Function at 0x410770
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4550fa
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x2b
xor eax, eax
push str.Tief_s
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
call fcn.00406c00
mov dword [ebp - 4], 0
push 0x19
xor eax, eax
push 0x45ff50
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x2dc], 7
mov dword [ebp - 0x2e0], 0
mov word [ebp - 0x2f0], ax
call fcn.00406c00
mov byte [ebp - 4], 1
push 0x2a
xor eax, eax
push str.Mas_rec
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 0x2c4], 7
mov dword [ebp - 0x2c8], 0
mov word [ebp - 0x2d8], ax
call fcn.00406c00
mov byte [ebp - 4], 2
push 0x35
xor eax, eax
push str.Nettoyer_en_profondeur_votre_ordinateur
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 0x2ac], 7
mov dword [ebp - 0x2b0], 0
mov word [ebp - 0x2c0], ax
call fcn.00406c00
mov byte [ebp - 4], 3
push 0x27
xor eax, eax
push str.Profondo_pulire_il_computer_nel_cestino
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 0x294], 7
mov dword [ebp - 0x298], 0
mov word [ebp - 0x2a8], ax
call fcn.00406c00
mov byte [ebp - 4], 4
push 0x20
xor eax, eax
push 0x4600a0
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x27c], 7
mov dword [ebp - 0x280], 0
mov word [ebp - 0x290], ax
call fcn.00406c00
mov byte [ebp - 4], 5
push 0x2b
xor eax, eax
push str.Profundamente_limpar_seu_computador_no_lixo
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x264], 7
mov dword [ebp - 0x268], 0
mov word [ebp - 0x278], ax
call fcn.00406c00
mov byte [ebp - 4], 6
push 0x20
xor eax, eax
push str.Derin
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
call fcn.00406c00
mov byte [ebp - 4], 7
mov dword [ebp - 0x234], 7
push 0xa
xor eax, eax
push 0x460184
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.00406c00
mov byte [ebp - 4], 8
push 0xa
xor eax, eax
push 0x46019c
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00406c00
xor eax, eax
push 0x206
mov dword [ebp - 4], 9
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x354], 7
mov dword [ebp - 0x358], 0
mov word [ebp - 0x368], ax
cmp word [ebp - 0x218], ax
jne 0x4109fd
xor ecx, ecx
jmp 0x410a15
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410a06
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x368]
call fcn.00406c00
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu
lea edx, [ebp - 0x368]
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 0xa
call fcn.00411660
add esp, 4
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x354], 8
mov edi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
jb 0x410a63
push dword [ebp - 0x368]
call edi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x324], 8
mov word [ebp - 0x368], ax
lea eax, [ebp - 0x338]
cmovae eax, dword [ebp - 0x338]
push eax
mov dword [ebp - 0x354], 7
mov dword [ebp - 0x358], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410b89
lea esi, [ebp - 0x308]
mov ebx, 0xa
mov edi, edi
push str..lnk
mov edx, esi
lea ecx, [ebp - 0x350]
call fcn.00411480
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x33c], 8
lea eax, [ebp - 0x350]
cmovae eax, dword [ebp - 0x350]
push eax
lea edx, [ebp - 0x338]
lea ecx, [ebp - 0x320]
call fcn.0042d4a0
add esp, 8
cmp dword [ebp - 0x30c], 8
lea eax, [ebp - 0x320]
cmovae eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410b36
cmp dword [ebp - 0x30c], 8
push 0
push 0
push 0
lea eax, [ebp - 0x320]
cmovae eax, dword [ebp - 0x320]
push eax
push str.startunpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x30c], 8
jb 0x410b4a
push dword [ebp - 0x320]
call edi
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x33c], 8
mov dword [ebp - 0x30c], 7
mov dword [ebp - 0x310], 0
mov word [ebp - 0x320], ax
jb 0x410b7f
push dword [ebp - 0x350]
call edi
add esp, 4
add esi, 0x18
dec ebx
jne 0x410ab0
cmp dword [ebp - 0x324], 8
jb 0x410b9d
push dword [ebp - 0x338]
call edi
add esp, 4
push fcn.00401100
xor eax, eax
push 0xa
mov word [ebp - 0x338], ax
push 0x18
lea eax, [ebp - 0x308]
push eax
mov dword [ebp - 0x324], 7
mov dword [ebp - 0x328], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004521cc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00452076
mov esp, ebp
pop ebp
ret