Function at 0x401040
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
mov eax, 0x404c0
call fcn.00401830
push ebx
push ebp
push esi
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x390]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, 0x3f
lea edi, [esp + 0x190]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff00
xor eax, eax
lea edi, [esp + 0x8d0]
push 0x4080bc
rep stosd dword es:[edi], eax
mov ecx, 0xc
lea edi, [esp + 0x60]
rep stosd dword es:[edi], eax
push 0x4080b8
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
stosw word es:[edi], ax
call fcn.00401815
add esp, 8
cmp eax, esi
mov dword [esp + 0x1c], eax
jne 0x4010bd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x404c0
ret
lea eax, [esp + 0x8d0]
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x390]
push esi
push 0x400
push ecx
call fcn.0040179e
add esp, 0xc
test eax, eax
je 0x4012ca
lea edi, [esp + 0x390]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x390]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x5c]
lea ebx, [esp + 0x390]
lea esi, [esp + 0x390]
lea ebp, [esp + ecx + 0x390]
mov ecx, 0xc
rep stosd dword es:[edi], eax
cmp edx, ebp
stosw word es:[edi], ax
jae 0x4010c8
mov al, byte [esi]
cmp al, 0x22
jne 0x401180
mov ecx, dword [esp + 0x14]
mov eax, 1
cmp ecx, eax
jne 0x401175
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x190]
lea edx, [esp + 0x190]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, esi
lea ecx, [ebx + 1]
sub eax, ebx
dec eax
push eax
push ecx
push edx
call fcn.004016a0
add esp, 0xc
mov dword [esp + 0x14], 0
jmp 0x40122e
mov ebx, esi
mov dword [esp + 0x14], eax
jmp 0x40122e
cmp al, 0x3a
jne 0x4011d4
inc esi
cmp esi, ebp
jae 0x40119d
mov al, byte [esi]
push eax
call fcn.00401450
add esp, 4
test eax, eax
je 0x40119d
inc esi
cmp esi, ebp
jb 0x401189
cmp esi, ebp
mov edi, esi
jae 0x40122e
mov cl, byte [esi]
push ecx
call fcn.00401450
add esp, 4
test eax, eax
jne 0x40123c
mov dl, byte [esi]
push edx
call fcn.00401430
add esp, 4
test eax, eax
je 0x4010c8
inc esi
cmp esi, ebp
jb 0x4011a7
jmp 0x40122e
push eax
call fcn.00401430
add esp, 4
test eax, eax
je 0x40122e
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40122e
cmp esi, ebp
jae 0x401201
mov al, byte [esi]
push eax
call fcn.00401450
add esp, 4
test eax, eax
je 0x401201
inc esi
cmp esi, ebp
jb 0x4011ed
cmp esi, ebp
mov edi, esi
jae 0x40122e
mov cl, byte [esi]
push ecx
call fcn.00401450
add esp, 4
test eax, eax
jne 0x401283
mov dl, byte [esi]
push edx
call fcn.00401430
add esp, 4
test eax, eax
je 0x4010c8
inc esi
cmp esi, ebp
jb 0x401207
inc esi
cmp esi, ebp
jb 0x401128
jmp 0x4010c8
sub esi, edi
lea eax, [esp + 0x5c]
push esi
push edi
push eax
call fcn.004016a0
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov eax, ecx
add ecx, 0x400
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x68]
lea edx, [esp + 0x19c]
push ecx
push edx
inc ebp
push 0x408070
push eax
mov dword [esp + 0x2c], ebp
call fcn.0040163f
add esp, 0x1c
jmp 0x4010c8
sub esi, edi
lea eax, [esp + 0x5c]
push esi
push edi
push eax
call fcn.004016a0
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov eax, ecx
add ecx, 0x400
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x68]
lea edx, [esp + 0x19c]
push ecx
push edx
inc ebp
push 0x408048
push eax
mov dword [esp + 0x2c], ebp
call fcn.0040163f
add esp, 0x1c
jmp 0x4010c8
push esi
call fcn.004015e9
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x95]
mov byte [esp + 0x94], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x295]
mov byte [esp + 0x294], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 4
stosb byte es:[edi], al
lea eax, [esp + 0x90]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x40803c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x90]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x790]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x401375
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x404c0
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x90]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
mov dword [esp + 0x20], 0x3c
cmp edi, eax
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
jle 0x401412
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea esi, [esp + 0x8d0]
push esi
push 0x408038
lea eax, [esp + 0x298]
push 0x100
push eax
call fcn.00401598
add esp, 0x10
lea edx, [esp + 0x20]
lea ecx, [esp + 0x290]
push edx
mov dword [esp + 0x38], ecx
call ebx
mov eax, dword [esp + 0x58]
push 0xffffffffffffffff
push eax
call ebp
add esi, 0x400
dec edi
jne 0x4013d3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x404c0
ret