Function at 0x4d2a1c
Capabilities:
Check os version
Create directory
Delete directory
Get common file path
Move file
Persist via windows service
Set registry value

Disassembly:
push 0x4b8
mov eax, 0x5152c9
call fcn.005060cc
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4ac], esi
call fcn.0045d959
test eax, eax
je 0x4d2e62
cmp dword [ebx], 0
je 0x4d2a50
test esi, esi
jne 0x4d2e62
mov edi, dword [ebx + 4]
xor edx, edx
inc edx
cmp edi, edx
je 0x4d31c3
cmp edi, 2
je 0x4d31c3
cmp edi, 0x1b
je 0x4d3085
cmp edi, 0x1c
je 0x4d3085
lea eax, [edi - 3]
cmp eax, 7
ja 0x4d2bc4
push 0x400
xor esi, esi
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.004f1a90
mov ecx, dword [ebp - 0x4ac]
lea eax, [edi - 7]
add esp, 0xc
test ecx, ecx
jne 0x4d2aac
lea eax, [edi - 3]
cmp eax, 3
ja 0x4d2e62
neg ecx
push esi
sbb eax, eax
and eax, 4
sub edi, eax
lea eax, [ebp - 0x410]
push dword [edi*4 + 0x51f4d4]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4d2e62
lea ecx, [ebp - 0x410]
call fcn.004234e6
test eax, eax
je 0x4d2e62
mov edi, dword [ebp - 0x4ac]
test edi, edi
jne 0x4d2b16
lea ecx, [ebp - 0x410]
call fcn.00422800
push str.__Disabled_by_AnVir_
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x410]
call fcn.004227d2
push esi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebx + 0x20]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x4ac]
mov ecx, ebx
push eax
call fcn.004d191e
lea ecx, [ebp - 0x410]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edx, dword [ebp - 0x4ac]
or esi, 0xffffffff
mov dword [ebp - 0x4a8], eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4d2b88
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4a8]
test eax, eax
je 0x4d2e62
test edi, edi
je 0x4d2d32
lea eax, [ebp - 0x4a8]
mov ecx, ebx
push eax
call fcn.004d198b
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edx, dword [ebp - 0x4a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jmp 0x4d2d28
cmp edi, 0x10
jne 0x4d2d3a
lea eax, [ebp - 0x4a8]
push eax
call fcn.004d1a55
mov edx, esi
neg edx
mov ecx, dword [eax]
sbb edx, edx
add edx, 3
test ecx, ecx
je 0x4d2bf5
call fcn.004c4cf5
mov dword [ebp - 0x4ac], eax
jmp 0x4d2bfc
and dword [ebp - 0x4ac], 0
mov edx, dword [ebp - 0x4a8]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4d2c1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x4ac], 0
je 0x4d2e62
test esi, esi
jne 0x4d2c92
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x4b4], esp
push str.AnVirDisabled
call fcn.004094e6
lea eax, [ebp - 0x4ac]
mov dword [ebp - 4], 7
push eax
mov ecx, ebx
call fcn.004d1a55
mov esi, eax
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 8
call fcn.004094e6
push ecx
mov ecx, esp
mov byte [ebp - 4], 9
push esi
mov edx, eax
call fcn.0040a740
pop ecx
push 2
pop edx
mov byte [ebp - 4], 0xb
call fcn.00415563
add esp, 0xc
mov byte [ebp - 4], 0xa
jmp 0x4d2cf7
push ecx
mov ecx, esp
mov dword [ebp - 0x4b0], esp
push str.AnVirDisabled
call fcn.004094e6
lea eax, [ebp - 0x4ac]
mov dword [ebp - 4], 0xc
push eax
mov ecx, ebx
call fcn.004d1a55
mov esi, eax
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0xd
call fcn.004094e6
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xe
push esi
mov edx, eax
call fcn.0040a740
pop ecx
xor edx, edx
mov byte [ebp - 4], pe_nt_image_headers32
inc edx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00414f9c
pop ecx
pop ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x4a8]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4d2d14
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x4ac]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4d2d32
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
inc eax
jmp 0x4d2e64
call fcn.00442fdc
test eax, eax
je 0x4d2fe3
lea eax, [ebp - 0x4a8]
push eax
call fcn.004d1a87
mov edx, dword [ebp - 0x4a8]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, dword [eax]
mov edi, dword [eax - 0xc]
mov eax, esi
add edi, 0xffffffec
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4d2d7b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, 0x1e
ja 0x4d2e62
cmp dword [ebx + 4], 0x17
je 0x4d2f5d
cmp dword [ebx + 4], 0x18
je 0x4d2f5d
lea eax, [ebp - 0x4a8]
mov ecx, ebx
push eax
call fcn.004d1a87
mov dword [ebp - 4], 0x13
mov ecx, dword [eax]
call fcn.004cd4c5
mov ecx, dword [ebp - 0x4ac]
cmp eax, ecx
mov dword [ebp - 4], esi
mov edx, dword [ebp - 0x4a8]
sete byte [ebp - 0x4b5]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4d2de7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x4ac]
cmp byte [ebp - 0x4b5], 0
jne 0x4d2e62
xor esi, esi
mov dword [ebp - 0x4c4], esi
mov dword [ebp - 0x4c0], esi
mov dword [ebp - 0x4bc], esi
test ecx, ecx
je 0x4d2e6c
push 0x2001f
push ecx
mov ecx, esp
mov dword [ebp - 4], 0x14
push str.ExtSettings_
mov edx, 0xd5aed4
call fcn.00405cb9
pop ecx
push SysReAllocString
lea ecx, [ebp - 0x4c4]
call fcn.00414ee2
test eax, eax
jne 0x4d2e57
push ecx
push esp
mov ecx, ebx
call fcn.004d1a87
lea ecx, [ebp - 0x4c4]
call fcn.00414f23
test eax, eax
je 0x4d2f4d
lea ecx, [ebp - 0x4c4]
call fcn.00408049
xor eax, eax
call fcn.00506076
ret 4
mov edi, 0x2001f
mov dword [ebp - 4], 0x15
push edi
push ecx
mov ecx, esp
mov edx, 0xd5aed4
push str.ExtSettings_
call fcn.00405cb9
pop ecx
push SysReAllocString
lea ecx, [ebp - 0x4c4]
call fcn.00414ee2
test eax, eax
je 0x4d2ecc
push esi
push esi
push edi
push esi
push esi
push ecx
mov ecx, esp
mov edx, 0xd5aed4
push str.ExtSettings_
call fcn.00405cb9
pop ecx
push SysReAllocString
lea ecx, [ebp - 0x4c4]
call fcn.00414e95
test eax, eax
jne 0x4d2e57
push esi
push esi
push edi
push esi
push esi
push ecx
push esp
mov ecx, ebx
call fcn.004d1a87
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x4c4]
call fcn.00414e95
test eax, eax
jne 0x4d2e57
push 4
lea eax, [ebp - 0x4a8]
xor ebx, ebx
push eax
push 4
push esi
push str.Flags
push dword [ebp - 0x4c4]
inc ebx
mov dword [ebp - 0x4a8], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x4b0], esp
push 0x51ebf4
call fcn.004094e6
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x16
push str.Version
call fcn.004094e6
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 0x15
call fcn.00415386
lea ecx, [ebp - 0x4c4]
call fcn.00408049
jmp 0x4d2d32
push ecx
mov ecx, esp
mov dword [ebp - 0x4b0], esp
mov edi, 0x51e784
push edi
call fcn.004094e6
push 2
mov dword [ebp - 4], 0x11
push dword [ebx + 8]
push ecx
mov eax, esp
mov dword [ebp - 0x4b4], esp
push eax
mov ecx, ebx
call fcn.004d1a87
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x12
mov esi, esp
call fcn.004169ca
test eax, eax
mov ecx, str.AnVirDisabled
mov edx, 0xd5af20
cmove edi, ecx
mov ecx, esi
push edi
call fcn.00405cb9
pop ecx
mov ecx, dword [ebp - 0x4ac]
