Function at 0x407f1a
Capabilities:
Check for unmoving mouse cursor
Create process on windows
Get common file path
Get file attributes
Persist via aedebug registry key
Query or enumerate registry value
Set current directory
Set registry value

Disassembly:
push ebp
push esi
push ebx
push edi
mov ebp, esp
sub esp, 0x408
push ebp
add dword [esp], 0xfffffff0
call sub.USER32.dll_GetCursorPos
push ebp
add dword [esp], 0xfffffff0
push dword [ebp + 0x14]
call sub.USER32.dll_ScreenToClient
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 0x14]
call sub.USER32.dll_ChildWindowFromPoint
cmp eax, dword [0x41a678]
jne 0x4088bc
push ebp
add dword [esp], 0xfffffff0
call sub.USER32.dll_GetCursorPos
push 0x2710
push dword [0x41a664]
call sub.USER32.dll_LoadMenuA
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
call sub.USER32.dll_GetSubMenu
mov dword [ebp - 4], eax
push 0xfffffffffffffff0
push dword [0x41a678]
call sub.USER32.dll_GetWindowLongA
mov esi, eax
test eax, 1
jne 0x407fa8
push 0
push 0x259
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
jmp 0x407fb7
push 3
push 0x259
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x25d
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x25e
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x260
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x261
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x262
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x25d
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x263
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x264
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x268
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push ebp
add dword [esp], 0xffffff7c
call sub.USER32.dll_GetCursorPos
push ebp
add dword [esp], 0xffffff7c
push dword [0x41a678]
call sub.USER32.dll_ScreenToClient
push ebp
add dword [esp], 0xffffff7c
push 0
push 0x1012
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
mov eax, dword [ebp - 0x7c]
test eax, 6
je 0x4080c0
push 0
push 0x258
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0
push 0x25f
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0
push 0x25b
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0
push 0x25c
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
jmp 0x408101
push 3
push 0x258
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x25f
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x25b
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 3
push 0x25c
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
jmp 0x40829a
cmp dword [0x41a71c], 1
jne 0x408119
push 3
push 0x267
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x24], 0x41d7e8
mov dword [ebp - 0x20], 0x104
push ebp
add dword [esp], 0xffffffc8
push 0
push 0x1005
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
push 0x41d6e4
push dword [ebp - 0x18]
call fcn.00408c7e
push 0x4217e8
push 0x41d6e4
call fcn.00401b87
push 0x41d7e8
push 0x41d6e4
call fcn.00401b87
mov dword [ebp - 0x1a0], 0
push ebp
add dword [esp], 0xfffffe60
push 0x41d6e4
call fcn.0040c1ee
test eax, eax
js 0x40829a
push 0x4217ea
push ebp
add dword [esp], 0xfffffe60
call fcn.00401c6c
jne 0x4081e2
push 0
push 0x25e
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0
push 0x261
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0
push 0x262
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0x41d6e4
call fcn.00401daa
test eax, eax
js 0x40820e
push 0
push 0x261
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0
push 0x262
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0x4217ef
push ebp
add dword [esp], 0xfffffe60
call fcn.00401c6c
jne 0x408231
push 0
push 0x263
