Function at 0x4151b0
Capabilities:
Create process on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x374], ecx
mov dword [ebp - 0x368], 0x44a1d0
mov dword [ebp - 0x364], str.ProductCode
mov dword [ebp - 0x360], 0x44a200
mov dword [ebp - 0x35c], str.ProductLanguage
mov dword [ebp - 0x358], str.Manufacturer
mov dword [ebp - 0x354], str.UpgradeCode
mov dword [ebp - 0x350], str.PIDTemplate
mov dword [ebp - 0x34c], str.DiskPrompt
mov dword [ebp - 0x348], str.LeftUnit
mov dword [ebp - 0x344], str.AdminProperties
mov dword [ebp - 0x340], str.DefaultUIFont
mov dword [ebp - 0x33c], str.SecureCustomProperties
mov dword [ebp - 0x338], str.EnableUserControl
mov dword [ebp - 0x334], str.MsiHiddenProperties
mov dword [ebp - 0x330], str.USERNAME
mov dword [ebp - 0x32c], str.COMPANYNAME
mov dword [ebp - 0x328], str.PIDKEY
mov dword [ebp - 0x324], str.PATCH
mov dword [ebp - 0x320], str.MSIPATCHREMOVE
mov dword [ebp - 0x31c], str.TARGETDIR
mov dword [ebp - 0x318], str.ACTION
mov dword [ebp - 0x314], str.LIMITUI
mov dword [ebp - 0x310], str.LOGACTION
mov dword [ebp - 0x30c], str.ALLUSERS
mov dword [ebp - 0x308], str.INSTALLLEVEL
mov dword [ebp - str.GetWindowTextW], str.REBOOT
mov dword [ebp - str.GetWindowTextW], str.REBOOTPROMPT
mov dword [ebp - 0x2fc], str.EXECUTEMODE
mov dword [ebp - 0x2f8], str.NONE
mov dword [ebp - 0x2f4], str.SCRIPT
mov dword [ebp - 0x2f0], str.EXECUTEACTION
mov dword [ebp - 0x2ec], str.SOURCELIST
mov dword [ebp - 0x2e8], str.ROOTDRIVE
mov dword [ebp - 0x2e4], str.TRANSFORMS
mov dword [ebp - 0x2e0], str.TRANSFORMSATSOURCE
mov dword [ebp - 0x2dc], str.TRANSFORMSSECURE
mov dword [ebp - 0x2d8], str.SEQUENCE
mov dword [ebp - 0x2d4], str.SHORTFILENAMES
mov dword [ebp - 0x2d0], str.PRIMARYFOLDER
mov dword [ebp - 0x2cc], str.AFTERREBOOT
mov dword [ebp - 0x2c8], str.NOCOMPANYNAME
mov dword [ebp - 0x2c4], str.NOUSERNAME
mov dword [ebp - 0x2c0], str.DISABLEROLLBACK
mov dword [ebp - 0x2bc], str.AVAILABLEFREEREG
mov dword [ebp - 0x2b8], str.DISABLEADVTSHORTCUTS
mov dword [ebp - 0x2b4], str.PATCHNEWPACKAGECODE
mov dword [ebp - 0x2b0], str.PATCHNEWSUMMARYSUBJECT
mov dword [ebp - 0x2ac], str.PATCHNEWSUMMARYCOMMENTS
mov dword [ebp - 0x2a8], str.PRODUCTLANGUAGE
mov dword [ebp - 0x2a4], str.MSICHECKCRCS
mov dword [ebp - 0x2a0], str.MSINODISABLEMEDIA
mov dword [ebp - 0x29c], str.CARRYINGNDP
mov dword [ebp - 0x298], str.URTREINSTALL
mov dword [ebp - 0x294], str.URTUPGRADE
mov dword [ebp - 0x290], str.MSIENFORCEUPGRADECOMPONENTRULES
mov dword [ebp - 0x28c], str.MSINEWINSTANCE
mov dword [ebp - 0x288], str.MSIINSTANCEGUID
mov dword [ebp - 0x284], str.MSIPACKAGEDOWNLOADLOCALCOPY
mov dword [ebp - 0x280], str.MSIPATCHDOWNLOADLOCALCOPY
mov dword [ebp - 0x27c], str.MSIDISABLELUAPATCHING
mov dword [ebp - 0x278], str.MsiLogging
mov dword [ebp - 0x274], str.MsiLogFileLocation
mov dword [ebp - 0x270], str.MSIRESTARTMANAGERCONTROL
mov dword [ebp - 0x26c], str.Disable
mov dword [ebp - 0x268], str.DisableShutdown
mov dword [ebp - 0x264], str.MsiRestartManagerSessionKey
mov dword [ebp - 0x260], str.MsiSystemRebootPending
mov dword [ebp - 0x25c], str.MSIRMSHUTDOWN
