Function at 0x40e850
Capabilities:
Delete file
Delete registry key
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a23e
mov eax, dword fs:[0]
push eax
sub esp, 0x89c
mov eax, dword [0x481720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov eax, str.InstallFolder
mov edx, esp
mov dword [ebp - 0x8a8], esp
xor ecx, ecx
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
lea eax, [eax + 4]
inc ecx
cmp dword [eax], 0
jne 0x40e8a2
push ecx
push str.InstallFolder
mov ecx, edx
call fcn.00401d70
sub esp, 0x18
mov dword [ebp - 4], 0
mov edx, esp
mov eax, str.SOFTWARECryptoBeesmiMind
xor ecx, ecx
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop
lea eax, [eax + 4]
inc ecx
cmp dword [eax], 0
jne 0x40e8e0
push ecx
push str.SOFTWARECryptoBeesmiMind
mov ecx, edx
call fcn.00401d70
lea eax, [ebp - 0x870]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.00406140
push 0x42c688
lea eax, [ebp - 0x870]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00402810
add esp, 0x40
mov byte [ebp - 4], 2
mov ecx, str.miMind.exe
xor edx, edx
lea ecx, [ecx + 4]
inc edx
cmp dword [ecx], 0
jne 0x40e936
push edx
push str.miMind.exe
mov ecx, eax
call fcn.00402490
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x828], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x818], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 3
mov dword [eax], 0
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 5
push eax
call fcn.00403860
mov ecx, dword [ebp - 0x814]
add esp, 4
mov byte [ebp - 4], 2
cmp ecx, 4
jb 0x40e9ec
mov edx, dword [ebp - 0x828]
lea ecx, [ecx*4 + 4]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e9e2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f098
push ecx
push edx
call fcn.00410dc4
add esp, 8
mov ecx, dword [ebp - 0x82c]
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 3
mov dword [ebp - 0x828], 0
mov byte [ebp - 4], 1
cmp ecx, 4
jb 0x40ea4e
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*4 + 4]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ea44
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f098
push ecx
push edx
call fcn.00410dc4
add esp, 8
sub esp, 0x18
mov eax, str.SOFTWARECryptoBeesmiMind
mov edx, esp
xor ecx, ecx
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop
lea eax, [eax + 4]
inc ecx
cmp dword [eax], 0
jne 0x40ea70
push ecx
push str.SOFTWARECryptoBeesmiMind
mov ecx, edx
call fcn.00401d70
call fcn.00405f40
mov edx, esp
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallmiMind
xor ecx, ecx
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
lea eax, [eax + 4]
inc ecx
cmp dword [eax], 0
jne 0x40eaa8
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallmiMind
mov ecx, edx
call fcn.00401d70
call fcn.00405f40
lea eax, [ebp - 0x840]
push str..mind
push eax
call fcn.0040ca00
add esp, 0x20
cmp dword [eax + 0x14], 8
jb 0x40eadf
mov eax, dword [eax]
push 0
push 0xf003f
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [ebp - 0x82c]
cmp ecx, 8
jb 0x40eb32
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40eb28
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f09d
push ecx
push edx
call fcn.00410dc4
add esp, 8
push 0x42c688
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00402810
add esp, 0xc
mov byte [ebp - 4], 6
mov ecx, str.uninstall.exe
xor edx, edx
lea ecx, [ecx + 4]
inc edx
cmp dword [ecx], 0
jne 0x40eb58
push edx
push str.uninstall.exe
mov ecx, eax
call fcn.00402490
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x828], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x818], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 3
mov dword [eax], 0
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x858]
push eax
call fcn.0040c960
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40ebd9
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
push eax
call esi
mov ecx, dword [ebp - 0x844]
cmp ecx, 8
jb 0x40ec26
mov edx, dword [ebp - 0x858]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ec1c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f0a2
push ecx
push edx
call fcn.00410dc4
add esp, 8
mov ecx, dword [ebp - 0x814]
xor eax, eax
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 7
mov word [ebp - 0x858], ax
mov byte [ebp - 4], 6
cmp ecx, 4
jb 0x40ec87
mov edx, dword [ebp - 0x828]
