Function at 0x47e160
Capabilities:
Check if file exists
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b9cd9
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x4ff1a0]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
call fcn.0042c710
xor ebx, ebx
cmp eax, ebx
je 0x47e395
cmp dword [edi + 0x14], 8
jb 0x47e1bf
mov eax, dword [edi]
jmp 0x47e1c1
mov eax, edi
push 5
push ebx
push ebx
push eax
push str.StartUnPin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x47e85a
push 1
push 2
lea ecx, [esp + 0x24]
call fcn.00413cc0
mov dword [esp + 0x170], ebx
push edi
push ecx
push str.._path:
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea eax, [esp + 0x34]
push str.ShellExecute_Failed._GetLastError:
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.004135f0
add esp, 4
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 8
push 0x1e
mov esi, 0xf
push str.CShellUtility::DetachStartmenu
lea ecx, [esp + 0xf8]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
call fcn.0040ebe0
mov byte [esp + 0x170], 1
mov edi, 0x10
push edi
push str.ShellUtility.cpp
lea ecx, [esp + 0xc0]
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], bl
call fcn.0040ebe0
mov byte [esp + 0x170], 2
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x20]
call fcn.00413de0
mov byte [esp + 0x170], 3
push eax
lea edx, [esp + 0xf4]
push edx
push 0x1b4
lea eax, [esp + 0xc4]
push eax
push ebx
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x170], 2
cmp dword [esp + 0xe8], 8
jb 0x47e2f3
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00490458
add esp, 4
xor edx, edx
mov dword [esp + 0xe8], 7
mov dword [esp + 0xe4], ebx
mov word [esp + 0xd4], dx
mov byte [esp + 0x170], 1
cmp dword [esp + 0xcc], edi
jb 0x47e330
mov eax, dword [esp + 0xb8]
push eax
call fcn.00490458
add esp, 4
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
mov byte [esp + 0x170], bl
cmp dword [esp + 0x104], edi
jb 0x47e365
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00490458
add esp, 4
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov byte [esp + 0xf0], bl
mov dword [esp + 0x170], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00412cc0
xor al, al
jmp 0x47e85c
push 0xa
xor edx, edx
mov esi, 7
push str.Start_Menu
lea ecx, [esp + 0xdc]
mov dword [esp + 0xf0], esi
mov dword [esp + 0xec], ebx
mov word [esp + 0xdc], dx
call fcn.0040e680
mov dword [esp + 0x170], 4
push 0x40
xor eax, eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [esp + 0xf8]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov word [esp + 0xf8], ax
call fcn.0040e680
mov byte [esp + 0x170], 5
mov dword [esp + 0x18], SysReAllocStringLen
call fcn.00410830
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0xdc]
lea edx, [esp + 0xf8]
lea esi, [esp + 0xc0]
call fcn.00412810
mov byte [esp + 0x170], 7
mov esi, 8
cmp dword [esp + 0x104], esi
jb 0x47e456
mov edx, dword [esp + 0xf0]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov dword [esp + 0x104], 7
mov dword [esp + 0x100], ebx
mov word [esp + 0xf0], ax
mov byte [esp + 0x170], 8
cmp dword [esp + 0xe8], esi
jb 0x47e493
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00490458
add esp, 4
mov eax, dword [esp + 0xb8]
xor edx, edx
mov dword [esp + 0xe8], 7
mov dword [esp + 0xe4], ebx
mov word [esp + 0xd4], dx
cmp dword [esp + 0xcc], esi
jae 0x47e4c6
lea eax, [esp + 0xb8]
push eax
push str.appdata_is__s_n
call fcn.004ae7ff
add esp, 8
cmp dword [esp + 0xc8], ebx
jne 0x47e578
call fcn.00410830
lea ebx, [esp + 0xd4]
mov ecx, eax
call fcn.00411e50
mov byte [esp + 0x170], 9
push eax
lea ecx, [esp + 0xbc]
call fcn.00409ad0
mov eax, 8
mov byte [esp + 0x170], al
cmp dword [esp + 0xe8], eax
jb 0x47e52e
mov eax, dword [esp + 0xd4]
push eax
call fcn.00490458
add esp, 4
xor ecx, ecx
mov dword [esp + 0xe8], 7
mov dword [esp + 0xe4], 0
mov word [esp + 0xd4], cx
cmp dword [esp + 0xc8], ecx
jbe 0x47e56a
push 7
push 0x4e8a10
lea ecx, [esp + 0xc0]
call fcn.00410dc0
xor ebx, ebx
lea esi, [ebx + 8]
cmp dword [esp + 0xc8], ebx
je 0x47e5a0
mov eax, dword [esp + 0xb8]
cmp dword [esp + 0xcc], esi
jae 0x47e58f
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
cmp al, bl
jne 0x47e5e7
mov dword [esp + 0x170], 0xffffffff
cmp dword [esp + 0xcc], esi
jb 0x47e5c4
mov edx, dword [esp + 0xb8]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov word [esp + 0xb8], ax
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], ebx
xor al, al
jmp 0x47e85c
cmp dword [esp + 0xc8], ebx
jbe 0x47e81a
push 0x4c4f30
push edi
mov edi, 1
call fcn.0041a550
cmp eax, 0xffffffff
jne 0x47e7d2
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x10]
inc eax
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0xf8]
push ecx
mov ecx, edi
call fcn.00413c40
mov byte [esp + 0x170], 0xa
push 0x4c4f30
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x114]
push eax
call fcn.00410b20
add esp, 0xc
mov byte [esp + 0x170], 0xb
lea ecx, [esp + 0xf0]
push ecx
push eax
lea edx, [esp + 0xdc]
push edx
call fcn.00410c00
add esp, 0xc
mov byte [esp + 0x170], 0xd
lea ecx, [esp + 0x10c]
call fcn.0040f320
push 1
lea esi, [esp + 0xd8]
call fcn.00423ad0
add esp, 4
cmp dword [edi + 0x14], 8
jb 0x47e69c
mov ecx, dword [edi]
jmp 0x47e69e
mov ecx, edi
push 0x1506
call fcn.0047e880
movzx eax, al
add esp, 4
cmp eax, ebx
jne 0x47e7ed
push 1
push 2
lea ecx, [esp + 0x24]
call fcn.00413cc0
mov byte [esp + 0x170], 0xe
lea eax, [esp + 0xd4]
push eax
push ecx
lea ecx, [esp + 0x24]
push str.WinXP_unpin_startmenu_quick_error:
push ecx
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 8
push str.CShellUtility::DetachStartmenu
lea ecx, [esp + 0x110]
call fcn.0040ece0
mov byte [esp + 0x170], 0xf
push str.ShellUtility.cpp
lea ecx, [esp + 0x12c]
call fcn.0040ece0
mov byte [esp + 0x170], 0x10
lea edx, [esp + 0x144]
push edx
lea ecx, [esp + 0x20]
call fcn.00413de0
mov byte [esp + 0x170], 0x11
push eax
lea eax, [esp + 0x110]
push eax
push 0x1d6
lea ecx, [esp + 0x134]
push ecx
push ebx
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x170], 0x10
lea ecx, [esp + 0x144]
call fcn.0040f320
mov byte [esp + 0x170], 0xf
lea ecx, [esp + 0x128]
call fcn.0040f350
mov byte [esp + 0x170], 0xe
lea ecx, [esp + 0x10c]
call fcn.0040f350
mov byte [esp + 0x170], 0xd
lea ecx, [esp + 0x1c]
call fcn.00412cc0
mov byte [esp + 0x170], 0xa
lea ecx, [esp + 0xd4]
call fcn.0040f320
mov byte [esp + 0x170], 8
lea ecx, [esp + 0xf0]
call fcn.0040f320
mov dword [esp + 0x170], 0xffffffff
lea ecx, [esp + 0xb8]
call fcn.0040f320
xor al, al
jmp 0x47e85c
mov byte [esp + 0x170], 0xa
lea ecx, [esp + 0xd4]
call fcn.0040f320
mov byte [esp + 0x170], 8
lea ecx, [esp + 0xf0]
call fcn.0040f320
mov esi, 8
mov dword [esp + 0x170], 0xffffffff
cmp dword [esp + 0xcc], esi
jb 0x47e83e
mov edx, dword [esp + 0xb8]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], ebx
mov word [esp + 0xb8], ax
mov al, 1
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.004911d1
mov esp, ebp
pop ebp
ret