Function at 0x405644
Capabilities:
Check if file exists
Create process on windows
Delete registry value
Open clipboard
Set registry value
Switch active desktop

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16b4
call fcn.0046a3d0
mov eax, dword [0x495040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.curssp
mov esi, str.Softwareprojone_secshare_
push esi
mov edi, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1650], edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405971
push str..ssp
push edi
call fcn.0040d8f3
test eax, eax
je 0x405971
xor ebx, ebx
push 0xffc
lea eax, [ebp - 0x1644]
push ebx
push eax
mov dword [ebp - 0x1648], ebx
call fcn.00460930
add esp, 0xc
push 7
xor eax, eax
mov byte [ebp - 0x2c], bl
pop ecx
lea edi, [ebp - 0x2b]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x1650]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x1648]
call fcn.00404d74
pop ecx
test al, al
jne 0x4056ed
push 2
pop eax
jmp 0x405974
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x1000
lea eax, [ebp - 0x1648]
push eax
push 3
push 0x47fddc
push 0x47fde8
push connect
call edi
test eax, eax
je 0x40573a
push 0x10
push ecx
push str.error
push str.common
call fcn.00417c11
add esp, 0xc
push eax
push 0x47fe30
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4056e5
call fcn.004050e9
test al, al
jne 0x405747
push 3
jmp 0x4056e7
mov ecx, dword [ebp - 0x1650]
lea eax, [ebp - 0x164c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00407ba3
pop ecx
pop ecx
mov dword [ebp - 0x1654], eax
cmp eax, ebx
je 0x405799
push 0x10
push ecx
push str.error
push str.common
call fcn.00417c11
add esp, 0xc
push eax
mov eax, dword [ebp - 0x1654]
call fcn.004048f6
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 4
jmp 0x4056e7
push dword [ebp - 0x164c]
call fcn.00405161
pop ecx
test eax, eax
je 0x4057be
push ebx
push dword [ebp - 0x164c]
call fcn.00407e52
pop ecx
pop ecx
push 5
jmp 0x4056e7
push 0x1000
lea eax, [ebp - 0x1648]
push eax
push 3
push str.curssp
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call edi
movsx ax, byte [ebp - 0x164c]
mov word [ebp - 0xc], ax
xor eax, eax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
push str.curVS
stosw word es:[edi], ax
push esi
lea esi, [ebp - 0xc]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040da1c
push ebx
push 0x1ff
push ebx
push ebx
push ebx
mov esi, str.FAE4601B_F5F7_4609_80EF_44D9E650022D
push esi
call dword [sym.imp.USER32.dll_CreateDesktopW]
push 0x104
lea eax, [ebp - 0x238]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movsx eax, byte [ebp - 0x164c]
push eax
lea eax, [ebp - 0x238]
push eax
push str.__s__vsl__c
lea eax, [ebp - 0x648]
push 0x208
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0x40
lea eax, [ebp - 0x16ac]
push ebx
push eax
mov dword [ebp - 0x16b0], 0x44
call fcn.00460930
xor eax, eax
mov dword [ebp - 0x1664], ebx
lea edi, [ebp - 0x1660]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1664]
push eax
lea eax, [ebp - 0x16b0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x648]
push eax
push ebx
mov dword [ebp - 0x16a8], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4058b8
push 0x65
jmp 0x4056e7
push dword [ebp - 0x1660]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x1664]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10ac]
push dword [ebp - 0x164c]
call fcn.00407e52
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push eax
call dword [sym.imp.USER32.dll_SwitchDesktop]
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x405912
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
push ebx
push 0x80000fd8
call fcn.0041bf3a
add esp, 0xc
cmp dword [ebp - 0x10ac], ebx
je 0x40596d
cmp esi, ebx
jne 0x40594c
push ebx
push 0x47fed0
push 0x47fed8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [ebp - 0x1650]
call fcn.0040df5d
jmp 0x40596d
push esi
push ecx
mov eax, esi
call fcn.004048f6
pop ecx
push eax
push 0x47ff18
push 0x10
mov edi, 0x47fbc4
xor esi, esi
call fcn.0040c45e
add esp, 0x10
xor eax, eax
jmp 0x405974
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e86d
leave
ret