Function at 0x4089c0
Capabilities:
Check if file exists
Create process on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file attributes
Persist via lnk shortcut
Persist via run registry key
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f94ca
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3b4], esi
mov dword [ebp - 0x3b0], 0
lea ecx, [ebp - 0x234]
push 0xb
xor eax, eax
mov byte [ebp - 0x3a5], 0
push str.DisplayIcon
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.00405110
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x35c]
call fcn.00411060
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x3b0], 1
call fcn.00405080
mov dword [ebp - 4], 1
lea eax, [ebp - 0x35c]
cmp dword [ebp - 0x348], 8
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x35c]
push eax
call edi
movzx ecx, byte [ebp - 0x3a5]
test eax, eax
mov edx, 1
mov dword [ebp - 0x284], 0
cmovne ecx, edx
mov dword [ebp - 0x280], 7
xor eax, eax
mov dword [ebp - 0x3bc], ecx
mov byte [ebp - 0x3b8], cl
mov word [ebp - 0x294], ax
mov byte [ebp - 4], 2
mov byte [ebp - 0x3a5], al
mov eax, dword [esi + 4]
test eax, eax
jne 0x408c6a
mov byte [ebp - 0x3a5], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x234]
push 8
push str.Location
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.00405110
lea edx, [ebp - 0x234]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x264]
call fcn.00411060
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x3b0], 5
mov esi, eax
mov byte [ebp - 4], 3
call fcn.00405080
push 0x513480
lea ecx, [ebp - 0x264]
call fcn.004083c0
test al, al
jne 0x408b67
cmp dword [ebp - 0x250], 8
lea eax, [ebp - 0x264]
cmovae eax, dword [ebp - 0x264]
push eax
call edi
test eax, eax
jne 0x408be6
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004d43f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408ba0
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x264]
call fcn.00405110
push 1
push str.SMDB
lea ecx, [ebp - 0x264]
call fcn.0040a0d0
push 5
push 0x513840
lea ecx, [ebp - 0x264]
call fcn.0040a0d0
lea eax, [ebp - 0x294]
cmp eax, esi
je 0x408c21
mov ecx, eax
call fcn.00405080
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x294], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x284], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 2
call fcn.00405080
push 1
push str.SMDB
lea ecx, [ebp - 0x294]
call fcn.0040a0d0
push 7
push str.new_ver
lea ecx, [ebp - 0x294]
call fcn.0040a0d0
mov esi, dword [ebp - 0x3b4]
mov eax, 1
mov dword [ebp - 0x3ac], eax
jmp 0x408d89
mov eax, dword [eax + 0x20]
lea ecx, [ebp - 0x234]
add eax, 0x94
push eax
call fcn.00404020
mov eax, 3
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x3ac], eax
call fcn.00405080
movups xmm0, xmmword [ebp - 0x234]
xor eax, eax
lea ecx, [ebp - 0x234]
mov word [ebp - 0x234], ax
movups xmmword [ebp - 0x294], xmm0
movq xmm0, qword [ebp - 0x224]
movq qword [ebp - 0x284], xmm0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
call fcn.00405080
push 0
push 0x410e90
call dword [sym.imp.USER32.dll_EnumWindows]
push 9
xor eax, eax
mov dword [ebp - 0x224], 0
push str.ExTab.exe
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.00405110
push ecx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 5
call fcn.0040e060
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x234]
call fcn.00405080
push 0xd
xor eax, eax
mov dword [ebp - 0x224], 0
push str.uninstall.exe
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.00405110
push ecx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 6
call fcn.0040e060
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x234]
call fcn.00405080
push 9
xor eax, eax
mov dword [ebp - 0x224], 0
push str.pakege.7z
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call fcn.00405110
push str.ZIPINSTALL
push 0xd0
mov byte [ebp - 4], 7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp dword [ebp - 0x220], 8
lea edx, [ebp - 0x234]
mov esi, eax
mov dword [ebp - 0x2ec], 0
cmovae edx, dword [ebp - 0x234]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x2e8], 7
mov word [ebp - 0x2fc], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408e06
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2fc]
call fcn.00405110
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x2e0], eax
xor eax, eax
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c8], 7
mov word [ebp - 0x2dc], ax
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 9
call fcn.0040d1c0
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x2e4]
test eax, eax
je 0x40975e
cmp dword [ebp - 0x2cc], 0
je 0x40975e
cmp dword [ebp - 0x2c8], 8
lea esi, [ebp - 0x2dc]
push eax
push dword [ebp - 0x2e0]
cmovae esi, dword [ebp - 0x2dc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x408f1e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x3c0], eax
test eax, eax
je 0x408f1e
push dword [ebp - 0x2e4]
push dword [ebp - 0x2e0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
mov dword [ebp - 0x3c4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x408f1e
push 0
lea eax, [ebp - 0x3b0]
mov dword [ebp - 0x3b0], 0
push eax
push dword [ebp - 0x3c4]
push dword [ebp - 0x3c0]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
push 5
xor eax, eax
mov dword [ebp - 0x334], 0
push 0x513840
lea ecx, [ebp - 0x344]
mov dword [ebp - 0x330], 7
mov word [ebp - 0x344], ax
call fcn.00405110
lea eax, [ebp - 0x2dc]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x32c]
call fcn.00404020
lea eax, [ebp - 0x32c]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x27c]
call fcn.00404020
lea eax, [ebp - 0x374]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x27c]
call fcn.00415eb0
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0xe
push ecx
lea ecx, [ebp - 0x2c4]
push ecx
mov ecx, eax
call fcn.00416040
lea ecx, [ebp - 0x374]
call fcn.00405080
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x11
call fcn.00405080
cmp dword [ebp - 0x2b0], 8
lea eax, [ebp - 0x2c4]
cmovae eax, dword [ebp - 0x2c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408fed
lea ecx, [ebp - 0x2c4]
call fcn.00416ed0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x264]
xor eax, eax
mov dword [ebp - 0x254], 0
mov word [ebp - 0x264], ax
mov eax, dword [ebp - 0x3ac]
or eax, 8
mov dword [ebp - 0x250], 7
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x2b4]
inc eax
push eax
call fcn.0040a2b0
cmp dword [ebp - 0x2b0], 8
lea eax, [ebp - 0x2c4]
push dword [ebp - 0x2b4]
cmovae eax, dword [ebp - 0x2c4]
lea ecx, [ebp - 0x264]
push eax
call fcn.0040a0d0
push 1
push str.SMDB
lea ecx, [ebp - 0x264]
call fcn.0040a0d0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
call fcn.0042b680
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x4090ac
push eax
call edi
mov dword [ebp - 0x240], 0
xor esi, esi
lea eax, [ebp - 0x32c]
cmp dword [ebp - 0x318], 8
push esi
cmovae eax, dword [ebp - 0x32c]
push 0x80
push 3
push esi
push 1
push SysReAllocString
push eax
mov dword [ebp - 0x3ac], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x240], eax
cmp eax, 0xffffffff
jne 0x409104
mov dword [ebp - 0x240], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x3ac], esi
test esi, esi
jne 0x409127
push ecx
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x240]
call fcn.0046bda0
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x409138
push eax
call edi
mov dword [ebp - 0x240], 0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x23c]
mov esi, dword [ebp - 0x23c]
push dword [esi + 4]
call fcn.0046c430
mov eax, dword [ebp - 0x23c]
push 0x28
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x23c]
mov dword [eax], esi
mov eax, dword [ebp - 0x23c]
mov dword [eax + 8], esi
push dword [ebp - 0x23c]
mov dword [ebp - 0x238], 0
call fcn.004d1750
add esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x264]
call fcn.00405080
cmp dword [ebp - 0x3ac], 0
je 0x4091d8
cmp byte [ebp - 0x3a5], 0
jne 0x40973d
mov eax, dword [ebp - 0x3b4]
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x94]
call eax
push 0
push 0
push 0x12
mov ecx, dword [eax + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40973d
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x38c]
call fcn.00404020
lea edx, [ebp - 0x38c]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x2c4]
call fcn.00416e60
test al, al
je 0x409732
cmp byte [ebp - 0x3a5], 0
jne 0x409732
push 0x513840
lea ecx, [ebp - 0x27c]
call fcn.00403fd0
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x38c]
call fcn.00416040
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x18
call fcn.00405080
push str.ExTab.exe
lea ecx, [ebp - 0x27c]
call fcn.00403fd0
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x264]
call fcn.00416040
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0x1a
cmp ecx, eax
je 0x4092a4
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x409295
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x264]
call fcn.00405110
lea ecx, [ebp - 0x2ac]
call fcn.00405080
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x18
call fcn.00405080
push 0x513480
lea ecx, [ebp - 0x2ac]
call fcn.00403fd0
push str.ExTab.lnk
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x1b
call fcn.00403fd0
push str.ExTab.exe
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0x1c
call fcn.00403fd0
push ecx
lea eax, [ebp - 0x2ac]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x3a4]
push eax
mov al, byte [ebp - 0x3bc]
xor al, 1
movzx eax, al
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00409cf0
lea ecx, [ebp - 0x3a4]
call fcn.00405080
lea ecx, [ebp - 0x27c]
call fcn.00405080
