Function at 0x402b84
Capabilities:
Check if file exists
Create process on windows
Get common file path
Query or enumerate registry value

Disassembly:
push 0x634
mov eax, 0x40ef25
call fcn.0040e093
xor ebx, ebx
lea eax, [ebp - 0x620]
mov dword [ebp - 4], ebx
push eax
mov edi, 0x412c1c
mov dword [ebp - 0x628], ebx
mov dword [ebp - 0x61c], ebx
call fcn.00402ea5
xor eax, eax
mov byte [ebp - 4], 1
push 0x3fe
mov word [ebp - 0x618], ax
lea eax, [ebp - 0x616]
push ebx
push eax
call fcn.004047c0
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x2001f
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x638], ebx
push SysReAllocString
mov dword [ebp - 0x63c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x402c2b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x61c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x624], ebx
cmp dword [ebp - 0x628], ebx
jbe 0x402df4
cmp esi, ebx
je 0x402df4
push ebx
push ebx
lea eax, [ebp - 0x63c]
push eax
push ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x618]
push eax
push dword [ebp - 0x624]
mov dword [ebp - 0x638], 0x200
push dword [ebp - 0x61c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ecx, ecx
cmp eax, ebx
sete cl
mov esi, ecx
cmp esi, ebx
je 0x402ddc
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.004013d0
mov eax, dword [0x41602c]
mov ecx, 0x41602c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x620]
lea eax, [ebp - 0x62c]
push str._delete__tn___s___f
call fcn.004033c7
cmp dword [ebp + 0xc], 6
pop ecx
pop ecx
jge 0x402db1
lea eax, [ebp - 0x634]
push eax
mov edi, str.schtasks.exe
call fcn.00402ea5
xor eax, eax
mov byte [ebp - 4], 3
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004047c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x402d27
sub eax, edx
sar eax, 1
je 0x402da4
lea eax, [ebp - 0x630]
push eax
lea edi, [ebp - 0x218]
call fcn.00402ea5
push 0x16
lea eax, [ebp - 0x630]
mov byte [ebp - 4], 4
call fcn.00403348
push dword [ebp - 0x630]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402d99
push ebx
push 0x412c1c
push dword [ebp - 0x62c]
push dword [ebp - 0x634]
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x100
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x630]
call fcn.0040312a
lea eax, [ebp - 0x634]
call fcn.0040312a
jmp 0x402dcd
push ecx
lea eax, [ebp - 0x620]
mov ebx, esp
mov dword [ebp - 0x640], esp
call fcn.00402e45
call fcn.004023cb
pop ecx
xor ebx, ebx
lea eax, [ebp - 0x62c]
mov byte [ebp - 4], 1
call fcn.0040312a
inc dword [ebp - 0x624]
mov eax, dword [ebp - 0x624]
cmp eax, dword [ebp - 0x628]
jb 0x402c3d
cmp dword [ebp - 0x61c], ebx
je 0x402e0e
push dword [ebp - 0x61c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x61c], ebx
cmp esi, ebx
je 0x402e15
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x620]
call fcn.0040312a
lea eax, [ebp + 8]
call fcn.0040312a
mov eax, ebx
call fcn.0040e0dd
ret