The job of the smaller of the two JavaScripts is to establish a system autostart mechanism. It accomplishes this by deobfuscating another script, link.js, into %TMP%. Link.js in turn creates a shortcut file "Java(TM) Platform SE Auto Updater.lnk" in the "Startup" special folder pointing to the main backdoor JavaScript