Function at 0x41a6f0
Capabilities:
Create process on windows
Delete directory
Delete file
Delete registry key
Get common file path
Move file
Self delete
Set current directory
Write and execute a file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x448586
mov eax, dword fs:[0]
push eax
sub esp, 0xa08
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0xa04], eax
push ebx
push esi
push edi
mov eax, dword [0x4563c4]
xor eax, esp
push eax
lea eax, [esp + 0xa18]
mov dword fs:[0], eax
lea eax, [esp + 0x5c]
push eax
call fcn.0041abc0
xor ebx, ebx
push str.SoftwareIntel
mov dword [esp + 0xa24], ebx
push 0x80000002
mov dword [esp + 0x1c], vtable.CFileCount.0
mov dword [esp + 0x20], ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
push str.Create_cleanup_script
push str.__s_
push 0x4575e0
xor eax, eax
call fcn.00419140
add dword [0x457600], 1
add esp, 0xc
push 0x44fd7c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 0x3fc]
push ecx
push ebx
push ebx
push 0x17
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x44fd84
lea edx, [esp + 0x400]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x18]
push eax
push 0x44d7ec
lea ecx, [esp + 0x404]
push ecx
lea ecx, [esp + 0x20]
call fcn.00418720
cmp eax, ebx
jne 0x41a7e3
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x400]
push eax
mov eax, dword [edx + 4]
lea ecx, [esp + 0x1c]
call eax
cmp dword [esp + 0x18], ebx
jne 0x41a84a
lea ecx, [esp + 0x80c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x604]
push edx
push ebx
push 0x44eb38
lea eax, [esp + 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [esp + 0x604]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x604]
push edx
lea eax, [esp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 0x604]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x1ec]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.iif2xdel.bat
lea eax, [esp + 0x1f0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x44fda0
push ecx
lea ecx, [esp + 0x6c]
push str.:loop
push ecx
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 8
push 0x104
lea edx, [esp + 0xe8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44fdac
push ecx
lea eax, [esp + 0xec]
push eax
push ecx
lea ecx, [esp + 0x74]
push str.del__
push ecx
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 8
push 0x44fda0
push ecx
push str.__goto_loop
push ecx
lea edx, [esp + 0xf4]
push edx
push ecx
lea eax, [esp + 0x7c]
push str.if_exist__
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
mov eax, dword [0x459de0]
add esp, 8
cmp dword [0x459df4], 8
jae 0x41a92d
mov eax, 0x459de0
push ebx
push ebx
push 0x104
lea ecx, [esp + 0x300]
push ecx
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [esp + 0x2f4], bl
je 0x41a99d
push 0x44fdac
push ecx
lea edx, [esp + 0x2fc]
push edx
push ecx
lea eax, [esp + 0x74]
push str.del__
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
lea ecx, [esp + 0x2fc]
push ecx
lea edx, [esp + 0xf0]
push 0x104
push edx
call fcn.00424d23
add esp, 0x14
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0xe4]
push eax
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
push 0x44fdac
push ecx
lea ecx, [esp + 0xec]
push ecx
push ecx
lea edx, [esp + 0x74]
push str.rmdir__
push edx
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 8
lea eax, [esp + 0xe4]
push eax
call esi
lea ecx, [esp + 0xe4]
push ecx
call edi
neg eax
sbb eax, eax
inc eax
je 0x41a9b3
push 0x44fdac
push ecx
lea edx, [esp + 0x1f4]
push edx
push ecx
lea eax, [esp + 0x74]
push str.del__
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
add esp, 0xc
push eax
call fcn.0041b780
lea ecx, [esp + 0x1f4]
push ecx
push str.Writing_cleanup_script_to__S
push 0x4575e0
xor eax, eax
call fcn.00419140
add esp, 0x14
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea edx, [esp + 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41ab1e
lea ecx, [esp + 0x40]
lea eax, [esp + 0x5c]
call fcn.0041ad00
mov edi, eax
lea ecx, [esp + 0x24]
lea eax, [esp + 0x5c]
mov byte [esp + 0xa20], 1
call fcn.0041ad00
cmp dword [eax + 0x18], 0x10
mov edi, dword [edi + 0x14]
jb 0x41aaa7
mov eax, dword [eax + 4]
jmp 0x41aaaa
add eax, 4
push ebx
lea ecx, [esp + 0x24]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x3c], 0x10
jb 0x41aacd
mov edx, dword [esp + 0x28]
push edx
call fcn.00422b32
add esp, 4
cmp dword [esp + 0x58], 0x10
mov edi, 0xf
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
jb 0x41aaf2
mov eax, dword [esp + 0x44]
push eax
call fcn.00422b32
add esp, 4
push esi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1f8]
push ecx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x41ab3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_writing_cleanup_script__0x_X_
push 0x4575e0
mov eax, 1
call fcn.00419140
add esp, 0xc
sub dword [0x457600], 1
lea ecx, [esp + 0xb0]
mov dword [esp + 0xa20], 0xffffffff
call fcn.0041ac60
lea edx, [esp + 0xb0]
push edx
mov dword [esp + 0xb4], vtable.std::ios_base.0
call fcn.00422117
add esp, 4
mov ecx, dword [esp + 0xa18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa04]
xor ecx, esp
call fcn.00422b23
add esp, 0xa14
ret