Function at 0x448e80
Capabilities:
Create directory
Create process on windows
Create thread
Hide graphical window
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x57b300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str.dlg_install_RNGImage_
mov dword [ebp - 0x684], eax
mov dword [0x5845f0], eax
call fcn.00459400
add esp, 4
test eax, eax
je 0x449a1f
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004edf00
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x518]
push 0
push eax
call fcn.004edf00
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004233a0
lea ecx, [ebp - 0x518]
mov dword [ebp - 0x654], 0
add esp, 0x14
mov dword [ebp - 0x650], 0xf
mov byte [ebp - 0x664], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448f30
sub ecx, edx
lea eax, [ebp - 0x518]
push ecx
push eax
lea ecx, [ebp - 0x664]
call fcn.00404d10
push 0x3a8
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.00429a60
add esp, 0xc
mov ecx, 0x57b0f8
push eax
call fcn.004291b0
lea ecx, [ebp - 0x634]
call fcn.00419810
mov edx, dword [ebp - 0x650]
cmp edx, 0x10
jb 0x448fb7
mov ecx, dword [ebp - 0x664]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x448fad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449a34
push edx
push ecx
call fcn.00461701
add esp, 8
mov edi, dword [0x57b10c]
mov edx, 0x57b0f8
mov esi, dword [0x57b108]
cmp edi, 8
cmovae edx, dword [0x57b0f8]
or ebx, 0xffffffff
test esi, esi
je 0x449132
lea eax, [esi - 1]
mov ecx, ebx
cmp eax, ebx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x2e
lea eax, [edx + ecx*2]
je 0x449002
cmp eax, edx
je 0x449132
sub eax, 2
cmp word [eax], 0x2e
jne 0x448ff1
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x449132
lea ecx, [eax + 1]
mov dword [ebp - 0x620], 7
xor eax, eax
mov word [ebp - 0x634], ax
cmp esi, ecx
jb 0x449a39
sub esi, ecx
mov eax, 0x57b0f8
cmp esi, 0xffffffff
cmovb ebx, esi
cmp edi, 8
cmovae eax, dword [0x57b0f8]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x680], eax
cmp ebx, 7
ja 0x449078
lea esi, [ebx + ebx]
mov dword [ebp - 0x624], ebx
push esi
push eax
lea eax, [ebp - 0x634]
push eax
call fcn.004ed980
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x634], ax
jmp 0x4490de
cmp ebx, 0x7ffffffe
ja 0x449a3e
mov esi, ebx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x449098
mov esi, SysReAllocString
jmp 0x4490a2
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x634]
call fcn.00416d20
mov dword [ebp - 0x620], esi
mov edi, eax
lea esi, [ebx + ebx]
mov dword [ebp - 0x624], ebx
push esi
push dword [ebp - 0x680]
push edi
call fcn.004ed400
add esp, 0xc
mov dword [ebp - 0x634], edi
xor eax, eax
mov word [edi + esi], ax
lea eax, [ebp - 0x634]
mov ecx, 0x57b110
push eax
call fcn.004291b0
mov edx, dword [ebp - 0x620]
cmp edx, 8
jb 0x44912f
mov ecx, dword [ebp - 0x634]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x449125
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449a43
push edx
push ecx
call fcn.00461701
add esp, 8
or ebx, 0xffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.00459720
lea eax, [ebp - 0x664]
push 0
push eax
call fcn.0042e850
mov esi, eax
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x44915a
mov esi, dword [esi]
call fcn.00449c30
mov ecx, eax
test ecx, ecx
je 0x449a48
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x680], eax
test esi, esi
je 0x449194
test esi, 0xffff0000
jne 0x449194
movzx eax, si
lea ecx, [ebp - 0x680]
push eax
call fcn.00449d30
jmp 0x4491a0
push esi
lea ecx, [ebp - 0x680]
call fcn.0044a0a0
mov edx, dword [ebp - 0x650]
cmp edx, 0x10
jb 0x4491da
mov ecx, dword [ebp - 0x664]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4491d0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449a52
push edx
push ecx
call fcn.00461701
add esp, 8
mov edi, dword [ebp - 0x680]
push 0x5c
push edi
call fcn.0050017f
mov ecx, eax
add esp, 8
sub ecx, edi
test eax, eax
mov eax, dword [edi - 0xc]
cmove ecx, ebx
sub eax, ecx
lea ecx, [ebp - 0x680]
dec eax
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.00449f00
mov esi, dword [ebp - 0x688]
cmp dword [esi - 0xc], 0
jl 0x449244
push 0x5412dc
push esi
call fcn.0050022d
add esp, 8
test eax, eax
je 0x449244
mov ecx, dword [0x5845c4]
sub eax, esi
cmp eax, 0xffffffff
mov edx, 1
cmovne ecx, edx
mov dword [0x5845c4], ecx
cmp dword [0x57b2a8], 8
mov eax, 0x57b294
cmovae eax, dword [0x57b294]
push eax
call fcn.00457af0
add esp, 4
test eax, eax
jne 0x449280
cmp dword [0x57b2a8], 8
mov eax, 0x57b294
push 0
cmovae eax, dword [0x57b294]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004edf00
cmp dword [0x57b2a8], 8
mov eax, 0x57b294
push 0x53fc80
cmovae eax, dword [0x57b294]
push eax
lea eax, [ebp - 0x20c]
push 0x53fb4c
push eax
call fcn.00420180
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4492e3
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44933f
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004edf00
cmp dword [0x57b2a8], 8
mov eax, 0x57b294
push str.RNGImage.7z
cmovae eax, dword [0x57b294]
push str.bin_
push eax
lea eax, [ebp - 0x61c]
push 0x53fc70
push eax
call fcn.00420180
push 0x5412cc
lea eax, [ebp - 0x61c]
push 0x67
push eax
call fcn.00459570
add esp, 0x2c
test eax, eax
jne 0x44936c
call dword [sym.imp.ole32.dll_CoUninitialize]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44935c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jmp 0x449a15
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004edf00
lea eax, [ebp - 0x414]
push eax
call fcn.00421360
add esp, 0x10
test eax, eax
je 0x449411
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
jle 0x449411
lea eax, [ebp - 0x414]
mov dword [0x5845d4], 1
push eax
call ebx
cmp word [ebp + eax*2 - 0x416], 0x5c
jne 0x4493df
lea eax, [eax*2 - 2]
cmp eax, 0x208
jae 0x449a61
xor ecx, ecx
mov word [ebp + eax - 0x414], cx
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4493f0
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
mov ecx, 0x57b27c
call fcn.00416d80
cmp dword [0x5845c4], 0
jne 0x449504
call fcn.00449c30
mov ecx, eax
test ecx, ecx
je 0x449a57
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x628], 0
push 0x85
lea ecx, [ebp - 0x62c]
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x620], 0
call fcn.0043fe10
push dword [ebp - 0x684]
call fcn.00467774
push 0x378
call fcn.004616d1
add esp, 8
test eax, eax
je 0x4494f4
mov ecx, eax
call fcn.0043de10
mov ebx, eax
mov dword [ebp - 0x680], ebx
test ebx, ebx
je 0x4494f4
push 0
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push 0
push 0x96c80000
push 0
push 0
mov ecx, ebx
call fcn.00463c73
mov ecx, ebx
call fcn.004634af
mov ecx, dword [ebp - 0x680]
mov ebx, eax
call fcn.00463b1d
mov ecx, dword [ebp - 0x680]
push 1
call fcn.004634af
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00466b8e
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x62c]
call fcn.0043fa10
jmp 0x4495f8
push 0x5845ac
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x449520
sub ecx, edx
sar ecx, 1
je 0x4495a9
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004edf00
push str.LinkImageUpdata.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x53fc00
push eax
call fcn.00420180
push 0
push 1
push 0
lea eax, [ebp - 0x20c]
push 0x5412e0
push eax
call fcn.00459460
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push str._uninstall
push eax
call fcn.00459460
add esp, 0x44
push str.LinkImageUpdata.exe
call fcn.00459e80
push str.LinkImage.exe
call fcn.00459e80
add esp, 8
lea eax, [ebp - 0x688]
push eax
push 0
push 0
push 0x4214f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x57b0f4], 0
je 0x4495e3
call fcn.004262d0
push 1
call fcn.00422890
add esp, 4
push 0x5845ac
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [0x57b290], 8
mov ecx, 0x57b27c
mov eax, dword [0x57b28c]
cmovae ecx, dword [0x57b27c]
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x684], ecx
cmp eax, 8
jae 0x44964b
movups xmm0, xmmword [ecx]
mov dword [ebp - 0x638], 7
movups xmmword [ebp - 0x64c], xmm0
jmp 0x449698
mov ebx, eax
lea ecx, [ebp - 0x64c]
mov eax, SysReAllocString
or ebx, 7
cmp ebx, eax
cmova ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.00416d20
mov ecx, dword [ebp - 0x680]
mov dword [ebp - 0x64c], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x684]
