Function at 0x408151
Capabilities:
Create directory
Extract resource via kernel32 functions
Get common file path
Get program files directory
Persist via run registry key
Set current directory
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x10408]
mov eax, 0x10408
call fcn.0050b030
push 0xffffffffffffffff
push 0x5229f6
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x57b830]
xor eax, ebp
mov dword [ebp + 0x10404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
cmp dword [0x57f198], edi
je 0x40819d
call fcn.004072b5
push edi
push 0x26
lea eax, [ebp + 0x10204]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp + 0x10204]
push eax
lea ecx, [ebp - 0x10]
call fcn.004013e4
mov dword [ebp - 4], edi
cmp dword [0x57f198], edi
je 0x4081e5
push edi
mov esi, str.__x86_
push esi
lea ecx, [ebp - 0x10]
call fcn.00407965
cmp eax, 0xffffffff
jne 0x4081e5
push esi
lea ecx, [ebp - 0x10]
call fcn.00407dfe
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x5352d0
push 0x87
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
mov eax, dword [0x57ef10]
cmp eax, edi
je 0x40822b
push edi
push 0xa
push 0x402
push dword [eax + 0x94]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 0x18], 0x64
mov ebx, 0x5350c0
mov esi, 0x5350d0
jbe 0x408329
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00407083
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00407083
mov eax, dword [eax]
add esp, 0x18
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010ac
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00407083
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call fcn.00407083
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010ac
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402d9f
or dword [ebp], 0xffffffff
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call fcn.004029bb
mov eax, dword [ebp]
mov dword [ebp - 0x18], eax
mov dword [ebp], edi
cmp eax, edi
jbe 0x408321
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call fcn.004029bb
lea eax, [ebp]
push eax
lea eax, [ebp + 0x28]
push eax
push dword [ebp - 0x20]
call fcn.004040e5
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, dword [ebp - 0x18]
jb 0x4082fa
push dword [ebp - 0x20]
call fcn.00402994
mov eax, dword [0x57ef10]
cmp eax, edi
je 0x408346
push edi
push 0x1e
push 0x402
push dword [eax + 0x94]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x57f198], edi
je 0x40848e
push 0x5352d0
push 0x88
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
cmp eax, 0x64
jbe 0x408495
lea eax, [ebp + 0x10204]
push eax
lea ecx, [ebp - 0x10]
mov byte [0x57f19d], 1
call fcn.004013b5
push 0x532ec8
push str.__x86_
lea ecx, [ebp - 0x10]
call fcn.00407b50
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00407083
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.00407083
mov eax, dword [eax]
add esp, 0x18
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010ac
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00407083
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 4
call fcn.00407083
add esp, 0x18
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004010ac
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402d9f
or dword [ebp], 0xffffffff
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call fcn.004029bb
mov eax, dword [ebp]
mov dword [ebp - 0x18], eax
mov dword [ebp], edi
cmp eax, edi
jbe 0x408484
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call fcn.004029bb
lea eax, [ebp]
push eax
lea eax, [ebp + 0x28]
push eax
push dword [ebp - 0x20]
call fcn.004040e5
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, dword [ebp - 0x18]
jb 0x40845d
push dword [ebp - 0x20]
call fcn.00402994
jmp 0x408495
mov byte [0x57f19d], 1
mov eax, dword [0x57ef10]
cmp eax, edi
je 0x4084b2
push edi
push 0x32
push 0x402
push dword [eax + 0x94]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x57f198], edi
je 0x4084cf
cmp byte [0x57f19d], 0
jne 0x4084cf
push 0x5352d0
push 0x93
jmp 0x4084d9
push 0x5352d0
push 0x8e
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0xffdc
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x228]
push edi
push eax
call fcn.00509740
add esp, 0xc
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea eax, [ebp + 0x228]
push eax
call fcn.00508ba0
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00407083
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 5
call fcn.00407083
push str.ini.reg
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 6
call fcn.00407083
add esp, 0x30
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.004010ac
push edi
push edi
push 4
push edi
push edi
push 0x40000000
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x4085b1
push edi
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x18]
lea eax, [ebp + 0x228]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x57ef10]
