Function at 0x4187e0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x1d6c
call fcn.00446f40
mov eax, dword [0x46a69c]
push esi
xor esi, esi
test eax, eax
jne 0x418814
mov eax, dword [0x46a680]
test eax, eax
jne 0x418814
mov eax, dword [0x46a6d4]
test eax, eax
je 0x41880f
push eax
call dword [0x4582cc]
mov esi, 1
push 0
push 0
call fcn.00418380
add esp, 8
test esi, esi
jne 0x418d22
push ebx
push ebp
lea eax, [esp + 0x26c]
push edi
push eax
push 0x208
call dword [0x4582b8]
mov ebx, dword [0x458270]
lea ecx, [esp + 0x270]
push str.DelUS.bat
push ecx
call ebx
push esi
push 0x8000080
push 2
push esi
push esi
lea edx, [esp + 0x284]
push 0x40000000
push edx
call fcn.00412e00
mov edi, dword [0x458468]
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x418911
lea eax, [esp + 0x270]
push 0x208
push eax
lea esi, [esp + 0x278]
call dword [0x4582e0]
mov al, byte [esp + 0x270]
test al, al
je 0x4188b2
push esi
call edi
mov esi, eax
cmp byte [esi], 0
jne 0x4188a8
lea ecx, [esp + 0x270]
push esi
push ecx
call dword [0x458420]
cmp byte [eax], 0x5c
je 0x4188d5
lea edx, [esp + 0x270]
push 0x45da58
push edx
call ebx
lea eax, [esp + 0x270]
push str.DelUS.bat
push eax
call ebx
push 0
push 0x8000080
push 2
push 0
push 0
lea ecx, [esp + 0x284]
push 0x40000000
push ecx
call fcn.00412e00
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x418d12
lea edx, [esp + 0x68]
push 0x104
push edx
push 0
call fcn.004132f0
mov ecx, dword [0x46a6d4]
lea eax, [esp + 0x588]
push 0xc00
push eax
push 0x16f
push ecx
call fcn.0040b8a0
mov eax, dword [0x46a69c]
add esp, 0x1c
test eax, eax
jne 0x418973
lea edx, [esp + 0x68]
push edx
call fcn.0040a630
add esp, 4
push eax
call edi
push eax
lea eax, [esp + 0x580]
push eax
call dword [0x4582f8]
test eax, eax
je 0x418973
xor edi, edi
jmp 0x418978
mov edi, 1
lea ecx, [esp + 0x16c]
push 0x104
lea edx, [esp + 0x6c]
push ecx
push edx
call fcn.0040da60
mov ebp, dword [0x458470]
add esp, 0xc
lea eax, [esp + 0x57c]
push str._echo_off_r_n_cd__r_n
push eax
call ebp
add esp, 8
test edi, edi
mov edi, dword [0x458284]
je 0x418af8
lea ecx, [esp + 0x16c]
lea edx, [esp + 0x16c]
push ecx
push edx
lea eax, [esp + 0x584]
push str.:Repeat1_r_n_del___s__r_n_if_exist___s__goto_Repeat1_r_n
push eax
call edi
lea ecx, [esp + eax + 0x588]
push ecx
call ebp
mov eax, dword [0x46a6d4]
add esp, 0x10
test eax, eax
je 0x418a5c
lea edx, [esp + 0x68]
push 0x104
push edx
push eax
call fcn.004132f0
mov eax, dword [0x46a6d4]
add esp, 0xc
push eax
call dword [0x4582cc]
lea ecx, [esp + 0x16c]
push 0x104
lea edx, [esp + 0x6c]
push ecx
push edx
mov dword [0x46a6d4], 0
call fcn.0040da60
add esp, 0xc
lea eax, [esp + 0x16c]
lea ecx, [esp + 0x16c]
lea edx, [esp + 0x57c]
push eax
push ecx
push str.:Repeat2_r_n_del___s__r_n_if_exist___s__goto_Repeat2_r_n
push edx
call edi
lea eax, [esp + eax + 0x588]
push eax
call ebp
add esp, 0x10
mov eax, dword [0x46a680]
test eax, eax
je 0x418af8
lea ecx, [esp + 0x68]
push 0x104
push ecx
push 0
call fcn.004132f0
lea edx, [esp + 0x74]
push edx
call fcn.0040a630
mov byte [eax], 0
lea eax, [esp + 0x78]
push eax
call fcn.0040a630
add esp, 0x14
test eax, eax
je 0x418af8
lea ecx, [esp + 0x16c]
push 0x104
lea edx, [esp + 0x6c]
push ecx
push edx
call fcn.0040da60
add esp, 0xc
lea eax, [esp + 0x16c]
lea ecx, [esp + 0x57c]
push eax
push str._rmdir___s__r_n
push ecx
call edi
lea edx, [esp + eax + 0x584]
push edx
call ebp
lea eax, [esp + 0x74]
push eax
call fcn.0040a630
add esp, 0x10
test eax, eax
je 0x418af8
lea ecx, [esp + 0x68]
mov byte [eax], 0
push ecx
call fcn.0040a630
add esp, 4
test eax, eax
jne 0x418a98
lea edx, [esp + 0x16c]
push 0x104
lea eax, [esp + 0x274]
push edx
push eax
call fcn.0040da60
add esp, 0xc
lea ecx, [esp + 0x16c]
lea edx, [esp + 0x57c]
push ecx
push str._del___s_
push edx
call edi
lea eax, [esp + eax + 0x584]
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x117c]
lea edx, [esp + 0x57c]
push ecx
push edx
call dword [0x4583f0]
lea eax, [esp + 0x20]
push 0
lea ecx, [esp + 0x1180]
push eax
push ecx
call edi
lea edx, [esp + 0x1184]
push eax
push edx
push esi
call fcn.00412f40
add esp, 0x14
push esi
call dword [0x458184]
mov ebp, dword [0x4582b4]
push esi
call ebp
lea eax, [esp + 0x57c]
push 0xc00
push eax
push str.COMSPEC
call dword [0x458308]
test eax, eax
je 0x418c42
mov al, byte [0x46a6e0]
mov edi, dword [0x4582e4]
test al, 3
je 0x418c0f
lea ecx, [esp + 0x57c]
push ecx
call fcn.0040a630
mov esi, eax
add esp, 4
test esi, esi
je 0x418c0f
lea edx, [esp + 0x57c]
lea eax, [esp + 0x478]
push edx
push eax
mov byte [esi], 0
call edi
lea ecx, [esp + 0x57c]
push 0x45d5b8
push ecx
mov byte [esi], 0x5c
call ebx
lea edx, [esp + 0x478]
lea eax, [esp + 0x57c]
push edx
push eax
call ebx
lea ecx, [esp + 0x57c]
push str._nul
push ecx
call ebx
lea edx, [esp + 0x57c]
push str.__C
push edx
call ebx
lea eax, [esp + 0x270]
lea ecx, [esp + 0x57c]
push eax
push ecx
call ebx
lea edx, [esp + 0x57c]
lea eax, [esp + 0x270]
push edx
push eax
call edi
mov eax, dword [esp + 0x1d80]
test eax, eax
je 0x418c6e
lea ecx, [esp + 0x270]
push 1
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEBUSetup
push 0x80000002
call fcn.00419340
add esp, 0x10
jmp 0x418d12
lea edx, [esp + 0x68]
push 0x104
push edx
call dword [0x4582e0]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x68]
rep stosd dword es:[edi], eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push edx
push 0
push 0x2c
push 0
push 0
lea eax, [esp + 0x28c]
push 0
push eax
push 0
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
call dword [0x4580d8]
test eax, eax
je 0x418d12
mov ecx, dword [esp + 0x14]
mov esi, dword [0x45817c]
push 0xffffffffffffffff
push ecx
call esi
push 0xf
call dword [0x458178]
push eax
call esi
push 0x80
call dword [0x4580fc]
push eax
call dword [0x458174]
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
call dword [0x458170]
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea edx, [esp + 0x68]
push edx
call fcn.00413380
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x1d6c
ret 4