Function at 0x415c10
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x48], ebx
push dword [ebx + 8]
push str.MsiSecurityList.cSecurityData__d_n
call fcn.00428ca0
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0042a4e0
add esp, 0x14
mov dword [ebp - 0x44], 0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push str.C:UsersVjollcaRadaAppDataLocalTempMSISeL.au3
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x415f78
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x44]
push 0
push eax
push 0x1cb
push str.include__Array.au3__r_nGlobal__aString___aList_1__6____y__0___n__1___cLine_r_n_aString__StringSplit_FileRead__ScriptDir___MSISeL.txt____ChrW_0___ChrW_0___ChrW_0___ChrW_0___1__r_nIf_NOT_IsArray__aString__Then_Exit_r_n_If__BitAND__aString_0___1___Then__aString_0____1_r_n_cLine__INT__aString_0____6__r_nReDim__aList__cLine__15__6__r_nFor__i__1_To__cLine_r_n_tFor__y__0_To_5__r_n_t_t_aList__i___y____aString__n__r_n_t_t_n__1_r_n_tNext_r_nNext_r_n_ArrayDisplay__aList___cLine__r_n
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push str.C:UsersVjollcaRadaAppDataLocalTempMSISeL.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x415f78
push 0
lea eax, [ebp - 0x44]
push eax
push 2
push 0x44e5a7
push esi
call edi
mov eax, dword [ebp - 0x48]
mov ebx, dword [ebx]
mov dword [ebp - 0x4c], ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x415f01
mov al, byte [ebx + 0x19]
push 0
cmp al, 1
jne 0x415cfb
lea eax, [ebp - 0x44]
push eax
push 8
push str.File
jmp 0x415d24
cmp al, 2
jne 0x415d0c
lea eax, [ebp - 0x44]
push eax
push 0x10
push str.Registry
jmp 0x415d24
cmp al, 4
lea eax, [ebp - 0x44]
push eax
jne 0x415d1d
push 0xe
push str.Service
jmp 0x415d24
push 0x18
push str.CreateFolder
push esi
call edi
push 0
lea eax, [ebp - 0x44]
push eax
push 8
push 0x44a170
push esi
call edi
push 0
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebx + 0xc]
add eax, eax
push eax
push dword [ebx]
push esi
call edi
push 0
lea eax, [ebp - 0x44]
push eax
push 8
push 0x44a170
push esi
call edi
push 0
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebx + 0x10]
add eax, eax
push eax
push dword [ebx + 4]
push esi
call edi
push 0
lea eax, [ebp - 0x44]
push eax
push 8
push 0x44a170
push esi
call edi
mov al, byte [ebx + 0x18]
push 0
test al, al
jne 0x415d90
lea eax, [ebp - 0x44]
push eax
push 0x14
push str.LockObject
jmp 0x415db9
cmp al, 1
jne 0x415da1
lea eax, [ebp - 0x44]
push eax
push 0x18
push str.LockObjectEx
jmp 0x415db9
cmp al, 2
lea eax, [ebp - 0x44]
push eax
jne 0x415db2
push 0x18
push str.ISLockObject
jmp 0x415db9
push 0x1e
push str.AdobeLockObject
push esi
call edi
push 0
lea eax, [ebp - 0x44]
push eax
push 8
push 0x44a170
push esi
call edi
mov ecx, dword [ebx + 0x14]
mov edi, 0x4575a4
xor bl, bl
xor eax, eax
mov word [0x4575a4], ax
nop
mov eax, 0xcccccccd
sub edi, 2
mul ecx
inc bl
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [edi], cx
mov ecx, edx
test ecx, ecx
jne 0x415de0
cmp bl, 0x16
jbe 0x415e11
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x415e2e
movzx eax, bl
inc bl
mov dword [0x457638], eax
movzx eax, bl
add eax, eax
push eax
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.0043c9e0
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x44]
push 0
push eax
mov eax, dword [0x457638]
add eax, eax
push eax
lea eax, [ebp - 0x40]
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x44]
push eax
push 8
push 0x44a170
push esi
call edi
mov eax, dword [ebp - 0x4c]
xor bl, bl
mov edi, 0x4575a4
mov ecx, dword [eax + 8]
xor eax, eax
mov word [0x4575a4], ax
nop
mov eax, 0xcccccccd
sub edi, 2
mul ecx
inc bl
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [edi], cx
mov ecx, edx
test ecx, ecx
jne 0x415e70
cmp bl, 0x16
jbe 0x415ea1
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x415ebe
movzx eax, bl
inc bl
mov dword [0x457638], eax
movzx eax, bl
add eax, eax
push eax
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.0043c9e0
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x44]
push 0
push eax
mov eax, dword [0x457638]
add eax, eax
push eax
lea eax, [ebp - 0x40]
push eax
push esi
call edi
push 0
lea eax, [ebp - 0x44]
push eax
push 8
push 0x44a170
push esi
call edi
mov ecx, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x4c]
dec ecx
add ebx, 0x1c
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], ebx
test ecx, ecx
jne 0x415ce5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3c
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.0042a4e0
add esp, 0xc
mov dword [ebp - 0x88], 0x3c
lea eax, [ebp - 0x88]
mov dword [ebp - 0x84], 0x4040
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
push eax
mov dword [ebp - 0x78], str.C:Program_Files__x86_AutoIt3AutoIt3.exe
mov dword [ebp - 0x74], str.C:UsersVjollcaRadaAppDataLocalTempMSISeL.au3
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x68], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428cd6
mov esp, ebp
pop ebp
ret