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0x4217f4
push ebp
add dword [esp], 0xfffffe60
call fcn.00401c6c
jne 0x408254
push 0
push 0x264
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0x4217f9
push ebp
add dword [esp], 0xfffffe60
call fcn.00401c6c
jne 0x408277
push 0
push 0x260
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0x4217fe
push ebp
add dword [esp], 0xfffffe60
call fcn.00401c6c
jne 0x40829a
push 0
push 0x25d
push dword [ebp - 4]
call sub.USER32.dll_EnableMenuItem
push 0
push dword [0x41a678]
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x100
push dword [ebp - 4]
call sub.USER32.dll_TrackPopupMenu
mov ebx, eax
test ebx, ebx
je 0x4088ab
cmp ebx, 0x259
je 0x4086f7
cmp ebx, 0x258
je 0x4084ad
cmp ebx, 0x264
je 0x40846d
cmp ebx, 0x25e
je 0x4085cc
cmp ebx, 0x25f
je 0x408523
cmp ebx, 0x25b
je 0x408710
cmp ebx, 0x25c
je 0x40874c
cmp ebx, 0x25d
je 0x40876e
cmp ebx, 0x260
je 0x4087ed
cmp ebx, 0x261
je 0x408821
cmp ebx, 0x262
je 0x408843
cmp ebx, 0x263
je 0x408865
cmp ebx, 0x1f4
je 0x40848f
cmp ebx, 0x1f5
je 0x40848f
cmp ebx, 0x1f6
je 0x40848f
cmp ebx, 0x1f7
je 0x40848f
cmp ebx, 0x265
je 0x4083a5
cmp ebx, 0x266
je 0x4083e9
cmp ebx, 0x267
je 0x4083c7
push 0x41d6e4
push 0x404cf8
push dword [ebp + 0x14]
push 0x2710
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x4088ab
push 0x41d6e4
push section.code
push dword [ebp + 0x14]
push 0x2774
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x4088ab
push 0
push 0
push 0x1032
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
mov ecx, 0x104
mul ecx
push 4
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 0x3b4], eax
mov ebx, 0xffffffff
mov edi, dword [ebp - 0x3b4]
push 2
push ebx
push 0x100c
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
mov ebx, eax
push 3
push 0
push 0x41d6e4
call fcn.00409a37
push eax
push 0x8000
push 0
push dword [ebp - 0x3b4]
call sub.KERNEL32.dll_VirtualFree
pop eax
test eax, eax
jne 0x4088ab
call fcn.00407c35
jmp 0x4088ab
push 0x41d6e4
push 0x404108
push dword [ebp + 0x14]
push 0x251c
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x4088ab
sub ebx, 0x1f4
and esi, 0xfffffffc
or esi, ebx
push esi
push 0xfffffffffffffff0
push dword [0x41a678]
call sub.USER32.dll_SetWindowLongA
jmp 0x408891
push 0x421803
push ebp
add dword [esp], 0xfffffe60
call fcn.00401c6c
jne 0x4084d0
push 0x41d6e4
push 0x41d6e4
call fcn.0040c807
push 0x41d6e4
call fcn.004102c7
push 5
push 0
push 0
push 0x41d6e4
push 0x421808
push 0
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
jg 0x4088ab
cmp eax, 0x1f
je 0x408550
push 0x41d6e4
push eax
call fcn.0040ca9b
push 0
push 0
push 0x41d6e4
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4088ab
push 0x42180d
push ebp
add dword [esp], 0xfffffe60
call fcn.00401c6c
jne 0x408546
push 0x41d6e4
push 0x41d6e4
call fcn.0040c807
push 0x41d6e4
call fcn.004102c7
push 0x41d6e4
push 0x104
push ebp
add dword [esp], 0xfffffe60
call fcn.0040cbef
mov dword [ebp - 0x3f8], 0x44
push ebp
add dword [esp], 0xfffffc08
call sub.KERNEL32.dll_GetStartupInfoA
push ebp
add dword [esp], 0xfffffbf8
push ebp
add dword [esp], 0xfffffc08
push 0
push 0
push 0
push 1
push 0
push 0
push ebp
add dword [esp], 0xfffffe60
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x4088ab
push dword [ebp - 0x408]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x404]
call sub.KERNEL32.dll_CloseHandle
jmp 0x4088ab
mov dword [ebp - 0x3b0], 0x104
push ebp
add dword [esp], 0xfffffc50
push ebp
add dword [esp], 0xfffffd58
push ebp
add dword [esp], 0xfffffe5c
push 0x41aa2f
push 0x41a9fa
push 0x80000002
call sub.SHLWAPI.dll_SHGetValueA
test eax, eax
jne 0x4086cd
cmp dword [ebp - 0x3b0], 0
