Function at 0x404e70
Capabilities:
Check if file exists
Check os version
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Set file attributes
Set registry value

Disassembly:
mov eax, 0x16bc
call fcn.00417fe0
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa9e]
mov word [esp + 0xa9c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x16d0]
lea ecx, [esp + 0xa9c]
push eax
push ecx
mov dword [esp + 0x18], esi
call fcn.00417ec8
mov eax, dword [0x4270d4]
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 8
cmp eax, ebx
je 0x40503d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x646]
mov word [esp + 0x644], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x644]
push edx
push ebx
push ebx
push ebx
push ebx
stosw word es:[edi], ax
call ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x4f8]
cmp eax, ebx
jne 0x404f16
mov eax, 0x422470
push eax
lea eax, [esp + 0x648]
push eax
lea ecx, [esp + 0x34]
push str._s_s.lnk
push ecx
call fcn.00417eed
add esp, 0x10
lea edx, [esp + 0x84c]
lea eax, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404fdc
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x234]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x234]
mov dword [esp + 0x234], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x238], 6
jae 0x404fdc
lea edx, [esp + 0x644]
mov ecx, 0x82
push edx
push ebx
xor eax, eax
lea edi, [esp + 0x64c]
push ebx
push 0x19
rep stosd dword es:[edi], eax
push ebx
call ebp
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x4f8]
cmp eax, ebx
jne 0x404fc1
mov eax, 0x422470
lea ecx, [esp + 0x644]
push eax
push ecx
lea edx, [esp + 0x34]
push str._s_s.lnk
push edx
call fcn.00417eed
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x2c]
push 0x80
push eax
call esi
lea ecx, [esp + 0x2c]
push ebx
lea edx, [esp + 0xaa0]
push ecx
push edx
call fcn.00412090
add esp, 0xc
test eax, eax
jne 0x405030
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x2c]
push ebx
lea edx, [esp + 0xaa0]
push ecx
push edx
call fcn.00411f70
add esp, 0xc
lea eax, [esp + 0x2c]
push 1
push eax
call esi
mov esi, dword [esp + 0x10]
cmp dword [0x4270d8], ebx
je 0x4053f4
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x646]
mov word [esp + 0x644], bx
rep stosd dword es:[edi], eax
push ebx
lea ecx, [esp + 0x648]
push 2
push ecx
push ebx
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x578]
cmp eax, ebx
jne 0x405098
mov eax, 0x422470
lea edx, [esp + 0x644]
push eax
push edx
lea eax, [esp + 0x34]
push 0x4278b8
push eax
call fcn.00417eed
add esp, 0x10
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405150
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x234]
lea edx, [esp + 0x234]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x238], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x238], 6
jae 0x405150
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x644]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x644]
push eax
push ebx
push ebx
push 0x17
push ebx
call ebp
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x578]
cmp eax, ebx
jne 0x405135
mov eax, 0x422470
lea ecx, [esp + 0x644]
push eax
push ecx
lea edx, [esp + 0x34]
push 0x4278b8
push edx
call fcn.00417eed
add esp, 0x10
lea eax, [esp + 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12be]
mov word [esp + 0x12bc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x4f8]
cmp eax, ebx
jne 0x405185
mov eax, 0x422470
lea ecx, [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x12c4]
push str._s_s.lnk
push edx
call fcn.00417eed
lea eax, [esp + 0x12cc]
push ebx
lea ecx, [esp + 0xab0]
push eax
push ecx
call fcn.00411f70
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x14e2]
mov word [esp + 0x14e0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x508]
add esp, 0x1c
cmp eax, ebx
jne 0x4051df
mov eax, 0x422470
lea edx, [esp + 0x2c]
push eax
push edx
lea eax, [esp + 0x14cc]
push 0x4278a0
push eax
call fcn.00417eed
lea ecx, [esp + 0x14d4]
push str._debug
lea edx, [esp + 0xab0]
push ecx
push edx
call fcn.00411f70
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xcc2]
mov word [esp + 0xcc0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x518]
add esp, 0x1c
cmp eax, ebx
jne 0x40523d
mov eax, 0x422470
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xcac]
push str._s_s.lnk
push ecx
call fcn.00417eed
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xebe]
mov word [esp + 0xebc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x42c4b4]
add esp, 0x10
cmp eax, ebx
jne 0x405280
mov eax, 0x422470
push eax
lea edx, [esp + 0xeb0]
push str._sEnableLog.reg
push edx
call fcn.00417eed
lea eax, [esp + 0xcb0]
push ebx
lea ecx, [esp + 0xebc]
push eax
push ecx
call fcn.00411f70
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x456]
mov word [esp + 0x454], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x568]
add esp, 0x18
cmp eax, ebx
jne 0x4052d5
mov eax, 0x422470
lea edx, [esp + 0x2c]
push eax
push edx
lea eax, [esp + 0x444]