lea ecx, [ecx*4 + 4]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ec7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f0a2
push ecx
push edx
call fcn.00410dc4
add esp, 8
mov ecx, dword [ebp - 0x82c]
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 3
mov dword [ebp - 0x828], 0
mov byte [ebp - 4], 1
cmp ecx, 4
jb 0x40ece9
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*4 + 4]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ecdf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f0a2
push ecx
push edx
call fcn.00410dc4
add esp, 8
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.0040c960
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40ed07
mov eax, dword [eax]
push 4
push 0
push eax
call esi
mov ecx, dword [ebp - 0x82c]
cmp ecx, 8
jb 0x40ed4e
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ed44
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f0a7
push ecx
push edx
call fcn.00410dc4
add esp, 8
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.00404150
push eax
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 0xa
push eax
call fcn.0040c960
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x40ed7d
mov eax, dword [eax]
push 4
push 0
push eax
call esi
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x40edc4
mov edx, dword [ebp - 0x828]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40edba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f0ac
push ecx
push edx
call fcn.00410dc4
add esp, 8
mov ecx, dword [ebp - 0x82c]
xor eax, eax
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
mov byte [ebp - 4], 1
cmp ecx, 4
jb 0x40ee25
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*4 + 4]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ee1b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f0ac
push ecx
push edx
call fcn.00410dc4
add esp, 8
mov dword [ebp - 0x840], 0
xor eax, eax
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
push eax
push 0x19
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xc
push eax
push dword [0x482898]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x40f02f
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x888]
push eax
call fcn.0040ce80
add esp, 8
mov byte [ebp - 4], 0xd
mov ecx, 0x42c688
xor edx, edx
lea ecx, [ecx + 4]
inc edx
cmp dword [ecx], 0
jne 0x40ee90
push edx
push 0x42c688
mov ecx, eax
call fcn.00402490
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x858], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x848], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 3
mov dword [eax], 0
mov byte [ebp - 4], 0x10
mov eax, str.miMind.lnk
xor ecx, ecx
nop word [eax + eax]
lea eax, [eax + 4]
inc ecx
cmp dword [eax], 0
jne 0x40ef00
push ecx
push str.miMind.lnk
lea ecx, [ebp - 0x858]
call fcn.00402490
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x828], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x818], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 3
mov dword [eax], 0
mov eax, dword [ebp - 0x844]
cmp eax, 4
jb 0x40ef81
inc eax
lea ecx, [ebp - 0x858]
push eax
push dword [ebp - 0x858]
call fcn.00405560
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 3
mov dword [ebp - 0x858], 0
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0x15
call fcn.00401fe0
cmp dword [ebp - 0x814], 4
lea eax, [ebp - 0x828]
push 0
cmovae eax, dword [ebp - 0x828]
push eax
push 0x3005
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [ebp - 0x828]
push eax
call fcn.00403910
add esp, 4
test al, al
je 0x40eff4
lea eax, [ebp - 0x828]
push eax
call fcn.00403860
add esp, 4
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x8a0]
push eax
call fcn.0040c960
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40f012
mov eax, dword [eax]
push 4
push 0
push eax
call esi
lea ecx, [ebp - 0x8a0]
call fcn.00403200
lea ecx, [ebp - 0x828]
call fcn.00401fe0
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 0x85c]
cmp ecx, 4
jb 0x40f07c
mov edx, dword [ebp - 0x870]
lea ecx, [ecx*4 + 4]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f072
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f0b1
push ecx
push edx
call fcn.00410dc4
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411023
mov esp, ebp
pop ebp
ret
call fcn.00415a2f
call fcn.00415a2f
call fcn.00415a2f
call fcn.00415a2f
call fcn.00415a2f
call fcn.00415a2f
int3