Function at 0x4010c0
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete directory
Delete file
Get common file path
Get file attributes
Move file
Persist via lnk shortcut
Set registry value

Disassembly:
mov eax, 0x1c98
call fcn.0040eb80
mov eax, dword [0x417004]
xor eax, esp
mov dword [esp + 0x1c94], eax
push ebx
push ebp
push esi
push edi
push 0x208
lea eax, [esp + 0x5c]
mov edi, edx
push 0
push eax
mov ebx, ecx
call fcn.004038e0
push 0x20a
lea eax, [esp + 0xa80]
push 0
push eax
call fcn.004038e0
push 0x408
lea eax, [esp + 0x684]
push 0
push eax
call fcn.004038e0
push 0x408
lea eax, [esp + 0x288]
push 0
push eax
call fcn.004038e0
push 0x408
lea eax, [esp + 0xcb0]
push 0
push eax
call fcn.004038e0
push 0x408
lea eax, [esp + 0x14cc]
push 0
push eax
call fcn.004038e0
add esp, 0x48
lea eax, [esp + 0x1084]
push 0x408
push 0
push eax
call fcn.004038e0
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0xc
mov dword [esp + 0x34], 1
push 0
push 0xa
push 0x402
push dword [0x418304]
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40122b
lea ecx, [esp + 0xa70]
mov dword [esp + 0x38], 0
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
mov esi, edi
movlpd qword [esp + 0x4a], xmm0
mov eax, ecx
mov dword [esp + 0x52], 0
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4011ef
movzx eax, word [esi + ecx]
test ax, ax
je 0x4011ef
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4011d1
lea eax, [ecx - 2]
mov dword [esp + 0x3c], 3
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0xa70]
mov dword [esp + 0x40], eax
mov eax, 0x614
mov word [esp + 0x48], ax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 2
push edi
push str..Supermium
call esi
test eax, eax
jne 0x40127c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10
push str.Error
cmp eax, 0x7b
jne 0x401258
push str.Installation_location_is_invalid___change_to_a_valid_location.
jmp 0x40125d
push str.Unspecified_error.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0x402
push dword [0x418304]
call ebp
xor eax, eax
jmp 0x401bd4
push 0
push 0x32
push 0x402
push dword [0x418304]
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [esp + 0x20]
push eax
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 0x80000000
call ebx
test eax, eax
jne 0x401a1a
push ecx
push edi
push ecx
mov esi, 0x102
lea ecx, [esp + 0x674]
mov edx, esi
call fcn.00401070
push ecx
push 0x413e68
push ecx
mov edx, esi
lea ecx, [esp + 0x26c]
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0x260]
cmp word [eax], 0
je 0x4012ee
add eax, 2
sub ecx, 1
jne 0x4012e0
test ecx, ecx
je 0x40131f
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, esi
sub eax, ecx
add edx, esi
push edi
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0x26c]
add ecx, eax
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0x668]
cmp word [eax], 0
je 0x401336
add eax, 2
sub ecx, 1
jne 0x401328
test ecx, ecx
je 0x40136b
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, esi
sub eax, ecx
add edx, esi
push str.chrome.exe_0
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0x674]
add ecx, eax
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0x260]
cmp word [eax], 0
je 0x401382
add eax, 2
sub ecx, 1
jne 0x401374
test ecx, ecx
je 0x4013b7
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, esi
sub eax, ecx
add edx, esi
push str.chrome.exe____single_argument__1
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0x26c]
add ecx, eax
call fcn.00401070
push ecx
push 0x413e68
push ecx
mov edx, esi
lea ecx, [esp + 0xc88]
call fcn.00401070
push ecx
push 0x413e68
push ecx
mov edx, esi
lea ecx, [esp + 0x1498]
call fcn.00401070
push ecx
push 0x413e68
push ecx
mov edx, esi
lea ecx, [esp + 0x1090]
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0xc7c]
nop
cmp word [eax], 0
je 0x40140e
add eax, 2
sub ecx, 1
jne 0x401400
test ecx, ecx
je 0x40143f
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, esi
sub eax, ecx
add edx, esi
push edi
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0xc88]
add ecx, eax
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0x148c]
cmp word [eax], 0
je 0x401456
add eax, 2
sub ecx, 1
jne 0x401448
test ecx, ecx
je 0x401487
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, esi
sub eax, ecx
add edx, esi
push edi
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0x1498]
add ecx, eax
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0x1084]
cmp word [eax], 0
je 0x40149e
add eax, 2
sub ecx, 1
jne 0x401490
test ecx, ecx
je 0x4014cf
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, esi
sub eax, ecx
add edx, esi
push edi
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0x1090]
add ecx, eax
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0xc7c]
cmp word [eax], 0
je 0x4014e6
add eax, 2
sub ecx, 1
jne 0x4014d8
test ecx, ecx
je 0x40151b
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, esi
sub eax, ecx
add edx, esi
push str.chrome.exe____hide_icons
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0xc88]
add ecx, eax
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0x148c]
cmp word [eax], 0
je 0x401532
add eax, 2
sub ecx, 1
jne 0x401524
test ecx, ecx
je 0x401567
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, esi
sub eax, ecx
add edx, esi
push str.chrome.exe____make_default_browser
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0x1498]
add ecx, eax
call fcn.00401070
mov ecx, esi
lea eax, [esp + 0x1084]
cmp word [eax], 0
je 0x40157e
add eax, 2
sub ecx, 1
jne 0x401570
test ecx, ecx
je 0x4015b1
mov edx, ecx
lea eax, [ecx - 0x102]
neg edx
push ecx
sbb edx, edx
and edx, eax
lea eax, [esp + 0x1088]
add edx, esi
sub esi, ecx
push str.chrome.exe____show_icons
push ecx
add esi, esi
neg ecx
sbb ecx, ecx
and ecx, esi
add ecx, eax
call fcn.00401070
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push 0x30
push str.Supermium_HTML_Document
push 1
push 0
push dword [esp + 0x30]
call esi
lea ecx, [esp + 0x668]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4015d2
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x66c]
push eax
push 1
push str.DefaultIcon
push dword [esp + 0x30]
call esi
lea ecx, [esp + 0x260]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401604
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x264]
push eax
push 1
push str.shellopencommand
push dword [esp + 0x30]
call esi
lea eax, [esp + 0x24]
push eax
push str.SOFTWAREClientsStartMenuInternetSupemium.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 0x80000002
call ebx
test eax, eax
jne 0x401a14
push 0x14
push 0x4140a8
push 1
push eax
push dword [esp + 0x34]
call esi
lea ecx, [esp + 0x260]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401660
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x264]
push eax
push 1
push str.shellopencommand
push dword [esp + 0x34]
call esi
lea ecx, [esp + 0x668]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401692
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x66c]
push eax
push 1
push str.DefaultIcon
push dword [esp + 0x34]
call esi
lea eax, [esp + 0x28]
push eax
push str.SOFTWAREClientsStartMenuInternetSupemium.I6TGNPUAC6WMCIZTJ3D4YIUP5ACapabilities
push 0x80000002
call ebx
lea eax, [esp + 0x14]
push eax
push str.SOFTWAREClientsStartMenuInternetSupemium.I6TGNPUAC6WMCIZTJ3D4YIUP5ACapabilitiesFileAssociations
push 0x80000002
call ebx
lea eax, [esp + 0x30]
push eax
push str.SOFTWAREClientsStartMenuInternetSupemium.I6TGNPUAC6WMCIZTJ3D4YIUP5ACapabilitiesStartmenu
push 0x80000002
call ebx
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREClientsStartMenuInternetSupemium.I6TGNPUAC6WMCIZTJ3D4YIUP5ACapabilitiesURLAssociations
push 0x80000002
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xd6
push str.Supermium_is_a_web_browser_targetting_legacy_versions_of_Windows_and_has_various_other_important_features.
