Function at 0x41002705
Capabilities:
Delete directory
Delete file
Delete registry key
Get common file path
Move file
Persist via lnk shortcut
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x530
and byte [ebp - 0x328], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x327]
rep stosd dword es:[edi], eax
and byte [ebp - 0x224], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x223]
and byte [ebp - 1], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x3b
mov byte [ebp - 0xa], 0x35
mov byte [ebp - 9], 0xb5
mov byte [ebp - 8], 0xb7
mov byte [ebp - 7], 0xcd
mov byte [ebp - 6], 0xb0
mov byte [ebp - 5], 0xd3
mov byte [ebp - 4], 0xc5
mov byte [ebp - 3], 0xcf
mov byte [ebp - 2], 0xc4
xor eax, eax
add byte [ebp + eax - 0xc], 0xfb
inc eax
cmp eax, 0xb
jl 0x41002771
and byte [ebp - 0x42c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x42b]
mov ebx, dword [sym.imp.MSVCRT.dll__snprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
mov esi, 0x104
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push str._s_s
lea eax, [ebp - 0x42c]
push esi
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push 1
pop edi
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x42c]
push str.UninstallString
push eax
push 0x80000002
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41002b89
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x41002b89
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
lea eax, [ebp - 0x224]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0xc
test eax, eax
je 0x41002b89
push 2
inc eax
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x328]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x328]
push 0x41006368
push eax
call fcn.41002d55
add esp, 0x1c
cmp eax, edi
jne 0x41002b89
and byte [ebp - 0x530], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x52f]
and byte [ebp - 0xd], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x14], 0x38
mov byte [ebp - 0x13], 0x3b
mov byte [ebp - 0x12], 0x35
mov byte [ebp - 0x11], 0x78
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6b
mov byte [ebp - 0xe], 0x6a
xor eax, eax
add byte [ebp + eax - 0x14], 0xfb
inc eax
cmp eax, 7
jl 0x4100289f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x410062f4
lea eax, [ebp - 0x530]
push esi
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x530]
push 0x40034
push 0x410062ec
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x41002b89
lea eax, [ebp - 0x328]
push eax
call fcn.41002e2b
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
pop ecx
lea eax, [ebp - 0x328]
push 0
push eax
call ebx
xor edi, edi
push 4
lea eax, [ebp - 0x328]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edi
lea eax, [ebp - 0x224]
push 0x10
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp eax, 1
jne 0x41002ad1
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x41002ad1
and byte [ebp - 0x120], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push str._s_s
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x120]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x120]
push 0
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea eax, [ebp - 0x120]
push 0
push eax
call edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push str._s_s.lnk
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x120]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x120]
push 0
push eax
call ebx
push 4
lea eax, [ebp - 0x120]
push 0
push eax
call edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x410062d4
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x120]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x120]
push 0
push eax
call ebx
push 4
lea eax, [ebp - 0x120]
push 0
push eax
call edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x410062c4
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x120]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x120]
push 0
push eax
call ebx
push 4
lea eax, [ebp - 0x120]
push 0
push eax
call edi
xor edi, edi
push edi
lea eax, [ebp - 0x224]
push 0xb
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp eax, 1
jne 0x41002b77
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x41002b77
and byte [ebp - 0x120], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x410062b8
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x120]
push 0
push eax
call ebx
push 4
lea eax, [ebp - 0x120]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x120]
push eax
call fcn.41002e2b
pop ecx
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 0x42c]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret