Function at 0x401160
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x91c
push esi
push edi
mov dword [ebp - 0x910], str.WMID00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000_
mov dword [ebp - 0x804], str.GQuh
mov dword [ebp - 0x91c], str.BUx_CQcT_
lea eax, [ebp - 0x90c]
push eax
lea ecx, [ebp - 0x918]
push ecx
push 0
push 0x20006
push 0
push 0x40ab3c
push 0
push str.SoftwareA_VPN_Tools
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4011d6
push 0x10
push str.Error
push str.Error_01
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4013ea
mov edi, dword [ebp - 0x910]
lea edx, [ebp - 0x400]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x914], 0
jmp 0x40121a
mov ecx, dword [ebp - 0x914]
add ecx, 1
mov dword [ebp - 0x914], ecx
cmp dword [ebp - 0x914], 0x28
jge 0x40124c
mov edx, dword [ebp - 0x914]
movsx eax, byte [ebp + edx - 0x400]
test eax, eax
je 0x401248
mov ecx, dword [ebp - 0x914]
movsx edx, byte [ebp + ecx - 0x400]
cmp edx, 0x3b
jne 0x40124a
jmp 0x40124c
jmp 0x40120b
mov eax, dword [ebp - 0x914]
mov byte [ebp + eax - 0x400], 0
lea ecx, [ebp - 0x400]
push ecx
push str.wmid
mov edx, dword [ebp - 0x918]
push edx
call section..text
add esp, 0xc
mov dword [ebp - 0x914], 0
jmp 0x401290
mov eax, dword [ebp - 0x914]
add eax, 1
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x914], 0x80
jge 0x4012b9
mov ecx, dword [ebp - 0x804]
add ecx, dword [ebp - 0x914]
mov edx, dword [ebp - 0x914]
mov al, byte [ecx]
mov byte [ebp + edx - 0x400], al
jmp 0x401281
lea ecx, [ebp - 0x400]
push ecx
call fcn.00401100
add esp, 4
lea edx, [ebp - 0x400]
push edx
push str.uname
mov eax, dword [ebp - 0x918]
push eax
call section..text
add esp, 0xc
mov dword [ebp - 0x914], 0
jmp 0x4012fe
mov ecx, dword [ebp - 0x914]
add ecx, 1
mov dword [ebp - 0x914], ecx
cmp dword [ebp - 0x914], 0x80
jge 0x401327
mov edx, dword [ebp - 0x91c]
add edx, dword [ebp - 0x914]
mov eax, dword [ebp - 0x914]
mov cl, byte [edx]
mov byte [ebp + eax - 0x400], cl
jmp 0x4012ef
lea edx, [ebp - 0x400]
push edx
call fcn.00401100
add esp, 4
lea eax, [ebp - 0x400]
push eax
push str.param2
mov ecx, dword [ebp - 0x918]
push ecx
call section..text
add esp, 0xc
lea edx, [ebp - 0x400]
push edx
push str.param2hash
mov eax, dword [ebp - 0x918]
push eax
call section..text
add esp, 0xc
lea ecx, [ebp - 0x908]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4013aa
mov edi, 0x40804c
lea edx, [ebp - 0x908]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.setup.exe
lea ecx, [ebp - 0x908]
push ecx
push str._s_s
lea edx, [ebp - 0x800]
push edx
call fcn.00401585
add esp, 0x10
lea eax, [ebp - 0x800]
push eax
call fcn.00401040
add esp, 4
push 5
lea ecx, [ebp - 0x800]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10