Function at 0x407c50
Capabilities:
Copy file
Persist via lnk shortcut
Read .ini file
Set file attributes

Disassembly:
mov r11, rsp
sub rsp, 0xc78
mov rax, qword [0x00417b90]
xor rax, rsp
mov qword [rsp + 0xc20], rax
mov rax, qword [rsp + 0xca0]
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x28], r12
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xca8]
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
mov r12, r9
mov qword [rsp + 0x48], r9
mov rbp, r8
mov r15, rdx
mov qword [rsp + 0x40], rdx
xor ebx, ebx
lea r9, [r11 - 0xae8]
lea r8, [0x00412649]
lea rcx, str.UnInstLog
lea rdx, str.UnInstLog
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rdx, str.PATH_02d
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov r14d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x190]
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x80]
lea r8, [0x00412649]
lea rdx, [rsp + 0x60]
lea rcx, str.PATHS
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x407db1
nop
nop
nop
add r14d, 1
lea rdx, str.PATH_02d
lea rcx, [rsp + 0x60]
mov r8d, r14d
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x190]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rdx
lea r8, [0x00412649]
lea rcx, str.PATHS
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x407d50
lea rdx, str.FILE_02d
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0xc48], r13
mov r13d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x190]
lea r9, [rsp + 0x80]
lea r8, [0x00412649]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x60]
lea rcx, str.FILES
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x407e81
nop
nop
add r13d, 1
lea rdx, str.FILE_02d
lea rcx, [rsp + 0x60]
mov r8d, r13d
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x190]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rdx
lea r8, [0x00412649]
lea rcx, str.FILES
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x407e20
lea r9, [rsp + 0x80]
lea r8, str.NotFound
lea rdx, str.SrcDirectry
lea rcx, str.Directry
mov qword [rsp + 0xc60], rsi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0xc58], rdi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rsi, [rsp + 0x6e0]
lea rdi, str.NotFound
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
jne 0x407ee0
xor eax, eax
jmp 0x408680
lea rcx, [rsp + 0x6e0]
mov edx, 0x104
call fcn.00407530
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x6e0]
mov edx, 0x104
call fcn.00407790
mov rcx, rbp
call fcn.00407a70
lea r9, str.PATH_02d
lea r8, str.PATHS
lea rdx, [rsp + 0x190]
mov rcx, rbp
call fcn.00407b00
test eax, eax
jns 0x407f70
lea rdx, str.PATH_02d
lea rcx, [rsp + 0x60]
mov r8d, r14d
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x190]
lea rdx, [rsp + 0x60]
lea rcx, str.PATHS
mov r8, rbp
mov dword [rsp + 0x34], 1
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
movzx eax, word [0x00419714]
add eax, 0xffffffff
cmp eax, 7
ja case.0x407f92.6
lea rdx, [0x00400000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x86d8]
add rcx, rdx
jmp rcx
lea rdx, str.Files9x
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x407fee
lea rdx, str.FilesNT
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x407fee
lea rdx, str.FilesXP
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x407fee
lea rdx, str.FilesX64
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov edi, ebx
lea rdx, str.file_03d
lea rcx, [rsp + 0x70]
mov r8d, edi
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0xa10]
lea r8, [0x00412649]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x5d0]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x208
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0xa10]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x408055
add edi, 1
cmp edi, 0x3e7
jl 0x407ff0
mov edi, dword [rsp + 0x30]
movzx r9d, di
xor r8d, r8d
mov edx, 0x401
shl r9d, 0x10
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageA]
lea r9, [rsp + 0x190]
lea rdx, str.PATH
lea rcx, str.UNINSTALL
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test edi, edi
mov r12d, ebx
jle 0x40842d
mov rbx, qword [rsp + 0x40]
mov r15d, 1
nop
nop
nop
nop
lea rdx, str.file_03d
lea rcx, [rsp + 0x70]
mov r8d, r12d
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0xa10]
lea r8, [0x00412649]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x5d0]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x208
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea r8, [rsp + 0x38]
lea rdx, [0x004126ac]
lea rcx, [rsp + 0xa10]
call fcn.00409ba0
test rax, rax
je 0x40826d
lea rcx, [rsp + 0x7f0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x38]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
mov rsi, rax
je 0x408244
lea rcx, [rsp + 0x80]
mov r9d, 1
mov r8, rax
mov edx, 0x104
call fcn.00407970
cmp byte [rsi], 0x5c
