Function at 0x411920
Capabilities:
Delete file
Delete registry value
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4c8578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x40c], 0
jne 0x411c33
cmp dword [esi + 0x474], 0
mov dword [esi + 0x40c], 1
je 0x411976
push 0x4705a0
push dword [0x50cff4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x411976
push 0
push 0
push 0
call eax
add esp, 0xc
push 0x46fbe0
push dword [0x502db0]
call fcn.004403a0
mov eax, dword [0x53f3fc]
add esp, 8
test eax, eax
je 0x411a1f
cmp dword [0x502db0], 0
je 0x411a1b
mov ecx, 0x502da0
call fcn.00407ec0
mov ecx, 0x502da0
call fcn.00407ee0
push 0x46c850
push dword [0x502db0]
call fcn.004403a0
push dword [esi + 0x9990]
push dword [0x502db0]
call fcn.0043ffb0
push 0x46c864
push dword [0x502db0]
call fcn.004403a0
push dword [esi + 0x9980]
push dword [esi + 0x998c]
push dword [0x502db0]
call fcn.004400c0
add esp, 0x24
push 3
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x9990]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x53f3fc]
test eax, eax
jne 0x411a35
push dword [esi + 0x998c]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 0x998c], 0
push 0x46fbfc
push dword [0x502db0]
call fcn.004403a0
add esp, 8
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x218]
push eax
push 0x20006
push 0
push 0x46e820
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esi + 0x9a5c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x4961a8
call fcn.0040ee50
mov ecx, 0x4961a8
call fcn.0040eea0
mov ecx, 0x4961a8
call fcn.0040eef0
push dword [0x502db0]
call fcn.0043ff40
add esp, 4
test eax, eax
je 0x411ad3
mov ecx, 0x4961a8
call fcn.0040eea0
mov ecx, 0x4961a8
call fcn.0040ee00
cmp dword [esi + 0x400], 0
je 0x411afb
push 4
lea eax, [esi + 0x9984]
mov dword [eax], 0
push eax
push 0x2a
push 0
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [esi + 0x4b8], eax
push edi
push dword [0x51b798]
lea eax, [ebp - 0xc]
push 0x46e590
push 5
push eax
call fcn.00419cf0
add esp, 0x10
cmp dword [0x51b690], 0
je 0x411b72
push 0x51b694
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
push 0x51b694
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
test edi, edi
je 0x411b64
push 0
lea eax, [ebp - 0x218]
push eax
push 0x64
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0xc]
push eax
push 0x51b694
jmp 0x411c12
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
test eax, eax
je 0x411c20
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00449d78
push str.ITSExitCode.log
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00449dd2
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
test edi, edi
je 0x411c07
push 0
lea eax, [ebp - 0x218]
push eax
push 0x64
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [0x502db0]
call fcn.004403d0
add esp, 0xc
push 0
push 0
push 0x10
push dword [esi + 0x9990]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00443fa5
mov esp, ebp
pop ebp
ret