Function at 0x416d3f
Capabilities:
Delete file
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423ef2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x32c
push edi
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x324], 0
mov al, byte [0x439ab0]
mov byte [ebp - 0x214], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x439ab4]
mov byte [ebp - 0x110], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x439ab8]
mov byte [ebp - 0x320], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x31f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x328], 0
lea eax, [ebp - 0x320]
push eax
push 0x104
push 0x4352e8
call fcn.00405071
add esp, 0xc
mov ecx, dword [ebp - 0x338]
call fcn.004164be
cmp eax, 1
jne 0x416e6e
lea ecx, [ebp - 0x324]
push ecx
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x416e47
push 0
push str.KANUpdate2::UpdateShortcut___CSIDL_COMMON_DESKTOPDIRECTORY_Fail
call fcn.00410257
add esp, 8
cmp dword [ebp - 0x218], 0
je 0x416e55
jmp 0x4170a3
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
jmp 0x416f44
lea ecx, [ebp - 0x334]
call fcn.0041d630
mov dword [ebp - 4], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerShell_Folders
push 0x80000002
lea ecx, [ebp - 0x334]
call fcn.0041d66d
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x416eb3
push 0
push str.RegKey.Open_def_KAN_COMMON_DESKTOP_PATH_9X_Fail
call fcn.00410257
add esp, 8
cmp dword [ebp - 0x218], 0
jne 0x416ed3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.0041d651
jmp 0x4170a3
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push str.Common_Desktop
lea ecx, [ebp - 0x334]
call fcn.0041d8b2
cmp dword [ebp - 0x218], 0
jne 0x416f07
push 0
push str.RegKey.Read_def_KAN_COMMON_DESKTOP_KEY_9X_Fail
call fcn.00410257
add esp, 8
cmp dword [ebp - 0x218], 0
jne 0x416f27
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.0041d651
jmp 0x4170a3
lea ecx, [ebp - 0x334]
call fcn.0041d6c6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.0041d651
push 0x104
push 0
lea edx, [ebp - 0x214]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x4353e8
lea eax, [ebp - 0x110]
push eax
push 0x435404
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x43540c
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x320]
push ecx
call fcn.00416c79
add esp, 0xc
mov ecx, dword [ebp - 0x338]
call fcn.004164be
cmp eax, 1
jne 0x416fe4
lea edx, [ebp - 0x324]
push edx
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x416fe2
push 0
push str.KANUpdate2::UpdateShortcut___CSIDL_COMMON_PROGRAMS_Fail
call fcn.00410257
add esp, 8
jmp 0x417013
lea eax, [ebp - 0x324]
push eax
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x417013
push 0
push str.KANUpdate2::UpdateShortcut___CSIDL_PROGRAMS_Fail
call fcn.00410257
add esp, 8
cmp dword [ebp - 0x218], 0
je 0x417021
jmp 0x4170a3
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push 0x104
push 0
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x435490
push 0x4354ac
lea ecx, [ebp - 0x110]
push ecx
push 0x4354c4
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x4354d0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x320]
push edx
call fcn.00416c79
add esp, 0xc
mov dword [ebp - 0x32c], 1
cmp dword [ebp - 0x32c], 0
jne 0x4170bb
push 0
push str.KANUpdate2::UpdateShortcut___Fail
call fcn.00410257
add esp, 8
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret