecx, 0x490f48
mov edx, dword [ebp - 0x18]
call fcn.00403dbc
mov eax, dword [ebp - 0x1c]
call fcn.00403f34
mov edx, eax
mov ecx, 0x490f58
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044eb9c
jmp 0x490ea8
lea eax, [ebp - 8]
mov edx, 0x490ed8
call fcn.00403b88
lea eax, [ebp - 0xc]
mov edx, 0x490f38
call fcn.00403b88
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f34
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00403f34
push eax
push 1
push 0x490f60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
push 0xffffffffffffffff
mov eax, dword [ebx + 0xa3b0]
call fcn.00403f34
push eax
push dword [ebx + 0x237ec]
push 0x490f70
push 0x490f80
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403e30
mov eax, dword [ebp - 0x20]
call fcn.00403f34
push eax
call sub.kernel32.dll_CopyFileA
push 0
lea eax, [ebp - 0x24]
mov ecx, 0x490f94
mov edx, dword [ebx + 0x237ec]
call fcn.00403dbc
mov eax, dword [ebp - 0x24]
call fcn.00403f34
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044ef0c
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408ff8
lea eax, [ebp - 0x28]
mov edx, 0x490f94
call fcn.00403d78
mov eax, dword [ebp - 0x28]
call fcn.00403f34
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 8]
mov edx, 0x490ed8
call fcn.00403b88
lea eax, [ebp - 0xc]
mov ecx, 0x490fa8
mov edx, dword [ebp - 0x14]
call fcn.00403dbc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f34
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00403f34
push eax
push 1
push 0x490fac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 8]
mov edx, 0x490ed8
call fcn.00403b88
lea eax, [ebp - 0xc]
mov ecx, 0x490fc8
mov edx, dword [ebp - 0x14]
call fcn.00403dbc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00403f34
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00403f34
push eax
push 1
push 0x490fcc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 0x30]
mov ecx, 0x490f94
mov edx, dword [ebx + 0x237ec]
call fcn.00403dbc
mov eax, dword [ebp - 0x30]
call fcn.00408f14
test al, al
jne 0x490ea8
push 0
lea eax, [ebp - 0x34]
mov ecx, 0x490f94
mov edx, dword [ebx + 0x237ec]
call fcn.00403dbc
mov eax, dword [ebp - 0x34]
call fcn.00403f34
push eax
lea edx, [ebp - 0x3c]
mov eax, dword [0x4acb28]
mov eax, dword [eax]
call fcn.0044ef0c
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00408ff8
lea eax, [ebp - 0x38]
mov edx, 0x490f94
call fcn.00403d78
mov eax, dword [ebp - 0x38]
call fcn.00403f34
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490eca
lea eax, [ebp - 0x3c]
mov edx, 0xe
call fcn.00403b14
ret