Function at 0x41be00
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e84
call fcn.0040ea30
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x9c], 0
mov word [ebp - 0x4f0], 0
push 0x206
push 0
lea eax, [ebp - 0x4ee]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1420], 0
push 0x206
push 0
lea ecx, [ebp - 0x141e]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1210], 0
push 0x206
push 0
lea edx, [ebp - 0x120e]
push edx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x2e0], 0
xor eax, eax
mov dword [ebp - 0x2de], eax
mov dword [ebp - 0x2da], eax
mov dword [ebp - 0x2d6], eax
mov dword [ebp - 0x2d2], eax
mov dword [ebp - 0x2ce], eax
mov dword [ebp - 0x2ca], eax
mov dword [ebp - 0x2c6], eax
mov word [ebp - 0x2c2], ax
mov cx, word [0x429180]
mov word [ebp - 0x90], cx
push 0x7e
push 0
lea edx, [ebp - 0x8e]
push edx
call fcn.004012f0
add esp, 0xc
mov ax, word [0x429184]
mov word [ebp - 0xe00], ax
push 0x7e
push 0
lea ecx, [ebp - 0xdfe]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x57c], 0
mov dx, word [0x429188]
mov word [ebp - 0x578], dx
push 0x7e
push 0
lea eax, [ebp - 0x576]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1214], 0
mov word [ebp - 0x1008], 0
push 0x206
push 0
lea ecx, [ebp - 0x1006]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x2c0], 0
xor edx, edx
mov dword [ebp - 0x2be], edx
mov dword [ebp - 0x2ba], edx
mov dword [ebp - 0x2b6], edx
mov dword [ebp - 0x2b2], edx
mov dword [ebp - 0x2ae], edx
mov dword [ebp - 0x2aa], edx
mov dword [ebp - 0x2a6], edx
mov word [ebp - 0x2a2], dx
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x2a0]
push eax
call fcn.004012f0
add esp, 0xc
push 1
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.0040fba0
add esp, 8
mov dword [ebp - 8], eax
push 0
lea edx, [ebp - 0x1620]
push edx
call fcn.0040fba0
add esp, 8
mov dword [ebp - 0x98], eax
push 0x104
lea eax, [ebp - 0x1420]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp - 8], 0
je 0x41c2f6
lea ecx, [ebp - 0xf8]
push ecx
push 0x10
lea edx, [ebp - 0x2e0]
push edx
call fcn.00401825
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0xf8]
push ecx
call fcn.0041a580
add esp, 8
lea edx, [ebp - 0xf8]
push edx
call fcn.0041b590
add esp, 4
cmp eax, 1
jne 0x41c057
mov eax, dword [ebp - 0x9c]
jmp 0x41c8ae
mov word [ebp - 0x1a38], 0
push 0x206
push 0
lea eax, [ebp - 0x1a36]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1828], 0
push 0x206
push 0
lea ecx, [ebp - 0x1826]
push ecx
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x182c], 0
lea edx, [ebp - 0xf8]
push edx
lea eax, [ebp - 0x1a38]
push eax
call fcn.004013c4
add esp, 8
lea ecx, [ebp - 0xf8]
push ecx
lea edx, [ebp - 0x1828]
push edx
call fcn.004013c4
add esp, 8
push 0x4291e0
lea eax, [ebp - 0x1828]
push eax
call fcn.0040139a
add esp, 8
lea ecx, [ebp - 0x1a38]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x182c], eax
cmp dword [ebp - 0x182c], 0
je 0x41c18b
mov edx, dword [ebp - 0x182c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1828]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x182c], eax
mov dword [ebp - 0x1a40], 0
lea ecx, [ebp - 0x1a38]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x182c], eax
cmp dword [ebp - 0x182c], 0
je 0x41c18b
cmp dword [ebp - 0x1a40], 5
jge 0x41c18b
mov edx, dword [ebp - 0x182c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1a40]
add eax, 1
mov dword [ebp - 0x1a40], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41c136
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x4f0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1a3c], eax
cmp dword [ebp - 0x1a3c], 0
je 0x41c1be
mov dword [ebp - 0x1e84], 0x429228
jmp 0x41c1c8