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x21
call fcn.00405080
call fcn.00417e70
cmp dword [eax], 7
lea eax, [ebp - 0x314]
jl 0x40937b
cmp dword [ebp - 0x300], 8
cmovae eax, dword [ebp - 0x314]
push eax
push ecx
call fcn.00418ca0
jmp 0x40939d
cmp dword [ebp - 0x300], 8
push 0
cmovae eax, dword [ebp - 0x314]
push 0
push 0
push eax
push str.taskbarpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x3b4]
lea ecx, [ebp - 0x27c]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x28]
mov al, byte [eax + 0x160]
mov byte [ebp - 0x3a5], al
lea eax, [ebp - 0x264]
push eax
call fcn.00404020
cmp byte [ebp - 0x3a5], 0
mov byte [ebp - 4], 0x22
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
je 0x409444
cmp dword [ebp - 0x268], 8
lea eax, [ebp - 0x27c]
push 0x513884
cmovae eax, dword [ebp - 0x27c]
push eax
lea eax, [ebp - 0x24c]
push str.__ls____ls
push eax
call fcn.00418690
mov eax, dword [ebp - 0x23c]
lea ecx, [ebp - 0x24c]
add esp, 0x10
cmp dword [ebp - 0x238], 8
cmovae ecx, dword [ebp - 0x24c]
add eax, eax
push eax
push ecx
push 1
push 0x513840
push 0x5138a8
push SysReAllocString
call esi
lea ecx, [ebp - 0x24c]
call fcn.00405080
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0x21
call fcn.00405080
push dword [ebp - 0x3b8]
lea eax, [ebp - 0x264]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00404020
call fcn.004097e0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x374]
call fcn.00404020
sub esp, 8
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x3dc]
call fcn.0041b1a0
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x3cc], 0
call fcn.0041b1f0
mov dword [ebp - 0x3d0], eax
mov byte [ebp - 4], 0x25
push dword [ebp - 0x3dc]
mov dword [ebp - 0x3c8], 1
push ecx
lea ecx, [ebp - 0x264]
call fcn.0041e9a0
add esp, 8
cmp byte [ebp - 0x3a5], 0
mov byte [ebp - 4], 0x26
jne 0x4095a4
push str.___auto0
lea ecx, [ebp - 0x374]
call fcn.0040a070
push str.auto
lea ecx, [ebp - 0x2ac]
call fcn.00403fd0
lea edx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x27c]
call fcn.00411370
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x29
call fcn.00405080
push 0x513880
lea ecx, [ebp - 0x2ac]
call fcn.00403fd0
lea eax, [ebp - 0x2ac]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x3dc]
call fcn.0041adc0
lea ecx, [ebp - 0x2ac]
call fcn.00405080
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x268]
cmp edx, 0x10
jb 0x4095a4
mov ecx, dword [ebp - 0x27c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40959a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4097b0
push edx
push ecx
call fcn.004d1750
add esp, 8
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x3dc]
call fcn.0041aac0
cmp dword [eax + 0x14], 8
jb 0x4095be
mov eax, dword [eax]
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x3e0], 0
push ecx
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x420], 0x44
push ecx
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x3f4], 0x8000000
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0x41c], xmm0
movlpd qword [ebp - 0x414], xmm0
movlpd qword [ebp - 0x40c], xmm0
movlpd qword [ebp - 0x404], xmm0
movlpd qword [ebp - 0x3fc], xmm0
movlpd qword [ebp - 0x3f0], xmm0
movlpd qword [ebp - 0x3e8], xmm0
movups xmmword [ebp - 0x244], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x40964e
push eax
call edi
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x40965b
push eax
call edi
lea ecx, [ebp - 0x2ac]
call fcn.00405080
cmp byte [ebp - 0x3bc], 0
jne 0x4096f8
lea ecx, [ebp - 0xc8]
call fcn.00419400
push ecx
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x2b
call fcn.004195d0
mov ecx, eax
or ecx, edx
jne 0x40969d
push ecx
call fcn.004dab64
add esp, 4
push edx
push eax
lea ecx, [ebp - 0x24c]
call fcn.00417350
mov eax, dword [ebp - 0x23c]
lea ecx, [ebp - 0x24c]
add esp, 8
cmp dword [ebp - 0x238], 8
cmovae ecx, dword [ebp - 0x24c]
add eax, eax
push eax
push ecx
push 1
push str.InstallTime
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallExTab
push SysReAllocString
call esi
lea ecx, [ebp - 0x24c]
call fcn.00405080
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x26
call fcn.004087e0
mov eax, dword [ebp - 0x3b4]
mov ecx, dword [eax + 4]
call fcn.00403e90
lea ecx, [ebp - 0x3dc]
call fcn.0041a7e0
lea ecx, [ebp - 0x374]
call fcn.00405080
lea ecx, [ebp - 0x314]
call fcn.00405080
lea ecx, [ebp - 0x264]
call fcn.00405080
lea ecx, [ebp - 0x38c]
call fcn.00405080
lea ecx, [ebp - 0x2c4]
call fcn.00405080
lea ecx, [ebp - 0x32c]
call fcn.00405080
lea ecx, [ebp - 0x344]
call fcn.00405080
lea ecx, [ebp - 0x2dc]
call fcn.00405080
lea ecx, [ebp - 0x2fc]
call fcn.00405080
lea ecx, [ebp - 0x234]
call fcn.00405080
lea ecx, [ebp - 0x294]
call fcn.00405080
lea ecx, [ebp - 0x35c]
call fcn.00405080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret
call fcn.004da89d
int3