push 1
push 0
push str.ApplicationDescription
push dword [esp + 0x3c]
call esi
lea ecx, [esp + 0x668]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401727
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x66c]
push eax
push 1
push 0
push str.ApplicationIcon
push dword [esp + 0x3c]
call esi
push 0x14
push 0x4140a8
push 1
push 0
push str.ApplicationName
push dword [esp + 0x3c]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str..htm
push dword [esp + 0x28]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str..html
push dword [esp + 0x28]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str..pdf
push dword [esp + 0x28]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str..shtml
push dword [esp + 0x28]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str..svg
push dword [esp + 0x28]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str..webp
push dword [esp + 0x28]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str..xht
push dword [esp + 0x28]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str..xhtml
push dword [esp + 0x28]
call esi
push 0x48
push str.Supemium.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.StartMenuInternet
push dword [esp + 0x44]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.http
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.https
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push 0x4145f4
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.mailto
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push 0x41460c
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.news
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.nntp
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push 0x41462c
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.smsto
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.snews
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push 0x41464c
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push 0x414654
push dword [esp + 0x24]
call esi
push 0x4e
push str.SupemiumHTM.I6TGNPUAC6WMCIZTJ3D4YIUP5A
push 1
push 0
push str.webcal
push dword [esp + 0x24]
call esi
lea eax, [esp + 0x18]
push eax
push str.SOFTWAREClientsStartMenuInternetSupemium.I6TGNPUAC6WMCIZTJ3D4YIUP5AInstallInfo
push 0x80000002
call ebx
lea ecx, [esp + 0xc7c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401966
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0xc80]
push eax
push 1
push 0
push str.HideIconsCommand
push dword [esp + 0x2c]
call esi
lea ecx, [esp + 0x1084]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4019a0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1088]
push eax
push 1
push 0
push str.ShowIconsCommand
push dword [esp + 0x2c]
call esi
lea ecx, [esp + 0x148c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4019d4
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1490]
push eax
push 1
push 0
push str.ReinstallCommand
push dword [esp + 0x2c]
call esi
push 4
lea eax, [esp + 0x38]
push eax
push 4
push 0
push str.IconsVisible
push dword [esp + 0x2c]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 0x46
push 0x402
push dword [0x418304]
call ebp
cmp dword [esp + 0x1cac], 0
je 0x401ab2
push 0x104
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, 0x82
lea eax, [esp + 0x58]
cmp word [eax], 0
je 0x401a60
add eax, 2
sub ecx, 1
jne 0x401a52
test ecx, ecx
je 0x401a99
mov edx, ecx
lea eax, [ecx - 0x82]
neg edx
push ecx
sbb edx, edx
and edx, eax
mov eax, 0x82
sub eax, ecx
add edx, 0x82
push str.FontsNotoEmoji.ttf
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [esp + 0x64]
add ecx, eax
call fcn.00401070
push 2
lea eax, [esp + 0x5c]
push eax
push str.NotoEmoji.ttf
call esi
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceW]
push 0
push 0x55
push 0x402
push dword [0x418304]
call ebp
cmp dword [esp + 0x1cb0], 0
je 0x401bbe
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x401bbe
lea eax, [esp + 0x1c]
push eax
push 0x40f200
push 1
push 0
push 0x40f220
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401bb8
push ecx
push edi
push ecx
mov edx, 0x82
lea ecx, [esp + 0x18a0]
call fcn.00401070
push str.chrome.exe
mov edx, 0x104
lea ecx, [esp + 0x1898]
call fcn.00401000
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x1894]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x1c]
push str.Supermium_Web_Browser
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
push 0x40f210
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x401bae
lea eax, [esp + 0x1a9c]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Supermium.lnk
mov edx, 0x104
lea ecx, [esp + 0x1aa0]
call fcn.00401000
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1a9c]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [esp + 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
push 0x64
push 0x402
push dword [0x418304]
call ebp
mov eax, 1
mov ecx, dword [esp + 0x1ca4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402729
add esp, 0x1c98
ret