Function at 0x41bef0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e8c
call fcn.0040e9e0
mov eax, dword [0x42b044]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x9c], 0
mov word [ebp - 0x4f0], 0
push 0x206
push 0
lea eax, [ebp - 0x4ee]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1420], 0
push 0x206
push 0
lea ecx, [ebp - 0x141e]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1210], 0
push 0x206
push 0
lea edx, [ebp - 0x120e]
push edx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x2e0], 0
xor eax, eax
mov dword [ebp - 0x2de], eax
mov dword [ebp - 0x2da], eax
mov dword [ebp - 0x2d6], eax
mov dword [ebp - 0x2d2], eax
mov dword [ebp - 0x2ce], eax
mov dword [ebp - 0x2ca], eax
mov dword [ebp - 0x2c6], eax
mov word [ebp - 0x2c2], ax
mov cx, word [0x4290b0]
mov word [ebp - 0x90], cx
push 0x7e
push 0
lea edx, [ebp - 0x8e]
push edx
call fcn.004012f0
add esp, 0xc
mov ax, word [0x4290b4]
mov word [ebp - 0xe00], ax
push 0x7e
push 0
lea ecx, [ebp - 0xdfe]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x57c], 0
mov dx, word [0x4290b8]
mov word [ebp - 0x578], dx
push 0x7e
push 0
lea eax, [ebp - 0x576]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1214], 0
mov word [ebp - 0x1008], 0
push 0x206
push 0
lea ecx, [ebp - 0x1006]
push ecx
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x2c0], 0
xor edx, edx
mov dword [ebp - 0x2be], edx
mov dword [ebp - 0x2ba], edx
mov dword [ebp - 0x2b6], edx
mov dword [ebp - 0x2b2], edx
mov dword [ebp - 0x2ae], edx
mov dword [ebp - 0x2aa], edx
mov dword [ebp - 0x2a6], edx
mov word [ebp - 0x2a2], dx
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x2a0]
push eax
call fcn.004012f0
add esp, 0xc
push 1
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.0040fb50
add esp, 8
mov dword [ebp - 8], eax
push 0
lea edx, [ebp - 0x1620]
push edx
call fcn.0040fb50
add esp, 8
mov dword [ebp - 0x98], eax
push 0x104
lea eax, [ebp - 0x1420]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x4f0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x4290bc
push 0x104
lea edx, [ebp - 0x4f0]
push edx
call fcn.004013e0
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
call fcn.004022d8
add esp, 4
test eax, eax
jbe 0x41c14d
lea ecx, [ebp - 0x4f0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c14d
lea edx, [ebp - 0x4f0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 8], 0
je 0x41c43f
lea eax, [ebp - 0x4f0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x118]
push ecx
push 0x104
lea edx, [ebp - 0x4f0]
push edx
call fcn.004013e0
add esp, 0xc
push 0x429104
push 0x104
lea eax, [ebp - 0x4f0]
push eax
call fcn.004013e0
add esp, 0xc
lea ecx, [ebp - 0x4f0]
push ecx
call fcn.004022d8
add esp, 4
test eax, eax
jbe 0x41c1fe
lea edx, [ebp - 0x4f0]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41c1fe
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x1c48]
push ecx
call fcn.004013c4
add esp, 8
push 0x429110
push 0x104
lea edx, [ebp - 0x1c48]
push edx
call fcn.004013e0
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xf8]
push ecx
push 0x10
lea edx, [ebp - 0x2e0]
push edx
call fcn.004017c5
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0xf8]
push ecx
call fcn.0041a530
add esp, 8
lea edx, [ebp - 0xf8]
push edx
call fcn.0041b460
add esp, 4
cmp eax, 1
jne 0x41c247
xor eax, eax
jmp 0x41c9e3
mov word [ebp - 0x1a38], 0
push 0x206
push 0
lea eax, [ebp - 0x1a36]
push eax
call fcn.004012f0
add esp, 0xc
mov word [ebp - 0x1828], 0
push 0x206
push 0
lea ecx, [ebp - 0x1826]
push ecx
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x182c], 0
lea edx, [ebp - 0xf8]
push edx
lea eax, [ebp - 0x1a38]
push eax
call fcn.004013c4
add esp, 8
lea ecx, [ebp - 0xf8]
push ecx
lea edx, [ebp - 0x1828]
push edx
call fcn.004013c4
add esp, 8
