Function at 0x426c40
Capabilities:
Copy file
Get common file path
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2104
call fcn.0042a310
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x449788]
mov word [ebp - 0x1904], ax
push 0xffe
push 0
lea ecx, [ebp - 0x1902]
push ecx
call fcn.0042d590
add esp, 0xc
mov dx, word [0x4497a0]
mov word [ebp - 0x2104], dx
push 0x7fe
push 0
lea eax, [ebp - 0x2102]
push eax
call fcn.0042d590
add esp, 0xc
mov cx, word [0x4497f0]
mov word [ebp - 0x904], cx
push 0x7fe
push 0
lea edx, [ebp - 0x902]
push edx
call fcn.0042d590
add esp, 0xc
mov eax, dword [0x449824]
mov dword [ebp - 0x104], eax
push 0xfc
push 0
lea ecx, [ebp - 0x100]
push ecx
call fcn.0042d590
add esp, 0xc
push 0x100
lea edx, [ebp - 0x104]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1904]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x904]
push ecx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x449868
lea edx, [ebp - 0x1904]
push edx
call fcn.0042faf2
add esp, 8
lea eax, [ebp - 0x904]
push eax
lea ecx, [ebp - 0x2104]
push ecx
call fcn.0042fb63
add esp, 8
push 0x44988c
lea edx, [ebp - 0x904]
push edx
call fcn.0042faf2
add esp, 8
push 0x4663bc
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
test eax, eax
je 0x42704f
lea eax, [ebp - 0x904]
push eax
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x426e82
lea ecx, [ebp - 0x904]
push ecx
call fcn.004088e0
add esp, 4
push 0x449a04
mov edx, dword [0x4497dc]
push edx
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x449a84
mov eax, dword [str.DirectoryBackground_shell]
push eax
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x449a94
push 0x449b04
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x449a14
push 0x449b3c
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x449bd4
push 0x449c6c
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x449ca0
push 0x449d48
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x449d60
push 0x449e10
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x449e4c
push 0x449f08
push SysReAllocString
call fcn.00408f40
add esp, 0xc
lea ecx, [ebp - 0x1904]
push ecx
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x426e82
lea edx, [ebp - 0x1904]
push edx
call fcn.004088e0
add esp, 4
push 0
push 0x449fc8
push 0
push 0x449fd4
mov eax, dword [0x4497dc]
push eax
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44a06c
push 0
push 0x44a07c
mov ecx, dword [0x4497dc]
push ecx
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44a12c
push 0
push 0x44a144
mov edx, dword [0x4497dc]
push edx
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44a1ec
push 0
push 0x44a214
push 0x44a2d0
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44a33c
push 0
push 0x44a3f0
push 0x44a40c
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44a4d8
push 0
push 0x44a530
push 0x44a5d4
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44a618
push 0
push 0x44a6c8
push 0x44a6e0
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44a7bc
push 0
push 0x44a800
push 0x44a8ac
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44a910
push 0
push 0x44a9b8
push 0x44a9e4
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44aac0
push 0
push 0x44aae8
push 0x44aba8
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44ab8c
push 0
push 0x44ac94
push 0x44aca8
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44ad7c
push 0
push 0x44adb8
push 0x44ae6c
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44af78
push 0
push 0x44b078
push 0x44b0c8
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
lea eax, [ebp - 0x904]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [0x4663bc]
push edx
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x427313
lea eax, [ebp - 0x904]
push eax
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x427158
lea ecx, [ebp - 0x904]
push ecx
call fcn.004088e0
add esp, 4
push 0x44b200
mov edx, dword [0x4497dc]
push edx
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x44b2d0
mov eax, dword [str.DirectoryBackground_shell]
push eax
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x44b310
push 0x44b3b4
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x44b41c
push 0x44b4d4
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x44b528
push 0x44b5d4
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x44b634
push 0x44b6d4
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x44b71c
push str.Directory_shellScan_with_Cls
push SysReAllocString
call fcn.00408f40
add esp, 0xc
push 0x44b838
push str.Directory_shell
push SysReAllocString
call fcn.00408f40
add esp, 0xc
lea ecx, [ebp - 0x1904]
push ecx
call fcn.0040d580
add esp, 4
cmp eax, 0x2b9
jne 0x427158
lea edx, [ebp - 0x1904]
push edx
call fcn.004088e0
add esp, 4
push 0
push 0x44b9cc
push 0
push 0x44ba08
mov eax, dword [0x4497dc]
push eax
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44baa8
push 0
push 0x44bb00
mov ecx, dword [0x4497dc]
push ecx
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44bbb0
push 0
push str.Position
mov edx, dword [0x4497dc]
push edx
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44bc9c
push 0
push 0x44bccc
push str.DirectoryBackground_shellClscommand
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44bdf0
push 0
push 0x44bec8
push 0x44bee8
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44bff8
push 0
push 0x44c044
push str.exefile_shellScan_With_Cls
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44c154
push 0
push 0x44c254
push 0x44c2a0
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44c3b8
push 0
push 0x44c414
push 0x44c4dc
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44c550
push 0
push 0x44c610
push str.Drive_shellScan_With_Cls
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44c6a8
push 0
push 0x44c6f8
push str.Drive_shellScan_With_Clscommand
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push str.Scan_With_Cls
push 0
push 0x44c7e4
push 0x44c814
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push 0x44c874
push 0
push str.icon
push str.Directory_shellScan_With_Cls
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
push str.Cls.exe__1
push 0
push 0x44c95c
push str.Directory_shellScan_With_Clscommand
push SysReAllocString
call fcn.0041bd10
add esp, 0x18
push 0
lea eax, [ebp - 0x904]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push 0
mov edx, dword [0x466a60]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea eax, [ebp - 0x2104]
push eax
lea ecx, [ebp - 0x1904]
push ecx
lea edx, [ebp - 0x904]
push edx
call fcn.0041c110
add esp, 0xc
call fcn.0041a7e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret