Function at 0x410df9
Capabilities:
Bypass mark of the web
Check if file exists
Copy file
Create directory
Delete file
Persist via run registry key

Disassembly:
push 0x1bc
mov eax, 0x49ffb2
call fcn.00454d9d
xor eax, eax
mov edi, ecx
mov dword [ebp - 0x100], edi
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 4], eax
call fcn.004138b2
mov ecx, edi
call fcn.004142a6
call fcn.00413a7d
test al, al
je 0x410e45
push edi
call fcn.0041211f
push 2
pop eax
call fcn.00454df9
ret
mov ecx, edi
call fcn.004140e4
mov eax, dword [edi + 0x1c]
mov ebx, 0x4ae0f8
push ebx
push eax
call fcn.0041f44f
push 0x4ae1b8
push eax
call fcn.0041f44f
push 0x4ae1cc
push eax
call fcn.0041f44f
lea esi, [ebp - 0x6c]
mov ecx, eax
call fcn.0041ee43
xor esi, esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x58], esi
jne 0x410eb6
lea ecx, [ebp - 0x1a8]
call fcn.0045066b
mov dword [ebp - 0x1a8], 0x4b1354
mov dword [ebp - 0x19c], 0x80047e4a
push 0x4ba2ec
lea eax, [ebp - 0x1a8]
push eax
call fcn.004548cc
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
jae 0x410ec2
lea eax, [ebp - 0x68]
push eax
call fcn.00421118
cmp eax, esi
pop ecx
jge 0x410f42
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
jae 0x410ed9
lea eax, [ebp - 0x68]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x410f42
cmp dword [ebp - 0x54], 8
mov ebx, dword [ebp - 0x68]
jae 0x410ef1
lea ebx, [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x410f05
and eax, 0xffff
or eax, 0x80070000
push ebx
push esi
push eax
push dword [edi + 0x10c]
call fcn.00418e71
lea ecx, [ebp - 0x150]
call fcn.0045066b
mov dword [ebp - 0x150], 0x4b1354
mov dword [ebp - 0x144], 0x80047e5d
push 0x4ba2ec
lea eax, [ebp - 0x150]
jmp 0x410eb0
lea edx, [ebp - 0x34]
mov ecx, edi
call fcn.00414203
mov byte [ebp - 4], 2
cmp dword [ebp - 0x20], esi
jne 0x410f84
lea ecx, [ebp - 0x160]
call fcn.0045066b
mov dword [ebp - 0x160], 0x4b1354
mov dword [ebp - 0x154], 0x80047e4b
push 0x4ba2ec
lea eax, [ebp - 0x160]
jmp 0x410eb0
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x410f90
lea eax, [ebp - 0x30]
push eax
call fcn.00421118
cmp eax, esi
pop ecx
jge 0x411010
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x410fa7
lea eax, [ebp - 0x30]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x411010
cmp dword [ebp - 0x1c], 8
mov ebx, dword [ebp - 0x30]
jae 0x410fbf
lea ebx, [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x410fd3
and eax, 0xffff
or eax, 0x80070000
push ebx
push esi
push eax
push dword [edi + 0x10c]
call fcn.00418e71
lea ecx, [ebp - 0x184]
call fcn.0045066b
mov dword [ebp - 0x184], 0x4b1354
mov dword [ebp - 0x178], 0x80047e5e
push 0x4ba2ec
lea eax, [ebp - 0x184]
jmp 0x410eb0
mov ecx, edi
lea eax, [ebp - 0xc0]
call fcn.00410891
mov ecx, edi
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 3
call fcn.0041087f
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.0040ce4d
push esi
push 1
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 3
call fcn.00407ab4
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x50]
call fcn.0041571b
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.00415753
lea eax, [ebp - 0x50]
push edi
push eax
call fcn.00417664
pop ecx
pop ecx
test al, al
jne 0x411096
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.00417664
pop ecx
pop ecx
test al, al
je 0x411173
cmp dword [ebp - 0x38], 8
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x108], 1
jae 0x4110ac
lea ecx, [ebp - 0x4c]
cmp dword [edi + 0x18], 8
jb 0x4110b7
mov eax, dword [edi + 4]
jmp 0x4110ba
lea eax, [edi + 4]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4110f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x4110db
and eax, 0xffff
or eax, 0x80070000
push eax