push str._s_s.lnk
push eax
call fcn.00417eed
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x10c6]
mov word [esp + 0x10c4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x42c4b4]
add esp, 0x10
cmp eax, ebx
jne 0x405318
mov eax, 0x422470
push eax
lea ecx, [esp + 0x10b8]
push str._sMx2Uninstall.exe
push ecx
call fcn.00417eed
add esp, 0xc
lea edx, [esp + 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x43c]
push ebx
lea ecx, [esp + 0x10b8]
push eax
push ecx
call fcn.00411f70
mov al, byte [esi + 0x5fc]
add esp, 0xc
cmp al, bl
je 0x4053f4
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x84e]
mov word [esp + 0x84c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x42c4b4]
cmp eax, ebx
jne 0x40538b
mov eax, 0x422470
push eax
lea edx, [esp + 0x850]
push str._sModulesMxKWSkwsinst.exe
push edx
call fcn.00417eed
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x242]
mov word [esp + 0x240], bx
rep stosd dword es:[edi], eax
add esp, 0xc
lea ecx, [esp + 0x234]
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x4277f8
push eax
push 0x4278a0
push ecx
call fcn.00417eed
lea edx, [esp + 0x244]
push str._u__uc
lea eax, [esp + 0x860]
push edx
push eax
call fcn.00411f70
add esp, 0x1c
cmp dword [0x4270dc], ebx
je 0x40558e
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x234]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x234]
mov dword [esp + 0x234], 0x114
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x238], 6
jb 0x4054f2
cmp dword [esp + 0x23c], 1
jb 0x405462
push 5
push ebx
lea edx, [esp + 0xaa4]
push str._Pin
push edx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40558e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x43e]
mov word [esp + 0x43c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [esp + 0x440]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x43c]
push 0x427788
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x84e]
mov word [esp + 0x84c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x4f8]
cmp eax, ebx
jne 0x4054ca
mov eax, 0x422470
lea edx, [esp + 0x43c]
push eax
push edx
lea eax, [esp + 0x854]
push str._s_s.lnk
push eax
call fcn.00417eed
push ebx
lea ecx, [esp + 0x860]
jmp 0x40557d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x43e]
mov word [esp + 0x43c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [esp + 0x440]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x43c]
push 0x427788
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x84e]
mov word [esp + 0x84c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x4f8]
cmp eax, ebx
jne 0x40555a
mov eax, 0x422470
lea edx, [esp + 0x43c]
push eax
push edx
lea eax, [esp + 0x854]
push str._s_s.lnk
push eax
call fcn.00417eed
push ebx
lea ecx, [esp + 0x860]
lea edx, [esp + 0xab0]
push ecx
push edx
call fcn.00411f70
add esp, 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push str.SOFTWAREMaxthon2
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4056ed
mov esi, dword [esp + 0x16d4]
push esi
call fcn.00417a8e
mov ecx, dword [esp + 0x18]
add esp, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
shl eax, 1
push eax
push esi
push 1
push ebx
push str.Folder
push ecx
call edi
mov edx, dword [esp + 0x10]
cmp dword [edx + 0x5e4], 1
jne 0x4056c2
mov al, byte [esp + 0x1b]
push 0x427784
mov byte [esp + 0x20], al
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00417a8e
add esp, 4
mov esi, eax
lea ecx, [esp + 0x1c]
push 1
push esi
call fcn.0040ce00
test al, al
je 0x405646
mov eax, dword [esp + 0x20]
cmp esi, ebx
mov ecx, 0x427784
jbe 0x40563a
mov edx, esi
mov bp, word [ecx]
add ecx, 2
mov word [eax], bp
add eax, 2
dec edx
jne 0x40562b
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], esi
mov word [ecx + esi*2], bx
mov eax, dword [esp + 0x20]
cmp eax, ebx
jne 0x405653
mov eax, 0x422470
mov edx, dword [esp + 0x24]
lea ecx, [edx + edx]
mov edx, dword [esp + 0x14]
push ecx
push eax
push 1
push ebx
push 0x42777c
push edx
call edi
cmp dword [0x4270f4], ebx
je 0x40569a
mov eax, dword [0x42c4c4]
mov ecx, dword [0x42c4c8]
cmp eax, ebx
jne 0x405687
mov eax, 0x422470
mov edx, dword [esp + 0x14]
add ecx, ecx
push ecx
push eax
push 1
push ebx
push 0x427774
push edx
call edi
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x4056e9
mov al, byte [ecx - 1]
cmp al, bl
je 0x4056b4
cmp al, 0xff
je 0x4056b4
dec al
mov byte [ecx - 1], al
jmp 0x4056e9
add ecx, 0xfffffffe
push ecx
call fcn.0041749e
add esp, 4
jmp 0x4056e9
mov eax, dword [0x42c4c4]
mov ecx, dword [0x42c4c8]
cmp eax, ebx
jne 0x4056d6
mov eax, 0x422470
mov edx, dword [esp + 0x14]
add ecx, ecx
push ecx
push eax
push 1
push ebx
push 0x427774
push edx
call edi
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x42c49c]
cmp eax, ebx
je 0x40572b
mov ecx, dword [0x42c4a0]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
je 0x40572b
lea edx, [esp + 0xa9c]
mov ecx, esi
push edx
call fcn.004058e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16bc
ret 8