Function at 0x40da30
Capabilities:
Check if file exists
Delete file
Delete registry value
Enumerate files on windows
Get common file path
Get file attributes
Get program files directory
Get startup folder
Move file
Persist via run registry key
Set file attributes
Write file to startup folder

Disassembly:
push 0xffffffffffffffff
push 0x41444b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x498
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebp
push esi
xor ebp, ebp
push edi
push ebp
lea eax, [esp + 0x24]
push 7
push eax
push ebp
mov dword [esp + 0x24], ebp
call ebx
test eax, eax
je 0x40dade
mov edi, str.dfzhqb.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40dade
mov eax, dword [esp + 0x4b8]
mov ebp, 1
test eax, eax
mov dword [esp + 0x14], ebp
je 0x40e45d
lea ecx, [esp + 0x20]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 4
lea edx, [esp + 0x24]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
lea eax, [esp + 0x24]
push 0x26
push eax
push 0
call ebx
test eax, eax
je 0x40dbe4
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esp + ecx + 0x1f]
lea edx, [esp + ecx + 0x20]
cmp al, 0x5c
je 0x40db11
mov byte [edx], 0x5c
inc edx
mov edi, str.Common_Files_
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
push 1
mov ecx, 0x41d8a8
call fcn.00412080
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
je 0x40dbe4
mov ebx, dword [esp + 0x4b8]
lea edx, [esp + 0x20]
lea esi, [eax + 0x108]
push edi
push edx
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x40dbc6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40dbc6
test al, 4
je 0x40dbc6
lea eax, [esp + 0x1c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
jne 0x40dbc6
mov ebp, 1
test ebx, ebx
mov dword [esp + 0x14], ebp
je 0x40e45d
lea ecx, [esp + 0x20]
push ecx
call fcn.004084e0
add esp, 4
lea edx, [esp + 0x10]
mov ecx, 0x41d8a8
push edx
push 1
call fcn.00412080
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
jne 0x40db70
test ebp, ebp
je 0x40dbf7
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40dd57
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebp, [esp + eax + 0x20]
mov ebx, 0x4156fc
mov byte [ebp], 0x5c
inc ebp
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40dc63
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40dc63
lea ecx, [esp + 0x20]
push ecx
call fcn.004084e0
add esp, 4
add ebx, 4
cmp ebx, 0x415708
jb 0x40dc15
push str._system_
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
add ebp, eax
mov edi, str.1sass.exe
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, str.zhqb.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x368]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40dd3e
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40dd37
lea edi, [esp + 0x394]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004084e0
add esp, 4
lea ecx, [esp + 0x368]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40dcf3
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.zhqbdf
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer_run
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x40dd6a
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40de01
lea edx, [esp + 0x20]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ebp, [esp + eax + 0x20]
mov ebx, 0x415708
mov byte [ebp], 0x5c
inc ebp
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40ddd6
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40ddd6
lea edx, [esp + 0x20]
push edx
call fcn.004084e0
add esp, 4
add ebx, 4
cmp ebx, 0x415714
jb 0x40dd88
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40de01
push str.updater
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40de18
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40df71
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ebp, [esp + eax + 0x20]
mov ebx, 0x415714
mov byte [ebp], 0x5c
inc ebp
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0x10
test al, al
jne 0x40de87
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40de87
lea ecx, [esp + 0x20]
push ecx
call fcn.004084e0
add esp, 4
add ebx, 4
cmp ebx, 0x4158f4
jb 0x40de36
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40dea9
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40df71
mov edi, str.k__________.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x124]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x40df71
lea ebx, [ebp + 1]
lea edi, [esp + 0x150]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
mov al, byte [ecx]
test al, al
je 0x40df2a
cmp al, 0x30
jl 0x40df2a
cmp al, 0x39
jg 0x40df2a
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40df1a
cmp byte [ecx], 0x2e
jne 0x40df4f
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40df66
lea eax, [esp + 0x20]
push eax
call fcn.004084e0
add esp, 4
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x124]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40deee
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40df88
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e0c2
lea ecx, [esp + 0x20]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebx, [esp + eax + 0x20]
push str.Downloaded_Program_Files_
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add ebx, eax
mov edi, 0x419d7c
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x124]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40e0c2
test byte [esp + 0x124], 0x10
jne 0x40e0a4
lea edx, [esp + 0x150]
push 0x2e
push edx
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x40e0a4
mov edi, dword [sym.imp.MSVCRT.dll__mbsicmp]
push 0x419444
push esi
call edi
add esp, 8
test eax, eax
je 0x40e03c
push 0x41c2fc
push esi
call edi
add esp, 8
test eax, eax
jne 0x40e0a4
lea edi, [esp + 0x150]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x40e084
lea eax, [esp + 0x20]
push eax
call fcn.00408400
add esp, 4
test eax, eax
je 0x40e0a4
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e0a4
lea ecx, [esp + 0x20]
push ecx
call fcn.004084e0
add esp, 4
lea edx, [esp + 0x124]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40dfed
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40e0d9
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e2c3
lea ecx, [esp + 0x124]
mov dword [esp + 0x10], 0
call fcn.00412740
lea eax, [esp + 0x10]
mov ecx, 0x41d8a8
push eax
push 1
mov dword [esp + 0x4b8], 0
call fcn.00412080
mov ecx, dword [esp + 0x10]
mov edi, eax
inc ecx
test edi, edi
mov dword [esp + 0x10], ecx
je 0x40e2ac
mov ebp, dword [sym.imp.MSVCRT.dll__mbslwr]
lea ecx, [edi + 4]
push str.WinSys
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40e165
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e288
lea edx, [edi + 0x108]
push edx
call fcn.004084e0
add esp, 4
push 1
jmp 0x40e27d
lea ebx, [edi + 0x108]
push ebx
call ebp
push str.rundll32
push ebx
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0xc
test eax, eax
je 0x40e288
push 0x3a
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x40e288
dec esi
push 0x2c
push esi
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x40e1b9
cmp byte [eax - 1], 0x22
jne 0x40e1b6
mov byte [eax - 1], 0
mov byte [eax], 0
push esi
lea ecx, [esp + 0x128]
call fcn.004127b0
test eax, eax
je 0x40e288
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x12c]
call fcn.00412870
test eax, eax
je 0x40e288
mov edx, dword [esp + 0x18]
push str.Player
push edx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
je 0x40e25c
mov eax, dword [esp + 0x18]
push str.Microsoft_DirectMusic_Interactive_Engine
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40e437
lea ecx, [esp + 0x264]
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea edx, [esp + 0x264]
push edx
call ebp
lea eax, [esp + 0x268]
push str.downloaded_program_files_
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0xc
neg eax
sbb eax, eax
neg eax
test eax, eax
je 0x40e288
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e288
push esi
call fcn.004084e0
add esp, 4
mov byte [ebx], 0
push 0
push edi
mov ecx, 0x41d8a8
call fcn.00411720
lea edx, [esp + 0x10]
mov ecx, 0x41d8a8
push edx
push 1
call fcn.00412080
mov ecx, dword [esp + 0x10]
mov edi, eax
inc ecx
test edi, edi
mov dword [esp + 0x10], ecx
jne 0x40e122
lea ecx, [esp + 0x124]
mov dword [esp + 0x4b0], 0xffffffff
call fcn.00412780
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40e2da
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e35d
lea eax, [esp + 0x10]
mov ecx, 0x41d8a8
push eax
push 0x40
mov dword [esp + 0x18], 0
call fcn.00412080
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
je 0x40e35d
lea ecx, [esp + 0x1c]
lea esi, [eax + 0x108]
push ecx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, 5
jae 0x40e33f
push esi
call fcn.00408400
add esp, 4
test eax, eax
je 0x40e33f
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e33f
push esi
call fcn.004084e0
add esp, 4
lea edx, [esp + 0x10]
mov ecx, 0x41d8a8
push edx
push 0x40
call fcn.00412080
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
jne 0x40e300
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40e374
mov ecx, dword [esp + 0x4b8]
test ecx, ecx
je 0x40e45f
lea eax, [esp + 0x18]
mov ecx, 0x41d8a8
push eax
push 8
mov dword [esp + 0x20], 0
call fcn.00412080
mov ecx, dword [esp + 0x18]
mov esi, eax
inc ecx
test esi, esi
mov dword [esp + 0x18], ecx
je 0x40e457
mov ebx, dword [sym.imp.MSVCRT.dll__mbsrchr]
mov ebp, dword [esp + 0x14]
lea edi, [esi + 0x108]
push 0x2e
push edi
call ebx
add esp, 8
test eax, eax
je 0x40e411
push str..sys
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40e3df
push 0x5f
push edi
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
test eax, eax
jne 0x40e3ec
push edi
call fcn.00408400
add esp, 4
test eax, eax
je 0x40e411
mov eax, dword [esp + 0x4b8]
mov ebp, 1
test eax, eax
je 0x40e411
push edi
call fcn.004084e0
add esp, 4
mov ecx, 0x41d8a8
push ebp
push esi
call fcn.00411720
lea ecx, [esp + 0x18]
push ecx
push 8
mov ecx, 0x41d8a8
call fcn.00412080
mov ecx, dword [esp + 0x18]
mov esi, eax
inc ecx
test esi, esi
mov dword [esp + 0x18], ecx
jne 0x40e3aa
jmp 0x40e45d
mov ecx, dword [esp + 0x18]
push str.IEHpr_Module
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40e288
jmp 0x40e25c
mov eax, dword [esp + 0x14]
jmp 0x40e45f
mov eax, ebp
mov ecx, dword [esp + 0x4a8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4a4
ret