je 0x4086cd
lea eax, [ebp - 0x2a8]
mov bl, byte [eax]
cmp bl, 0x22
je 0x408626
mov bl, 0x20
push ebp
add dword [esp], 0xfffffd58
call sub.SHLWAPI.dll_PathFindFileNameA
mov cl, byte [eax]
cmp cl, bl
je 0x408640
test cl, cl
je 0x408640
inc eax
jmp 0x408633
mov word [eax + 1], 0x20
push 0x41d6e4
call fcn.004102c7
push 0x41d6e4
call sub.SHLWAPI.dll_PathQuoteSpacesA
push 0x41d6e4
push ebp
add dword [esp], 0xfffffd58
call fcn.00401b87
mov dword [ebp - 0x3f8], 0x44
push ebp
add dword [esp], 0xfffffc08
call sub.KERNEL32.dll_GetStartupInfoA
push ebp
add dword [esp], 0xfffffbf8
push ebp
add dword [esp], 0xfffffc08
push 0
push 0
push 0
push 1
push 0
push 0
push ebp
add dword [esp], 0xfffffd58
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x4086e2
push dword [ebp - 0x408]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x404]
call sub.KERNEL32.dll_CloseHandle
jmp 0x4088ab
push 0
push 0
push 0x421812
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4088ab
push 0
push 0
push 0x42183e
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4088ab
push 0
push 0
push 0x1016
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
jmp 0x408891
push 0x42185f
push ebp
add dword [esp], 0xfffffe60
call fcn.00401c6c
jne 0x408733
push 0x41d6e4
push 0x41d6e4
call fcn.0040c807
push 0x41d6e4
call fcn.004102c7
push 0x41d6e4
call fcn.004096d3
jmp 0x4088ab
push 0x41d6e4
push 0x409ff2
push dword [ebp + 0x14]
push 0xfa0
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x4088ab
push 0x41d6e4
push ebp
add dword [esp], 0xfffffe60
call fcn.0040c807
push ebp
add dword [esp], 0xfffffe60
call fcn.00401efc
push ebp
add dword [esp], 0xfffffe60
push 0x41d6e4
call fcn.00401bb4
push ebp
add dword [esp], 0xfffffe60
call sub.KERNEL32.dll_GetFileAttributesA
test eax, eax
js 0x4088ab
and eax, 0x10
jne 0x4087cb
push ebp
add dword [esp], 0xfffffe60
push 0x41d6e4
call fcn.00401f0c
push 0x41d6e4
call fcn.00408e41
push eax
push 9
push 0x110b
push dword [0x41a674]
call sub.USER32.dll_PostMessageA
jmp 0x408891
push 0
push 0x40ce10
push dword [ebp + 0x14]
push 0x1770
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
push 0x41d6e4
call fcn.004102c7
push eax
push 0x41d6e4
call fcn.0040ccb7
jmp 0x4088ab
push 0x41d6e4
push 0x40ede1
push dword [ebp + 0x14]
push 0x1d4c
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x4088ab
push 0x41d6e4
push 0x40eff3
push dword [ebp + 0x14]
push 0x1d4c
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x4088ab
push 0x41d6e4
call fcn.004102c7
push 0x41d6e4
push 0x40ff01
push dword [ebp + 0x14]
push 0x2134
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x4088ab
push 0
push 0
push dword [0x41a678]
call sub.USER32.dll_InvalidateRect
push dword [0x41a678]
call sub.USER32.dll_UpdateWindow
push dword [ebp - 8]
call sub.USER32.dll_DestroyMenu
mov esp, ebp
pop edi
pop ebx
pop esi
pop ebp
ret 4
cmp eax, dword [0x41a674]
jne 0x408c4c
push ebp
add dword [esp], 0xffffff90
call sub.USER32.dll_GetCursorPos
push ebp
add dword [esp], 0xffffff90
push dword [0x41a674]
call sub.USER32.dll_ScreenToClient
push ebp
add dword [esp], 0xffffff90
push 0
push 0x1111
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0x60], 1
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0x104
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x5c], eax
push ebp
add dword [esp], 0xffffffa0
push 0
push 0x110c
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
push dword [ebp - 0x5c]
push 3
push 0x110a
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
test eax, eax
jne 0x408a49
push ebp
add dword [esp], 0xffffff90
push dword [0x41a674]
call sub.USER32.dll_ClientToScreen
call sub.USER32.dll_CreatePopupMenu
