Function at 0x407d60
Capabilities:
Create process on windows
Get common file path
Persist via run registry key
Query environment variable
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d4
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x4d4], ecx
push 0x3f6
lea eax, [ebp - 0x484]
push eax
mov ecx, dword [ebp - 0x4d4]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 4]
call fcn.00402360
lea ecx, [ebp - 4]
call fcn.00408f70
test eax, eax
je 0x407e48
push 0x434260
push 0x434280
push 0x43e210
lea ecx, [ebp - 0x488]
push ecx
call fcn.00406ae0
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.00406ae0
lea ecx, [ebp - 0x488]
call fcn.00401860
lea ecx, [ebp - 0x24]
call fcn.00401bf0
lea eax, [ebp - 0x4a4]
push eax
call fcn.0041eeb0
add esp, 4
mov ecx, eax
call fcn.00407350
push eax
lea ecx, [ebp - 0x24]
call fcn.00401360
lea ecx, [ebp - 0x4a4]
call fcn.00407330
push 1
lea ecx, [ebp - 0x24]
call fcn.004140e0
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.004140e0
push eax
push 0x434284
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x24]
call fcn.00401860
lea ecx, [ebp - 0x20]
call fcn.00401860
push 0x3eb
lea ecx, [ebp - 0x4a8]
push ecx
mov ecx, dword [ebp - 0x4d4]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 8]
call fcn.00402360
lea ecx, [ebp - 8]
call fcn.00408f70
test eax, eax
je 0x407f26
push str.yylauncher.exe
push 0x4342b0
push 0x43e210
lea edx, [ebp - 0x4ac]
push edx
call fcn.00406ae0
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.00406ae0
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 0x48]
call fcn.00408fc0
lea ecx, [ebp - 0x4b0]
call fcn.00401860
lea ecx, [ebp - 0x4ac]
call fcn.00401860
lea ecx, [ebp - 0x28]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x407f1e
lea ecx, [ebp - 0x48]
call fcn.00409640
shl eax, 1
push eax
lea ecx, [ebp - 0x48]
call fcn.00407350
push eax
push 1
push 0
push 0x434334
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x48]
call fcn.00407330
push 0x3f4
lea ecx, [ebp - 0x4b4]
push ecx
mov ecx, dword [ebp - 0x4d4]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 0x10]
call fcn.00402360
lea ecx, [ebp - 0x10]
call fcn.00408f70
test eax, eax
je 0x407fb0
push 0x4342b4
push 0x43433c
push 0x43e210
lea edx, [ebp - 0x4b8]
push edx
call fcn.00406ae0
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00406ae0
lea ecx, [ebp - 0x4b8]
call fcn.00401860
push 5
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.004140e0
push eax
push 0x434340
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x50]
call fcn.00401860
push 0x3f5
lea ecx, [ebp - 0x4bc]
push ecx
mov ecx, dword [ebp - 0x4d4]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402360
lea ecx, [ebp - 0x1c]
call fcn.00408f70
test eax, eax
je 0x40811d
lea edx, [ebp - 0x58]
push edx
push 6
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x40811d
lea edx, [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40811d
lea ecx, [ebp - 0x260]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004030d0
push 0
push 0
push 2
push 0
push 0
push 0x1f01ff
push 0x43434c
push 0x434360
lea edx, [ebp - 0x268]
push edx
lea eax, [ebp - 0x4c0]
push eax
call fcn.00406ae0
push eax
lea ecx, [ebp - 0x4c4]
push ecx
call fcn.00406ae0
mov ecx, eax
call fcn.004140e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x264], eax
lea ecx, [ebp - 0x4c4]
call fcn.00401860
lea ecx, [ebp - 0x4c0]
call fcn.00401860
cmp dword [ebp - 0x264], 0xffffffff
je 0x408108
push str._InternetShortcut__nURLhttp:__www.duowan.com_index3.html
lea ecx, [ebp - 0x270]
call fcn.004030d0
lea ecx, [ebp - 0x270]
call fcn.00401c10
shl eax, 1
mov dword [ebp - 0x26c], eax
push 0
lea edx, [ebp - 0x274]
push edx
mov eax, dword [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x270]
call fcn.004140e0
push eax
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x270]
call fcn.00401860
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x268]
call fcn.00401860
push 5
push 0
push 0
push 0x434364
push 0x43440c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.installstat.exe
push 0x434438
push 0x43e210
lea ecx, [ebp - 0x4c8]
push ecx
call fcn.00406ae0
push eax
lea edx, [ebp - 0x18]
push edx
call fcn.00406ae0
lea ecx, [ebp - 0x4c8]
call fcn.00401860
lea ecx, [ebp - 0xc]
call fcn.00401bf0
push 1
push 0x43443c
push str.__s_di_
lea eax, [ebp - 0xc]
push eax
call fcn.00408510
add esp, 0x10
push 0
mov ecx, 0x43e210
call fcn.004140e0
push eax
lea ecx, [ebp - 0xc]
call fcn.004140e0
push eax
lea ecx, [ebp - 0x18]
call fcn.004140e0
push eax
push 0x434464
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.yyrun.exe
push 0x434484
push 0x43e210
lea ecx, [ebp - 0x4cc]
push ecx
call fcn.00406ae0
push eax
lea edx, [ebp - 0x14]
push edx
call fcn.00406ae0
lea ecx, [ebp - 0x4cc]
call fcn.00401860
push 0
mov ecx, 0x43e210
call fcn.004140e0
push eax
push 0x434488
lea ecx, [ebp - 0x14]
call fcn.004140e0
push eax
push 0x434494
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
je 0x408296
xor ecx, ecx
mov word [ebp - 0x480], cx
push 0x206
push 0
lea edx, [ebp - 0x47e]
push edx
call fcn.00422790
add esp, 0xc
push 0x104
lea eax, [ebp - 0x480]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x480]
push ecx
lea ecx, [ebp - 0x278]
call fcn.004030d0
push str.installer_duowanyy.exe
lea ecx, [ebp - 0x278]
call fcn.00403170
push 0
push 0
push 0x4344dc
lea ecx, [ebp - 0x278]
call fcn.004140e0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x278]
call fcn.00401860
mov dword [ebp - 0x4d0], 0
lea ecx, [ebp - 0x14]
call fcn.00401860
lea ecx, [ebp - 0xc]
call fcn.00401860
lea ecx, [ebp - 0x18]
call fcn.00401860
mov eax, dword [ebp - 0x4d0]
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00422540
mov esp, ebp
pop ebp
ret