Function at 0x4011d3
Capabilities:
Check if file exists
Get common file path
Get file size
Persist via run registry key
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3dc]
sub esp, 0x45c
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x3d8], eax
push ebx
push esi
push edi
call fcn.00403452
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor ebx, ebx
mov dword [ebp - 0x64], eax
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
cmp eax, ebx
je 0x401216
lea ecx, [ebp - 0x60]
push ecx
push edi
push eax
call esi
cmp eax, ebx
je 0x401234
lea eax, [ebp - 0x60]
push eax
push edi
push 0x80000001
call esi
cmp eax, ebx
je 0x401234
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4013c1
push 7
pop ecx
mov esi, str.ArcadeWeb_Uninstaller_Finish
lea edi, [ebp + 0x3b8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x103
push esi
lea eax, [ebp - 0x57]
push ebx
push eax
mov byte [ebp - 0x58], bl
call fcn.00407070
push esi
lea eax, [ebp + 0x2b5]
push ebx
push eax
mov byte [ebp + 0x2b4], bl
call fcn.00407070
add esp, 0x18
lea edi, [esi + 1]
push edi
lea eax, [ebp - 0x58]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp + 0x1b1]
push ebx
push eax
mov byte [ebp + 0x1b0], bl
call fcn.00407070
push esi
lea eax, [ebp + 0xad]
push ebx
push eax
mov dword [ebp - 0x80], edi
mov byte [ebp + 0xac], bl
call fcn.00407070
add esp, 0x18
mov byte [ebp - 0x59], 1
call fcn.00403656
test al, al
je 0x4012e3
call fcn.00402fd1
test al, al
je 0x401337
mov eax, dword [0x416e70]
cmp eax, ebx
je 0x401337
push eax
push 0x413098
lea eax, [ebp + 0x2b4]
push edi
push eax
call fcn.00404291
add esp, 0x10
jmp 0x401345
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x1b0]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
jne 0x4012fb
mov byte [ebp - 0x59], bl
lea ecx, [ebp + 0xac]
call fcn.00403718
test eax, eax
jne 0x40130d
mov byte [ebp - 0x59], bl
cmp byte [ebp - 0x59], bl
je 0x401337
lea eax, [ebp + 0xac]
push eax
lea eax, [ebp + 0x1b0]
push eax
push str._s_s_
lea eax, [ebp + 0x2b4]
push edi
push eax
call fcn.00404291
add esp, 0x14
jmp 0x401345
lea eax, [ebp + 0x2b4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
push str.awun.exe
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x58]
push eax
call esi
mov dword [ebp - 0x6c], eax
cmp eax, 0xffffffff
je 0x4013b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4013b1
push ebx
push 0x80
push 2
push ebx
push 3
push 0xc0000000
lea eax, [ebp + 0x2b4]
push eax
call esi
mov dword [ebp - 0x70], eax
cmp eax, 0xffffffff
jne 0x4013db
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x64]
call esi
push dword [ebp - 0x60]
call esi
xor eax, eax
mov ecx, dword [ebp + 0x3d8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404175
add ebp, 0x3dc
leave
ret
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x74], esi
cmp esi, ebx
jne 0x40140c
push dword [ebp - 0x6c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x70]
call esi
jmp 0x4013b1
lea eax, [esi + 1]
push eax
push 8
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x68], eax
cmp eax, ebx
je 0x401483
push ebx
lea ecx, [ebp - 0x78]
push ecx
push esi
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401483
cmp dword [ebp - 0x78], ebx
jbe 0x401483
mov ecx, dword [ebp - 0x68]
push esi
call fcn.00402720
pop ecx
cmp eax, ebx
je 0x40146e
push 5
pop ecx
push dword [ebp - 0x74]
mov edi, eax
mov esi, str.asInvoker_
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x68]
movsb byte es:[edi], byte [esi]
call fcn.00402720
pop ecx
cmp eax, ebx
jne 0x401449
mov esi, dword [ebp - 0x74]
mov edi, 0x104
push ebx
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [ebp - 0x68]
mov dword [ebp - 0x7c], ebx
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x6c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x70]
call esi
push edi
push 0x413128
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp + 0x2b4]
push eax
push 1
push ebx
lea eax, [ebp + 0x3b8]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4013b7
push dword [ebp - 0x60]
call esi
push dword [ebp - 0x64]
call esi
xor eax, eax
inc eax
jmp 0x4013c3