cmp eax, edi
je 0x4085ce
push edi
push 0x46
push 0x402
push dword [eax + 0x94]
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.0040bd06
push eax
lea ecx, [ebp - 0x18]
call fcn.00401217
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push str._S___s_
push eax
mov byte [ebp - 4], 0xa
call fcn.00407e1b
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00407083
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0xb
call fcn.00407083
mov eax, dword [eax]
push edi
push eax
push dword [ebp - 0x18]
push str.regedit.exe
push edi
push edi
call fcn.004076b9
mov ecx, dword [ebp - 0x28]
add esp, 0x3c
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.004010ac
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x57f1b8]
mov edi, str.SOFTWARETrueCut_tc_INSTALL
push str.TC_TCServer
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.0040772c
push dword [0x57f1a0]
push str.TC_TCPort
push edi
push esi
call fcn.004077d3
push dword [0x57f1b4]
push str.TC_PatchServer
push edi
push esi
call fcn.0040772c
push dword [0x57f1a4]
push str.TC_HTTP_Port
push edi
push esi
call fcn.004077d3
add esp, 0x40
mov ecx, 0x57f1ac
call fcn.00407c81
mov ecx, 0x57f2a8
call fcn.00407c81
mov ecx, 0x57f1b0
call fcn.00407c81
push dword [0x57f1ac]
push str.TC_Org
push edi
push esi
call fcn.0040772c
push dword [0x57f2a8]
push str.TC_Section
push edi
push esi
call fcn.0040772c
push dword [0x57f1b0]
push str.TC_User_office
push edi
push esi
call fcn.0040772c
add esp, 0x30
push ebx
lea ecx, [ebp - 0x30]
call fcn.004013e4
mov dword [ebp - 0x28], eax
push 0x5350d0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xc
call fcn.004013e4
push eax
lea eax, [ebp + 0x10204]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0xd
call fcn.004070db
push dword [ebp - 0x28]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00407d5a
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xf
call fcn.00407db1
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.004010ac
cmp dword [0x57f198], 0
je 0x40885c
cmp byte [0x57f19d], 0
jne 0x408827
push 0
push str.__x86_
lea ecx, [ebp - 0x10]
call fcn.00407965
cmp eax, 0xffffffff
jne 0x408827
push ebx
lea ecx, [ebp - 0x14]
call fcn.004013e4
mov ebx, eax
push str.__x86__
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.004013e4
push eax
lea eax, [ebp + 0x10204]
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x11
call fcn.004070db
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x12
call fcn.00407d5a
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x13
call fcn.00407db1
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.004010ac
cmp dword [0x57f198], 0
je 0x40885c
cmp byte [0x57f19d], 0
je 0x40885c
push 0
mov ebx, str.__x86_
push ebx
lea ecx, [ebp - 0x10]
call fcn.00407965
cmp eax, 0xffffffff
je 0x40885c
push 0x532ec8
push ebx
lea ecx, [ebp - 0x10]
call fcn.00407b50
push dword [ebp - 0x10]
push str.TC_InstallPath
push edi
push esi
call fcn.0040772c
add esp, 0x10
push str._m__d__Y
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00407894
mov ecx, eax
call fcn.004080db
push dword [ebp - 0x38]
mov byte [ebp - 4], 0x14
push str.TC_IDATE
push edi
push esi
call fcn.0040772c
xor edi, edi
add esp, 0x10
cmp dword [0x57f1a8], edi
jne 0x4088cd
push edi
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push esi
call fcn.004077d3
push 1
push str.UacDisableNotify
push str.SoftwareMicrosoftSecurity_Center
push esi
call fcn.004077d3
add esp, 0x20
mov eax, dword [0x57ef10]
cmp eax, edi
je 0x4088ea
push edi
push 0x5a
push 0x402
push dword [eax + 0x94]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x5350d0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00407083
mov ebx, str.trojancut.exe
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x15
call fcn.00407083
add esp, 0x18
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x16
call fcn.00407db1
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x14
call fcn.004010ac
push 5
push edi
push edi
push dword [ebp - 0x24]
push edi
push edi
call fcn.004076b9
push dword [ebp - 0x24]
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x5352f8
push edi
push esi
call fcn.0040772c
add esp, 0x28
push str.tc_au.exe
push ebx
lea ecx, [ebp - 0x24]
call fcn.00407b50
push dword [ebp - 0x24]
push str.TrojanCutAutoPatch
push edi
push esi
call fcn.0040772c
add esp, 0x10
cmp dword [0x57f198], 0
je 0x408996
call fcn.004072d8
mov eax, dword [0x57ef10]
test eax, eax
je 0x4089c3
push 0
push 0x64
push 0x402
push dword [eax + 0x94]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x57ef10]
test ecx, ecx
je 0x4089c3
call fcn.00406eba
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010ac
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10404]
xor ecx, ebp
call fcn.0050949c
add ebp, 0x10408
leave
ret