Function at 0x4159f0
Capabilities:
Check if file exists
Delete file
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6377fe
mov eax, dword fs:[0]
push eax
sub esp, 0x580
mov eax, dword [0x6e606c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4f0]
call fcn.00404d10
mov ecx, dword [ebp - 0x4f0]
call fcn.00416600
lea ecx, [ebp - 0x58]
push ecx
call fcn.00411040
mov ecx, eax
call fcn.004ca179
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00402ac0
test eax, eax
jbe 0x415b85
call fcn.004c6c27
movzx edx, al
test edx, edx
jne 0x415a78
jmp 0x415b53
call fcn.00413740
test eax, eax
je 0x415a96
push 4
call fcn.00413740
mov ecx, eax
call fcn.004111a0
movzx eax, al
test eax, eax
jne 0x415a9b
jmp 0x415b53
lea ecx, [ebp - 0x58]
call fcn.004095f0
mov dword [ebp - 0x51c], eax
push str.1284
call fcn.004c6a16
add esp, 4
mov dword [ebp - 0x524], eax
push 0x6ca700
call fcn.004c6a16
add esp, 4
mov dword [ebp - 0x528], eax
push 0
push 0
push 0x6bc9b7
push 0x2b
push 0x6ca6d8
push 4
lea ecx, [ebp - 0x3c8]
call fcn.0040fe90
mov dword [ebp - 0x520], eax
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0x52c], ecx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x51c]
push edx
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x528]
push ecx
mov ecx, dword [ebp - 0x52c]
call fcn.00402110
mov ecx, eax
call fcn.00413750
mov ecx, eax
call fcn.00413750
mov ecx, eax
call fcn.00413750
push eax
call fcn.00413740
mov ecx, eax
call fcn.00411130
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c8]
call fcn.00410180
lea ecx, [ebp - 0x4f1]
call fcn.004c8a9d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.004095f0
push eax
lea ecx, [ebp - 0x4f1]
call fcn.004c925e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4f1]
call fcn.00425e50
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x568], esp
push 0x6ca6c4
call fcn.0040e100
push reloc.gdiplus.dll_Ordinal_1
mov ecx, dword [ebp - 0x4f0]
call fcn.004167f0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x564], esp
push 0x6ca730
call fcn.0040e100
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x4f0]
call fcn.004167f0
lea ecx, [ebp - 0x4ea]
call fcn.004c8a9d
mov byte [ebp - 4], 4
push 0x6ca744
lea ecx, [ebp - 0x4ea]
call fcn.004ca46d
push 0x6ca70c
lea ecx, [ebp - 0x4ea]
call fcn.004ca46d
push 0x6ca720
lea ecx, [ebp - 0x4ea]
call fcn.004ca560
lea ecx, [ebp - 0x70]
call fcn.00404dd0
mov byte [ebp - 4], 5
lea edx, [ebp - 0xa0]
push edx
call fcn.004c9430
add esp, 4
mov byte [ebp - 4], 6
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea ecx, [ebp - 0xa0]
call fcn.0040e2a0
push str.Desktop
lea ecx, [ebp - 0xa0]
call fcn.004095f0
push eax
push reloc.WS2_32.dll_closesocket
lea eax, [ebp - 0x88]
push eax
call fcn.004c43c0
add esp, 0x10
mov byte [ebp - 4], 7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x6ca754
call fcn.0040e100
lea ecx, [ebp - 0x88]
push ecx
call fcn.004c2e85
add esp, 0x1c
push 0x6ca758
lea ecx, [ebp - 0x88]
call fcn.004095f0
push eax
push str._s_s.lnk
lea edx, [ebp - 0xe8]
push edx
call fcn.004c2ff5
add esp, 0x10
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040e070
lea ecx, [ebp - 0xe8]
call fcn.00404d80
lea ecx, [ebp - 0x70]
call fcn.004095f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415cf1
lea ecx, [ebp - 0x70]
call fcn.004095f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040e170
mov byte [ebp - 4], 8
push 0x6ca83c
lea ecx, [ebp - 0x28]
call fcn.0040e2a0
lea ecx, [ebp - 0x28]
call fcn.004095f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415e27
call fcn.004c6c27
