Function at 0x4055a3
Capabilities:
Delete file
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
mov esi, 0x423010
push edi
push esi
push 0x422a9c
mov edi, str.General
push str.Title
push edi
mov dword [esp + 0x20], 1
call fcn.0040c714
push esi
push dword [0x421b94]
push str.Language
push edi
call fcn.0040c86c
mov ebx, 0x421734
mov ebp, 0x104
push ebx
lea eax, [esp + 0x40]
push ebp
push eax
push 0
push str.ProgramGroupName
push str.Shortcut
call fcn.0040c615
add esp, 0x38
test eax, eax
je 0x40562c
lea eax, [esp + 0x1c]
push esi
push eax
push 0x42284c
call fcn.0040c26a
pop ecx
pop ecx
push eax
push str.ProgramGroupFolder
push edi
call fcn.0040c714
add esp, 0x10
push ebx
lea eax, [esp + 0x20]
push ebp
push eax
push 0
mov edi, 0x41e5e8
push str.RunAppPath
push edi
call fcn.0040c615
add esp, 0x18
test eax, eax
je 0x4056bd
lea eax, [esp + 0x1c]
push eax
call fcn.00402f1e
lea eax, [esp + 0x20]
push esi
push eax
push str.RunAppPath
push edi
call fcn.0040c714
push ebx
lea eax, [esp + 0x34]
push ebp
push eax
push 0x423224
push str.RunAppArg
push edi
call fcn.0040c615
lea eax, [esp + 0x48]
push eax
call fcn.00402f1e
lea eax, [esp + 0x4c]
push esi
push eax
push str.RunAppArg
push edi
call fcn.0040c714
add esp, 0x40
push esi
push ebx
push 1
push str.AllowCancelRunApp
push edi
call fcn.0040c6f5
add esp, 0x10
push eax
push str.AllowCancelRunApp
push edi
call fcn.0040c89b
add esp, 0x10
push ebx
lea eax, [esp + 0x20]
push ebp
push eax
push 0
mov edi, str.Info
push str.PostInfoPath
push edi
call fcn.0040c615
add esp, 0x18
test eax, eax
je 0x405719
lea eax, [esp + 0x1c]
push eax
call fcn.00402f1e
lea eax, [esp + 0x20]
push esi
push eax
push str.PostInfoPath
push edi
call fcn.0040c714
add esp, 0x14
push esi
push ebx
mov ebx, str.AllowCancelPostInfo
push 1
push ebx
push edi
call fcn.0040c6f5
add esp, 0x10
push eax
push ebx
push edi
call fcn.0040c89b
add esp, 0x10
xor edi, edi
cmp dword [0x422f04], edi
je 0x405850
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push edi
push 2
push edi
push edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4057b8
lea eax, [esp + 0x1c]
push ebp
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x1c]
push eax
call fcn.0040be4c
lea eax, [esp + 0x20]
mov dword [esp], 0x41e594
mov ebx, 0x208
push eax
push ebx
call fcn.0040baef
lea eax, [esp + 0x28]
push esi
push eax
push ebx
call fcn.0040baef
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
lea eax, [esp + 0x20]
push eax
push 1
push edi
push 0x422a9c
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057bc
mov dword [esp + 0x10], edi
cmp dword [0x4210f8], edi
je 0x405841
mov ebx, 0x421a90
push ebx
call fcn.00402778
pop ecx
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405836
push dword [0x421ba4]
push dword [0x4210f8]
push ebp
call fcn.0040cb25
add esp, 0xc
test eax, eax
push ebp
je 0x405830
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
push ebx
push str.WizardBitmap
push str.Window
call fcn.0040c714
push ebx
push edi
push str.SourceFile
call fcn.00402ad0
add esp, 0x1c
jmp 0x405841
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov dword [esp + 0x10], edi
push esi
push edi
push str.SourceFile
call fcn.00402ad0
add esp, 0xc
push esi
push 0x420d70
push str.WizardStamp
push str.Window
call fcn.0040c714
mov eax, dword [esp + 0x20]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret