Function at 0x403888
Capabilities:
Check os version
Delete file
Delete registry key
Delete registry value
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x74
push 0
push 0
dec ecx
jne 0x403890
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x404008
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
lea eax, [ebp - 0x14a]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov ebx, eax
lea edx, [ebp - 0x14a]
lea eax, [ebp - 0x247]
call fcn.0040382c
mov edx, 0x404018
lea eax, [ebp + ebx - 0x14a]
call fcn.0040382c
lea eax, [ebp - 0x14a]
call fcn.00403854
mov esi, eax
test esi, esi
jne 0x403fcd
mov edx, 0x404024
lea eax, [ebp + ebx - 0x247]
call fcn.0040382c
lea eax, [ebp - 0x247]
call fcn.00403854
mov esi, eax
test esi, esi
jne 0x403fcd
lea eax, [ebp - 0x24c]
mov edx, dword [0x4050bc]
call fcn.00402f54
mov edx, dword [ebp - 0x24c]
lea ecx, [ebp - 0x18]
mov eax, 0x80000002
call fcn.00403788
test eax, eax
je 0x403958
cmp eax, 5
jne 0x40394d
mov esi, dword [0x4050b4]
jmp 0x403fcd
mov esi, dword [0x4050b0]
jmp 0x403fcd
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
mov edx, 9
call fcn.004030c8
mov dword [ebp - 0x20], 1
xor eax, eax
mov dword [ebp - 0x24], eax
call sub.kernel32.dll_GetVersion
cmp eax, 0x80000000
jae 0x403cce
lea eax, [ebp - 0x250]
mov edx, dword [0x4050c0]
call fcn.00402f54
mov edx, dword [ebp - 0x250]
lea ecx, [ebp - 0x1c]
mov eax, 0x80000001
call fcn.00403788
test eax, eax
jne 0x403ba7
xor eax, eax
push ebp
push 0x403ba0
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x403aa7
cmp byte [ebp - 0x12], 0
jne 0x403aa4
lea eax, [ebp - 0x254]
mov edx, dword [0x4050c4]
call fcn.00402f54
lea eax, [ebp - 0x254]
mov edx, dword [ebp - 8]
call fcn.00402fd4
mov edx, dword [ebp - 0x254]
lea ecx, [ebp - 0x18]
mov eax, 0x80000002
call fcn.00403788
xor eax, eax
push ebp
push 0x403a9d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1e
lea ecx, [ebp - 0x4d]
mov edx, 0x40403c
mov eax, dword [ebp - 0x18]
call fcn.004037ac
lea eax, [ebp - 0x258]
lea edx, [ebp - 0x4d]
mov ecx, 0x21
call fcn.00402f90
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 4]
call fcn.0040374c
mov eax, dword [ebp - 4]
mov edx, 0x404050
call fcn.00403018
jne 0x403a86
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x12], 1
lea eax, [ebp - 0x358]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00402fa8
lea edx, [ebp - 0x358]
lea eax, [ebp - 0x11]
mov cl, 8
call fcn.004025b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403aa4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x20]
push 9
lea edx, [ebp - 0x35c]
mov eax, dword [ebp - 0x20]
call fcn.0040371c
mov eax, dword [ebp - 0x35c]
push eax
mov eax, dword [ebp - 8]
call fcn.004030bc
mov ecx, eax
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.004037ac
test al, al
jne 0x4039cd
cmp byte [ebp - 0x12], 0
je 0x403b89
mov eax, dword [ebp - 0x20]
dec eax
cmp eax, dword [ebp - 0x24]
jle 0x403b65
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub edx, 2
sub edx, eax
jl 0x403b65
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
push 9
lea edx, [ebp - 0x360]
mov eax, dword [ebp - 0x28]
inc eax
call fcn.0040371c
mov eax, dword [ebp - 0x360]
push eax
mov eax, dword [ebp - 8]
call fcn.004030bc
mov ecx, eax
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.004037ac
push 8
mov eax, dword [ebp - 8]
call fcn.004030bc
push eax
push 1
push 0
lea edx, [ebp - 0x364]
mov eax, dword [ebp - 0x28]
call fcn.0040371c
mov eax, dword [ebp - 0x364]
call fcn.004030bc
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExA
inc dword [ebp - 0x28]
dec dword [ebp - 0x2c]
jne 0x403b00
lea edx, [ebp - 0x368]
mov eax, dword [ebp - 0x20]
dec eax
call fcn.0040371c
mov eax, dword [ebp - 0x368]
call fcn.004030bc
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403eca
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov esi, dword [0x4050a4]
jmp 0x403fcd
xor eax, eax
push ebp
push 0x403cc7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x12], 0
jne 0x403cad
push 9
mov eax, dword [ebp - 8]
