Function at 0x403f40
Capabilities:
Create process on windows
Delete directory
Get common file path
Get program files directory
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x40809b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x330
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x38]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, str.Mobilnet
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x38]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
je 0x4041c2
mov esi, 7
push str.ftc.exe
mov ecx, ebp
call fcn.00402ab0
push str.WmClt.exe
mov ecx, ebp
call fcn.00402ab0
push str.WmCltSvc.exe
mov ecx, ebp
call fcn.00402ab0
push str.gcrawl.exe
mov ecx, ebp
call fcn.00402ab0
dec esi
jne 0x403fd2
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, ebp
call fcn.004041e0
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [esp + 0x34]
push eax
call ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x23d]
mov byte [esp + 0x23c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea ecx, [esp + 0x240]
push 0x25
push ecx
push 0
mov dword [esp + 0x28], str.WmCltSvc.exe
mov dword [esp + 0x2c], str.gcrawl.exe
mov dword [esp + 0x30], str.mswinclts
mov dword [esp + 0x34], str.MsWinWordG
mov dword [esp + 0x38], str.mswinwordg.bat
mov dword [esp + 0x3c], str.WmCLTUS.exe
mov dword [esp + 0x40], str.WMSH.dll
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea esi, [esp + 0x18]
mov edi, 7
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [esi]
lea eax, [esp + 0x23c]
push edx
push eax
lea ecx, [esp + 0x18]
push str._s_s
push ecx
mov dword [esp + 0x358], 0
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.004078f6
mov ecx, ebp
call fcn.00404300
lea ecx, [esp + 0x10]
mov dword [esp + 0x348], 0xffffffff
call sub.MFC42.DLL_CString::CString
add esi, 4
dec edi
jne 0x40409a
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x139]
mov byte [esp + 0x138], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
lea eax, [esp + 0x13c]
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, str.Mobilnet
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x138]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x138]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, ebp
call fcn.004041e0
lea ecx, [esp + 0x138]
push ecx
call ebx
push str.SOFTWAREMOBILNET
push 0x80000002
mov ecx, ebp
call fcn.00404570
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMulti__
push 0x80000002
mov ecx, ebp
call fcn.00404570
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall1633C64F_BD4E_4262_8DED_ED34ED43DCA3
push 0x80000002
call fcn.00406b90
add esp, 8
push 0
push str.sc_delete_WmCltSvc
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x340]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x33c
ret