push eax
call fcn.004ed400
mov eax, dword [ebp - 0x680]
add esp, 0xc
mov dword [ebp - 0x638], ebx
push 8
push str.missent
lea ecx, [ebp - 0x64c]
mov dword [ebp - 0x63c], eax
call fcn.00419c70
cmp dword [ebp - 0x638], 8
lea eax, [ebp - 0x64c]
push 1
cmovae eax, dword [ebp - 0x64c]
push eax
call fcn.00458120
add esp, 8
cmp dword [0x5845d4], 0
jne 0x449718
cmp dword [0x57b2d8], 8
mov ebx, 0x57b2c4
push dword [0x57b0ec]
cmovae ebx, dword [0x57b2c4]
sub esp, 0x18
mov ecx, esp
push str.qdnews
call fcn.00428f80
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00428f80
push SysReAllocStringLen
call fcn.00418030
add esp, 0x38
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x3f
push str.SoftwareMicrosoftwindowscurrentVersionUninstallMiniInpaint
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.00416d80
push SysReAllocStringLen
call fcn.00416f10
add esp, 4
xor eax, eax
mov ecx, esp
push 0x39
push str.SoftwareMicrosoftwindowscurrentVersionUninstallxcnte
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.00416d80
push SysReAllocStringLen
call fcn.00416f10
add esp, 4
xor eax, eax
mov ecx, esp
push 0x3f
push str.SoftwareMicrosoftwindowscurrentVersionUninstall_notetts.exe
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.00416d80
push SysReAllocStringLen
call fcn.00416f10
add esp, 0x1c
cmp dword [0x57b0f0], 0
je 0x44998d
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._c_schtasks__create__sc_minute__mo_60__tn
lea ecx, [ebp - 0x634]
call fcn.00428f80
push 1
push 0x53fccc
lea ecx, [ebp - 0x634]
call fcn.00419c70
push 0xe
push str.LinkImage_plan
lea ecx, [ebp - 0x634]
call fcn.00419c70
push 1
push 0x53fccc
lea ecx, [ebp - 0x634]
call fcn.00419c70
push 5
push 0x541508
lea ecx, [ebp - 0x634]
call fcn.00419c70
push 1
push 0x53fccc
lea ecx, [ebp - 0x634]
call fcn.00419c70
cmp dword [0x57b290], 8
lea ecx, [ebp - 0x634]
push dword [0x57b28c]
mov eax, 0x57b27c
cmovae eax, dword [0x57b27c]
push eax
call fcn.00419c70
push 1
push 0x53ed68
lea ecx, [ebp - 0x634]
call fcn.00419c70
push 0xd
push str.LinkImage.exe
lea ecx, [ebp - 0x634]
call fcn.00419c70
push 1
push 0x541514
lea ecx, [ebp - 0x634]
call fcn.00419c70
mov ax, word [0x541520]
movq xmm0, qword [str.__smostart]
mov word [ebp - 0x65c], ax
lea eax, [ebp - 0x664]
push 0x3a8
push eax
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x650], 0xf
push eax
mov dword [ebp - 0x654], 0xa
movq qword [ebp - 0x664], xmm0
mov byte [ebp - 0x65a], 0
call fcn.00429a60
mov edx, eax
add esp, 0xc
cmp dword [edx + 0x14], 8
jb 0x4498df
mov edx, dword [edx]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4498e4
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x634]
call fcn.00419c70
lea ecx, [ebp - 0x67c]
call fcn.00419810
mov edx, dword [ebp - 0x650]
cmp edx, 0x10
jb 0x449945
mov ecx, dword [ebp - 0x664]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44993b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449a66
push edx
push ecx
call fcn.00461701
add esp, 8
push 0xd
push str.___RL_HIGHEST
lea ecx, [ebp - 0x634]
call fcn.00419c70
cmp dword [ebp - 0x620], 8
lea eax, [ebp - 0x634]
push 0
cmovae eax, dword [ebp - 0x634]
push 0
push eax
push 0x541540
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x634]
call fcn.00419810
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x638]
cmp edx, 8
jb 0x4499d3
mov ecx, dword [ebp - 0x64c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4499c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x449a6b
push edx
push ecx
call fcn.00461701
add esp, 8
xor eax, eax
mov dword [ebp - 0x63c], 0
lea edx, [esi - 0x10]
mov word [ebp - 0x64c], ax
or esi, 0xffffffff
mov dword [ebp - 0x638], 7
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x449a0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x449a1f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046170f
mov esp, ebp
pop ebp
ret 0x10
call fcn.004f6f4a
call fcn.00403550
call fcn.00404fd0
call fcn.004f6f4a
push 0x80004005
call fcn.00440030
call fcn.004f6f4a
push 0x80004005
call fcn.00440030
call fcn.00461bac
call fcn.004f6f4a
call fcn.004f6f4a
int3