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov edx, dword [ebx + 0x2c]
call fcn.00413acb
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4d2e62
mov ecx, ebx
call fcn.004d219a
mov eax, esi
jmp 0x4d2e64
cmp edi, 0x1d
je 0x4d2ff1
cmp edi, 0x1e
jne 0x4d2e62
cmp dword [0xd5b274], 0
jne 0x4d3041
push 0x90
lea eax, [ebp - 0x4a0]
mov dword [0xd5b274], edx
push 0
push eax
mov dword [ebp - 0x4a4], 0x94
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
imul eax, dword [ebp - 0x4a0], 0xa
add eax, dword [ebp - 0x49c]
mov dword [0xd5b270], eax
jmp 0x4d3046
mov eax, dword [0xd5b270]
push 0x20
pop ecx
push 0x5c
pop edx
cmp eax, 0x3c
cmovge ecx, edx
add ecx, ebx
push ecx
mov esi, esp
mov dword [ebp - 0x4b0], esi
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.004098e7
mov ecx, dword [ebp - 0x4ac]
add eax, 0x10
mov dword [esi], eax
call fcn.004c2ece
pop ecx
test eax, eax
jne 0x4d2d32
jmp 0x4d2e62
mov eax, dword [ebx + 0x3c]
cmp eax, edx
je 0x4d3167
cmp eax, 2
je 0x4d30f2
add eax, 0xfffffffd
cmp eax, 4
ja 0x4d2e62
push ecx
mov esi, esp
mov dword [ebp - 0x4b0], esp
mov dword [ebp - 0x4b4], esi
mov ecx, dword [ebx + 0x24]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 5
push dword [ebx + 0x3c]
push dword [ebx + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x4b4], esp
mov dword [ebp - 0x4a8], esi
mov ecx, dword [ebx + 0x38]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 6
jmp 0x4d3134
push ecx
mov ecx, esp
mov dword [ebp - 0x4b0], esp
push 0x51e784
call fcn.004094e6
mov dword [ebp - 4], 3
push 2
push dword [ebx + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x4b4], esp
mov dword [ebp - 0x4a8], esi
mov ecx, dword [ebx + 0x38]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
push ecx
mov esi, esp
mov dword [ebp - 0x4a8], esi
mov ecx, dword [ebx + 0x30]
sub ecx, 0x10
call fcn.004098e7
mov ecx, dword [ebp - 0x4ac]
add eax, 0x10
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
mov edx, dword [ebx + 0x2c]
call fcn.00413acb
add esp, 0x14
jmp 0x4d3251
push dword [ebx + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x4b0], esp
mov dword [ebp - 0x4b4], esi
mov ecx, dword [ebx + 0x34]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
push ecx
mov dword [ebp - 4], 2
mov esi, esp
mov dword [ebp - 0x4b4], esi
mov ecx, dword [ebx + 0x30]
sub ecx, 0x10
call fcn.004098e7
mov ecx, dword [ebp - 0x4ac]
add eax, 0x10
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
mov edx, dword [ebx + 0x2c]
call fcn.00414112
add esp, 0xc
jmp 0x4d3251
mov ecx, dword [ebx + 0x28]
lea eax, [ecx - 7]
test esi, esi
jne 0x4d31d0
lea eax, [ecx - 1]
cmp eax, 5
ja 0x4d2e62
push 6
pop eax
push 0xfffffffffffffffa
pop edx
test esi, esi
push ecx
cmovne eax, edx
mov dword [ebp - 0x4b0], esp
mov esi, esp
mov dword [ebp - 0x4b4], esi
lea edi, [eax + ecx]
mov ecx, dword [ebx + 0x20]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
and dword [ebp - 4], 0
push ecx
mov esi, esp
mov dword [ebp - 0x4b4], esp
mov dword [ebp - 0x4a8], esi
mov ecx, dword [ebx + 0x24]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
push ecx
lea eax, [edi*4 + 0xd5aed8]
mov byte [ebp - 4], 1
mov ecx, esp
mov edx, 0xd5aed4
push eax
call fcn.0040a740
or dword [ebp - 4], 0xffffffff
pop ecx
push dword [ebx + 0x2c]
mov ecx, ebx
call fcn.004d20b8
test eax, eax
je 0x4d2e62
mov ecx, ebx
call fcn.004d219a
jmp 0x4d3078