movzx edx, al
test edx, edx
jne 0x415d36
jmp 0x415df5
call fcn.00413740
test eax, eax
je 0x415d54
push 4
call fcn.00413740
mov ecx, eax
call fcn.004111a0
movzx eax, al
test eax, eax
jne 0x415d59
jmp 0x415df5
push str.1286
call fcn.004c6a16
add esp, 4
mov dword [ebp - 0x538], eax
push 0x6ca880
call fcn.004c6a16
add esp, 4
mov dword [ebp - 0x4fc], eax
push 0
push 0
push 0x6bc9be
push 0x4e
push 0x6ca800
push 4
lea ecx, [ebp - 0x4e8]
call fcn.0040fe90
mov dword [ebp - 0x534], eax
mov ecx, dword [ebp - 0x534]
mov dword [ebp - 0x500], ecx
mov byte [ebp - 4], 9
lea edx, [ebp - 0x538]
push edx
lea eax, [ebp - 0x4fc]
push eax
mov ecx, dword [ebp - 0x500]
call fcn.00402110
mov ecx, eax
call fcn.00413750
mov ecx, eax
call fcn.00413750
push eax
call fcn.00413740
mov ecx, eax
call fcn.00411130
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4e8]
call fcn.00410180
lea ecx, [ebp - 0x4f2]
call fcn.004c8a9d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
call fcn.004095f0
push eax
lea ecx, [ebp - 0x4f2]
call fcn.004cae88
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4f2]
call fcn.00425e50
lea ecx, [ebp + 8]
call fcn.00402ac0
test eax, eax
jbe 0x415ffc
lea ecx, [ebp + 8]
call fcn.004095f0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415ffc
call fcn.004c6c27
movzx ecx, al
test ecx, ecx
jne 0x415e5f
jmp 0x415f1e
call fcn.00413740
test eax, eax
je 0x415e7d
push 4
call fcn.00413740
mov ecx, eax
call fcn.004111a0
movzx edx, al
test edx, edx
jne 0x415e82
jmp 0x415f1e
push str.1285
call fcn.004c6a16
add esp, 4
mov dword [ebp - 0x508], eax
push str.1283
call fcn.004c6a16
add esp, 4
mov dword [ebp - 0x50c], eax
push 0
push 0
push 0x6bc9bf
push 0x59
push str.CDoTaskUnInstallWinAssist::DoUnInstall
push 4
lea ecx, [ebp - 0x2a8]
call fcn.0040fe90
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x510], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x508]
push ecx
lea edx, [ebp - 0x50c]
push edx
mov ecx, dword [ebp - 0x510]
call fcn.00402110
mov ecx, eax
call fcn.00413750
mov ecx, eax
call fcn.00413750
push eax
call fcn.00413740
mov ecx, eax
call fcn.00411130
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2a8]
call fcn.00410180
lea ecx, [ebp - 0x4e9]
call fcn.004c8a9d
mov byte [ebp - 4], 0xc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x55c], esp
push str.SoftManage_Shell_Extension
call fcn.0040e100
mov dword [ebp - 0x558], eax
mov byte [ebp - 4], 0xd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x554], esp
push str.3AE435F1_16F2_41E6_A344_70C3447280BC
call fcn.0040e100
mov dword [ebp - 0x570], eax
mov byte [ebp - 4], 0xe
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x56c], esp
push 0x6ca94c
call fcn.0040e100
mov dword [ebp - 0x574], eax
mov byte [ebp - 4], 0xf
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x578], esp
lea eax, [ebp + 8]
push eax
call fcn.0040e170
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x4e9]
call fcn.004c8e8d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x57c], esp
push 0x6ca960
call fcn.0040e100
lea ecx, [ebp - 0x4e9]
call fcn.004c8d7e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x580], esp
push 0x6ca938
call fcn.0040e100
lea ecx, [ebp - 0x4e9]
call fcn.004c8d7e
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4e9]
call fcn.00425e50
lea ecx, [ebp - 0x40]
push ecx
call fcn.00410f60
mov ecx, eax
call fcn.004c4ef8
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x40]
push edx
call fcn.004c31a5
add esp, 4
test eax, eax
jne 0x41602d
push 0x6ca948
lea ecx, [ebp - 0x40]
call fcn.0040e2a0
lea ecx, [ebp - 0x40]
call fcn.004095f0
push eax
call fcn.004c882b
add esp, 4
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x416088
push str.Render
mov ecx, dword [ebp - 0x4f0]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00416910
add esp, 0xc
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb8]
call fcn.004095f0
push eax
call fcn.004c882b
add esp, 4
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xb8]
call fcn.00404d80
mov dword [ebp - 0x4f8], 0
jmp 0x4160a3
mov eax, dword [ebp - 0x4f8]
add eax, 1
mov dword [ebp - 0x4f8], eax
mov ecx, dword [ebp - 0x4f0]
add ecx, 0x20
call fcn.004093b0
cmp dword [ebp - 0x4f8], eax
jae 0x416151
push 0x6ca9ac
mov ecx, dword [ebp - 0x4f0]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.00416910
add esp, 0xc
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x518], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x4f8]
push ecx
mov ecx, dword [ebp - 0x4f0]
add ecx, 0x20
call fcn.00414b50
push eax
mov edx, dword [ebp - 0x518]
push edx
lea eax, [ebp - 0xd0]
push eax
call fcn.004169e0
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x100]
call fcn.00404d80
lea ecx, [ebp - 0xd0]
call fcn.004095f0
push eax
call fcn.004c8813
add esp, 4
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xd0]
call fcn.00404d80
jmp 0x416094
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x584], esp
push 0x6ca974
call fcn.0040e100
push reloc.gdiplus.dll_Ordinal_1
mov ecx, dword [ebp - 0x4f0]
call fcn.004167f0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x588], esp
push str.WINGlobal
call fcn.0040e100
push reloc.gdiplus.dll_Ordinal_1
mov ecx, dword [ebp - 0x4f0]
call fcn.004167f0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x53c], esp
push 0x6ca9b8
call fcn.0040e100
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x4f0]
call fcn.004167f0
lea ecx, [ebp - 0x188]
call fcn.004d1240
mov byte [ebp - 4], 0x15
push 0
lea ecx, [ebp - 0x188]
call fcn.004d2b70
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x540], esp
push str._soft_i3
call fcn.00402c00
mov dword [ebp - 0x544], eax
mov byte [ebp - 4], 0x16
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x548], esp
push 0x6ca9b0
call fcn.00402c00
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x188]
call fcn.004d1f60
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x54c], esp
call fcn.004c47ca
push eax
push esi
call fcn.004c315a
add esp, 8
mov dword [ebp - 0x550], eax
mov byte [ebp - 4], 0x17
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x58c], esp
push 0x6ca9b4
call fcn.00402c00
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x188]
call fcn.004d1f60
push 0
push 0
lea ecx, [ebp - 0x188]
push ecx
call fcn.00410e80
mov ecx, eax
call fcn.004d0920
mov edx, dword [ebp - 0x4f0]
cmp dword [edx + 0x18], 0
je 0x4162b4
mov eax, dword [ebp - 0x4f0]
cmp dword [eax + 0x1c], 0
jbe 0x4162b4
push 0
push 0
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x188]
call fcn.00404170
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
call fcn.00404d80
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
call fcn.00404d80
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xa0]
call fcn.00404d80
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.00404d80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4ea]
call fcn.00425e50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00404d80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404d80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004278da
mov esp, ebp
pop ebp
ret 0x1c