Function at 0x402382
Capabilities:
Delete file
Get common file path
Persist via run registry key
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4a4b60]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
push esi
mov esi, dword [ebp + 0x198]
push edi
lea eax, [ebp - 0x80]
push eax
xor ebx, ebx
push 0x1c
push ebx
mov byte [esi], bl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4023cb
push esi
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x4023cb
mov byte [esi], bl
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esi], bl
jne 0x4023f1
push esi
push str.Local_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push closesocket
call fcn.004019ea
add esp, 0x10
cmp byte [esi], bl
je 0x40246c
push esi
call fcn.00401b9d
cmp byte [eax], 0x5c
pop ecx
je 0x402405
push 0x482aac
push eax
call edi
push str.Axialis_
push esi
call edi
push esi
call fcn.004022e3
pop ecx
test eax, eax
je 0x40246c
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.pssp
push esi
call fcn.004038e7
add esp, 0x10
test eax, eax
je 0x40246c
lea eax, [ebp - 0x7c]
push eax
call fcn.00401bbb
pop ecx
test eax, eax
je 0x40246c
push 0x80
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x7c]
push eax
call fcn.00401bbb
pop ecx
test eax, eax
jne 0x40246c
xor eax, eax
inc eax
jmp 0x4025a9
push esi
push 0x104
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4024ed
push esi
call fcn.00401b9d
cmp byte [eax], 0x5c
pop ecx
je 0x402492
push 0x482aac
push eax
call edi
push esi
call fcn.004022e3
pop ecx
test eax, eax
je 0x4024ed
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.pssp
push esi
call fcn.004038e7
add esp, 0x10
test eax, eax
je 0x4024ed
lea eax, [ebp - 0x7c]
push eax
call fcn.00401bbb
pop ecx
test eax, eax
je 0x4024ed
push 0x80
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x7c]
push eax
call fcn.00401bbb
pop ecx
test eax, eax
je 0x402464
lea eax, [ebp - 0x80]
push eax
push 0x1a
push ebx
mov byte [esi], bl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x402510
push esi
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x402510
mov byte [esi], bl
cmp byte [esi], bl
jne 0x402530
push esi
push str.AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push closesocket
call fcn.004019ea
add esp, 0x10
cmp byte [esi], bl
je 0x4025a7
push esi
call fcn.00401b9d
cmp byte [eax], 0x5c
pop ecx
je 0x402544
push 0x482aac
push eax
call edi
push str.Axialis_
push esi
call edi
push esi
call fcn.004022e3
pop ecx
test eax, eax
je 0x4025a7
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.pssp
push esi
call fcn.004038e7
add esp, 0x10
test eax, eax
je 0x4025a7
lea eax, [ebp - 0x7c]
push eax
call fcn.00401bbb
pop ecx
test eax, eax
je 0x4025a7
push 0x80
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x7c]
push eax
call fcn.00401bbb
pop ecx
test eax, eax
je 0x402464
xor eax, eax
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461b8a
add ebp, 0x190
leave
ret