Function at 0x404aa6
Capabilities:
Delete file
Delete registry key
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push edi
mov edi, 0x40bd94
push 0x1024
push edi
xor ebx, ebx
push 0x40bc94
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x404ce0
push esi
mov esi, 0x100
lea eax, [ebp - 0x110]
push esi
push eax
push dword [0x409190]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x210]
push str.command__c_del
push eax
call fcn.00405820
pop ecx
lea eax, [ebp - 0x110]
pop ecx
push esi
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00405830
pop ecx
lea eax, [ebp - 0xc]
pop ecx
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push 0x40c794
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x210]
push eax
call fcn.00405b50
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push 0x40c794
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x110]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
lea eax, [ebp - 0x110]
push 0x4086f4
push eax
call fcn.00405830
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
call esi
lea eax, [ebp - 8]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x110]
push str.u_rc
push eax
call fcn.00405830
lea eax, [ebp - 0x110]
push 0x40a994
push eax
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call esi
lea eax, [ebp - 8]
push eax
push 0xb
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x110]
push str.u_rc
push eax
call fcn.00405830
lea eax, [ebp - 0x110]
push 0x40a994
push eax
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call esi
lea eax, [ebp - 8]
push eax
push 2
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x110]
push str.u_rc
push eax
call fcn.00405830
lea eax, [ebp - 0x110]
push 0x40a994
push eax
call fcn.00405830
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call esi
push 0x1000
push edi
push 0x40bb94
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
pop ebx
leave
ret