Function at 0x4089d0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x41c]
sub esp, 0x41c
push 0xffffffffffffffff
push 0x44b135
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x461040]
xor eax, ebp
mov dword [ebp + 0x418], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
sub esp, 8
lea ecx, [ebp]
call fcn.00405950
add esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.00409890
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 7
jbe 0x408a3a
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.00403d40
cmp edi, 0xffffffff
jne 0x408a70
or edi, edi
jmp 0x408da1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 4
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
test ebx, ebx
je 0x408ad8
cmp word [ebx], dx
je 0x408ad8
push edx
push edx
push edx
push edx
push 0xffffffffffffffff
push ebx
push edx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jle 0x408ad6
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
push 0
push edi
push eax
push 0xffffffffffffffff
push ebx
push 0
mov dword [ebp - 0x10], eax
push 0xfde9
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x10]
jmp 0x408ad8
xor edx, edx
mov ebx, edx
lea edi, [ebp + 0x30]
mov edx, edi
mov ecx, str._InternetShortcut__r_nURL
sub ecx, edx
mov al, 0x5b
mov edx, dword [ebp - 0x10]
nop dword [eax + eax]
mov byte [edi], al
inc edi
mov al, byte [ecx + edi]
test al, al
jne 0x408af0
mov byte [edi], al
mov dl, byte [edx]
test dl, dl
je 0x408b8c
lea ebx, [ebx + 1]
cmp dl, 0x61
jl 0x408b13
cmp dl, 0x7a
jle 0x408b76
cmp dl, 0x41
jl 0x408b1d
cmp dl, 0x5a
jle 0x408b76
cmp dl, 0x30
jl 0x408b27
cmp dl, 0x39
jle 0x408b76
mov eax, str.__.____:_______
mov cl, 0x2d
nop
cmp cl, dl
je 0x408b3e
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408b30
jmp 0x408b45
sub eax, str.__.____:_______
jns 0x408b76
mov cl, dl
mov byte [edi], 0x25
sar cl, 4
and dl, 0xf
and cl, 0xf
cmp cl, 0xa
sbb al, al
and al, 0xf9
add al, 0x37
add al, cl
cmp dl, 0xa
mov byte [edi + 1], al
sbb al, al
and al, 0xf9
add al, 0x37
add al, dl
mov byte [edi + 2], al
mov eax, 3
jmp 0x408b7d
mov byte [edi], dl
mov eax, 1
add edi, eax
mov byte [edi], 0
mov dl, byte [ebx]
test dl, dl
jne 0x408b06
mov word [edi], 0xa0d
lea eax, [ebp + 0x30]
add edi, 2
push 0
mov byte [edi], 0
sub edi, eax
lea eax, [ebp - 0x24]
push eax
push edi
mov edi, dword [ebp - 0x18]
lea eax, [ebp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
push edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x408cd7
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 5
xor edi, edi
mov dword [ebp - 0x1c], edi
cmp byte [ebp + 0x30], 0
mov dword [ebp - 0x20], edi
je 0x408c38
push edi
push edi
push 0xffffffffffffffff
lea eax, [ebp + 0x30]
push eax
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test ebx, ebx
jle 0x408c35
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
mov edi, eax
lea eax, [ebp + 0x30]
push edi
push 0xffffffffffffffff
push eax
push 0
mov dword [ebp - 0x1c], edi
push 0xfde9
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [ebp - 0x18]
cmp word [esi], 0
mov eax, esi
je 0x408c49
add eax, 2
cmp word [eax], 0
jne 0x408c40
mov edx, str.URL_Shortcut_content:
mov esi, eax
mov ecx, 0x55
sub edx, eax
nop word [eax + eax]
mov word [esi], cx
add esi, 2
movzx ecx, word [edx + esi]
test cx, cx
jne 0x408c60
xor eax, eax
mov word [esi], ax
test edi, edi
je 0x408c9a
movzx eax, word [edi]
mov ecx, eax
test ax, ax
je 0x408c95
mov ecx, edi
sub ecx, esi
mov word [esi], ax
add esi, 2
movzx eax, word [ecx + esi]
test ax, ax
jne 0x408c86
xor eax, eax
mov word [esi], ax
mov ecx, 0x4595a4
mov eax, 0xd
sub ecx, esi
mov word [esi], ax
add esi, 2
movzx eax, word [ecx + esi]
test ax, ax
jne 0x408ca6
xor eax, eax
mov word [esi], ax
mov byte [ebp - 4], 4
test edi, edi
je 0x408cc9
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
or edi, 0xffffffff
test ebx, ebx
je 0x408d7f
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.00409890
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 7
jbe 0x408cfa
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x18]
call fcn.00403d40
test esi, esi
je 0x408d32
push esi
mov edx, str.open
mov ecx, edi
call fcn.004092a0
add esp, 4
mov esi, eax
cmp edi, 0x20
ja 0x408d7f
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp]
call fcn.00409890
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 7
jbe 0x408d4f
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x18]
call fcn.00403d40
test esi, esi
je 0x408d7f
push esi
xor edx, edx
mov ecx, edi
call fcn.004092a0
add esp, 4
xor eax, eax
cmp edi, 0x20
cmova edi, eax
mov byte [ebp - 4], al
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00403d40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x418]
xor ecx, ebp
call fcn.00429557
lea esp, [ebp + 0x41c]
pop ebp
ret