mov dword [ebp - 0x1e84], 0x429230
lea edx, [ebp - 0x4f0]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x118]
push eax
push 0x104
lea ecx, [ebp - 0x4f0]
push ecx
call fcn.00401412
add esp, 0xc
push 0x429238
push 0x104
lea edx, [ebp - 0x4f0]
push edx
call fcn.00401412
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
call fcn.0040234b
add esp, 4
test eax, eax
jbe 0x41c26f
lea ecx, [ebp - 0x4f0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c26f
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x1c48]
push eax
call fcn.004013c4
add esp, 8
push 0x429244
push 0x104
lea ecx, [ebp - 0x1c48]
push ecx
call fcn.00401412
add esp, 0xc
lea edx, [ebp - 0x4f0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x21a]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.004013c4
add esp, 8
lea edx, [ebp - 0x29c]
push edx
lea eax, [ebp - 0xe00]
push eax
call fcn.004013c4
add esp, 8
mov cx, word [ebp - 0x21c]
mov word [ebp - 0x57c], cx
lea edx, [ebp - 0x1fa]
push edx
lea eax, [ebp - 0x578]
push eax
call fcn.004013c4
add esp, 8
mov cx, word [ebp - 0x17a]
mov word [ebp - 0x1214], cx
mov edx, dword [ebp - 0xd8]
mov dword [ebp - 0x2e4], edx
lea eax, [ebp - 0x118]
push eax
push 0x10
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.00401825
add esp, 0xc
jmp 0x41c3c3
cmp dword [0x42c0a0], 3
jne 0x41c3c3
push 0x236
push 0
lea edx, [ebp - 0x1e80]
push edx
call fcn.004012f0
add esp, 0xc
lea eax, [ebp - 0x1e80]
push eax
call fcn.0041dcb0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41c3c3
lea ecx, [ebp - 0x1d72]
push ecx
lea edx, [ebp - 0x90]
push edx
call fcn.004013c4
add esp, 8
lea eax, [ebp - 0xe00]
push eax
mov ecx, dword [ebp - 0x1d7a]
push ecx
call fcn.0041a870
add esp, 8
mov dx, word [ebp - 0x1d76]
mov word [ebp - 0x57c], dx
lea eax, [ebp - 0x578]
push eax
mov ecx, dword [ebp - 0x1d80]
push ecx
call fcn.0041a870
add esp, 8
mov dx, word [ebp - 0x1d7c]
mov word [ebp - 0x1214], dx
push 4
lea eax, [ebp - 0x1e78]
push eax
lea ecx, [ebp - 0x2e4]
push ecx
call fcn.004014c0
add esp, 0xc
lea edx, [ebp - 0x1d52]
push edx
push 0x10
lea eax, [ebp - 0x2e0]
push eax
call fcn.00401825
add esp, 0xc
cmp dword [ebp - 0x98], 0
je 0x41c4a1
lea ecx, [ebp - 0x159a]
push ecx
lea edx, [ebp - 0x90]
push edx
call fcn.004013c4
add esp, 8
lea eax, [ebp - 0x161c]
push eax
lea ecx, [ebp - 0xe00]
push ecx
call fcn.004013c4
add esp, 8
mov dx, word [ebp - 0x159c]
mov word [ebp - 0x57c], dx
push 0x429280
lea eax, [ebp - 0x578]
push eax
call fcn.004013c4
add esp, 8
mov cx, word [ebp - 0x14fa]
mov word [ebp - 0x1214], cx
mov edx, dword [0x42c634]
mov dword [ebp - 0x2e4], edx
cmp dword [0x42c0a0], 3
je 0x41c454
push 1
lea eax, [ebp - 0x1008]
push eax
call fcn.0041b660
add esp, 8
jmp 0x41c465
push 0
lea ecx, [ebp - 0x1008]
push ecx
call fcn.0041b660
add esp, 8
lea edx, [ebp - 0x1008]
push edx
lea eax, [ebp - 0x1210]
push eax
call fcn.004013c4
add esp, 8
push 0x42929c
push 0x104
lea ecx, [ebp - 0x1210]
push ecx
call fcn.00401412
add esp, 0xc
lea edx, [ebp - 0x1210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
push 0
lea eax, [ebp - 0x2a0]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x2a0], 0x504d534d
mov word [ebp - 0x21c], 0x51
push 0x4292b4
lea ecx, [ebp - 0x29c]
push ecx
call fcn.004013c4
add esp, 8
mov word [ebp - 0x17a], 0x2b66
push 0x4292d0
lea edx, [ebp - 0x1fa]
push edx
call fcn.004013c4
add esp, 8
push 0x4292ec
lea eax, [ebp - 0x21a]
push eax
call fcn.004013c4
add esp, 8
mov ecx, dword [0x42c634]
mov dword [ebp - 0xd8], ecx
cmp dword [ebp - 8], 0
jne 0x41c530
cmp dword [ebp - 4], 0
jne 0x41c530
cmp dword [ebp - 0x98], 0
je 0x41c5af
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x21a]
push eax
call fcn.00401050
add esp, 8
lea ecx, [ebp - 0xe00]
push ecx
lea edx, [ebp - 0x29c]
push edx
call fcn.00401030
add esp, 8
mov ax, word [ebp - 0x57c]
mov word [ebp - 0x21c], ax
lea ecx, [ebp - 0x578]
push ecx
lea edx, [ebp - 0x1fa]
push edx
call fcn.00401030
add esp, 8
mov ax, word [ebp - 0x1214]
mov word [ebp - 0x17a], ax
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0xd8], ecx
cmp dword [ebp - 0x2e4], 0
jne 0x41c5af
mov edx, dword [0x42c634]
mov dword [ebp - 0xd8], edx
push 0x4292f8
lea eax, [ebp - 0x1fa]
push eax
call fcn.004013c4
add esp, 8
movzx ecx, word [ebp - 0x29c]
test ecx, ecx
je 0x41c5d9
movzx edx, word [ebp - 0x21c]
test edx, edx
jg 0x41c5e3
jmp 0x41c89e
mov dword [ebp - 0x2a0], 0x504d534d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040148c
add esp, 4
mov word [ebp - 0xd80], 0
push 0x7fe
push 0
lea eax, [ebp - 0xd7e]
push eax
call fcn.004012f0
add esp, 0xc
movzx ecx, word [ebp - 0x178]
test ecx, ecx
jne 0x41c64f
lea edx, [ebp - 0xd80]
push edx
push 6
push 5
call fcn.0041abe0
add esp, 0xc
lea eax, [ebp - 0xd80]
push eax
lea ecx, [ebp - 0x178]
push ecx
call fcn.00401050
add esp, 8
movzx edx, word [ebp - 0x158]
test edx, edx
jne 0x41c683
lea eax, [ebp - 0xd80]
push eax
push 6
push 5
call fcn.0041abe0
add esp, 0xc
lea ecx, [ebp - 0xd80]
push ecx
lea edx, [ebp - 0x158]
push edx
call fcn.00401050
add esp, 8
movzx eax, word [ebp - 0x118]
test eax, eax
jne 0x41c6b7
lea ecx, [ebp - 0xd80]
push ecx
push 6
push 5
call fcn.0041abe0
add esp, 0xc
lea edx, [ebp - 0xd80]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.00401050
add esp, 8
movzx ecx, word [ebp - 0xf8]
test ecx, ecx
jne 0x41c714
lea edx, [ebp - 0xd80]
push edx
push 6
push 5
call fcn.0041abe0
add esp, 0xc
lea eax, [ebp - 0xd80]
push eax
lea ecx, [ebp - 0xf8]
push ecx
call fcn.00401050
add esp, 8
lea edx, [ebp - 0x2e0]
push edx
call fcn.0040234b
add esp, 4
test eax, eax
jbe 0x41c714
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0xf8]
push ecx
call fcn.00401050
add esp, 8
lea edx, [ebp - 0x2c0]
push edx
call fcn.0040234b
add esp, 4
test eax, eax
je 0x41c73f
lea eax, [ebp - 0x2c0]
push eax
push 0x10
lea ecx, [ebp - 0x138]
push ecx
call fcn.00401825
add esp, 0xc
movzx edx, word [ebp - 0x138]
test edx, edx
jne 0x41c773
lea eax, [ebp - 0xd80]
push eax
push 6
push 5
call fcn.0041abe0
add esp, 0xc
lea ecx, [ebp - 0xd80]
push ecx
lea edx, [ebp - 0x138]
push edx
call fcn.00401050
add esp, 8
mov eax, dword [0x42c630]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd8], 0
jne 0x41c793
mov ecx, dword [0x42c634]
mov dword [ebp - 0xd8], ecx
lea edx, [ebp - 0x2a0]
push edx
call fcn.0040fac0
add esp, 4
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x41c7bb
jmp 0x41c89e
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0xf8]
push ecx
call fcn.0041a580
add esp, 8
mov dword [ebp - 0x94], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040148c
add esp, 4
push 0x64
push 0x32
call fcn.0041aaa0
add esp, 8
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
push edx
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x1420]
push ecx
call fcn.0041b480
add esp, 0xc
mov dword [ebp - 0x4f4], 0
lea edx, [ebp - 0x4f4]
push edx
push 3
push 0
push 0x429388
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c884
lea eax, [ebp - 0x4f0]
push eax
call fcn.0040234b
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x4f0]
push edx
push 1
push 0
push 0x4293f4
mov eax, dword [ebp - 0x4f4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41c884
mov ecx, dword [ebp - 0x4f4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x429384
lea edx, [ebp - 0x4f0]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret