Function at 0x40e2e0
Capabilities:
Check if file exists
Delete file
Delete registry value
Enumerate files on windows
Get common file path
Get file attributes
Get program files directory
Get startup folder
Move file
Persist via run registry key
Set file attributes
Write file to startup folder

Disassembly:
push 0xffffffffffffffff
push 0x415d3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x498
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebp
push esi
xor ebp, ebp
push edi
push ebp
lea eax, [esp + 0x24]
push 7
push eax
push ebp
mov dword [esp + 0x24], ebp
call ebx
test eax, eax
je 0x40e38e
mov edi, str.dfzhqb.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40e38e
mov eax, dword [esp + 0x4b8]
mov ebp, 1
test eax, eax
mov dword [esp + 0x14], ebp
je 0x40ed0d
lea ecx, [esp + 0x20]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 4
lea edx, [esp + 0x24]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0
lea eax, [esp + 0x24]
push 0x26
push eax
push 0
call ebx
test eax, eax
je 0x40e494
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esp + ecx + 0x1f]
lea edx, [esp + ecx + 0x20]
cmp al, 0x5c
je 0x40e3c1
mov byte [edx], 0x5c
inc edx
mov edi, str.Common_Files_
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
push 1
mov ecx, 0x41ec90
call fcn.00413780
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
je 0x40e494
mov ebx, dword [esp + 0x4b8]
lea edx, [esp + 0x20]
lea esi, [eax + 0x108]
push edi
push edx
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x40e476
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40e476
test al, 4
je 0x40e476
lea eax, [esp + 0x1c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
jne 0x40e476
mov ebp, 1
test ebx, ebx
mov dword [esp + 0x14], ebp
je 0x40ed0d
lea ecx, [esp + 0x20]
push ecx
call fcn.004086c0
add esp, 4
lea edx, [esp + 0x10]
mov ecx, 0x41ec90
push edx
push 1
call fcn.00413780
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
jne 0x40e420
test ebp, ebp
je 0x40e4a7
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e607
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebp, [esp + eax + 0x20]
mov ebx, 0x4166c8
mov byte [ebp], 0x5c
inc ebp
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40e513
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e513
lea ecx, [esp + 0x20]
push ecx
call fcn.004086c0
add esp, 4
add ebx, 4
cmp ebx, 0x4166d4
jb 0x40e4c5
push str._system_
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
add ebp, eax
mov edi, str.1sass.exe
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, str.zhqb.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x368]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e5ee
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e5e7
lea edi, [esp + 0x394]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004086c0
add esp, 4
lea ecx, [esp + 0x368]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e5a3
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.zhqbdf
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer_run
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x40e61a
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e6b1
lea edx, [esp + 0x20]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ebp, [esp + eax + 0x20]
mov ebx, 0x4166d4
mov byte [ebp], 0x5c
inc ebp
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40e686
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e686
lea edx, [esp + 0x20]
push edx
call fcn.004086c0
add esp, 4
add ebx, 4
cmp ebx, 0x4166e0
jb 0x40e638
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e6b1
push str.updater
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40e6c8
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e821
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ebp, [esp + eax + 0x20]
mov ebx, 0x4166e0
mov byte [ebp], 0x5c
inc ebp
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0x10
test al, al
jne 0x40e737
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e737
lea ecx, [esp + 0x20]
push ecx
call fcn.004086c0
add esp, 4
add ebx, 4
cmp ebx, 0x4168c8
jb 0x40e6e6
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40e759
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e821
mov edi, str.k__________.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x124]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x40e821
lea ebx, [ebp + 1]
lea edi, [esp + 0x150]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
mov al, byte [ecx]
test al, al
je 0x40e7da
cmp al, 0x30
jl 0x40e7da
cmp al, 0x39
jg 0x40e7da
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40e7ca
cmp byte [ecx], 0x2e
jne 0x40e7ff
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e816
lea eax, [esp + 0x20]
push eax
call fcn.004086c0
add esp, 4
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x124]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e79e
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40e838
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40e972
lea ecx, [esp + 0x20]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebx, [esp + eax + 0x20]
push str.Downloaded_Program_Files_
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add ebx, eax