jne 0x408198
lea rdx, [rsp + 0x6e0]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x4c0]
mov edx, 0x104
call fcn.00407790
jmp 0x4081ae
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x38]
lea rdx, [0x004126ac]
xor ecx, ecx
call fcn.00409ba0
test rax, rax
mov rsi, rax
je 0x408231
lea rcx, [rsp + 0x80]
mov r9d, 1
mov r8, rax
mov edx, 0x104
call fcn.00407970
cmp byte [rsi], 0x5c
jne 0x408219
lea rcx, [rsp + 0x2a0]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x2a0]
mov edx, 0x104
call fcn.00407790
jmp 0x4082aa
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4082aa
lea rcx, [rsp + 0x2a0]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4082aa
lea rdx, [rsp + 0x6e0]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x2a0]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4082aa
lea rdx, [rsp + 0xa10]
lea rcx, [rsp + 0x7f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rsp + 0x6e0]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x2a0]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x2a0]
call fcn.00407a70
lea r9, str.PATH_02d
lea r8, str.PATHS
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x2a0]
call fcn.00407b00
test eax, eax
jns 0x408321
mov esi, dword [rsp + 0x34]
lea rdx, str.PATH_02d
lea rcx, [rsp + 0x60]
lea r8d, [r14 + rsi]
call qword [sym.imp.USER32.dll_wsprintfA]
add esi, 1
lea r9, [rsp + 0x190]
lea r8, [rsp + 0x2a0]
lea rdx, [rsp + 0x60]
lea rcx, str.PATHS
mov dword [rsp + 0x34], esi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r8, [rsp + 0x7f0]
lea rcx, [rsp + 0x4c0]
mov edx, 0x104
call fcn.00407790
lea r8, [rsp + 0x7f0]
lea rcx, [rsp + 0x2a0]
mov edx, 0x104
call fcn.00407790
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x2a0]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8, r15
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x7f0]
call qword [sym.imp.USER32.dll_SetWindowTextA]
lea r9, str.FILE_02d
lea r8, str.FILES
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x2a0]
call fcn.00407b00
test eax, eax
jns 0x408415
mov esi, dword [rsp + 0x30]
lea rdx, str.FILE_02d
lea rcx, [rsp + 0x60]
lea r8d, [r13 + rsi]
call qword [sym.imp.USER32.dll_wsprintfA]
add esi, 1
lea r9, [rsp + 0x190]
lea r8, [rsp + 0x2a0]
lea rdx, [rsp + 0x60]
lea rcx, str.FILES
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add r12d, 1
add r15, 1
cmp r12d, edi
jl 0x4080b0
mov r15, qword [rsp + 0x40]
xor ebx, ebx
mov eax, dword [rsp + 0xcb0]
mov r9, qword [str.Common_Programs]
mov r8, qword [str.Programs]
lea rcx, [rsp + 0x900]
mov edx, 0x104
mov dword [rsp + 0x20], eax
call fcn.00407640
mov eax, dword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
lea esi, [r13 + rax]
nop
nop
nop
lea rdx, str.Icon_03d
lea rcx, [rsp + 0x70]
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
movzx edx, word [0x00419714]
cmp dx, 7
je 0x4084c8
cmp dx, 9
je 0x4084c8
lea r9, [rsp + 0x80]
lea r8, [0x00412649]
lea rdx, [rsp + 0x70]
lea rcx, str.ShortCut
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x4084f6
lea r9, [rsp + 0x80]
lea r8, [0x00412649]
lea rdx, [rsp + 0x70]
lea rcx, str.ShortCutX64
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4085ed
lea r8, [rsp + 0x38]
lea rdx, [0x004126ac]
lea rcx, [rsp + 0x80]
call fcn.00409ba0
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x3b0]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x3b0]
mov r8, rbp
mov edx, 0x104
call fcn.00407790
lea rcx, [rsp + 0x3b0]
mov r8, rdi
mov edx, 0x104
call fcn.00407790
lea rdx, str..lnk
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r9, str.FILE_02d
lea r8, str.FILES
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x3b0]
call fcn.00407b00
test eax, eax
jns 0x4085de
lea rdx, str.FILE_02d
lea rcx, [rsp + 0x60]
mov r8d, esi
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x190]
lea r8, [rsp + 0x3b0]
lea rdx, [rsp + 0x60]
lea rcx, str.FILES
add esi, 1
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add ebx, 1
cmp ebx, 0x3e7
jl 0x408470
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x3b0]
mov r8, rbp
mov edx, 0x104
call fcn.00407790
lea r9, str.PATH_02d
lea r8, str.PATHS
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x3b0]
call fcn.00407b00
test eax, eax
jns 0x40867b
mov eax, dword [rsp + 0x34]
lea rdx, str.PATH_02d
lea rcx, [rsp + 0x60]
lea r8d, [r14 + rax]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x190]
lea r8, [rsp + 0x3b0]
lea rdx, [rsp + 0x60]
lea rcx, str.PATHS
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, 1
mov r15, qword [rsp + 0xc38]
mov r14, qword [rsp + 0xc40]
mov r13, qword [rsp + 0xc48]
mov r12, qword [rsp + 0xc50]
mov rdi, qword [rsp + 0xc58]
mov rsi, qword [rsp + 0xc60]
mov rbp, qword [rsp + 0xc68]
mov rbx, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0xc20]
xor rcx, rsp
call fcn.00409d20
add rsp, 0xc78
ret