Function at 0x4085e0
Capabilities:
Create directory
Extract resource via kernel32 functions
Get common file path
Get program files directory
Persist via run registry key
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525c1f
mov eax, dword fs:[0]
push eax
mov eax, 0x10534
call fcn.0050cb10
mov eax, dword [0x57f82c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x583198], 0
je 0x40861d
call fcn.00407c40
push 0
push 0x26
lea eax, [ebp - 0x10424]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x10424]
push ecx
lea ecx, [ebp - 0x1042c]
call fcn.00401020
mov dword [ebp - 4], 0
cmp dword [0x583198], 0
je 0x408679
push 0
push 0x538718
lea ecx, [ebp - 0x1042c]
call fcn.0040a4a0
cmp eax, 0xffffffff
jne 0x408679
push 0x538720
lea ecx, [ebp - 0x1042c]
call fcn.0040a1b0
push 0
lea ecx, [ebp - 0x1042c]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x538728
mov edx, 6
add edx, 0x81
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
cmp dword [0x582f10], 0
je 0x4086d1
push 0xa
mov ecx, dword [0x582f10]
add ecx, 0x74
call fcn.00409450
cmp dword [ebp - 0x18], 0x64
jbe 0x408885
push 0
push 0x538730
push 0x538740
lea ecx, [ebp - 0x1042c]
push ecx
lea edx, [ebp - 0x10444]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104a4], eax
mov eax, dword [ebp - 0x104a4]
mov dword [ebp - 0x104a8], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x104a8]
push ecx
lea edx, [ebp - 0x10448]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104ac], eax
mov ecx, dword [ebp - 0x104ac]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x10448]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10444]
call fcn.004019f0
push 0x538744
push 0x538754
lea eax, [ebp - 0x1042c]
push eax
lea ecx, [ebp - 0x1044c]
push ecx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104b0], eax
mov edx, dword [ebp - 0x104b0]
mov dword [ebp - 0x104b4], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x104b4]
push eax
lea ecx, [ebp - 0x10450]
push ecx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104b8], eax
mov ecx, dword [ebp - 0x104b8]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x10450]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1044c]
call fcn.004019f0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea ecx, [ebp - 0x10438]
push ecx
call fcn.0040337a
mov dword [ebp - 0x244], 0xffffffff
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x10438]
push eax
call fcn.00402f96
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x1043c], ecx
mov dword [ebp - 0x244], 0
jmp 0x40883c
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x1043c]
jae 0x408879
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x10438]
push edx
call fcn.00402f96
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x10438]
push edx
call fcn.004046c0
jmp 0x40882d
mov eax, dword [ebp - 0x10438]
push eax
call fcn.00402f6f
cmp dword [0x582f10], 0
je 0x40889e
push 0x1e
mov ecx, dword [0x582f10]
add ecx, 0x74
call fcn.00409450
cmp dword [0x583198], 0
je 0x408aba
push 0x538758
mov ecx, 7
add ecx, 0x81
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x64
jbe 0x408ab8
mov byte [0x58319d], 1
lea eax, [ebp - 0x10424]
push eax
lea ecx, [ebp - 0x1042c]
call fcn.004010a0
push 0x5384e5
push 0x538760
lea ecx, [ebp - 0x1042c]
call fcn.0040a1d0
push 0
push 0x538768
push 0x538778
lea ecx, [ebp - 0x1042c]
push ecx
lea edx, [ebp - 0x10454]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104bc], eax
mov eax, dword [ebp - 0x104bc]
mov dword [ebp - 0x104c0], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x104c0]
push ecx
lea edx, [ebp - 0x10458]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104c4], eax
mov ecx, dword [ebp - 0x104c4]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x10458]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10454]
call fcn.004019f0
push 0x53877c
push 0x53878c
lea eax, [ebp - 0x1042c]
push eax
lea ecx, [ebp - 0x1045c]
push ecx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104c8], eax
mov edx, dword [ebp - 0x104c8]
mov dword [ebp - 0x104cc], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x104cc]
push eax
lea ecx, [ebp - 0x10460]
push ecx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104d0], eax
mov ecx, dword [ebp - 0x104d0]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x10460]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1045c]
call fcn.004019f0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea ecx, [ebp - 0x10438]
push ecx
call fcn.0040337a
mov dword [ebp - 0x244], 0xffffffff
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x10438]
push eax
call fcn.00402f96
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x1043c], ecx
mov dword [ebp - 0x244], 0
jmp 0x408a6f
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x1043c]
jae 0x408aac
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x10438]
push edx
call fcn.00402f96
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x10438]
push edx
call fcn.004046c0
jmp 0x408a60
mov eax, dword [ebp - 0x10438]
push eax
call fcn.00402f6f
jmp 0x408ac1
mov byte [0x58319d], 1
cmp dword [0x582f10], 0
je 0x408ada
push 0x32
mov ecx, dword [0x582f10]
add ecx, 0x74
call fcn.00409450
cmp dword [0x583198], 0
je 0x408b0c
movzx ecx, byte [0x58319d]
test ecx, ecx
jne 0x408b0c
push 0x538790
mov edx, 0x12
add edx, 0x81
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
jmp 0x408b27
push 0x538798
mov eax, 0xd
add eax, 0x81
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
push 0xffdc
push 0
lea edx, [ebp - 0x10224]
push edx
call fcn.0050c7f0
add esp, 0xc
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea edx, [ebp - 0x10224]
push edx
call fcn.0050bdd0
add esp, 0xc
push str.ini.reg
push 0x5387ac
push 0x5387bc
lea eax, [ebp - 0x1042c]
push eax
lea ecx, [ebp - 0x10464]
push ecx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104d4], eax
mov edx, dword [ebp - 0x104d4]
mov dword [ebp - 0x104d8], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x104d8]
push eax
lea ecx, [ebp - 0x10468]
push ecx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104dc], eax
mov edx, dword [ebp - 0x104dc]
mov dword [ebp - 0x104e0], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x104e0]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00407880
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x10468]
call fcn.004019f0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10464]
call fcn.004019f0
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10428], eax
cmp dword [ebp - 0x10428], 0xffffffff
je 0x408c72
push 0
push 0
push 0
mov edx, dword [ebp - 0x10428]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x10440]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10224]
push edx
mov eax, dword [ebp - 0x10428]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x10428]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x582f10], 0
je 0x408c8b
push 0x46
mov ecx, dword [0x582f10]
add ecx, 0x74
call fcn.00409450
lea ecx, [ebp - 0x10430]
call fcn.0040a150
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x14]
push edx
push str._S___s_
lea eax, [ebp - 0x10430]
push eax
call fcn.0040acb0
add esp, 0xc
push 0
push 0x5387c8
push 0x5387d8
lea ecx, [ebp - 0x1042c]
push ecx
lea edx, [ebp - 0x1046c]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104e4], eax
mov eax, dword [ebp - 0x104e4]
mov dword [ebp - 0x104e8], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x104e8]
push ecx
lea edx, [ebp - 0x10470]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x104ec], eax
mov eax, dword [ebp - 0x104ec]
mov dword [ebp - 0x104f0], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x104f0]
call fcn.00401750
push eax
lea ecx, [ebp - 0x10430]
call fcn.00401750
push eax
push str.regedit.exe
push 0
push 0
call fcn.00408380
add esp, 0x18
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x10470]
call fcn.004019f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1046c]
call fcn.004019f0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x5831b8
call fcn.00401750
push eax
push str.TC_TCServer
push 0x5387f4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
mov ecx, dword [0x5831a0]
push ecx
push str.TC_TCPort
push 0x53881c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408500
add esp, 0x10
mov ecx, 0x5831b4
call fcn.00401750
push eax
push str.TC_PatchServer
push 0x538848
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
mov edx, dword [0x5831a4]
push edx
push str.TC_HTTP_Port
push 0x538874
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408500
add esp, 0x10
mov ecx, 0x5831ac
call fcn.0040a570
mov ecx, 0x5832a8
call fcn.0040a570
mov ecx, 0x5831b0
call fcn.0040a570
mov ecx, 0x5831ac
call fcn.00401750
push eax
push str.TC_Org
push 0x538898
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
mov ecx, 0x5832a8
call fcn.00401750
push eax
push str.TC_Section
push 0x5388c0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
mov ecx, 0x5831b0
call fcn.00401750
push eax
push str.TC_User_office
push 0x5388ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
push 0x538908
lea ecx, [ebp - 0x10474]
call fcn.00401020
mov dword [ebp - 0x104f4], eax
mov eax, dword [ebp - 0x104f4]
mov dword [ebp - 0x104f8], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x104f8]
push ecx
push 0x538918
lea ecx, [ebp - 0x10478]
call fcn.00401020
mov dword [ebp - 0x104fc], eax
mov edx, dword [ebp - 0x104fc]
mov dword [ebp - 0x10500], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x10500]
push eax
lea ecx, [ebp - 0x10424]
push ecx
lea edx, [ebp - 0x1047c]
push edx
call fcn.00407950
add esp, 0xc
mov dword [ebp - 0x10504], eax
mov eax, dword [ebp - 0x10504]
mov dword [ebp - 0x10508], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10508]
push ecx
lea edx, [ebp - 0x10480]
push edx
call fcn.0040a790
add esp, 0xc
