Function at 0x4013c0
Capabilities:
Create process on windows
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x7f0]
sub esp, 0x7f0
push 0xffffffffffffffff
push 0x40c088
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x410090]
xor eax, ebp
mov dword [ebp + 0x7ec], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x103
lea eax, [ebp + 0x465]
push ebx
mov dword [ebp - 4], ebx
push eax
mov byte [ebp + 0x464], bl
call fcn.00403040
add esp, 0xc
push 0x104
lea ecx, [ebp + 0x464]
push ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp + 0x464]
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401445
sub eax, edx
push eax
lea edx, [ebp + 0x464]
push edx
lea ecx, [ebp]
call fcn.00401a50
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea edi, [ebp]
mov byte [ebp - 0x14], 0x5c
call fcn.00401960
lea ecx, [eax + 1]
lea esi, [ebp + 0x38]
mov edx, edi
call fcn.00401850
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00401880
mov byte [ebp - 4], 1
cmp dword [ebp + 0x50], 0x10
jb 0x4014a4
mov ecx, dword [ebp + 0x3c]
push ecx
call fcn.0040240a
add esp, 4
lea edx, [ebp]
push edx
mov edi, str.autorun.inf
lea esi, [ebp + 0x1c]
call fcn.00401d90
add esp, 4
push 0x7f
lea eax, [ebp + 0x76d]
push ebx
mov byte [ebp - 4], 3
push eax
mov byte [ebp + 0x76c], bl
call fcn.00403040
push 0x103
lea ecx, [ebp + 0x569]
push ebx
push ecx
mov byte [ebp + 0x568], bl
call fcn.00403040
mov eax, dword [ebp + 0x20]
mov esi, 0x10
add esp, 0x18
cmp dword [ebp + 0x34], esi
jae 0x4014fc
lea eax, [ebp + 0x20]
mov edi, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push eax
push 0x80
lea edx, [ebp + 0x76c]
push edx
push 0x40ebe8
push str.Version
push str.autorun
call edi
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x34], esi
jae 0x40152b
lea eax, [ebp + 0x20]
push eax
push 0x104
lea eax, [ebp + 0x568]
push eax
push 0x40ebe8
push str.PCODE
push str.autorun
call edi
push 0x40f
lea ecx, [ebp + 0x55]
push ebx
mov esi, 1
push ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp + 0x54], bl
call fcn.00403040
add esp, 0xc
call fcn.004010c0
cmp eax, ebx
je 0x40159f
cmp byte [ebp + 0x568], bl
je 0x4015de
lea edx, [ebp + 0x568]
push edx
lea eax, [ebp + 0x54]
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallHaitai_s
push eax
call fcn.004025e1
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
push 0x20219
push ebx
lea edx, [ebp + 0x54]
push edx
jmp 0x4015cd
cmp byte [ebp + 0x568], bl
je 0x4015de
lea eax, [ebp + 0x568]
push eax
lea ecx, [ebp + 0x54]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHaitai_s
push ecx
call fcn.004025e1
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
push 0x20019
push ebx
lea eax, [ebp + 0x54]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x4015de
xor esi, esi
push 0x7f
lea ecx, [ebp + 0x66d]
push ebx
push ecx
mov dword [ebp - 0x20], 0x80
mov byte [ebp + 0x66c], bl
call fcn.00403040
add esp, 0xc
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x18]
lea eax, [ebp + 0x66c]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push str.DisplayVersion
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x401622
xor esi, esi
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp + 0x66c]
lea ecx, [ebp + 0x76c]
call fcn.00401130
cmp eax, 1
je 0x401646
cmp eax, ebx
jne 0x40164a
xor eax, eax
jmp 0x40164d
mov eax, dword [ebp - 0x1c]
cmp esi, ebx
je 0x401659
cmp eax, ebx
je 0x40174e
push 0x7f
lea ecx, [ebp + 0x6ed]
push ebx
push ecx
mov byte [ebp + 0x6ec], bl
call fcn.00403040
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [ebp + 0x34], 0x10
jae 0x40167d
lea eax, [ebp + 0x20]
push eax
push 0x80
lea edx, [ebp + 0x6ec]
push edx
push 0x40ebe8
push str.InstallFile
push str.autorun
call edi
lea eax, [ebp]
push eax
lea edi, [ebp + 0x6ec]
lea esi, [ebp + 0x38]
call fcn.00401d90
mov esi, dword [ebp + 0x3c]
mov edi, 0x10
add esp, 4
cmp dword [ebp + 0x50], edi
jae 0x4016c0
lea esi, [ebp + 0x3c]
call section..text
test eax, eax
jne 0x401701
cmp dword [ebp + 0x50], edi
jb 0x4016da
mov ecx, dword [ebp + 0x3c]
push ecx
call fcn.0040240a
add esp, 4
mov esi, 0xf
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x4c], ebx
mov byte [ebp + 0x3c], bl
cmp dword [ebp + 0x34], edi
jb 0x4016f9
mov edx, dword [ebp + 0x20]
push edx
call fcn.0040240a
add esp, 4
cmp dword [ebp + 0x18], edi
mov dword [ebp + 0x34], esi
jmp 0x40176e
mov eax, dword [ebp + 0x3c]
cmp dword [ebp + 0x50], edi
jae 0x40170c
lea eax, [ebp + 0x3c]
push eax
call fcn.00402060
test eax, eax
jne 0x40173d
mov ecx, dword [ebp + 4]
cmp dword [ebp + 0x18], edi
jae 0x401721
lea ecx, [ebp + 4]
mov eax, dword [ebp + 0x3c]
cmp dword [ebp + 0x50], edi
jae 0x40172c
lea eax, [ebp + 0x3c]
push 5
push ecx
push 0x40ebe8
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp + 0x50], edi
jb 0x40174e
mov ecx, dword [ebp + 0x3c]
push ecx
call fcn.0040240a
add esp, 4
mov esi, 0x10
cmp dword [ebp + 0x34], esi
jb 0x401764
mov edx, dword [ebp + 0x20]
push edx
call fcn.0040240a
add esp, 4
cmp dword [ebp + 0x18], esi
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], bl
mov dword [ebp + 0x30], ebx
jb 0x401782
mov eax, dword [ebp + 4]
push eax
call fcn.0040240a
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7ec]
xor ecx, ebp
call fcn.004022d9
add ebp, 0x7f0
mov esp, ebp
pop ebp
ret