Function at 0x42627f
Capabilities:
Check if file exists
Create process on windows
Delete file
Set file attributes
Set registry value

Disassembly:
push 0x354
mov eax, 0x442f2b
call 0x42b7b6
mov esi, ecx
push 0x449918
mov eax, esi
mov dword [ebp - 0x34c], esi
call fcn.0040e942
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x4266a3
call fcn.0041e469
call fcn.00402648
test al, al
jne 0x4266a3
push 0x44991c
mov eax, esi
call fcn.0040e942
mov esi, eax
cmp esi, ebx
je 0x4266a3
call fcn.0041e469
call fcn.00402648
test al, al
jne 0x4266a3
push 0xffffffffffffffff
mov eax, edi
call fcn.0041e469
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.0041d121
mov edi, dword [eax]
add esp, 0xc
mov dword [ebp - 0x348], edi
mov dword [eax], ebx
mov dword [ebp - 0x360], edi
mov dword [ebp - 4], ebx
push dword [ebp - 0x350]
call fcn.004273e1
pop ecx
push 0xffffffffffffffff
mov eax, esi
call fcn.0041e469
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.0041d121
mov esi, dword [eax]
add esp, 0xc
mov dword [ebp - 0x344], esi
mov dword [eax], ebx
mov dword [ebp - 0x35c], esi
push dword [ebp - 0x354]
call fcn.004273e1
xor eax, eax
pop ecx
mov dword [ebp - 0x328], 7
mov dword [ebp - 0x32c], ebx
mov word [ebp - 0x33c], ax
mov byte [ebp - 4], 2
mov eax, dword [0x45c0d4]
cmp dword [eax + 0x1c], 8
jb 0x426382
mov ebx, dword [eax + 8]
jmp 0x426385
lea ebx, [eax + 8]
push edi
mov edi, dword [eax]
lea ecx, [ebp - 0x340]
call fcn.00425ded
cmp dword [ebp - 0x328], 8
mov eax, dword [ebp - 0x33c]
pop ecx
jae 0x4263a9
lea eax, [ebp - 0x33c]
push eax
call fcn.00427ef7
pop ecx
push esi
mov edi, eax
call fcn.00427ef7
cmp eax, edi
pop ecx
jle 0x42667c
mov eax, dword [ebp - 0x34c]
push 0x449920
call fcn.0040e942
mov esi, eax
test esi, esi
je 0x42641b
call fcn.0041e469
call fcn.00402648
test al, al
jne 0x42641b
mov eax, esi
call fcn.0041e469
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.0041d121
mov edi, dword [eax]
add esp, 0xc
call fcn.00425fde
push dword [ebp - 0x350]
mov bl, al
call fcn.004273e1
pop ecx
test bl, bl
jne 0x42667c
mov eax, dword [ebp - 0x34c]
push 0x449924
call fcn.0040e942
mov edi, eax
test edi, edi
je 0x42667c
call fcn.0041e469
call fcn.00402648
test al, al
jne 0x42667c
mov eax, dword [ebp - 0x34c]
push str.type
call fcn.0040e942
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x426679
call fcn.0041e469
call fcn.00402648
test al, al
jne 0x426679
mov eax, edi
call fcn.0041e469
mov dword [ebp - 0x354], eax
mov eax, esi
call fcn.0041e469
push 0x103
mov dword [ebp - 0x350], eax
lea eax, [ebp - 0x11b]
push ebx
push eax
mov byte [ebp - 0x11c], bl
call 0x42b020
mov eax, dword [ebp - 0x34c]
add esp, 0xc
push str.filename
call fcn.0040e942
mov esi, eax
cmp esi, ebx
je 0x4264d9
call fcn.0041e469
call fcn.00402648
test al, al
jne 0x4264d9
mov eax, esi
call fcn.0041e469
mov esi, eax
jmp 0x42654b
push 0x2f
push dword [ebp - 0x354]
call 0x42aff0
pop ecx
pop ecx
cmp eax, ebx
je 0x426679
inc eax
mov dword [ebp - 0x34c], eax
lea eax, [ebp - 0x11c]
xor edi, edi
sub dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
lea esi, [ebp + edi - 0x11c]
mov bl, byte [eax + esi]
test bl, bl
je 0x42653f
cmp bl, 0x3f
je 0x42653f
movsx eax, bl
push eax
push str._:____
call 0x429720
pop ecx
pop ecx
test eax, eax
je 0x426534
mov bl, 0x2b
inc edi
cmp edi, 0x104
mov byte [esi], bl
jl 0x426505
mov byte [ebp - 0x19], 0
lea esi, [ebp - 0x11c]
xor ebx, ebx
lea eax, [ebp - 0x324]
push eax
call fcn.00426256
pop ecx
test al, al
je 0x426679
push 0xffffffffffffffff
lea eax, [ebp - 0x358]
push esi
push eax
call fcn.0041d121
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [ebp - 0x358]
call fcn.004273e1
pop ecx
push ebx
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x426679
mov ecx, dword [ebp - 0x354]
lea edi, [ebp - 0x324]
call fcn.0042615e
test al, al
je 0x426679
mov esi, dword [ebp - 0x350]
push 2
mov edi, 0x44993c
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x426603
push 5
push ebx
push ebx
lea eax, [ebp - 0x324]
push eax
push 0x449940
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x426624
mov esi, dword [ebp - 0x350]
push 2
mov edi, 0x44994c
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x426624
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [ebp - 0x348], ebx
je 0x426679
cmp dword [ebp - 0x344], ebx
je 0x426679
mov ecx, dword [0x45c0d4]
cmp dword [ecx + 0x1c], 8
jb 0x426645
mov edi, dword [ecx + 8]
jmp 0x426648
lea edi, [ecx + 8]
mov eax, dword [ebp - 0x344]
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x426651
sub eax, esi
sar eax, 1
add eax, eax
push eax
push dword [ebp - 0x344]
push 1
push dword [ebp - 0x348]
push edi
push dword [ecx]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
jmp 0x42667e
push 0
push 1
lea esi, [ebp - 0x340]
call fcn.004021f4
push dword [ebp - 0x344]
call fcn.004273e1
pop ecx
push dword [ebp - 0x348]
call fcn.004273e1
pop ecx
call 0x42b839
ret