mov edi, 0x41ad98
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x124]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40e972
test byte [esp + 0x124], 0x10
jne 0x40e954
lea edx, [esp + 0x150]
push 0x2e
push edx
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x40e954
mov edi, dword [sym.imp.MSVCRT.dll__mbsicmp]
push 0x41a424
push esi
call edi
add esp, 8
test eax, eax
je 0x40e8ec
push 0x41d5ec
push esi
call edi
add esp, 8
test eax, eax
jne 0x40e954
lea edi, [esp + 0x150]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x40e934
lea eax, [esp + 0x20]
push eax
call fcn.004085e0
add esp, 4
test eax, eax
je 0x40e954
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40e954
lea ecx, [esp + 0x20]
push ecx
call fcn.004086c0
add esp, 4
lea edx, [esp + 0x124]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e89d
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40e989
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40eb73
lea ecx, [esp + 0x124]
mov dword [esp + 0x10], 0
call fcn.00414010
lea eax, [esp + 0x10]
mov ecx, 0x41ec90
push eax
push 1
mov dword [esp + 0x4b8], 0
call fcn.00413780
mov ecx, dword [esp + 0x10]
mov edi, eax
inc ecx
test edi, edi
mov dword [esp + 0x10], ecx
je 0x40eb5c
mov ebp, dword [sym.imp.MSVCRT.dll__mbslwr]
lea ecx, [edi + 4]
push str.WinSys
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40ea15
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40eb38
lea edx, [edi + 0x108]
push edx
call fcn.004086c0
add esp, 4
push 1
jmp 0x40eb2d
lea ebx, [edi + 0x108]
push ebx
call ebp
push str.rundll32
push ebx
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0xc
test eax, eax
je 0x40eb38
push 0x3a
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x40eb38
dec esi
push 0x2c
push esi
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x40ea69
cmp byte [eax - 1], 0x22
jne 0x40ea66
mov byte [eax - 1], 0
mov byte [eax], 0
push esi
lea ecx, [esp + 0x128]
call fcn.00414080
test eax, eax
je 0x40eb38
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x12c]
call fcn.00414140
test eax, eax
je 0x40eb38
mov edx, dword [esp + 0x18]
push str.Player
push edx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
je 0x40eb0c
mov eax, dword [esp + 0x18]
push str.Microsoft_DirectMusic_Interactive_Engine
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40ece7
lea ecx, [esp + 0x264]
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea edx, [esp + 0x264]
push edx
call ebp
lea eax, [esp + 0x268]
push str.downloaded_program_files_
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0xc
neg eax
sbb eax, eax
neg eax
test eax, eax
je 0x40eb38
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40eb38
push esi
call fcn.004086c0
add esp, 4
mov byte [ebx], 0
push 0
push edi
mov ecx, 0x41ec90
call fcn.00412c10
lea edx, [esp + 0x10]
mov ecx, 0x41ec90
push edx
push 1
call fcn.00413780
mov ecx, dword [esp + 0x10]
mov edi, eax
inc ecx
test edi, edi
mov dword [esp + 0x10], ecx
jne 0x40e9d2
lea ecx, [esp + 0x124]
mov dword [esp + 0x4b0], 0xffffffff
call fcn.00414050
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40eb8a
mov eax, dword [esp + 0x4b8]
test eax, eax
je 0x40ec0d
lea eax, [esp + 0x10]
mov ecx, 0x41ec90
push eax
push 0x40
mov dword [esp + 0x18], 0
call fcn.00413780
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
je 0x40ec0d
lea ecx, [esp + 0x1c]
lea esi, [eax + 0x108]
push ecx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, 5
jae 0x40ebef
push esi
call fcn.004085e0
add esp, 4
test eax, eax
je 0x40ebef
mov eax, dword [esp + 0x4b8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x40ebef
push esi
call fcn.004086c0
add esp, 4
lea edx, [esp + 0x10]
mov ecx, 0x41ec90
push edx
push 0x40
call fcn.00413780
mov edx, dword [esp + 0x10]
inc edx
test eax, eax
mov dword [esp + 0x10], edx
jne 0x40ebb0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ec24
mov ecx, dword [esp + 0x4b8]
test ecx, ecx
je 0x40ed0f
lea eax, [esp + 0x18]
mov ecx, 0x41ec90
push eax
push 8
mov dword [esp + 0x20], 0
call fcn.00413780
mov ecx, dword [esp + 0x18]
mov esi, eax
inc ecx
test esi, esi
mov dword [esp + 0x18], ecx
je 0x40ed07
mov ebp, dword [esp + 0x14]
mov ebx, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea edi, [esi + 0x108]
push 0x2e
push edi
call ebx
add esp, 8
test eax, eax
je 0x40ec8f
push str..sys
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40ec8f
push 0x5f
push edi
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
test eax, eax
jne 0x40ec9c
push edi
call fcn.004085e0
add esp, 4
test eax, eax
je 0x40ecc1
mov eax, dword [esp + 0x4b8]
mov ebp, 1
test eax, eax
je 0x40ecc1
push edi
call fcn.004086c0
add esp, 4
mov ecx, 0x41ec90
push ebp
push esi
call fcn.00412c10
lea ecx, [esp + 0x18]
push ecx
push 8
mov ecx, 0x41ec90
call fcn.00413780
mov ecx, dword [esp + 0x18]
mov esi, eax
inc ecx
test esi, esi
mov dword [esp + 0x18], ecx
jne 0x40ec5a
jmp 0x40ed0d
mov ecx, dword [esp + 0x18]
push str.IEHpr_Module
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40eb38
jmp 0x40eb0c
mov eax, dword [esp + 0x14]
jmp 0x40ed0f
mov eax, ebp
mov ecx, dword [esp + 0x4a8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4a4
ret