push 0x429170
lea eax, [ebp - 0x1828]
push eax
call fcn.0040139a
add esp, 8
lea ecx, [ebp - 0x1a38]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x182c], eax
cmp dword [ebp - 0x182c], 0
je 0x41c37b
mov edx, dword [ebp - 0x182c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1828]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x182c], eax
mov dword [ebp - 0x1c4c], 0
lea ecx, [ebp - 0x1a38]
push ecx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x182c], eax
cmp dword [ebp - 0x182c], 0
je 0x41c37b
cmp dword [ebp - 0x1c4c], 5
jge 0x41c37b
mov edx, dword [ebp - 0x182c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c4c]
add eax, 1
mov dword [ebp - 0x1c4c], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41c326
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x4f0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1a3c], eax
cmp dword [ebp - 0x1a3c], 0
je 0x41c3ae
mov dword [ebp - 0x1e8c], 0x4291b8
jmp 0x41c3b8
mov dword [ebp - 0x1e8c], 0x4291c0
lea edx, [ebp - 0x21a]
push edx
lea eax, [ebp - 0x90]
push eax
call fcn.004013c4
add esp, 8
lea ecx, [ebp - 0x29c]
push ecx
lea edx, [ebp - 0xe00]
push edx
call fcn.004013c4
add esp, 8
mov ax, word [ebp - 0x21c]
mov word [ebp - 0x57c], ax
lea ecx, [ebp - 0x1fa]
push ecx
lea edx, [ebp - 0x578]
push edx
call fcn.004013c4
add esp, 8
mov ax, word [ebp - 0x17a]
mov word [ebp - 0x1214], ax
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0x2e4], ecx
lea edx, [ebp - 0x118]
push edx
push 0x10
lea eax, [ebp - 0x2c0]
push eax
call fcn.004017c5
add esp, 0xc
jmp 0x41c50c
cmp dword [0x42c0a0], 3
jne 0x41c50c
push 0x236
push 0
lea ecx, [ebp - 0x1e88]
push ecx
call fcn.004012f0
add esp, 0xc
lea edx, [ebp - 0x1e88]
push edx
call fcn.0041dc60
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41c50c
lea eax, [ebp - 0x1d7a]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.004013c4
add esp, 8
lea edx, [ebp - 0xe00]
push edx
mov eax, dword [ebp - 0x1d82]
push eax
call fcn.0041a820
add esp, 8
mov cx, word [ebp - 0x1d7e]
mov word [ebp - 0x57c], cx
lea edx, [ebp - 0x578]
push edx
mov eax, dword [ebp - 0x1d88]
push eax
call fcn.0041a820
add esp, 8
mov cx, word [ebp - 0x1d84]
mov word [ebp - 0x1214], cx
push 4
lea edx, [ebp - 0x1e80]
push edx
lea eax, [ebp - 0x2e4]
push eax
call fcn.00401460
add esp, 0xc
lea ecx, [ebp - 0x1d5a]
push ecx
push 0x10
lea edx, [ebp - 0x2e0]
push edx
call fcn.004017c5
add esp, 0xc
cmp dword [ebp - 0x98], 0
je 0x41c5ea
lea eax, [ebp - 0x159a]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.004013c4
add esp, 8
lea edx, [ebp - 0x161c]
push edx
lea eax, [ebp - 0xe00]
push eax
call fcn.004013c4
add esp, 8
mov cx, word [ebp - 0x159c]
mov word [ebp - 0x57c], cx
push 0x4291c8
lea edx, [ebp - 0x578]
push edx
call fcn.004013c4
add esp, 8
mov ax, word [ebp - 0x14fa]
mov word [ebp - 0x1214], ax
mov ecx, dword [0x42c634]
mov dword [ebp - 0x2e4], ecx
cmp dword [0x42c0a0], 3
je 0x41c59d
push 1
lea edx, [ebp - 0x1008]
push edx
call fcn.0041b530
add esp, 8
jmp 0x41c5ae
push 0
lea eax, [ebp - 0x1008]
push eax
call fcn.0041b530
add esp, 8
lea ecx, [ebp - 0x1008]
push ecx
lea edx, [ebp - 0x1210]
push edx
call fcn.004013c4
add esp, 8
push 0x4291e4
push 0x104
lea eax, [ebp - 0x1210]
push eax
call fcn.004013e0
add esp, 0xc
lea ecx, [ebp - 0x1210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
push 0
lea edx, [ebp - 0x2a0]
push edx
call fcn.004012f0
add esp, 0xc
mov dword [ebp - 0x2a0], 0x504d534d
mov word [ebp - 0x21c], 0x51
push 0x4291fc
lea eax, [ebp - 0x29c]
push eax
call fcn.004013c4
add esp, 8
mov word [ebp - 0x17a], 0x2b66
push 0x429218
lea ecx, [ebp - 0x1fa]
push ecx
call fcn.004013c4
add esp, 8
push 0x429234
lea edx, [ebp - 0x21a]
push edx
call fcn.004013c4
add esp, 8
mov eax, dword [0x42c634]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 8], 0
jne 0x41c678
cmp dword [ebp - 4], 0
jne 0x41c678
cmp dword [ebp - 0x98], 0
je 0x41c6f7
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x21a]
push edx
call fcn.00401030
add esp, 8
lea eax, [ebp - 0xe00]
push eax
lea ecx, [ebp - 0x29c]
push ecx
call fcn.00401050
add esp, 8
mov dx, word [ebp - 0x57c]
mov word [ebp - 0x21c], dx
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x1fa]
push ecx
call fcn.00401050
add esp, 8
mov dx, word [ebp - 0x1214]
mov word [ebp - 0x17a], dx
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0x2e4], 0
jne 0x41c6f7
mov ecx, dword [0x42c634]
mov dword [ebp - 0xd8], ecx
movzx edx, word [ebp - 0x29c]
test edx, edx
je 0x41c70d
movzx eax, word [ebp - 0x21c]
test eax, eax
jg 0x41c717
jmp 0x41c9d3
mov dword [ebp - 0x2a0], 0x504d534d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004022ee
add esp, 4
mov word [ebp - 0xd80], 0
push 0x7fe
push 0
lea ecx, [ebp - 0xd7e]
push ecx
call fcn.004012f0
add esp, 0xc
movzx edx, word [ebp - 0x178]
test edx, edx
jne 0x41c783
lea eax, [ebp - 0xd80]
push eax
push 6
push 5
call fcn.0041ab90
add esp, 0xc
lea ecx, [ebp - 0xd80]
push ecx
lea edx, [ebp - 0x178]
push edx
call fcn.00401030
add esp, 8
movzx eax, word [ebp - 0x158]
test eax, eax
jne 0x41c7b7
lea ecx, [ebp - 0xd80]
push ecx
push 6
push 5
call fcn.0041ab90
add esp, 0xc
lea edx, [ebp - 0xd80]
push edx
lea eax, [ebp - 0x158]
push eax
call fcn.00401030
add esp, 8
movzx ecx, word [ebp - 0x118]
test ecx, ecx
jne 0x41c7eb
lea edx, [ebp - 0xd80]
push edx
push 6
push 5
call fcn.0041ab90
add esp, 0xc
lea eax, [ebp - 0xd80]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.00401030
add esp, 8
movzx edx, word [ebp - 0xf8]
test edx, edx
jne 0x41c848
lea eax, [ebp - 0xd80]
push eax
push 6
push 5
call fcn.0041ab90
add esp, 0xc
lea ecx, [ebp - 0xd80]
push ecx
lea edx, [ebp - 0xf8]
push edx
call fcn.00401030
add esp, 8
lea eax, [ebp - 0x2e0]
push eax
call fcn.004022d8
add esp, 4
test eax, eax
jbe 0x41c848
lea ecx, [ebp - 0x2e0]
push ecx
lea edx, [ebp - 0xf8]
push edx
call fcn.00401030
add esp, 8
lea eax, [ebp - 0x2c0]
push eax
call fcn.004022d8
add esp, 4
test eax, eax
je 0x41c873
lea ecx, [ebp - 0x2c0]
push ecx
push 0x10
lea edx, [ebp - 0x138]
push edx
call fcn.004017c5
add esp, 0xc
movzx eax, word [ebp - 0x138]
test eax, eax
jne 0x41c8a7
lea ecx, [ebp - 0xd80]
push ecx
push 6
push 5
call fcn.0041ab90
add esp, 0xc
lea edx, [ebp - 0xd80]
push edx
lea eax, [ebp - 0x138]
push eax
call fcn.00401030
add esp, 8
mov ecx, dword [0x42c630]
mov dword [ebp - 0xd4], ecx
cmp dword [ebp - 0xd8], 0
jne 0x41c8c8
mov edx, dword [0x42c634]
mov dword [ebp - 0xd8], edx
lea eax, [ebp - 0x2a0]
push eax
call fcn.0040fa70
add esp, 4
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x41c8f0
jmp 0x41c9d3
lea ecx, [ebp - 0x4f0]
push ecx
lea edx, [ebp - 0xf8]
push edx
call fcn.0041a530
add esp, 8
mov dword [ebp - 0x94], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004022ee
add esp, 4
push 0x64
push 0x32
call fcn.0041aa50
add esp, 8
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
push eax
lea ecx, [ebp - 0x4f0]
push ecx
lea edx, [ebp - 0x1420]
push edx
call fcn.0041b350
add esp, 0xc
mov dword [ebp - 0x4f4], 0
lea eax, [ebp - 0x4f4]
push eax
push 3
push 0
push 0x4292b0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c9b9
lea ecx, [ebp - 0x4f0]
push ecx
call fcn.004022d8
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x4f0]
push eax
push 1
push 0
push 0x42931c
mov ecx, dword [ebp - 0x4f4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41c9b9
mov edx, dword [ebp - 0x4f4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x429324
lea eax, [ebp - 0x4f0]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004012de
mov esp, ebp
pop ebp
ret