Function at 0x401078
Capabilities:
Get common file path
Get installed programs
Persist via run registry key
Read .ini file
Set registry value

Disassembly:
jmp 0x402660
sub esp, 0x330
mov eax, dword [0x42d664]
xor eax, esp
mov dword [esp + 0x32c], eax
push ebx
push ebp
push esi
push edi
push 0x12b
lea eax, [esp + 0x21]
push 0
push eax
mov byte [esp + 0x28], 0
call fcn.00405be0
add esp, 0xc
push 0x4300b8
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.ck_setup_restart.ini
push 0x4300b8
lea ecx, [esp + 0x150]
push str._s_s
push ecx
call fcn.00405c5a
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0x10
mov esi, section..data
jmp 0x4026d0
lea ebp, [esi + 8]
test ebp, ebp
je 0x4026ea
mov eax, dword [esi]
lea edx, [esp + 0x148]
push edx
push ebp
push eax
push str.General
call ebx
mov edi, dword [esi]
push edi
call fcn.00401032
mov ecx, eax
shl ecx, 4
sub ecx, eax
add ecx, ecx
add ecx, ecx
add esp, 4
cmp dword [ecx + 0x42d32c], 1
mov dword [0x42ef3c], eax
jne 0x402729
lea eax, [ecx + 0x42d330]
cmp eax, ebp
jbe 0x402729
lea ecx, [esp + 0x148]
push ecx
push eax
push edi
push str.General
call ebx
add esi, 0x3c
cmp esi, 0x42d21c
jl 0x4026d0
mov esi, 0x42d220
lea esp, [esp]
mov ebp, 1
cmp dword [esi + 8], ebp
jne 0x402761
mov eax, dword [esi]
lea edx, [esp + 0x148]
push edx
push str.TRUE
push eax
push str.ComponentSelect
call ebx
mov ecx, dword [esi + 4]
push ecx
call fcn.00401014
add esp, 4
mov dword [0x4302ac], eax
cmp dword [eax*8 + 0x42d2c4], ebp
jne 0x402792
mov eax, dword [esi]
lea edx, [esp + 0x148]
push edx
push str.TRUE
push eax
push str.ComponentSelect
call ebx
add esi, 0xc
cmp esi, 0x42d2bc
jl 0x402740
push 0x4300b8
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x4286e8
push str.ck_setup.exe
push 0x4300b8
push str.__s_s___s
push 0x42eda8
call fcn.00405c5a
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add esp, 0x14
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0xf003f
push 0
push 0x4286c8
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call esi
test eax, eax
jne 0x402815
push 0x42eda8
push str.ck_setup
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.0040100f
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0x4286c8
push 0
push str.SOFTWAREARLCK_SETUP
push 0x80000001
call esi
test eax, eax
jne 0x402aa6
mov edx, dword [esp + 0x14]
push 0xc8
push 0x4300b8
push ebp
push eax
push str.ck_setup_path
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402aa6
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [esp + 0x1c], al
mov eax, dword [0x42ec64]
mov ebx, 0x12c
mov dword [esp + 0x10], ebx
cmp eax, ebp
jne 0x40293e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall323E45F0_27F8_4B98_A38A_947243AA8D2E
push 0x80000002
call fcn.0040106e
add esp, 0x14
test eax, eax
je 0x402ab1
lea edx, [esp + 0x1c]
push str.__C:
push edx
call fcn.004054a0
mov byte [eax], 0
inc eax
push eax
push str._s__x
push 0x438a90
call fcn.00405c5a
push 0x438a90
call fcn.00401023
add esp, 0x18
test eax, eax
jne 0x402ab1
push 0x42efa8
push 0xfa
push 0x42eb68
push str.undefined
push str.Msg_Reboot
push 0x42ed04
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40031
push str.Alert
push 0x42eb68
push 0
call edi
cmp eax, ebp
jne 0x402aaa
call fcn.00401073
mov eax, dword [0x42ec64]
cmp eax, 2
je 0x40294c
cmp eax, 3
jne 0x402a05
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallCryptoKit
push 0x80000002
mov dword [esp + 0x24], ebx
mov byte [esp + 0x30], 0
call fcn.0040106e
add esp, 0x14
test eax, eax
je 0x402ab1
lea edx, [esp + 0x1c]
push str.__M
push edx
call fcn.004054a0
mov byte [eax], 0
push 0x4300b8
inc eax
push eax
lea eax, [esp + 0x2c]
push eax
push str.__s___s__s__removeonly
push 0x438a90
call fcn.00405c5a
push 0x438a90
call fcn.00401023
add esp, 0x20
test eax, eax
jne 0x402ab1
push 0x42efa8
push 0xfa
push 0x42eb68
push str.undefined
push str.Msg_Reboot
push 0x42ed04
call esi
push 0x40031
push str.Alert
push 0x42eb68
push 0
call edi
cmp eax, ebp
jne 0x402aaa
call fcn.00401073
mov eax, dword [0x42ec64]
cmp eax, 4
jne 0x402aa6
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallF75D2B1D_5309_41DF_BC96_DFC3C3568C1D
push 0x80000002
call fcn.0040106e
add esp, 0x14
test eax, eax
je 0x402ab1
lea eax, [esp + 0x1c]
push str.__I
push eax
call fcn.004054a0
mov byte [eax], 0
add eax, 3
push eax
lea ecx, [esp + 0x28]
push ecx
push str.__s___x_s__qn__norestart
push 0x438a90
call fcn.00405c5a
push 0x438a90
call fcn.00401023
add esp, 0x1c
push 0x42efa8
push 0xfa
push 0x42eb68
push str.undefined
push str.Msg_Reboot
push 0x42ed04
call esi
push 0x40031
push str.Alert
push 0x42eb68
push 0
call edi
cmp eax, ebp
jne 0x402aaa
call fcn.00401073
xor eax, eax
jmp 0x402ab3
push 0
call fcn.00405951
mov eax, ebp
mov ecx, dword [esp + 0x33c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405bd0
add esp, 0x330
ret