mov dword [ebp - 0x258], str.MSIDISABLERMRESTART
mov dword [ebp - 0x254], str.MSIDEPLOYMENTCOMPLIANT
mov dword [ebp - 0x250], str.MSIUSEREALADMINDETECTION
mov dword [ebp - 0x24c], str.MSIUNINSTALLSUPERSEDEDCOMPONENTS
mov dword [ebp - 0x248], str.MSIDISABLEEEUI
mov dword [ebp - 0x244], str.MSIFASTINSTALL
mov dword [ebp - 0x240], str.MSIINSTALLPERUSER
mov dword [ebp - 0x23c], str.MSIINTERNALINSTALLEDPERUSER
mov dword [ebp - 0x238], str.ARPAUTHORIZEDCDFPREFIX
mov dword [ebp - 0x234], str.ARPCOMMENTS
mov dword [ebp - 0x230], str.ARPCONTACT
mov dword [ebp - 0x22c], str.ARPHELPLINK
mov dword [ebp - 0x228], str.ARPHELPTELEPHONE
mov dword [ebp - 0x224], str.ARPINSTALLLOCATION
mov dword [ebp - 0x220], str.ARPNOMODIFY
mov dword [ebp - 0x21c], str.ARPNOREMOVE
mov dword [ebp - 0x218], str.ARPNOREPAIR
mov dword [ebp - 0x214], str.ARPREADME
mov dword [ebp - 0x210], str.ARPSIZE
mov dword [ebp - 0x20c], str.ARPSYSTEMCOMPONENT
mov dword [ebp - 0x208], str.ARPURLINFOABOUT
mov dword [ebp - 0x204], str.ARPURLUPDATEINFO
mov dword [ebp - 0x200], str.ARPPRODUCTICON
mov dword [ebp - 0x1fc], str.MSIARPSETTINGSIDENTIFIER
mov dword [ebp - 0x1f8], str.SHIMFLAGS
mov dword [ebp - 0x1f4], str.SHIMVERSIONNT
mov dword [ebp - 0x1f0], str.SHIMSERVICEPACKLEVEL
mov dword [ebp - 0x1ec], str.Installed
mov dword [ebp - 0x1e8], str.ProductState
mov dword [ebp - 0x1e4], str.Preselected
mov dword [ebp - str.GetWindowTextW], str.RESUME
mov dword [ebp - 0x1dc], str.UpdateStarted
mov dword [ebp - 0x1d8], str.ProductID
mov dword [ebp - 0x1d4], str.OutOfDiskSpace
mov dword [ebp - 0x1d0], str.OutOfNoRbDiskSpace
mov dword [ebp - 0x1cc], str.CostingComplete
mov dword [ebp - 0x1c8], str.SourceDir
mov dword [ebp - 0x1c4], str.ReplacedInUseFiles
mov dword [ebp - 0x1c0], str.PrimaryVolumePath
mov dword [ebp - 0x1bc], str.PrimaryVolumeSpaceAvailable
mov dword [ebp - 0x1b8], str.PrimaryVolumeSpaceRequired
mov dword [ebp - 0x1b4], str.PrimaryVolumeSpaceRemaining
mov dword [ebp - 0x1b0], str.IsAdminPackage
mov dword [ebp - 0x1ac], str.RollbackDisabled
mov dword [ebp - 0x1a8], str.RestrictedUserControl
mov dword [ebp - 0x1a4], str.MsiUISourceResOnly
mov dword [ebp - 0x1a0], str.MsiUIHideCancel
mov dword [ebp - 0x19c], str.MsiUIProgressOnly
mov dword [ebp - 0x198], str.MsiUIUACOnly
mov dword [ebp - 0x194], str.Time
mov dword [ebp - 0x190], str.Date
mov dword [ebp - 0x18c], str.DateTime
mov dword [ebp - 0x188], str.Intel
mov dword [ebp - 0x184], str.AMD64
mov dword [ebp - 0x180], 0x4453c0
mov dword [ebp - 0x17c], str.MsiAMD64
mov dword [ebp - 0x178], str.Msix64
mov dword [ebp - 0x174], str.Intel64
mov dword [ebp - 0x170], str.IA64
mov dword [ebp - 0x16c], str.TextHeight
mov dword [ebp - 0x168], str.TextInternalLeading
mov dword [ebp - 0x164], str.ScreenX
mov dword [ebp - 0x160], str.ScreenY
mov dword [ebp - 0x15c], str.CaptionHeight
mov dword [ebp - 0x158], str.BorderTop
mov dword [ebp - 0x154], str.BorderSide
mov dword [ebp - 0x150], str.ColorBits
mov dword [ebp - 0x14c], str.PhysicalMemory
mov dword [ebp - 0x148], str.VirtualMemory
mov dword [ebp - 0x144], str.TextHeightCorrection
mov dword [ebp - 0x140], str.MsiTabletPC
mov dword [ebp - 0x13c], str.VersionNT
mov dword [ebp - 0x138], str.Version9X
mov dword [ebp - 0x134], str.VersionNT64
mov dword [ebp - 0x130], str.WindowsBuild
mov dword [ebp - 0x12c], str.ServicePackLevel
mov dword [ebp - 0x128], str.ServicePackLevelMinor
mov dword [ebp - 0x124], str.SharedWindows
mov dword [ebp - 0x120], str.ComputerName
mov dword [ebp - 0x11c], str.ShellAdvtSupport
mov dword [ebp - 0x118], str.OLEAdvtSupport
mov dword [ebp - 0x114], str.SystemLanguageID
mov dword [ebp - 0x110], str.TTCSupport
mov dword [ebp - 0x10c], str.TerminalServer
mov dword [ebp - 0x108], str.RemoteAdminTS
mov dword [ebp - 0x104], str.RedirectedDllSupport
mov dword [ebp - 0x100], str.MsiNTProductType
mov dword [ebp - 0xfc], str.MsiNTSuiteBackOffice
mov dword [ebp - 0xf8], str.MsiNTSuiteDataCenter
mov dword [ebp - 0xf4], str.MsiNTSuiteEnterprise
mov dword [ebp - 0xf0], str.MsiNTSuiteSmallBusiness
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push str.C:UsersVjollcaRadaAppDataLocalTempCPP2AU3.au3
mov dword [ebp - 0xec], str.MsiNTSuiteSmallBusinessRestricted
mov dword [ebp - 0xe8], str.MsiNTSuitePersonal
mov dword [ebp - 0xe4], str.MsiNTSuiteWebServer
mov dword [ebp - 0xe0], str.MsiNetAssemblySupport
mov dword [ebp - 0xdc], str.MsiWin32AssemblySupport
mov dword [ebp - 0xd8], str.LogonUser
mov dword [ebp - 0xd4], str.UserSID
mov dword [ebp - 0xd0], str.AdminUser
mov dword [ebp - 0xcc], str.UserLanguageID
mov dword [ebp - 0xc8], str.Privileged
mov dword [ebp - 0xc4], str.MsiRunningElevated
mov dword [ebp - 0xc0], str.MsiTrueAdminUser
mov dword [ebp - 0xbc], str.WindowsFolder
mov dword [ebp - 0xb8], str.SystemFolder
mov dword [ebp - 0xb4], str.System16Folder
mov dword [ebp - 0xb0], str.WindowsVolume
mov dword [ebp - 0xac], str.TempFolder
mov dword [ebp - 0xa8], str.ProgramFilesFolder
mov dword [ebp - 0xa4], str.CommonFilesFolder
mov dword [ebp - 0xa0], str.System64Folder
mov dword [ebp - 0x9c], str.ProgramFiles64Folder
mov dword [ebp - 0x98], str.CommonFiles64Folder
mov dword [ebp - 0x94], str.StartMenuFolder
mov dword [ebp - 0x90], str.ProgramMenuFolder
mov dword [ebp - 0x8c], str.StartupFolder
mov dword [ebp - 0x88], str.NetHoodFolder
mov dword [ebp - 0x84], str.PersonalFolder
mov dword [ebp - 0x80], str.SendToFolder
mov dword [ebp - 0x7c], str.DesktopFolder
mov dword [ebp - 0x78], str.TemplateFolder
mov dword [ebp - 0x74], str.FontsFolder
mov dword [ebp - 0x70], str.FavoritesFolder
mov dword [ebp - 0x6c], str.RecentFolder
mov dword [ebp - 0x68], str.AppDataFolder
mov dword [ebp - 0x64], str.PrintHoodFolder
mov dword [ebp - 0x60], str.AdminToolsFolder
mov dword [ebp - 0x5c], str.CommonAppDataFolder
mov dword [ebp - 0x58], str.LocalAppDataFolder
mov dword [ebp - 0x54], str.MyPicturesFolder
mov dword [ebp - 0x50], str.ADDLOCAL
mov dword [ebp - 0x4c], str.ADDSOURCE
mov dword [ebp - 0x48], str.ADDDEFAULT
mov dword [ebp - 0x44], str.REMOVE
mov dword [ebp - 0x40], str.ADVERTISE
mov dword [ebp - 0x3c], 0x44b8bc
mov dword [ebp - 0x38], str.COMPADDLOCAL
mov dword [ebp - 0x34], str.COMPADDSOURCE
mov dword [ebp - 0x30], str.COMPADDDEFAULT
mov dword [ebp - 0x2c], str.FILEADDLOCAL
mov dword [ebp - 0x28], str.FILEADDSOURCE
mov dword [ebp - 0x24], str.FILEADDDEFAULT
mov dword [ebp - 0x20], str.REINSTALL
mov dword [ebp - 0x1c], str.REINSTALLMODE
mov dword [ebp - 0x18], str.PROMPTROLLBACKCOST
mov dword [ebp - 0x14], 0x44b9cc
mov dword [ebp - 0x10], 0x44b9d0
mov dword [ebp - 0xc], 0x44b9d4
mov dword [ebp - 8], 0x44b9d8
mov dword [ebp - 0x36c], 0
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x415bf6
push 0
lea eax, [ebp - 0x36c]
push eax
push 0x1a6
push str.include__Array.au3__r_nGlobal__aString___aList_1__1__r_n_aString__StringSplit_FileRead__ScriptDir___CPP2AU3.txt____ChrW_0___ChrW_0___ChrW_0___ChrW_0___1__r_nIf_NOT_IsArray__aString__Then_Exit_r_nIf__BitAND__aString_0___1___Then__aString_0____1_r_nReDim__aList___aString_0____2___1__2__r_nFor__i__1_To__aString_0__Step_2_r_n_t_aList__i___2__0____aString__i__r_n_t_aList__i___2__1____aString__i__1__r_nNext_r_n_ArrayDisplay__aList__r_n
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push str.C:UsersVjollcaRadaAppDataLocalTempCPP2AU3.txt
call edi
mov edi, eax
mov dword [ebp - 0x370], edi
cmp edi, 0xffffffff
je 0x415bf6
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x36c]
push ebx
push 0
push eax
push 2
push 0x44e5a7
push edi
call esi
xor ebx, ebx
test ebx, ebx
je 0x415a9a
push 0
lea eax, [ebp - 0x36c]
push eax
push 8
push 0x44a170
push edi
call esi
mov esi, dword [ebp + ebx*4 - 0x368]
test esi, esi
je 0x415ade
mov eax, SysReAllocString
mov ecx, esi
nop dword [eax]
cmp word [ecx], 0
je 0x415abe
add ecx, 2
sub eax, 1
jne 0x415ab0
xor ecx, ecx
mov edi, 0x80070057
test eax, eax
cmovne edi, ecx
je 0x415ae3
lea ecx, [eax + eax]
mov edx, 0xfffffffe
sub edx, ecx
neg eax
sbb eax, eax
and eax, edx
jmp 0x415ae5
mov edi, 0x80070057
xor eax, eax
mov dword [0x457630], eax
test edi, edi
jns 0x415b01
test esi, esi
je 0x415aff
cmp word [esi], 0
je 0x415aff
mov eax, 0xfffffffe
jmp 0x415b01
xor eax, eax
mov edi, dword [ebp - 0x370]
lea ecx, [ebp - 0x36c]
push 0
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x36c]
push eax
push 8
push 0x44a170
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x374]
mov edx, esi
call fcn.0040c850
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x36c]
push 0
push ecx
mov ecx, dword [0x457638]
add ecx, ecx
push ecx
push eax
push edi
call esi
inc ebx
cmp ebx, 0xd9
jb 0x415a83
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3c
lea eax, [ebp - 0x3b0]
push 0
push eax
call fcn.0042a4e0
add esp, 0xc
mov dword [ebp - 0x3b0], 0x3c
lea eax, [ebp - 0x3b0]
mov dword [ebp - 0x3ac], 0x4040
mov dword [ebp - 0x3a8], 0
mov dword [ebp - 0x3a4], 0
push eax
mov dword [ebp - 0x3a0], str.C:Program_Files__x86_AutoIt3AutoIt3.exe
mov dword [ebp - 0x39c], str.C:UsersVjollcaRadaAppDataLocalTempCPP2AU3.au3
mov dword [ebp - 0x398], 0
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x390], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x378]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428cd6
mov esp, ebp
pop ebp
ret