mov dword [ebp - 0x1050c], eax
mov eax, dword [ebp - 0x1050c]
mov dword [ebp - 0x10510], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10510]
push ecx
lea ecx, [ebp - 0x1042c]
call fcn.0040a170
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x10480]
call fcn.004019f0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1047c]
call fcn.004019f0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x10478]
call fcn.004019f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10474]
call fcn.004019f0
cmp dword [0x583198], 0
je 0x4090a0
movzx edx, byte [0x58319d]
test edx, edx
jne 0x4090a0
push 0
push 0x53891c
lea ecx, [ebp - 0x1042c]
call fcn.0040a4a0
cmp eax, 0xffffffff
jne 0x4090a0
push 0x538924
lea ecx, [ebp - 0x10484]
call fcn.00401020
mov dword [ebp - 0x10514], eax
mov eax, dword [ebp - 0x10514]
mov dword [ebp - 0x10518], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x10518]
push ecx
push str.__x86__
lea ecx, [ebp - 0x10488]
call fcn.00401020
mov dword [ebp - 0x1051c], eax
mov edx, dword [ebp - 0x1051c]
mov dword [ebp - 0x10520], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x10520]
push eax
lea ecx, [ebp - 0x10424]
push ecx
lea edx, [ebp - 0x1048c]
push edx
call fcn.00407950
add esp, 0xc
mov dword [ebp - 0x10524], eax
mov eax, dword [ebp - 0x10524]
mov dword [ebp - 0x10528], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x10528]
push ecx
lea edx, [ebp - 0x10490]
push edx
call fcn.0040a790
add esp, 0xc
mov dword [ebp - 0x1052c], eax
mov eax, dword [ebp - 0x1052c]
mov dword [ebp - 0x10530], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x10530]
push ecx
lea ecx, [ebp - 0x1042c]
call fcn.0040a170
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x10490]
call fcn.004019f0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1048c]
call fcn.004019f0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x10488]
call fcn.004019f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10484]
call fcn.004019f0
cmp dword [0x583198], 0
je 0x4090e0
movzx edx, byte [0x58319d]
test edx, edx
je 0x4090e0
push 0
push 0x53893c
lea ecx, [ebp - 0x1042c]
call fcn.0040a4a0
cmp eax, 0xffffffff
je 0x4090e0
push 0x5384e6
push str.__x86_
lea ecx, [ebp - 0x1042c]
call fcn.0040a1d0
lea ecx, [ebp - 0x1042c]
call fcn.00401750
push eax
push str.TC_InstallPath
push 0x53895c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
push str._m__d__Y
lea eax, [ebp - 0x10434]
push eax
lea ecx, [ebp - 0x10498]
push ecx
call fcn.00409340
mov ecx, eax
call fcn.00409380
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x10434]
call fcn.00401750
push eax
push str.TC_IDATE
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
cmp dword [0x5831a8], 0
jne 0x409184
push 0
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408500
add esp, 0x10
push 1
push str.UacDisableNotify
push str.SoftwareMicrosoftSecurity_Center
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408500
add esp, 0x10
cmp dword [0x582f10], 0
je 0x40919d
push 0x5a
mov ecx, dword [0x582f10]
add ecx, 0x74
call fcn.00409450
lea ecx, [ebp - 0x1042c]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x538a2c
push 0x538a3c
lea edx, [ebp - 0x1042c]
push edx
lea eax, [ebp - 0x1049c]
push eax
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x10534], eax
mov ecx, dword [ebp - 0x10534]
mov dword [ebp - 0x10538], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x10538]
push edx
lea eax, [ebp - 0x104a0]
push eax
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0x1053c], eax
mov ecx, dword [ebp - 0x1053c]
mov dword [ebp - 0x10540], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x10540]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040a170
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x104a0]
call fcn.004019f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1049c]
call fcn.004019f0
push 5
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
push 0
push 0
call fcn.00408380
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
push 0x538a40
push 0x538a4c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
push str.tc_au.exe
push str.trojancut.exe
lea ecx, [ebp - 0x14]
call fcn.0040a1d0
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
push str.TrojanCutAutoPatch
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408400
add esp, 0x10
cmp dword [0x583198], 0
je 0x4092b9
call fcn.00407c70
cmp dword [0x582f10], 0
je 0x4092d2
push 0x64
mov ecx, dword [0x582f10]
add ecx, 0x74
call fcn.00409450
cmp dword [0x582f10], 0
je 0x4092e6
mov ecx, dword [0x582f10]
call fcn.00407590
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10434]
call fcn.004019f0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10430]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004019f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1042c]
call fcn.004019f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0050c6c0
mov esp, ebp
pop ebp
ret