Function at 0x4083af
Capabilities:
Persist via lnk shortcut
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
mov eax, dword [0x42b260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x42d3c0]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x408863
push esi
push edi
push 2
pop edi
cmp eax, edi
jne 0x4085ba
mov eax, dword [0x42d248]
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x494]
push eax
mov dword [ebp - 0x494], 3
mov dword [ebp - 0x490], str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov dword [ebp - 0x48c], str.UninstallCrosData
mov dword [ebp - 0x488], 1
mov dword [ebp - 0x484], str.Application
call fcn.004064cd
pop ecx
mov esi, dword [edi*4 + 0x42d3a0]
xor ebx, ebx
inc ebx
jmp 0x408506
push 0x400
lea eax, [ebp - 0x468]
push 0
push eax
call fcn.0040e8e0
lea eax, [edi - 1]
add esp, 0xc
dec eax
je 0x408494
dec eax
jne 0x4084e2
push ebx
lea eax, [ebp - 0x68]
push str.LnkData_d
push eax
call fcn.0040f37b
mov eax, dword [esi + 0x10]
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x468]
push eax
inc ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..lnk
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4084e2
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xc], 3
jae 0x408504
push ebx
lea eax, [ebp - 0x68]
push str.RegData_d
push eax
call fcn.0040f37b
mov eax, dword [esi + 0x10]
add esp, 0xc
inc ebx
cmp dword [eax + 8], 0
mov ecx, str._s__s__s
jne 0x4084c3
mov ecx, str._s__s
push dword [eax + 8]
push dword [eax + 4]
mov eax, dword [eax]
push dword [eax*4 + 0x42b018]
lea eax, [ebp - 0x468]
push ecx
push eax
call fcn.0040f37b
add esp, 0x14
lea eax, [ebp - 0x68]
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x494]
push eax
call fcn.004064cd
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x408438
inc edi
cmp edi, 4
jl 0x408429
mov esi, dword [0x42d3b8]
xor edi, edi
inc edi
jmp 0x4085ad
push 0x400
lea eax, [ebp - 0x468]
push 0
push eax
call fcn.0040e8e0
mov eax, dword [esi + 0x10]
add esp, 0xc
cmp dword [eax + 0xc], 3
jae 0x4085ab
push edi
lea eax, [ebp - 0x68]
push str.UserRegData_d
push eax
call fcn.0040f37b
mov eax, dword [esi + 0x10]
add esp, 0xc
inc edi
cmp dword [eax + 8], 0
mov ecx, str._s__s__s
jne 0x40856b
mov ecx, str._s__s
push dword [eax + 8]
push dword [eax + 4]
mov eax, dword [eax]
push dword [eax*4 + 0x42b018]
lea eax, [ebp - 0x468]
push ecx
push eax
call fcn.0040f37b
lea eax, [ebp - 0x68]
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x494]
push eax
call fcn.004064cd
add esp, 0x18
mov esi, dword [esi]
test esi, esi
jne 0x408526
jmp 0x408861
mov esi, 0x42d420
push esi
lea eax, [ebp - 0x468]
push str.Uninstall.dat__s
push eax
call fcn.0040f37b
lea eax, [ebp - 0x468]
push eax
call fcn.00401b8f
mov ecx, dword [0x42d3a4]
add esp, 0x10
cmp ecx, ebx
je 0x4085f5
push ecx
push eax
call fcn.0040447e
pop ecx
pop ecx
jmp 0x4085fa
mov dword [0x42d3a4], eax
push esi
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push 0x4233d8
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 0x80
push edi
push ebx
push edi
push 0x40000000
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x46c], eax
cmp eax, 0xffffffff
je 0x408861
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea eax, [ebp - 0x470]
push eax
push dword [0x42d248]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
inc eax
push eax
push dword [0x42d248]
push dword [ebp - 0x46c]
call ebx
push 0
lea eax, [ebp - 0x470]
push eax
push esi
call edi
inc eax
push eax
push esi
push dword [ebp - 0x46c]
call ebx
push 0x1400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov eax, dword [0x42d7f8]
test eax, eax
je 0x4086d6
lea ecx, [esi + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 8]
push eax
call edi
push 0
lea ecx, [ebp - 0x470]
push ecx
add eax, 8
push eax
push esi
push dword [ebp - 0x46c]
mov dword [esi + 4], eax
mov dword [esi], 0x100
call ebx
mov eax, dword [0x42c46c]
test eax, eax
je 0x40871b
lea ecx, [esi + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 8]
push eax
call edi
push 0
lea ecx, [ebp - 0x470]
push ecx
add eax, 8
push eax
push esi
push dword [ebp - 0x46c]
mov dword [esi + 4], eax
mov dword [esi], 0x200
call ebx
push dword [0x42c46c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x42c460]
and dword [ebp - 0x474], 0
test eax, eax
je 0x4087e3
mov ebx, eax
jmp 0x40877e
push dword [ebx + 8]
lea eax, [esi + 8]
push dword [ebx + 4]
push str._s__s
push eax
call fcn.0040f37b
add esp, 0x10
lea eax, [esi + 8]
push eax
call edi
add eax, 8
mov dword [esi + 4], eax
movzx ecx, word [ebx]
shl ecx, 0x10
or ecx, 0x300
push 0
mov dword [esi], ecx
lea ecx, [ebp - 0x470]
push ecx
push eax
push esi
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x408733
mov edi, dword [0x42c460]
test edi, edi
je 0x4087dd
mov dword [ebp - 0x478], 3
lea ebx, [edi + 0x18]
mov eax, dword [ebx]
test eax, eax
je 0x4087c6
movzx edx, word [ebp - 0x478]
push esi
lea ecx, [ebp - 0x474]
push ecx
movzx ecx, word [edi]
shl ecx, 0x10
or ecx, edx
push ecx
push eax
push dword [ebp - 0x46c]
call fcn.004082a5
add esp, 0x14
dec dword [ebp - 0x478]
sub ebx, 4
cmp dword [ebp - 0x478], 0
jge 0x408799
mov edi, dword [edi + 0x1c]
jmp 0x408788
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 3
pop edi
mov eax, dword [edi*4 + 0x42d3a0]
test eax, eax
je 0x408809
push esi
lea ecx, [ebp - 0x474]
push ecx
push edi
push eax
push dword [ebp - 0x46c]
call fcn.004082a5
add esp, 0x14
mov eax, dword [edi*4 + 0x42d3b0]
test eax, eax
je 0x408831
push esi
lea ecx, [ebp - 0x474]
push ecx
mov ecx, edi
or ecx, 0x10
push ecx
push eax
push dword [ebp - 0x46c]
call fcn.004082a5
add esp, 0x14
dec edi
jns 0x4087e6
push 0
lea eax, [ebp - 0x470]
push eax
push 4
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0x46c]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040e67e
leave
ret