Function at 0x404a55
Capabilities:
Check if file exists
Get common file path
Get file size
Persist via run registry key
Query or enumerate registry value
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x540]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00401294
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x404a99
lea ecx, [ebp - 0x14]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push eax
call edi
cmp eax, ebx
je 0x404abb
lea eax, [ebp - 0x14]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call edi
cmp eax, ebx
je 0x404abb
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404da2
mov edi, 0x103
push edi
lea eax, [ebp - 0x233]
push ebx
push eax
mov byte [ebp - 0x234], bl
call fcn.0040a870
push edi
lea eax, [ebp - 0x337]
push ebx
push eax
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x338], bl
call fcn.0040a870
add esp, 0x18
call fcn.0040148a
test al, al
je 0x404b21
call fcn.004056b0
test al, al
je 0x404b7b
mov eax, dword [0x415ce0]
cmp eax, ebx
je 0x404b7b
push eax
push 0x410d88
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.004058c6
add esp, 0x10
jmp 0x404b89
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 1], 1
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
jne 0x404b3d
mov byte [ebp - 1], bl
lea eax, [ebp - 0x338]
push eax
call fcn.0040154e
pop ecx
test eax, eax
jne 0x404b51
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x404b7b
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x234]
push eax
push str._s_s_
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.004058c6
add esp, 0x14
jmp 0x404b89
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
lea eax, [ebp - 0x43b]
push ebx
push eax
mov byte [ebp - 0x43c], bl
call fcn.0040a870
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push str.FreeWorkz
push dword [ebp - 0x14]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404c3e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00405a1e
pop ecx
call fcn.00405a30
lea ecx, [ebp - 0x130]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x404be7
sub ecx, esi
mov edx, ecx
push 5
pop ecx
lea edi, [ebp + edx - 0x130]
mov esi, str.FreeWorkz_Uninstaller
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp + edx - 0x11b]
push 0x1c
mov byte [edi], 0x5f
inc edi
pop esi
jmp 0x404c31
mov ecx, esi
mov edx, eax
sar edx, cl
cmp edx, 0xa
lea ecx, [edx + 0x30]
jle 0x404c25
lea ecx, [edx + 0x57]
mov byte [edi], cl
mov ecx, esi
shl edx, cl
inc edi
sub eax, edx
sub esi, 4
cmp eax, ebx
jne 0x404c14
mov esi, str..exe
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x404c58
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.00405960
mov esi, str.Uninstaller.exe
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
pop ecx
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
mov edi, 0x80
push edi
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x540]
push eax
call esi
push ebx
push edi
push 2
push ebx
push 3
mov dword [ebp - 8], eax
push 0xc0000000
lea eax, [ebp - 0x130]
push eax
call esi
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x404caa
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
jmp 0x404da0
push 0x104
push str.__quiet
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
lea ecx, [ebp - 0x130]
call fcn.004057cb
push eax
mov eax, ecx
push eax
push 1
push ebx
push str.freeworkz_un_post
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0xffffffff
je 0x404d92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x404d92
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x404d92
lea eax, [esi + 1]
push eax
push 8
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, ebx
je 0x404d92
push ebx
lea eax, [ebp - 0x18]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404d92
cmp dword [ebp - 0x18], ebx
jbe 0x404d92
push esi
mov ecx, edi
call fcn.00401908
pop ecx
cmp eax, ebx
je 0x404d7d
push 5
pop ecx
push dword [ebp - 0x1c]
mov edi, eax
mov esi, str.asInvoker_
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x10]
movsb byte es:[edi], byte [esi]
call fcn.00401908
pop ecx
cmp eax, ebx
jne 0x404d5d
mov esi, dword [ebp - 0x1c]
push ebx
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x2c], ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret