Function at 0x406560
Capabilities:
Copy file
Persist via lnk shortcut
Read .ini file
Set file attributes

Disassembly:
sub esp, 0xb58
mov eax, dword [esp + 0xb60]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
push eax
lea ecx, [esp + 0x144]
push 0x104
push ecx
push 0x4117d0
xor esi, esi
push str.UnInstLog
push str.UnInstLog
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], esi
call ebp
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea edx, [esp + 0x14]
push str.PATH_02d
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x140]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x10]
push eax
push 0x104
push ecx
push 0x4117d0
push edx
push str.PATHS
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x3c]
push eax
call edi
test eax, eax
jle 0x406629
inc esi
lea ecx, [esp + 0x10]
push esi
push str.PATH_02d
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x140]
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x10]
push edx
push 0x104
push eax
push 0x4117d0
push ecx
push str.PATHS
call ebp
lea edx, [esp + 0x3c]
push edx
call edi
test eax, eax
jg 0x4065ea
xor edi, edi
lea eax, [esp + 0x10]
push edi
push str.FILE_02d
push eax
mov dword [esp + 0x30], esi
call ebx
add esp, 0xc
lea ecx, [esp + 0x140]
lea edx, [esp + 0x3c]
lea eax, [esp + 0x10]
push ecx
push 0x104
push edx
push 0x4117d0
push eax
push str.FILES
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x3c]
push ecx
call esi
test eax, eax
jle 0x4066b2
inc edi
lea edx, [esp + 0x10]
push edi
push str.FILE_02d
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x140]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x10]
push eax
push 0x104
push ecx
push 0x4117d0
push edx
push str.FILES
call ebp
lea eax, [esp + 0x3c]
push eax
call esi
test eax, eax
jg 0x406673
mov ecx, dword [esp + 0xb70]
lea edx, [esp + 0x3c]
push ecx
push 0x104
push edx
push str.NotFound
push str.SrcDirectry
push str.Directry
mov dword [esp + 0x44], edi
call ebp
mov edi, str.NotFound
lea esi, [esp + 0x654]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x40670d
test al, al
je 0x406709
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x40670d
add esi, 2
add edi, 2
test al, al
jne 0x4066e5
xor eax, eax
jmp 0x406712
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406721
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb58
ret
lea eax, [esp + 0x654]
push 0x104
push eax
call fcn.00406040
lea ecx, [esp + 0x44]
lea edx, [esp + 0x65c]
push ecx
push 0x104
push edx
call fcn.00406200
mov edi, dword [esp + 0xb88]
push edi
call fcn.004063f0
push str.PATH_02d
lea eax, [esp + 0x15c]
push str.PATHS
push eax
push edi
call fcn.00406460
add esp, 0x28
test eax, eax
jge 0x4067ab
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x10]
push ecx
push str.PATH_02d
push edx
mov dword [esp + 0x2c], 1
call ebx
add esp, 0xc
lea eax, [esp + 0x140]
lea ecx, [esp + 0x10]
push eax
push edi
push ecx
push str.PATHS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor eax, eax
mov ax, word [0x412e54]
dec eax
cmp eax, 7
ja case.0x4067b9.7
jmp dword [eax*4 + 0x406e08]
push str.Files9x
jmp 0x4067ea
lea eax, [esp + 0x550]
push str.FilesNT
push eax
jmp 0x4067f2
lea ecx, [esp + 0x550]
push str.FilesXP
push ecx
jmp 0x4067f2
push str.FilesX64
lea edx, [esp + 0x554]
push edx
call ebx
add esp, 8
xor esi, esi
push esi
lea eax, [esp + 0x34]
push str.file_03d
push eax
call ebx
mov ecx, dword [esp + 0xb7c]
add esp, 0xc
lea edx, [esp + 0x960]
lea eax, [esp + 0x30]
push ecx
push 0x208
push edx
push 0x4117d0
lea ecx, [esp + 0x560]
push eax
push ecx
call ebp
lea edx, [esp + 0x960]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x406853
inc esi
cmp esi, 0x3e7
jl 0x4067f9
mov esi, dword [esp + 0x1c]
jmp 0x406857
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0xb78]
mov eax, esi
and eax, 0xffff
shl eax, 0x10
push eax
push 0
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [esp + 0x140]
push edx
push edi
push str.PATH
push str.UNINSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor edi, edi
test esi, esi
jle 0x406bcf
push edi
lea eax, [esp + 0x34]
push str.file_03d
push eax
call ebx
mov ecx, dword [esp + 0xb7c]
add esp, 0xc
lea edx, [esp + 0x960]
lea eax, [esp + 0x30]
push ecx
push 0x208
push edx
push 0x4117d0
lea ecx, [esp + 0x560]
push eax
push ecx
call ebp
lea edx, [esp + 0x960]
push 0x40e6e8
push edx
call fcn.00407c02
add esp, 8
test eax, eax
je 0x406a22
push eax
lea eax, [esp + 0x75c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e6e8
push 0
call fcn.00407c02
mov esi, eax
add esp, 8
test esi, esi
je 0x406a0a
push 1
push esi
lea ecx, [esp + 0x44]
push 0x104
push ecx
call fcn.00406330
mov al, byte [esi]
add esp, 0x10
cmp al, 0x5c
jne 0x406965
lea edx, [esp + 0x654]
lea eax, [esp + 0x44c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x44c]
push ecx
push 0x104
push edx
call fcn.00406200
add esp, 0xc
jmp 0x406978
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x44c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e6e8
push 0
call fcn.00407c02
mov esi, eax
add esp, 8
test esi, esi
je 0x4069f2
push 1
push esi
lea edx, [esp + 0x44]
push 0x104
push edx
call fcn.00406330
mov al, byte [esi]
add esp, 0x10
cmp al, 0x5c
jne 0x4069dd
mov eax, dword [esp + 0xb74]
lea ecx, [esp + 0x244]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x3c]
lea eax, [esp + 0x244]
push edx
push 0x104
push eax
call fcn.00406200
add esp, 0xc
jmp 0x406a5e
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x244]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x406a5e
mov eax, dword [esp + 0xb74]
lea ecx, [esp + 0x244]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x406a5e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x654]
lea eax, [esp + 0x44c]
push edx
push eax
jmp 0x406a4a
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x960]
lea ecx, [esp + 0x758]
push eax
push ecx
call esi
lea edx, [esp + 0x654]
lea eax, [esp + 0x44c]
push edx
push eax
call esi
mov ecx, dword [esp + 0xb74]
lea edx, [esp + 0x244]
push ecx
push edx
call esi
lea eax, [esp + 0x244]
push eax
call fcn.004063f0
push str.PATH_02d
lea ecx, [esp + 0x148]
push str.PATHS
lea edx, [esp + 0x250]
push ecx
push edx
call fcn.00406460
add esp, 0x14
test eax, eax
jge 0x406ad0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
add eax, ecx
inc ecx
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x14]
push str.PATH_02d
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x140]
lea eax, [esp + 0x244]
lea ecx, [esp + 0x10]
push edx
push eax
push ecx
push str.PATHS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edx, [esp + 0x758]
lea eax, [esp + 0x44c]
push edx
push 0x104
push eax
call fcn.00406200
lea ecx, [esp + 0x764]
lea edx, [esp + 0x250]
push ecx
push 0x104
push edx
call fcn.00406200
add esp, 0x18
lea eax, [esp + 0x244]
lea ecx, [esp + 0x44c]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x244]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp + 0xb78]
inc edi
push 0
push edi
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0xb7c]
lea ecx, [esp + 0x758]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push str.FILE_02d
lea eax, [esp + 0x144]
push str.FILES
lea ecx, [esp + 0x24c]
push eax
push ecx
call fcn.00406460
add esp, 0x10
test eax, eax
jge 0x406bc5
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
lea eax, [edx + ecx]
inc ecx
push eax
lea eax, [esp + 0x14]
push str.FILE_02d
push eax
mov dword [esp + 0x34], ecx
call ebx
add esp, 0xc
lea ecx, [esp + 0x140]
lea edx, [esp + 0x244]
lea eax, [esp + 0x10]
push ecx
push edx
push eax
push str.FILES
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp edi, dword [esp + 0x1c]
jl 0x40689a
mov ecx, dword [esp + 0xb84]
mov edx, dword [str.Common_Programs]
mov eax, dword [str.Programs]
push ecx
push edx
push eax
lea ecx, [esp + 0x868]
push 0x104
push ecx
call fcn.00406100
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
add esp, 0x14
mov dword [esp + 0x1c], 0
lea esi, [edx + eax]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push ecx
push str.Icon_03d
push edx
call ebx
mov ax, word [0x412e54]
add esp, 0xc
cmp ax, 7
je 0x406c55
cmp ax, 9
je 0x406c55
mov eax, dword [esp + 0xb70]
lea ecx, [esp + 0x3c]
push eax
push 0x104
push ecx
lea edx, [esp + 0x3c]
push 0x4117d0
push edx
push str.ShortCut
jmp 0x406c76
mov eax, dword [esp + 0xb70]
lea ecx, [esp + 0x3c]
push eax
push 0x104
push ecx
lea edx, [esp + 0x3c]
push 0x4117d0
push edx
push str.ShortCutX64
call ebp
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x406d65
lea ecx, [esp + 0x3c]
push 0x40e6e8
push ecx
call fcn.00407c02
add esp, 8
mov edi, eax
lea edx, [esp + 0x85c]
lea eax, [esp + 0x348]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0xb80]
lea edx, [esp + 0x348]
push ecx
push 0x104
push edx
call fcn.00406200
push edi
lea eax, [esp + 0x358]
push 0x104
push eax
call fcn.00406200
add esp, 0x18
lea ecx, [esp + 0x348]
push str..lnk
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.FILE_02d
lea edx, [esp + 0x144]
push str.FILES
lea eax, [esp + 0x350]
push edx
push eax
call fcn.00406460
add esp, 0x10
test eax, eax
jge 0x406d51
mov eax, esi
lea ecx, [esp + 0x10]
push eax
push str.FILE_02d
push ecx
inc esi
call ebx
add esp, 0xc
lea edx, [esp + 0x140]
lea eax, [esp + 0x348]
lea ecx, [esp + 0x10]
push edx
push eax
push ecx
push str.FILES
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 0x3e7
mov dword [esp + 0x1c], eax
jl 0x406c0c
lea edx, [esp + 0x85c]
lea eax, [esp + 0x348]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0xb80]
lea edx, [esp + 0x348]
push ecx
push 0x104
push edx
call fcn.00406200
push str.PATH_02d
lea eax, [esp + 0x150]
push str.PATHS
lea ecx, [esp + 0x35c]
push eax
push ecx
call fcn.00406460
add esp, 0x1c
test eax, eax
jge 0x406df5
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
add eax, edx
lea ecx, [esp + 0x10]
push eax
push str.PATH_02d
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x140]
lea eax, [esp + 0x348]
lea ecx, [esp + 0x10]
push edx
push eax
push ecx
push str.PATHS
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xb58
ret