Function at 0x403300
Capabilities:
Create directory
Create process on windows
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44a62b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x15f4
call fcn.004382f0
mov eax, dword [0x466910]
xor eax, esp
mov dword [esp + 0x15f0], eax
push ebx
push esi
push edi
mov eax, dword [0x466910]
xor eax, esp
push eax
lea eax, [esp + 0x1608]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x444], ebx
je 0x403358
xor al, al
jmp 0x403690
push 0xdb4
lea eax, [esp + 0x2c]
push ebx
push eax
mov byte [esp + 0x22], 1
mov dword [esp + 0x30], ebx
call fcn.00437170
add esp, 0xc
lea ecx, [esp + 0x2c]
cmp dword [edi + 0x458], ebx
je 0x4033ae
push str.http:__maxsecuresoftware.com_uploadstandalonenew_MaxAVPlusProductX64.exe
push 0x64
push ecx
call fcn.0043349d
add esp, 0xc
push str.MaxAVPlusProductX64.exe
lea edx, [esp + 0x918]
push 0x32
push edx
call fcn.0043349d
add esp, 0xc
push str.MaxAVPlusProductX64.exe
jmp 0x4033da
push str.http:__maxsecuresoftware.com_uploadstandalonenew_MaxAVPlusProduct.exe
push 0x64
push ecx
call fcn.0043349d
add esp, 0xc
push str.MaxAVPlusProduct.exe
lea edx, [esp + 0x918]
push 0x32
push edx
call fcn.0043349d
add esp, 0xc
push str.MaxAVPlusProduct.exe
lea eax, [esp + 0xd8e]
push 0x28
push eax
call fcn.0043349d
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 0xc
lea ecx, [esp + 0xf4]
push ecx
push ebx
push ebx
push 0x1c
push ebx
mov dword [esp + 0x3c], 4
call esi
test eax, eax
jge 0x403422
lea edx, [esp + 0xf4]
push edx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x40345d
push str.Max_Secure_Software_
lea eax, [esp + 0xf8]
push 0x208
push eax
call fcn.0043350c
add esp, 0xc
lea ecx, [esp + 0xf4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40345d
push ebx
lea edx, [esp + 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.MaxDownloadTemp_
lea eax, [esp + 0xf8]
push 0x208
push eax
call fcn.0043350c
add esp, 0xc
lea ecx, [esp + 0xf4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x403498
push ebx
lea edx, [esp + 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x504]
push eax
push ebx
push ebx
push 0x10
push ebx
call esi
test eax, eax
jge 0x4034cb
lea ecx, [esp + 0xf4]
push ecx
lea edx, [esp + 0x508]
push 0x208
push edx
mov byte [esp + 0x22], bl
call fcn.0043349d
jmp 0x4034e2
push 0x455740
lea eax, [esp + 0x508]
push 0x208
push eax
call fcn.0043350c
add esp, 0xc
push 0x40e
lea edx, [esp + 0xde2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xde8], cx
call fcn.00437170
add esp, 0xc
lea eax, [esp + 0x504]
push eax
lea ecx, [esp + 0xde0]
push 0x208
push ecx
call fcn.0043349d
add esp, 0xc
lea edx, [esp + 0xd8a]
push edx
lea eax, [esp + 0xde0]
push 0x208
push eax
call fcn.0043350c
add esp, 0xc
lea ecx, [esp + 0x504]
push ecx
lea edx, [esp + 0xde0]
push 0x208
push edx
call fcn.0043349d
add esp, 0xc
lea eax, [esp + 0xd8a]
push eax
lea ecx, [esp + 0xde0]
push 0x208
push ecx
call fcn.0043350c
add esp, 0xc
lea edx, [esp + 0xddc]
push edx
lea ecx, [edi + 0x6d4]
call fcn.00420e4e
mov ecx, dword [edi + 0x7c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [esp + 0x24]
push edx
call eax
test al, al
je 0x403679
mov byte [esp + 0x17], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
push 0x40e
lea edx, [esp + 0x11f2]
xor ecx, ecx
push ebx
mov dword [esp + 0x1618], ebx
push edx
mov word [esp + 0x11f8], cx
call fcn.00437170
add esp, 0xc
push 0x104
lea eax, [esp + 0x11f0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x2001f
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea esi, [esp + 0x18]
call fcn.00401980
mov esi, dword [esp + 0x18]
test eax, eax
jne 0x403627
push str.MaxDownloadMgr
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, ebx
je 0x403623
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
mov ecx, dword [edi + 0x7c]
push 1
push ebx
push ebx
add ecx, 4
push ecx
push 0x455744
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [esp + 0x16], bl
je 0x40365d
push ecx
lea edx, [esp + 0xf8]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.004014b0
call fcn.00411c10
push 3
add edi, 0x440
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp esi, ebx
je 0x40368c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40368c
push 2
add edi, 0x440
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [esp + 0x17], bl
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x1608]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x15f0]
xor ecx, esp
call fcn.004331c4
mov esp, ebp
pop ebp
ret