Function at 0x4014c5
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c4c
call fcn.00416330
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x206
xor esi, esi
push ebx
lea eax, [ebp - 0x3ce]
push esi
push eax
mov word [ebp - 0x3d0], si
call fcn.00408c40
add esp, 0xc
push ebx
lea eax, [ebp - 0xdf6]
push esi
push eax
mov word [ebp - 0xdf8], si
call fcn.00408c40
add esp, 0xc
push ebx
lea eax, [ebp - 0xbee]
push esi
push eax
mov word [ebp - 0xbf0], si
call fcn.00408c40
add esp, 0xc
push 7
pop ecx
xor eax, eax
mov word [ebp - 0x24], si
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
push 0x7e
stosw word es:[edi], ax
lea eax, [ebp - 0x146]
push esi
push eax
mov word [ebp - 0x148], si
call fcn.00408c40
add esp, 0xc
push 0x7e
lea eax, [ebp - 0xc6]
push esi
push eax
mov word [ebp - 0xc8], si
call fcn.00408c40
add esp, 0xc
push 0x7e
lea eax, [ebp - 0x1c6]
push esi
push eax
mov dword [ebp - 0x1c3c], esi
mov word [ebp - 0x1c8], si
call fcn.00408c40
add esp, 0xc
push ebx
lea eax, [ebp - 0x7de]
push esi
push eax
mov dword [ebp - 0x1c34], esi
mov word [ebp - 0x7e0], si
call fcn.00408c40
add esp, 0xc
push 7
pop ecx
xor eax, eax
mov word [ebp - 0x44], si
lea edi, [ebp - 0x42]
rep stosd dword es:[edi], eax
push 0x200
stosw word es:[edi], ax
lea eax, [ebp - 0x17f8]
push esi
push eax
mov dword [ebp - 0x1c38], esi
mov dword [ebp - 0x1c4c], esi
call fcn.00408c40
add esp, 0xc
push 1
lea edi, [ebp - 0x17f8]
call fcn.00408a72
pop ecx
push esi
lea edi, [ebp - 0x1c30]
mov dword [ebp - 0x1c44], eax
call fcn.00408a72
pop ecx
mov dword [ebp - 0x1c48], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0xdf8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x3d0]
push eax
push ebx
call edi
push 0x41dc44
lea eax, [ebp - 0x3d0]
push ebx
push eax
call fcn.00408d30
lea eax, [ebp - 0x3d0]
add esp, 0xc
push eax
call fcn.00409c28
test eax, eax
pop ecx
jbe 0x40166e
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40166e
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x1c44], esi
je 0x4018ac
lea eax, [ebp - 0x3d0]
push eax
push ebx
call edi
lea eax, [ebp - 0x1670]
push eax
lea eax, [ebp - 0x3d0]
push ebx
push eax
call fcn.00408d30
add esp, 0xc
mov edi, 0x41dc28
push edi
lea eax, [ebp - 0x3d0]
push ebx
push eax
call fcn.00408d30
lea eax, [ebp - 0x3d0]
add esp, 0xc
push eax
call fcn.00409c28
test eax, eax
pop ecx
jbe 0x401705
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401705
lea eax, [ebp - 0x1670]
push eax
lea eax, [ebp - 0x1a08]
push eax
call fcn.00408d14
push edi
lea eax, [ebp - 0x1a08]
push ebx
push eax
call fcn.00408d30
add esp, 0x14
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x1650]
push eax
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.00409115
add esp, 0xc
lea ebx, [ebp - 0x3d0]
lea edi, [ebp - 0x1650]
call fcn.00403032
mov ebx, edi
call fcn.0040137b
cmp eax, 1
jne 0x40173e
xor eax, eax
jmp 0x401d93
mov edi, 0x206
push edi
lea eax, [ebp - 0x5d6]
push esi
push eax
mov word [ebp - 0x5d8], si
call fcn.00408c40
add esp, 0xc
push edi
lea eax, [ebp - 0x9e6]
push esi
push eax
mov word [ebp - 0x9e8], si
call fcn.00408c40
add esp, 0xc
lea eax, [ebp - 0x1650]
push eax
lea eax, [ebp - 0x5d8]
push eax
call fcn.00408d14
lea eax, [ebp - 0x1650]
push eax
lea eax, [ebp - 0x9e8]
push eax
call fcn.00408d14
lea eax, [ebp - 0x9e8]
push 0x41dc1c
push eax
call fcn.00408cea
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
add esp, 0x18
lea eax, [ebp - 0x5d8]
push eax
push esi
mov ebx, 0x20000
push ebx
call edi
cmp eax, esi
je 0x401816
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x9e8]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x1c34], esi
jmp 0x401807
cmp dword [ebp - 0x1c34], 5
jge 0x401816
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x1c34]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x5d8]
push eax
push esi
push ebx
call edi
cmp eax, esi
jne 0x4017e6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x1772]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.00408d14
lea eax, [ebp - 0x17f4]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00408d14
movzx eax, word [ebp - 0x1774]
mov dword [ebp - 0x1c3c], eax
lea eax, [ebp - 0x1752]
push eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.00408d14
movzx eax, word [ebp - 0x16d2]
mov dword [ebp - 0x1c34], eax
mov eax, dword [ebp - 0x1630]
mov dword [ebp - 0x1c38], eax
lea eax, [ebp - 0x1670]
push eax
lea eax, [ebp - 0x44]
push 0x10
push eax
call fcn.00409115
add esp, 0x24
mov ebx, 0x104
jmp 0x401961
cmp dword [0x4230a0], 3
jne 0x401961
push 0x236
lea eax, [ebp - 0x1a30]
push esi
push eax
call fcn.00408c40
add esp, 0xc
lea edi, [ebp - 0x1a30]
call fcn.0040360b
cmp eax, esi
mov dword [ebp - 0x1c4c], eax
je 0x401961
lea eax, [ebp - 0x1922]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.00408d14
mov edx, dword [ebp - 0x192a]
lea esi, [ebp - 0xc8]
call fcn.00402da9
movzx eax, word [ebp - 0x1926]
mov edx, dword [ebp - 0x1930]
lea esi, [ebp - 0x1c8]
mov dword [ebp - 0x1c3c], eax
call fcn.00402da9
movzx eax, word [ebp - 0x192c]
mov dword [ebp - 0x1c34], eax
push 4
lea eax, [ebp - 0x1a28]
push eax
lea eax, [ebp - 0x1c38]
push eax
call fcn.00408db0
add esp, 0x14
lea eax, [ebp - 0x1902]
push eax
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.00409115
add esp, 0xc
xor esi, esi
cmp dword [ebp - 0x1c48], esi
mov edi, 0x41dc5c
je 0x401a37
lea eax, [ebp - 0x1baa]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.00408d14
lea eax, [ebp - 0x1c2c]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00408d14
movzx eax, word [ebp - 0x1bac]
mov dword [ebp - 0x1c3c], eax
lea eax, [ebp - 0x1c8]
push edi
push eax
call fcn.00408d14
movzx eax, word [ebp - 0x1b0a]
add esp, 0x18
cmp dword [0x4230a0], 3
mov dword [ebp - 0x1c34], eax
mov dword [ebp - 0x1c38], 5
lea eax, [ebp - 0x7e0]
je 0x4019e5
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x401a02
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dc18
lea eax, [ebp - 0x7e0]
push ebx
push eax
call fcn.00408d30
add esp, 0xc
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0xbf0]
push eax
call fcn.00408d14
push 0x41dc78
lea eax, [ebp - 0xbf0]
push ebx
push eax
call fcn.00408d30
add esp, 0x14
lea eax, [ebp - 0xbf0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
lea eax, [ebp - 0x17f8]
push esi
push eax
call fcn.00408c40
add esp, 0xc
lea eax, [ebp - 0x17f4]
push 0x41dc90
mov ebx, 0x504d534d
push eax
mov dword [ebp - 0x17f8], ebx
mov word [ebp - 0x1774], 0x51
call fcn.00408d14
lea eax, [ebp - 0x1752]
push edi
push eax
mov word [ebp - 0x16d2], 0x2b66
call fcn.00408d14
lea eax, [ebp - 0x1772]
push 0x41dcac
push eax
call fcn.00408d14
add esp, 0x18
cmp dword [ebp - 0x1c44], esi
mov dword [ebp - 0x1630], 5
jne 0x401ac1
cmp dword [ebp - 0x1c4c], esi
jne 0x401ac1
cmp dword [ebp - 0x1c48], esi
je 0x401b43
lea eax, [ebp - 0x148]
push eax
push 0x10
pop edi
lea eax, [ebp - 0x1772]
push edi
push eax
call fcn.00409115
add esp, 0xc
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x17f4]
push 0x40
push eax
call fcn.00409115
mov ax, word [ebp - 0x1c3c]
mov word [ebp - 0x1774], ax
add esp, 0xc
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x1752]
push 0x40
push eax
call fcn.00409115
mov ax, word [ebp - 0x1c34]
mov word [ebp - 0x16d2], ax
mov eax, dword [ebp - 0x1c38]
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x1630], eax
jne 0x401b46
mov dword [ebp - 0x1630], 5
jmp 0x401b46
push 0x10
pop edi
cmp word [ebp - 0x17f4], si
je 0x401d90
cmp word [ebp - 0x1774], si
jbe 0x401d90
mov dword [ebp - 0x17f8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00409c3e
mov dword [esp], 0x7fe
lea eax, [ebp - 0x15f6]
push esi
push eax
mov word [ebp - 0x15f8], si
call fcn.00408c40
add esp, 0xc
cmp word [ebp - 0x16d0], si
jne 0x401bbd
lea eax, [ebp - 0x15f8]
push eax
call fcn.004028ea
pop ecx
lea eax, [ebp - 0x15f8]
push eax
lea eax, [ebp - 0x16d0]
push edi
push eax
call fcn.00409115
add esp, 0xc
cmp word [ebp - 0x16b0], si
jne 0x401bea
lea eax, [ebp - 0x15f8]
push eax
call fcn.004028ea
pop ecx
lea eax, [ebp - 0x15f8]
push eax
lea eax, [ebp - 0x16b0]
push edi
push eax
call fcn.00409115
add esp, 0xc
cmp word [ebp - 0x1670], si
jne 0x401c17
lea eax, [ebp - 0x15f8]
push eax
call fcn.004028ea
pop ecx
lea eax, [ebp - 0x15f8]
push eax
lea eax, [ebp - 0x1670]
push edi
push eax
call fcn.00409115
add esp, 0xc
cmp word [ebp - 0x1650], si
jne 0x401c66
lea eax, [ebp - 0x15f8]
push eax
call fcn.004028ea
pop ecx
lea eax, [ebp - 0x15f8]
push eax
lea eax, [ebp - 0x1650]
push edi
push eax
call fcn.00409115
lea eax, [ebp - 0x24]
add esp, 0xc
push eax
call fcn.00409c28
test eax, eax
pop ecx
jbe 0x401c66
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1650]
push edi
push eax
call fcn.00409115
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
call fcn.00409c28
test eax, eax
pop ecx
je 0x401c88
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1690]
push edi
push eax
call fcn.00409115
add esp, 0xc
cmp word [ebp - 0x1690], si
jne 0x401cb5
lea eax, [ebp - 0x15f8]
push eax
call fcn.004028ea
pop ecx
lea eax, [ebp - 0x15f8]
push eax
lea eax, [ebp - 0x1690]
push edi
push eax
call fcn.00409115
add esp, 0xc
cmp dword [ebp - 0x1630], esi
mov dword [ebp - 0x162c], 0x1000206
jne 0x401cd1
mov dword [ebp - 0x1630], 5
lea eax, [ebp - 0x17f8]
push eax
call fcn.00408afc
test eax, eax
pop ecx
je 0x401d90
lea ebx, [ebp - 0x3d0]
lea edi, [ebp - 0x1650]
call fcn.00403032
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00409c3e
pop ecx
push 0x32
push 0x64
pop eax
call fcn.004028bc
pop ecx
mov ecx, ebx
push ecx
lea ecx, [ebp - 0xdf8]
push ecx
call fcn.00401414
pop ecx
pop ecx
lea eax, [ebp - 0x1c40]
push eax
push 3
push esi
push 0x41dcb8
push 0x80000001
mov dword [ebp - 0x1c40], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401d79
mov eax, ebx
push eax
call fcn.00409c28
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, ebx
push eax
push 1
push esi
push 0x41dd24
push dword [ebp - 0x1c40]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401d79
push dword [ebp - 0x1c40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push esi
push 0x41dd90
lea eax, [ebp - 0x3d0]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408c2e
leave
ret