Function at 0x419f60
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get cpu information
Get file attributes
Get session user name
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c05db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe94
push esi
push edi
push 0x3fc
lea eax, [ebp - 0xaa0]
mov dword [ebp - 0x1c], 0xff
push 0
push eax
call fcn.004a3c90
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x14]
add esp, 0xc
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419fdd
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xaa0]
push eax
push 0
push 0
push str.ProductName
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3fc
lea eax, [ebp - 0xea0]
mov dword [ebp - 0x20], 0xff
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20119
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call edi
test eax, eax
jne 0x41a037
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xea0]
push eax
push 0
push 0
push str.ProcessorNameString
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x202
push eax
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp byte [0x4da960], 0
je 0x41a07b
push 0
call fcn.004ab5ce
add esp, 4
push eax
call fcn.004aa01a
add esp, 4
mov byte [0x4da960], 0
call fcn.004a9ff9
cdq
mov ecx, 5
idiv ecx
lea ecx, [ebp - 0x54]
add edx, 4
call fcn.0040ef20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
cmp dword [ebp - 0x40], 0x10
mov eax, dword [ebp - 0x44]
cmovae ecx, dword [ebp - 0x54]
add eax, ecx
cmp dword [ebp - 0x40], 0x10
lea ecx, [ebp - 0x54]
cmovae ecx, dword [ebp - 0x54]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00405df0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
mov edx, str._Temp__
lea ecx, [ebp - 0x84]
call fcn.00405bc0
add esp, 4
push str..txt
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x41a0f9
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x498]
push 0x208
push ecx
push eax
call esi
mov edx, dword [ebp - 0x58]
cmp edx, 8
jb 0x41a148
mov ecx, dword [ebp - 0x6c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a13e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a3cc
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 7
mov word [ebp - 0x6c], ax
cmp edx, 8
jb 0x41a19d
mov ecx, dword [ebp - 0x84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a193
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a3cc
push edx
push ecx
call fcn.004a24e6
add esp, 8
lea eax, [ebp - 0x3c]
mov edx, str._Temp__
push eax
lea ecx, [ebp - 0x84]
call fcn.00405bc0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x41a1bc
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x290]
push ecx
push eax
call esi
mov edx, dword [ebp - 0x70]
cmp edx, 8
jb 0x41a208
mov ecx, dword [ebp - 0x84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a1fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a3d1
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp byte [0x4da960], 0
je 0x41a23a
push 0
call fcn.004ab5ce
add esp, 4
push eax
call fcn.004aa01a
add esp, 4
mov byte [0x4da960], 0
call fcn.004a9ff9
cdq
mov ecx, 0x28b
idiv ecx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add edx, 0x3b3
push edx
call edi
cmp word [ebp - 0x290], 0
je 0x41a3c4
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a3c4
shr eax, 4
and al, 1
je 0x41a3c4
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x498]
push 0x4c7018
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x41a2f4
lea eax, [ebp - 0xaa0]
push eax
push str._wS_n
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0x6a0]
push eax
push str._wS_n
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0xea0]
push eax
push str._wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
cmp byte [0x4da960], 0
je 0x41a317
push 0
call fcn.004ab5ce
add esp, 4
push eax
call fcn.004aa01a
add esp, 4
mov byte [0x4da960], 0
call fcn.004a9ff9
cdq
mov ecx, 0x337
idiv ecx
add edx, 0x36d
push edx
call edi
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x28]
cmp edx, 8
jb 0x41a370
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a366
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a3d6
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov edx, dword [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
cmp edx, 0x10
jb 0x41a3b4
mov ecx, dword [ebp - 0x54]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41a3aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a3d6
push edx
push ecx
call fcn.004a24e6
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
int3