call fcn.004030bc
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004037ac
lea eax, [ebp - 0x36c]
mov edx, dword [0x4050c4]
call fcn.00402f54
lea eax, [ebp - 0x36c]
mov edx, dword [ebp - 8]
call fcn.00402fd4
mov edx, dword [ebp - 0x36c]
lea ecx, [ebp - 0x18]
mov eax, 0x80000002
call fcn.00403788
xor eax, eax
push ebp
push 0x403ca6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea ecx, [ebp - 0x4d]
mov edx, 0x40403c
mov eax, dword [ebp - 0x18]
call fcn.004037ac
lea eax, [ebp - 0x370]
lea edx, [ebp - 0x4d]
mov ecx, 0x21
call fcn.00402f90
mov eax, dword [ebp - 0x370]
lea edx, [ebp - 4]
call fcn.0040374c
mov eax, dword [ebp - 4]
mov edx, 0x404050
call fcn.00403018
jne 0x403c8f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x12], 1
lea eax, [ebp - 0x358]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.00402fa8
lea edx, [ebp - 0x358]
lea eax, [ebp - 0x11]
mov cl, 8
call fcn.004025b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403cad
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403cce
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
lea eax, [ebp - 0x374]
mov edx, dword [0x4050c0]
call fcn.00402f54
lea eax, [ebp - 0x374]
push eax
lea edx, [ebp - 0x378]
mov eax, dword [ebp - 0x20]
call fcn.0040371c
mov edx, dword [ebp - 0x378]
pop eax
call fcn.00402fd4
mov edx, dword [ebp - 0x374]
lea ecx, [ebp - 0x1c]
mov eax, 0x80000001
call fcn.00403788
test eax, eax
je 0x403bb2
cmp byte [ebp - 0x12], 0
je 0x403eca
mov eax, dword [ebp - 0x20]
dec eax
cmp eax, dword [ebp - 0x24]
jle 0x403e81
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
sub edx, 2
sub edx, eax
jl 0x403e81
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x37c]
mov edx, dword [0x4050c0]
call fcn.00402f54
lea eax, [ebp - 0x37c]
push eax
lea edx, [ebp - 0x380]
mov eax, dword [ebp - 0x28]
inc eax
call fcn.0040371c
mov edx, dword [ebp - 0x380]
pop eax
call fcn.00402fd4
mov edx, dword [ebp - 0x37c]
lea ecx, [ebp - 0x1c]
mov eax, 0x80000001
call fcn.00403788
xor eax, eax
push ebp
push 0x403dcb
push dword fs:[eax]
mov dword fs:[eax], esp
push 9
mov eax, dword [ebp - 8]
call fcn.004030bc
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004037ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403dd2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
lea eax, [ebp - 0x390]
mov edx, dword [0x4050c0]
call fcn.00402f54
lea eax, [ebp - 0x390]
push eax
lea edx, [ebp - 0x394]
mov eax, dword [ebp - 0x20]
dec eax
call fcn.0040371c
mov edx, dword [ebp - 0x394]
pop eax
call fcn.00402fd4
mov eax, dword [ebp - 0x390]
call fcn.004030bc
push eax
push 0x80000001
call sub.advapi32.dll_RegDeleteKeyA
cmp byte [ebp - 0x12], 0
je 0x403f9f
lea eax, [ebp - 0x39c]
lea edx, [ebp - 0x11]
call fcn.00402f84
mov eax, dword [ebp - 0x39c]
lea edx, [ebp - 0x398]
call fcn.0040374c
mov edx, dword [ebp - 0x398]
lea eax, [ebp - 0x358]
mov ecx, 0xff
call fcn.00402fa8
lea edx, [ebp - 0x358]
lea eax, [ebp - 0x11]
mov cl, 8
call fcn.004025b0
xor edx, edx
mov esi, 8
lea eax, [ebp - 0x10]
mov cl, byte [eax]
cmp cl, 0x30
jb 0x403f3a
cmp cl, 0x39
ja 0x403f3a
and ecx, 0xff
sub ecx, 0x30
jmp 0x403f46
and ecx, 0xff
sub ecx, 0x41
add ecx, 0xa
shl edx, 4
add ecx, edx
mov edx, ecx
inc eax
dec esi
jne 0x403f23
push edx
call sub.user32.dll_UnloadKeyboardLayout
lea eax, [ebp - 0x3a0]
mov edx, dword [0x4050c4]
call fcn.00402f54
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x3a4]
lea edx, [ebp - 0x11]
call fcn.00402f84
mov edx, dword [ebp - 0x3a4]
pop eax
call fcn.00402fd4
mov eax, dword [ebp - 0x3a0]
call fcn.004030bc
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x4050bc]
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 0x14a]
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x247]
push eax
call sub.kernel32.dll_DeleteFileA
mov esi, dword [0x4050ac]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40400f
lea eax, [ebp - 0x3a4]
mov edx, 0x13
call fcn.00402e84
lea eax, [ebp - 0x258]
mov edx, 4
call fcn.00402e84
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402e84
ret