Function at 0x4298f0
Capabilities:
Delete file
Get common file path
Get program files directory
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce7aa
mov eax, dword fs:[0]
push eax
sub esp, 0xafc
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00555bf0
add esp, 0xc
push 0
push 0
call fcn.00476650
add esp, 8
call fcn.004183f0
movzx ecx, al
test ecx, ecx
je 0x429abf
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x429abd
push str.Zemana_AntiMalware
lea ecx, [ebp - 0xa54]
call fcn.004b3550
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xa60]
call fcn.004b3550
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa54]
push ecx
lea edx, [ebp - 0xa60]
push edx
lea eax, [ebp - 0xa30]
push eax
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa60]
call fcn.004b3860
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa54]
call fcn.004b3860
push 0x400
lea ecx, [ebp - 0xa24]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0xa24]
push edx
lea ecx, [ebp - 0xa6c]
call fcn.004b3550
mov byte [ebp - 4], 5
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0xa78]
push ecx
call fcn.00413220
add esp, 8
mov dword [ebp - 0xaec], eax
mov edx, dword [ebp - 0xaec]
mov dword [ebp - 0xaf0], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xaf0]
push eax
lea ecx, [ebp - 0xa30]
push ecx
lea edx, [ebp - 0xa84]
push edx
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xaf8], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xaf8]
push ecx
lea ecx, [ebp - 0xa30]
call fcn.004b3890
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa84]
call fcn.004b3860
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa78]
call fcn.004b3860
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa6c]
call fcn.004b3860
push 1
lea edx, [ebp - 0xa30]
push edx
call fcn.004184e0
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.004b3860
jmp 0x429b38
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00414b30
mov ecx, eax
call fcn.00414830
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x429b38
push str.ZemanaAntiMalware
mov ecx, dword [ebp - 0x220]
call fcn.00414000
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0xa8c], eax
mov ecx, dword [ebp - 0xa8c]
mov dword [ebp - 0xa88], ecx
cmp dword [ebp - 0xa88], 0
je 0x429b2e
push 1
mov edx, dword [ebp - 0xa88]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xa88]
mov edx, dword [eax]
call edx
mov dword [ebp - 0xafc], eax
jmp 0x429b38
mov dword [ebp - 0xafc], 0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x429bf0
push str.Zemana_AntiMalware.lnk
lea ecx, [ebp - 0xa98]
call fcn.004b3550
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0xaa4]
call fcn.004b3550
mov byte [ebp - 4], 9
lea edx, [ebp - 0xa98]
push edx
lea eax, [ebp - 0xaa4]
push eax
lea ecx, [ebp - 0xa3c]
push ecx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xaa4]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa98]
call fcn.004b3860
lea edx, [ebp - 0xa3c]
push edx
call fcn.004bc0e0
add esp, 4
movzx eax, al
test eax, eax
je 0x429be5
lea ecx, [ebp - 0xa3c]
push ecx
call fcn.004bc0c0
add esp, 4
lea ecx, [ebp - 0xa3c]
call fcn.004b3860
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x429cae
push str.Zemana_AntiMalware
lea ecx, [ebp - 0xab0]
call fcn.004b3550
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xabc]
call fcn.004b3550
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xab0]
push ecx
lea edx, [ebp - 0xabc]
push edx
lea eax, [ebp - 0xac8]
push eax
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0xb00], eax
mov ecx, dword [ebp - 0xb00]
mov dword [ebp - 0xb04], ecx
mov byte [ebp - 4], 0xc
push 1
mov edx, dword [ebp - 0xb04]
push edx
call fcn.00413530
add esp, 8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xac8]
call fcn.004b3860
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xabc]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab0]
call fcn.004b3860
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x429d73
push str.Zemana_AntiMalware
lea ecx, [ebp - 0xad4]
call fcn.004b3550
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0xae0]
call fcn.004b3550
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0xad4]
push edx
lea eax, [ebp - 0xae0]
push eax
lea ecx, [ebp - 0xa48]
push ecx
call fcn.00412f50
add esp, 0xc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xae0]
call fcn.004b3860
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xad4]
call fcn.004b3860
push 1
lea edx, [ebp - 0xa48]
push edx
call fcn.00413530
add esp, 8
movzx eax, al
test eax, eax
jne 0x429d61
push 4
push 0
lea ecx, [ebp - 0xa48]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa48]
call fcn.004b3860
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.00414b30
mov ecx, eax
call fcn.00414830
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x429dec
push str.ZemanaAntiMalware
mov ecx, dword [ebp - 0x220]
call fcn.00413e60
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0xae8], ecx
mov edx, dword [ebp - 0xae8]
mov dword [ebp - 0xae4], edx
cmp dword [ebp - 0xae4], 0
je 0x429de2
push 1
mov eax, dword [ebp - 0xae4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xae4]
mov eax, dword [edx]
call eax
mov dword [ebp - 0xb08], eax
jmp 0x429dec
mov dword [ebp - 0xb08], 0
push 1
call fcn.0042ef60
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret