Function at 0x40310e
Capabilities:
Delete file
Get common file path
Persist via run registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
jne 0x403128
mov esi, 0x4425d0
lea eax, [ebp + 8]
mov byte [esi], bl
push eax
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40314b
push esi
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x40314b
mov byte [esi], bl
cmp byte [esi], bl
jne 0x403169
push esi
push str.Local_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004026e1
add esp, 0x10
cmp byte [esi], bl
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x4031fb
push esi
call fcn.00402fa9
cmp byte [eax], 0x5c
pop ecx
je 0x403189
push 0x43c1bc
push eax
call edi
push str.Axialis_
push esi
call edi
push esi
call fcn.00403090
test eax, eax
pop ecx
je 0x4031fb
lea eax, [ebp - 0x208]
push eax
push ebx
push str.inst
push esi
call fcn.004034ce
add esp, 0x10
test eax, eax
je 0x4031fb
lea eax, [ebp - 0x208]
push eax
call fcn.00402fc7
test eax, eax
pop ecx
je 0x4031fb
lea eax, [ebp - 0x208]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x208]
push eax
call fcn.00402fc7
test eax, eax
pop ecx
je 0x403354
push esi
push 0x104
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40328b
push esi
call fcn.00402fa9
cmp byte [eax], 0x5c
pop ecx
je 0x403221
push 0x43c1bc
push eax
call edi
push esi
call fcn.00403090
test eax, eax
pop ecx
je 0x40328b
lea eax, [ebp - 0x208]
push eax
push ebx
push str.inst
push esi
call fcn.004034ce
add esp, 0x10
test eax, eax
je 0x40328b
lea eax, [ebp - 0x208]
push eax
call fcn.00402fc7
test eax, eax
pop ecx
je 0x40328b
lea eax, [ebp - 0x208]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x208]
push eax
call fcn.00402fc7
test eax, eax
pop ecx
je 0x403354
lea eax, [ebp + 8]
mov byte [esi], bl
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4032ae
push esi
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x4032ae
mov byte [esi], bl
cmp byte [esi], bl
jne 0x4032d2
push esi
push str.AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.004026e1
add esp, 0x10
cmp byte [esi], bl
je 0x403359
push esi
call fcn.00402fa9
cmp byte [eax], 0x5c
pop ecx
je 0x4032e6
push 0x43c1bc
push eax
call edi
push str.Axialis_
push esi
call edi
push esi
call fcn.00403090
test eax, eax
pop ecx
je 0x403359
lea eax, [ebp - 0x208]
push eax
push ebx
push str.inst
push esi
call fcn.004034ce
add esp, 0x10
test eax, eax
je 0x403359
lea eax, [ebp - 0x208]
push eax
call fcn.00402fc7
test eax, eax
pop ecx
je 0x403359
lea eax, [ebp - 0x208]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x208]
push eax
call fcn.00402fc7
test eax, eax
pop ecx
jne 0x403359
push 1
pop eax
jmp 0x40335b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret