Function at 0x401a50
Capabilities:
Create process on windows
Delete file
Get common file path
Set registry value

Disassembly:
mov eax, 0x1c44
call fcn.00417fa0
mov eax, dword [0x432c20]
xor eax, esp
mov dword [esp + 0x1c3c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x81e]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x28], ebx
mov word [esp + 0x824], ax
call fcn.00415af0
add esp, 0xc
push 0x206
lea eax, [esp + 0x1246]
xor edx, edx
push ebx
push eax
mov word [esp + 0x124c], dx
call fcn.00415af0
add esp, 0xc
push 0x206
lea edx, [esp + 0xe36]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xe3c], cx
call fcn.00415af0
xor eax, eax
add esp, 0xc
push 0x7e
lea edx, [esp + 0x71e]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x684], ax
mov dword [esp + 0x686], eax
mov dword [esp + 0x68a], eax
mov dword [esp + 0x68e], eax
mov dword [esp + 0x692], eax
mov dword [esp + 0x696], eax
mov dword [esp + 0x69a], eax
mov dword [esp + 0x69e], eax
mov word [esp + 0x6a2], ax
mov word [esp + 0x724], cx
call fcn.00415af0
add esp, 0xc
push 0x7e
lea ecx, [esp + 0x79e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x7a4], ax
call fcn.00415af0
add esp, 0xc
push 0x7e
lea eax, [esp + 0x69e]
xor edx, edx
push ebx
push eax
xor ebp, ebp
mov word [esp + 0x6a4], dx
call fcn.00415af0
add esp, 0xc
push 0x206
lea edx, [esp + 0xc2e]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], ebx
mov word [esp + 0xc34], cx
call fcn.00415af0
add esp, 0xc
xor eax, eax
mov word [esp + 0x658], ax
mov dword [esp + 0x65a], eax
mov dword [esp + 0x65e], eax
mov dword [esp + 0x662], eax
mov dword [esp + 0x666], eax
mov dword [esp + 0x66a], eax
push 0x206
lea edx, [esp + 0xa26]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x67a], eax
mov dword [esp + 0x67e], eax
mov word [esp + 0x682], ax
mov word [esp + 0xa2c], cx
call fcn.00415af0
add esp, 0xc
push 0x206
lea ecx, [esp + 0x103e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x1044], ax
call fcn.00415af0
add esp, 0xc
push 0x200
lea edx, [esp + 0x24]
push ebx
push edx
call fcn.00415af0
add esp, 0xc
push 1
lea edi, [esp + 0x24]
call fcn.004027f0
add esp, 4
mov esi, eax
push 0x104
lea eax, [esp + 0x1244]
push eax
push ebx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x818]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x42d6e0
lea edx, [esp + 0x81c]
push 0x104
push edx
call fcn.00413562
add esp, 0xc
lea eax, [esp + 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, ebx
je 0x401ebf
lea ecx, [esp + 0x818]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x1a8]
push edx
lea eax, [esp + 0x81c]
push 0x104
push eax
call fcn.00413562
add esp, 0xc
push 0x42d6f8
lea ecx, [esp + 0x81c]
push 0x104
push ecx
call fcn.00413562
add esp, 0xc
lea edx, [esp + 0x818]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x1c8]
push eax
lea ecx, [esp + 0x67c]
push 0x10
push ecx
call fcn.004135df
add esp, 0xc
lea edi, [esp + 0x818]
lea esi, [esp + 0x1c8]
call fcn.00402ab0
call fcn.00402b50
cmp eax, 1
jne 0x401d29
xor eax, eax
jmp 0x4024bf
xor eax, eax
jmp 0x401d30
movzx ecx, word [esp + eax + 0x1c8]
mov word [esp + eax + 0xa20], cx
add eax, 2
test cx, cx
jne 0x401d30
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x1c8]
mov word [esp + eax + 0x1038], cx
add eax, 2
test cx, cx
jne 0x401d50
lea eax, [esp + 0x1038]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401d72
mov edx, dword [0x42d704]
mov ecx, dword [0x42d708]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [eax], edx
mov edx, dword [0x42d70c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0xa20]
push eax
push 0
push 0x20000
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x401e15
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
lea ecx, [esp + 0x1038]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea edx, [esp + 0xa20]
push edx
xor esi, esi
push esi
push 0x20000
call ebp
test eax, eax
je 0x401e15
lea esp, [esp]
cmp esi, 5
jge 0x401e15
push eax
call edi
push 0x1f4
inc esi
call ebx
lea eax, [esp + 0xa20]
push eax
push 0
push 0x20000
call ebp
test eax, eax
jne 0x401df0
push 0x3e8
call ebx
lea ecx, [esp + 0x818]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x24]
mov word [esp + eax + 0x798], cx
add eax, 2
test cx, cx
jne 0x401e30
xor eax, eax
jmp 0x401e50
movzx ecx, word [esp + eax + 0xa6]
mov word [esp + eax + 0x718], cx
add eax, 2
test cx, cx
jne 0x401e50
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0xc6]
mov word [esp + eax + 0x698], cx
add eax, 2
test cx, cx
jne 0x401e70
movzx edx, word [esp + 0x146]
movzx ebp, word [esp + 0xa4]
mov ebx, dword [esp + 0x1e8]
lea eax, [esp + 0x1a8]
push eax
lea ecx, [esp + 0x65c]
push 0x10
push ecx
mov dword [esp + 0x24], edx
call fcn.004135df
jmp 0x401f60
push 0x236
lea edx, [esp + 0x224]
push 0
push edx
call fcn.00415af0
add esp, 0xc
lea esi, [esp + 0x220]
call fcn.00402cf0
mov dword [esp + 0x1c], eax
test eax, eax
je 0x401f63
xor eax, eax
movzx ecx, word [esp + eax + 0x32e]
mov word [esp + eax + 0x718], cx
add eax, 2
test cx, cx
jne 0x401ef0
movzx eax, word [esp + 0x324]
mov ecx, dword [esp + 0x326]
movzx ebp, word [esp + 0x32a]
lea esi, [esp + 0x798]
mov dword [esp + 0x18], eax
call fcn.00403110
mov ecx, dword [esp + 0x320]
lea esi, [esp + 0x698]
call fcn.00403110
lea ecx, [esp + 0x34e]
push ecx
lea edx, [esp + 0x67c]
push 0x10
push edx
call fcn.004135df
mov ebx, dword [esp + 0x234]
add esp, 0xc
push 0x200
lea eax, [esp + 0x45c]
push 0
push eax
call fcn.00415af0
add esp, 0xc
push 0
lea edi, [esp + 0x45c]
call fcn.004027f0
mov edi, eax
add esp, 4
test edi, edi
je 0x4020a2
xor eax, eax
jmp 0x401fa0
movzx ecx, word [eax + 0x42d710]
mov word [esp + eax + 0x698], cx
add eax, 2
test cx, cx
jne 0x401fa0
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x4de]
mov word [esp + eax + 0x718], cx
add eax, 2
test cx, cx
jne 0x401fc0
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x45c]
mov word [esp + eax + 0x798], cx
add eax, 2
test cx, cx
jne 0x401fe0
cmp dword [0x433f90], 3
movzx ebp, word [esp + 0x4dc]
movzx esi, word [esp + 0x57e]
mov ebx, 5
je 0x40202b
lea ecx, [esp + 0xc28]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x402058
push 0x104
lea edx, [esp + 0xc2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x42d89c
lea eax, [esp + 0xc2c]
push 0x104
push eax
call fcn.00413562
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0xc28]
mov word [esp + eax + 0xe30], cx
add eax, 2
test cx, cx
jne 0x402060
push 0x42d72c
lea ecx, [esp + 0xe34]
push 0x104
push ecx
call fcn.00413562
add esp, 0xc
lea edx, [esp + 0xe30]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4020a6
mov esi, dword [esp + 0x18]
push 0x200
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00415af0
mov ecx, 0x51
mov edx, 0x2b70
add esp, 0xc
mov dword [esp + 0x20], 0x504d534d
mov word [esp + 0xa4], cx
mov word [esp + 0x146], dx
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x42d744]
mov word [esp + eax + 0xc6], cx
add eax, 2
test cx, cx
jne 0x4020e0
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x42d760]
mov word [esp + eax + 0x24], cx
add eax, 2
test cx, cx
jne 0x402100
xor eax, eax
jmp 0x402120
movzx ecx, word [eax + 0x42d77c]
mov word [esp + eax + 0xa6], cx
add eax, 2
test cx, cx
jne 0x402120
cmp dword [esp + 0x14], 0
mov dword [esp + 0x1e8], 5
jne 0x402158
cmp dword [esp + 0x1c], 0
jne 0x402158
test edi, edi
je 0x4021c9
lea eax, [esp + 0x718]
push eax
lea ecx, [esp + 0xaa]
push 0x10
push ecx
call fcn.004135df
add esp, 0xc
lea edx, [esp + 0x798]
push edx
lea eax, [esp + 0x28]
push 0x40
push eax
call fcn.004135df
add esp, 0xc
lea ecx, [esp + 0x698]
push ecx
lea edx, [esp + 0xca]
push 0x40
push edx
call fcn.004135df
add esp, 0xc
mov word [esp + 0xa4], bp
mov word [esp + 0x146], si
mov dword [esp + 0x1e8], ebx
test ebx, ebx
jne 0x4021c9
mov dword [esp + 0x1e8], 5
mov edx, 0x42d788
lea ecx, [esp + 0x24]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4021f8
test ax, ax
je 0x4021f4
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4021f8
add ecx, 4
add edx, 4
test ax, ax
jne 0x4021d2
xor eax, eax
jmp 0x4021fd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40221b
cmp word [esp + 0xa4], 0x51
jne 0x40221b
mov eax, 0x2b8e
cmp word [esp + 0x146], ax
je 0x402274
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + 0x42d7a4]
mov word [esp + eax + 0xa6], cx
add eax, 2
test cx, cx
jne 0x402220
mov ecx, 0x51
mov edx, 0x2b8e
mov word [esp + 0xa4], cx
mov dword [esp + 0x1e8], 5
mov word [esp + 0x146], dx
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x42d7b0]
mov word [esp + eax + 0x24], cx
add eax, 2
test cx, cx
jne 0x402260
xor eax, eax
jmp 0x402280
movzx ecx, word [eax + 0x42d7cc]
mov word [esp + eax + 0xc6], cx
add eax, 2
test cx, cx
jne 0x402280
cmp word [esp + 0x24], cx
je 0x4024ba
cmp word [esp + 0xa4], cx
jbe 0x4024ba
mov dword [esp + 0x20], 0x504d534d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0041364e
add esp, 4
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x1452]
push ecx
mov word [esp + 0x1454], ax
call fcn.00415af0
lea eax, [esp + 0x664]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4022f1
sub eax, edx
sar eax, 1
je 0x402335
lea edx, [esp + 0x658]
push edx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x402335
lea eax, [esp + 0x658]
push eax
lea ecx, [esp + 0x1ac]
push 0x10
push ecx
call fcn.004135df
add esp, 0xc
cmp word [esp + 0x1a8], 0
jne 0x40236a
lea edx, [esp + 0x1448]
push edx
call fcn.00403190
add esp, 4
lea eax, [esp + 0x1448]
push eax
lea ecx, [esp + 0x1ac]
push 0x10
push ecx
call fcn.004135df
add esp, 0xc
cmp word [esp + 0x1c8], 0
jne 0x4023db
lea edx, [esp + 0x1448]
push edx
call fcn.00403190
add esp, 4
lea eax, [esp + 0x1448]
push eax
lea ecx, [esp + 0x1cc]
push 0x10
push ecx
call fcn.004135df
lea eax, [esp + 0x684]
add esp, 0xc
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4023b0
sub eax, edx
sar eax, 1
je 0x4023db
lea edx, [esp + 0x678]
push edx
lea eax, [esp + 0x1cc]
push 0x10
push eax
call fcn.004135df
add esp, 0xc
cmp dword [esp + 0x1e8], 0
mov dword [esp + 0x1ec], 0x100029b
jne 0x4023fb
mov dword [esp + 0x1e8], 5
lea ecx, [esp + 0x20]
push ecx
call fcn.004032c0
add esp, 4
test eax, eax
je 0x4024ba
lea edi, [esp + 0x818]
lea esi, [esp + 0x1c8]
call fcn.00402ab0
mov edx, edi
push edx
lea eax, [esp + 0x1244]
call fcn.00403450
add esp, 4
lea eax, [esp + 0x10]
push eax
push 3
push 0
push 0x42d7e8
push closesocket
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40249f
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402460
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x81c]
push edx
push 1
push 0
push 0x42d854
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40249f
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x42d85c
lea edx, [esp + 0x824]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
mov ecx, dword [esp + 0x1c4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413553
add esp, 0x1c44
ret