lea esi, [ebp - 0x1c8]
call fcn.00410c22
push 0x4ba2ec
mov eax, esi
jmp 0x410eb0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x88]
call fcn.004156ab
push 0x4afae0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 6
call fcn.0040cce3
cmp dword [ebp - 0x70], 8
mov eax, dword [ebp - 0x84]
jae 0x411128
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, esi
jne 0x41115e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41115e
cmp eax, esi
jle 0x41114c
and eax, 0xffff
or eax, 0x80070000
push 0x4afb08
push esi
push eax
push dword [edi + 0x10c]
call fcn.00418e71
mov ecx, edi
call fcn.004152d0
push esi
push 1
lea ecx, [ebp - 0x88]
call fcn.00407ab4
lea ecx, [ebp - 0x114]
call fcn.0043a5a9
push esi
push 0xf003f
push 0x4ae5a0
push 0x80000001
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 7
call fcn.0043abe8
cmp eax, esi
jne 0x4111d0
lea ecx, [ebp - 0x140]
call fcn.0045066b
mov dword [ebp - 0x140], 0x4b1354
mov dword [ebp - 0x134], 0x80047e4c
push 0x4ba2ec
lea eax, [ebp - 0x140]
jmp 0x410eb0
mov eax, dword [edi + 0x1c]
push ebx
push eax
call fcn.0041f44f
push 0x4ae14c
push eax
call fcn.0041f44f
push 0x4ae0e0
push eax
call fcn.0041f44f
lea esi, [ebp - 0xa4]
mov ecx, eax
call fcn.0041ee43
push eax
lea eax, [ebp - 0xf8]
push 0x4ae38c
push eax
mov byte [ebp - 4], 8
call fcn.004166f0
add esp, 0xc
xor ebx, ebx
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0xa
call fcn.00407ab4
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0041576e
push 0x4afb4c
push eax
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 0xb
call fcn.0041673b
add esp, 0xc
push ebx
push esi
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xd
call fcn.00407ab4
cmp dword [ebp - 0xc4], 8
mov ecx, dword [ebp - 0xd8]
jae 0x41127b
lea ecx, [ebp - 0xd8]
cmp dword [ebp - 0xe0], 8
mov eax, dword [ebp - 0xf4]
jae 0x411290
lea eax, [ebp - 0xf4]
push ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.0043ab8f
cmp eax, ebx
jne 0x4112d0
lea ecx, [ebp - 0x1b8]
call fcn.0045066b
mov dword [ebp - 0x1b8], 0x4b1354
mov dword [ebp - 0x1ac], 0x80047e4d
push 0x4ba2ec
lea eax, [ebp - 0x1b8]
jmp 0x410eb0
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.00412191
mov dword [edi + 0x28], esi
cmp dword [ebp - 0x108], esi
jne 0x4113c7
mov byte [edi + 0x24], 1
add edi, 0x34
call fcn.00410b55
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0041576e
push 0x4afb54
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0xe
call fcn.0040cce3
push 0x10
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004501b0
add esp, 0xc
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x8c], 8
mov ebx, dword [ebp - 0xa0]
jae 0x411342
lea ebx, [ebp - 0xa0]
lea eax, [ebp - 0x7c]
push eax
call fcn.0042194b
xor esi, esi
cmp eax, esi
jge 0x411398
push 0x4afb60
push esi
push eax
mov eax, dword [ebp - 0x100]
push dword [eax + 0x10c]
call fcn.00418e71
lea ecx, [ebp - 0x174]
call fcn.0045066b
mov dword [ebp - 0x174], 0x4b1354
mov dword [ebp - 0x168], 0x80047e4e
push 0x4ba2ec
lea eax, [ebp - 0x174]
jmp 0x410eb0
cmp dword [ebp - 0x7c], esi
je 0x4113a6
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x78], esi
je 0x4113b4
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 1
lea ecx, [ebp - 0xa4]
call fcn.00407ab4
xor esi, esi
xor ebx, ebx
inc esi
push ebx
push esi
lea ecx, [ebp - 0xdc]
call fcn.00407ab4
push ebx
push esi
lea ecx, [ebp - 0xf8]
call fcn.00407ab4
lea ecx, [ebp - 0x114]
call fcn.0043a88a
push ebx
push esi
lea ecx, [ebp - 0x50]
call fcn.00407ab4
push ebx
push esi
lea ecx, [ebp - 0xc0]
call fcn.00407ab4
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.00407ab4
push ebx
push esi
lea ecx, [ebp - 0x6c]
call fcn.00407ab4
mov eax, dword [ebp - 0x108]
jmp 0x410e3f