Function at 0x4095b6
Capabilities:
Create directory
Delete file
Delete registry key
Get common file path
Set registry value

Disassembly:
sub esp, 0x314
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push eax
call fcn.004ba78c
lea esi, [esp + 0x20]
mov edx, 0xe08d0599
push 0xea83685c
mov ecx, 0x503b908a
add esi, eax
call fcn.0040138c
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x4095fc
lea eax, [esp + 0x10]
xor edi, edi
push eax
push 0x2000e
push edi
lea eax, [esp + 0x24]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop ebx
test eax, eax
jne 0x409761
push 0x4ee5d0
push 0xc149377a
mov edx, 0xcb475ab2
mov ecx, 0x7bf1cfbd
call fcn.004013ad
pop ecx
push eax
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x220]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call ebp
push 0x104
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x18]
push 0x5c
push eax
call fcn.004bacf8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x409761
push 0x93b7e6f4
mov edx, 0x99b98b36
mov ecx, 0x290f1e09
add esi, ebx
call fcn.004013ad
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x4096bc
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x18]
push eax
call edi
push 0xb382f9fc
mov edx, 0xb98c943e
mov ecx, 0x93a01e5
call fcn.004013ad
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x4096f0
lea eax, [esp + 0x18]
push eax
call edi
push 0xa1eb5f59
mov edx, 0xabe5329b
mov ecx, 0x1b53a75c
call fcn.004013ad
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x40971e
lea eax, [esp + 0x18]
push eax
call edi
push 0x7414b731
mov edx, 0x7e1adaee
mov ecx, 0xceac4f0d
call fcn.004013ad
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, ebx
test cx, cx
jne 0x40974a
lea eax, [esp + 0x18]
push eax
call edi
xor edi, edi
xor ecx, ecx
inc ecx
call fcn.00408b9a
lea eax, [esp + 0x10]
push eax
push dword [0x529b30]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40978e
push dword [esp + 0x10]
call ebp
jmp 0x4099ea
call fcn.0042105b
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x1a
push edi
call ebx
test eax, eax
jne 0x409807
push 0xc95e50dd
mov edx, 0xc3503d02
mov ecx, 0x73e6a883
call fcn.004013ad
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x4097c2
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x4097d8
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0041fa4a
xor edi, edi
pop ecx
cmp al, 1
je 0x40995d
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x23
push edi
call ebx
test eax, eax
jne 0x409875
push 0x950b485f
mov edx, 0x9f052580
mov ecx, 0x2fb3b027
call fcn.004013ad
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x409830
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x409846
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0041fa4a
xor edi, edi
pop ecx
cmp al, 1
je 0x40995d
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x23
push edi
call ebx
test eax, eax
jne 0x40995d
push 0xd4c1282d
mov edx, 0xdecf45e5
mov ecx, 0x6e79d1a0
call fcn.004013ad
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x4098a2
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ebx, ebx
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4098b8
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x7a72ba98
mov edx, 0x707cd75d
mov ecx, 0xc0ca4328
call fcn.004013ad
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x4098f7
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40990b
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0041fa4a
xor edi, edi
pop ecx
test al, al
jne 0x40995d
push edi
push 0x80
push 1
push edi
push 2
push 0x40000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40995d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push dword [0x529b30]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4099b8
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x1cd8087
mov ecx, 0xb17b1498
lea eax, [eax*2 + 2]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push edi
push 0xbc3ed4e
call fcn.004013ad
pop ecx
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x14]
call ebp
push edi
push 0x4ee998
push 0xec609a8f
mov edx, 0xe66ef754
mov ecx, 0x56d8635d
call fcn.0040138c
pop ecx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004ba78c
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.0040a983
mov ecx, dword [esp + 0x320]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x314
ret