Function at 0x414a7c
Capabilities:
Create directory
Delete file
Delete registry key
Get common file path
Set registry value

Disassembly:
sub esp, 0x314
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push eax
call fcn.004b4a31
lea esi, [esp + 0x20]
mov edx, 0x4c946479
push 0x774eaf7c
mov ecx, 0x26c278d5
add esi, eax
call fcn.00401513
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x414ac2
lea eax, [esp + 0x10]
xor edi, edi
push eax
push 0x2000e
push edi
lea eax, [esp + 0x24]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop ebx
test eax, eax
jne 0x414bf9
push 0x4e8940
push 0xa78e7a0c
mov edx, 0x9c54b104
mov ecx, 0xf602adb4
call fcn.00401534
pop ecx
push eax
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x220]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x10]
call ebp
push 0x104
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x18]
push 0x5c
push eax
call fcn.004b3fe0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x414bf9
push 0xefcbbbc6
mov edx, 0xd41170c4
mov ecx, 0xbe476c44
add esi, ebx
call fcn.00401534
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x414b82
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x18]
push eax
call edi
push 0xa273b9d1
mov edx, 0x99a972d3
mov ecx, 0xf3ff6eb7
call fcn.00401534
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x414bb6
lea eax, [esp + 0x18]
push eax
call edi
push 0x9c98d0ec
mov edx, 0xa7421bee
mov ecx, 0xcd140796
call fcn.00401534
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, ebx
test cx, cx
jne 0x414be2
lea eax, [esp + 0x18]
push eax
call edi
xor edi, edi
xor ecx, ecx
inc ecx
call fcn.00414060
lea eax, [esp + 0x10]
push eax
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x414c26
push dword [esp + 0x10]
call ebp
jmp 0x414e82
call fcn.0041c364
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x1a
push edi
call ebx
test eax, eax
jne 0x414c9f
push 0xdf7ec19b
mov edx, 0xe4a40a84
mov ecx, 0x8ef216d8
call fcn.00401534
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x414c5a
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x414c70
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00419cdb
xor edi, edi
pop ecx
cmp al, 1
je 0x414df5
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x23
push edi
call ebx
test eax, eax
jne 0x414d0d
push 0xb648aceb
mov edx, 0x8d9267f4
mov ecx, 0xe7c47bca
call fcn.00401534
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x414cc8
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x414cde
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00419cdb
xor edi, edi
pop ecx
cmp al, 1
je 0x414df5
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 0x23
push edi
call ebx
test eax, eax
jne 0x414df5
push 0x1d2666f5
mov edx, 0x26fcadfd
mov ecx, 0x4caab1e5
call fcn.00401534
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x414d3a
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
xor ebx, ebx
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x414d50
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x3286e900
mov edx, 0x95c2205
mov ecx, 0x630a3fed
call fcn.00401534
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x414d8f
lea edi, [esp + 0x18]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x414da3
mov ecx, edx
lea eax, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00419cdb
xor edi, edi
pop ecx
test al, al
jne 0x414df5
push edi
push 0x80
push 1
push edi
push 2
push 0x40000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x414df5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x414e50
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0xe8fd36e8
mov ecx, 0x82ab2b2e
lea eax, [eax*2 + 2]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push edi
push 0xd327fde1
call fcn.00401534
pop ecx
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x14]
call ebp
push edi
push 0x4e8ae8
push 0x33b55b11
mov edx, 0x86f900a
mov ecx, 0x62398dde
call fcn.00401513
pop ecx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004b4a31
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.0040329c
mov ecx, dword [esp + 0x320]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x314
ret