mov dword [ebp - 8], eax
push 0x421864
push 0x64
push 0
push dword [ebp - 8]
call sub.USER32.dll_AppendMenuA
push 0x421875
push 0x65
push 0
push dword [ebp - 8]
call sub.USER32.dll_AppendMenuA
push 0
push dword [0x41a674]
push 0
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push 0x100
push dword [ebp - 8]
call sub.USER32.dll_TrackPopupMenu
mov ebx, eax
cmp ebx, 0x64
jne 0x4089e8
push ebp
add dword [esp], 0xfffffe60
call fcn.00401b1b
lea eax, [eax + ebp - 0x1a0]
mov byte [eax], 0x5c
mov byte [eax + 1], 0
push ebp
add dword [esp], 0xfffffe60
push 0x40cf43
push dword [ebp + 0x14]
push 0x1964
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x408c44
cmp ebx, 0x65
jne 0x408c44
push ebp
add dword [esp], 0xfffffe60
push dword [ebp - 0x5c]
call fcn.00408c7e
push ebp
add dword [esp], 0xfffffe60
call fcn.00401b1b
lea edx, [eax + ebp - 0x1a0]
mov cl, byte [edx - 1]
cmp cl, 0x5c
je 0x408a25
mov byte [edx], 0x5c
mov byte [edx + 1], 0
inc eax
push eax
push ebp
add dword [esp], 0xfffffe60
push 1
push 0x41aadf
push 0x41aa83
push 0x80000001
call sub.SHLWAPI.dll_SHSetValueA
jmp 0x408c44
push ebp
add dword [esp], 0xffffff90
push dword [0x41a674]
call sub.USER32.dll_ClientToScreen
call sub.USER32.dll_CreatePopupMenu
mov dword [ebp - 8], eax
push 0x421886
push 0x64
push 0
push dword [ebp - 8]
call sub.USER32.dll_AppendMenuA
push 0x421897
push 0x66
push 0
push dword [ebp - 8]
call sub.USER32.dll_AppendMenuA
push 0x4218a6
push 0x67
push 0
push dword [ebp - 8]
call sub.USER32.dll_AppendMenuA
push 0x4218b6
push 0x65
push 0
push dword [ebp - 8]
call sub.USER32.dll_AppendMenuA
push 0
push dword [0x41a674]
push 0
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push 0x100
push dword [ebp - 8]
call sub.USER32.dll_TrackPopupMenu
mov ebx, eax
cmp ebx, 0x64
jne 0x408b21
push ebp
add dword [esp], 0xfffffe60
push dword [ebp - 0x5c]
call fcn.00408c7e
push ebp
add dword [esp], 0xfffffe60
call fcn.00401b1b
lea edx, [eax + ebp - 0x1a0]
mov cl, byte [edx - 1]
cmp cl, 0x5c
je 0x408afd
mov byte [edx], 0x5c
mov byte [edx + 1], 0
inc eax
push eax
push ebp
add dword [esp], 0xfffffe60
push 1
push 0x41aadf
push 0x41aa83
push 0x80000001
call sub.SHLWAPI.dll_SHSetValueA
jmp 0x408c44
cmp ebx, 0x65
jne 0x408b46
push dword [ebp - 0x5c]
push 0x404753
push dword [ebp + 0x14]
push 0x222e
push dword [0x41a664]
call sub.USER32.dll_DialogBoxParamA
jmp 0x408c44
cmp ebx, 0x66
jne 0x408bef
mov ebx, dword [ebp - 0x5c]
push ebp
add dword [esp], 0xfffffc54
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push ebp
add dword [esp], 0xfffffc54
call fcn.00408e41
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 8
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0x10
push ebp
add dword [esp], 0xffffffa0
push 0
push 0x110d
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
push ebp
add dword [esp], 0xfffffe60
push ebx
call fcn.00408c7e
push ebp
add dword [esp], 0xfffffe60
call sub.KERNEL32.dll_SetCurrentDirectoryA
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], 8
mov dword [ebp - 0x58], 0x10
mov dword [ebp - 0x54], 0x10
push ebp
add dword [esp], 0xffffffa0
push 0
push 0x110d
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
jmp 0x408c44
cmp ebx, 0x67
jne 0x408c44
push ebp
add dword [esp], 0xfffffc54
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push ebp
add dword [esp], 0xfffffc54
call fcn.00408e41
push eax
push eax
push 9
push 0x110b
push dword [0x41a674]
call sub.USER32.dll_PostMessageA
pop eax
push eax
push 0
push 0x1114
push dword [0x41a674]
call sub.USER32.dll_PostMessageA
jmp 0x408c44
push dword [ebp - 8]
call sub.USER32.dll_DestroyMenu
mov esp, ebp
pop edi
pop ebx
pop esi
pop ebp
ret 4