Function at 0x447bf0
Capabilities:
Check if file exists
Check os version
Create process on windows
Delete registry key
Get common file path
Get file attributes
Get session user name
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1dc]
sub esp, 0x1dc
push 0xffffffffffffffff
push 0x620450
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp + 0x1d8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x447c78
lea ecx, [ebp - 0x38]
push ecx
push str.SeRestorePrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x30], 2
push ebx
push ebx
push ebx
lea edx, [ebp - 0x3c]
push edx
push ebx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 1
push 0x94
push ebx
lea ecx, [ebp]
push ecx
call fcn.005f8cb0
add esp, 0xc
mov dword [ebp], 0x94
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x447e3d
cmp dword [ebp + 0x10], 2
jne 0x447e3d
push 0x6513c0
call fcn.00445b00
add esp, 4
mov edi, eax
cmp edi, ebx
je 0x447d7f
push str.SHGetFolderPathA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x447d70
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 0xd4]
push eax
push 0
push 0
push 0x1a
push 0
call esi
test eax, eax
jne 0x447d6a
lea eax, [ebp + 0xd4]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447d10
sub eax, edx
dec eax
mov dword [ebp - 0x1c], eax
cmp byte [ebp + eax + 0xd4], 0x5c
mov eax, 0x64f8bc
je 0x447d31
mov eax, 0x652d88
push eax
lea ecx, [ebp + 0xd4]
push ecx
push str._s_sDMCache
lea edx, [ebp - 0x14]
push edx
call fcn.00402f60
mov eax, dword [ebp - 0x14]
push eax
call fcn.005fcdfb
add esp, 0x14
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x447d6a
mov ebx, 1
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x447f2f
lea edx, [ebp - 0x24]
push edx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x447e3d
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xd4]
push ecx
push 0
push 0
push 0x658a5c
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x447e2b
lea eax, [ebp + 0xd4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447dd1
sub eax, edx
dec eax
mov dword [ebp - 0x1c], eax
cmp byte [ebp + eax + 0xd4], 0x5c
mov eax, 0x64f8bc
je 0x447df2
mov eax, 0x652d88
push eax
lea eax, [ebp + 0xd4]
push eax
push str._s_sDMCache
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f60
mov edx, dword [ebp - 0x14]
push edx
call fcn.005fcdfb
add esp, 0x14
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x447e2b
mov ebx, 1
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x447f2f
push 0x104
lea edx, [ebp + 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x447f81
lea eax, [ebp + 0xd4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447e60
sub eax, edx
dec eax
mov dword [ebp - 0x1c], eax
cmp byte [ebp + eax + 0xd4], 0x5c
mov eax, 0x64f8bc
je 0x447e81
mov eax, 0x652d88
push eax
lea eax, [ebp + 0xd4]
push eax
push str._s_sDMCache
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f60
mov edx, dword [ebp - 0x14]
push edx
call fcn.005fcdfb
add esp, 0x14
cmp dword [ebp + 0x10], 2
jne 0x447f19
mov dword [ebp - 0x2c], 0x40
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x94]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x447ed9
push 0x658a4c
lea edx, [ebp + 0x94]
push edx
call fcn.005fb4cb
add esp, 8
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax + 0xd4], 0x5c
mov eax, 0x64f8bc
je 0x447ef0
mov eax, 0x652d88
lea ecx, [ebp + 0x94]
push ecx
push eax
lea edx, [ebp + 0xd4]
push edx
push str._s_sDMCache_s
lea eax, [ebp - 0x14]
push eax
call fcn.00402f60
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.005fcdfb
add esp, 0x18
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x447f81
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x18]
call fcn.004024e0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
push eax
push str._s_settings.bak
lea ecx, [ebp - 0x18]
push ecx
call fcn.00402f60
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x448076
cmp dword [ebp + 0x10], 2
jne 0x447fb2
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x70f604]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegRestoreKeyA]
jmp 0x448019
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1d8]
xor ecx, ebp
call fcn.005f85e7
add ebp, 0x1dc
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
push edx
push str.idmtmp
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
test eax, eax
jne 0x448009
push str.shlwapi.dll
call fcn.00445b00
add esp, 4
mov esi, eax
test esi, esi
je 0x448009
push str.SHCopyKeyA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x448002
push 0
mov ecx, dword [0x70f604]
push ecx
push str.idmtmp
push 0x80000003
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.idmtmp
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.C:Program_FilesSpyhunter
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44805f
push 0x10004
push str.Intenet_Download_Manager
push str.Internet_Download_Manager_detected_that_its_registry_keys_had_been_damaged_since_the_last_run._Its_possible_that_you_run_a_flaky_spyware_remover_program_like_Spyhunter_which_corrupted_system_registry._Internet_Download_Manager_will_try_to_restore_all_damaged_data__but_some_data_may_remain_corrupted._r_nWould_you_like_to_see_additional_information_about_this_problem_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x448076
push 1
push 0
push 0
push str.https:__www.internetdownloadmanager.com_support_damaged_keys.html
push 0x64ed4c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x448076
push 0x10000
push str.Intenet_Download_Manager
push str.Internet_Download_Manager_detected_that_its_registry_keys_had_been_damaged_since_the_last_run._Its_possible_that_you_run_a_flaky_spyware_remover_program_which_corrupted_system_registry._Internet_Download_Manager_will_try_to_restore_all_damaged_data__but_some_data_may_remain_corrupted.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402550
mov dword [ebp - 4], 0xffffffff
jmp 0x447f8d