Function at 0x4067a0
Capabilities:
Check if file exists
Delete file
Delete registry key
Delete registry value
Get common file path
Get program files directory
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x44f343
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x4655f0]
xor eax, esp
mov dword [esp + 0x284], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4655f0]
xor eax, esp
push eax
lea eax, [esp + 0x29c]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [esp + 0x199]
push ebx
push eax
mov byte [esp + 0x1a0], bl
call fcn.0043b390
add esp, 0xc
push ebx
push 0x26
lea ecx, [esp + 0x19c]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [esp + 0x194]
push 0x456f6e
push edx
call fcn.004369f3
add esp, 8
test eax, eax
jne 0x40683f
push str.C:Program_Files
lea eax, [esp + 0x198]
push 0x104
push eax
call fcn.00437c78
add esp, 0xc
lea ecx, [esp + 0x194]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004017a0
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x2a8], ebx
call fcn.00406d30
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [esp + 0x90]
push eax
push ebx
push ebx
push 0x17
push ebx
call ebp
test eax, eax
mov esi, 0x10
jne 0x406b13
mov edi, 0xf
lea eax, [esp + 0x90]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4068a4
sub eax, edx
push eax
lea ecx, [esp + 0x94]
push ecx
lea ecx, [esp + 0x7c]
call fcn.004071b0
push 8
push 0x457984
lea eax, [esp + 0x7c]
mov byte [esp + 0x2ac], 1
call fcn.004070c0
lea eax, [esp + 0x90]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4068f0
sub eax, edx
push eax
lea edx, [esp + 0x94]
push edx
lea ecx, [esp + 0x28]
call fcn.004071b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x5c]
push ecx
mov edi, 0x4578ac
mov byte [esp + 0x2ac], 2
call fcn.004075f0
add esp, 8
mov byte [esp + 0x2a4], 4
cmp dword [esp + 0x38], esi
jb 0x406947
mov edx, dword [esp + 0x24]
push edx
call fcn.004181cf
add esp, 4
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
jae 0x406965
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x406985
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x40697e
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
mov edi, 0x457990
call fcn.004075f0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x2b0], 5
call fcn.00406fe0
mov byte [esp + 0x2a4], 4
cmp dword [esp + 0x54], esi
jb 0x4069cc
mov edx, dword [esp + 0x40]
push edx
call fcn.004181cf
add esp, 4
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x4069da
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4069fa
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x4069f3
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
mov edi, 0x4579a4
call fcn.004075f0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x2b0], 6
call fcn.00406fe0
mov byte [esp + 0x2a4], 4
cmp dword [esp + 0x54], esi
jb 0x406a41
mov edx, dword [esp + 0x40]
push edx
call fcn.004181cf
add esp, 4
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x406a4f
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x406a6f
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x406a68
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
mov edi, 0x4579d0
call fcn.004075f0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x2b0], 7
call fcn.00406fe0
mov byte [esp + 0x2a4], 4
cmp dword [esp + 0x54], esi
jb 0x406ab6
mov edx, dword [esp + 0x40]
push edx
call fcn.004181cf
add esp, 4
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x406ac4
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov byte [esp + 0x2a4], 1
cmp dword [esp + 0x70], esi
jb 0x406ae6
mov eax, dword [esp + 0x5c]
push eax
call fcn.004181cf
add esp, 4
mov byte [esp + 0x2a4], bl
cmp dword [esp + 0x8c], esi
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
jb 0x406b13
mov ecx, dword [esp + 0x78]
push ecx
call fcn.004181cf
add esp, 4
lea edx, [esp + 0x90]
push edx
push ebx
push ebx
push ebx
push ebx
call ebp
test eax, eax
jne 0x406c15
lea eax, [esp + 0x90]
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x406b50
sub eax, edx
push eax
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x7c]
call fcn.004071b0
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x5c]
push edx
mov edi, 0x4578ac
mov byte [esp + 0x2ac], 8
call fcn.004075f0
add esp, 8
mov byte [esp + 0x2a4], 0xa
cmp dword [esp + 0x8c], esi
jb 0x406baa
mov eax, dword [esp + 0x78]
push eax
call fcn.004181cf
add esp, 4
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
mov edi, 0xf
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
jae 0x406bcf
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x406bef
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x406be8
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [esp + 0x2a4], bl
cmp dword [esp + 0x70], esi
jb 0x406c09
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.004181cf
add esp, 4
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x406c5d
mov ecx, dword [esp + 0x14]
push str.FileHamBrowser
push ecx
call edi
mov edx, dword [esp + 0x14]
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
jne 0x406c93
mov edx, dword [esp + 0x14]
push str.FileHamBrowser
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call ebp
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [esp + 0x2a4], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406cce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x29c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x284]
xor ecx, esp
call fcn.00437030
add esp, 0x294
ret