Function at 0x402250
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Hide graphical window
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp byte [0x405524], 0
jne 0x402279
push 5
push dword [0x4054e0]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4054e4]
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x184
push dword [0x4054e0]
call sub.user32.dll_SendMessageA
push 0x4053c5
call fcn.00401360
push 0x405299
call fcn.00401360
call fcn.004011b0
push 1
push 3
call fcn.00401050
test eax, eax
je 0x40246b
mov dword [ebp - 4], eax
jmp 0x4022d7
inc ecx
push ecx
push 3
call fcn.00401050
or eax, eax
je 0x4022d2
cmp eax, dword [ebp - 4]
jne 0x4022d7
jmp 0x40246b
mov dword [ebp - 8], 0
mov ecx, dword [0x4054a4]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push 0x4053d6
call fcn.00401360
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.00401490
test eax, eax
je 0x402421
mov eax, dword [esi + 2]
or eax, eax
je 0x402336
cmp dword [0x40592d], eax
je 0x40232a
push 0x40513f
call fcn.00401360
jmp 0x402421
push 0x405162
call fcn.00401360
jmp 0x402340
push 0x40516f
call fcn.00401360
cmp dword [esi + 0xa], 0
je 0x402379
push dword [0x405931]
push dword [0x40592d]
call section..text
cmp dword [esi + 0xa], eax
je 0x40236d
push 0x405107
call fcn.00401360
jmp 0x402421
push str.CRC32_
call fcn.00401360
jmp 0x402383
push 0x40512b
call fcn.00401360
cmp byte [esi + 1], 1
jne 0x4023d2
mov eax, 0x23b
add eax, dword [0x4054a0]
push esi
push eax
push 3
push dword [0x405931]
call fcn.004027f0
or eax, eax
jne 0x4023bf
push 0x4051af
call fcn.00401360
push dword [0x40592d]
pop dword [0x405939]
jmp 0x4023d0
push 0x4051c4
call fcn.00401360
mov dword [ebp - 8], 1
jmp 0x402421
mov bl, byte [esi + 0x1a]
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
mov edi, dword [0x405931]
lea esp, [esp]
lea esp, [esp]
nop
cmp dword [esi], 0
jne 0x4023fc
cmp word [esi + 4], 0
je 0x402421
lodsd eax, dword [esi]
xchg ecx, eax
lodsb al, byte [esi]
or bl, bl
jne 0x402414
cmp byte [ecx + edi], al
je 0x402414
push 0x405187
call fcn.00401360
jmp 0x402421
lodsb al, byte [esi]
mov byte [ecx + edi], al
mov dword [ebp - 8], 1
jmp 0x4023f0
cmp dword [ebp - 8], 0
jne 0x40243f
push dword [0x40592d]
pop dword [0x405939]
push 0x405225
call fcn.00401360
jmp 0x402449
push 0x405236
call fcn.00401360
push dword [ebp - 8]
call fcn.004016c0
push 0x405290
call fcn.00401360
push 0x405299
call fcn.00401360
pop ecx
jmp 0x4022c0
push 1
push 4
call fcn.00401050
test eax, eax
je 0x4025c7
mov dword [ebp - 4], eax
jmp 0x4024a7
inc ecx
push ecx
push 4
call fcn.00401050
or eax, eax
je 0x4024a2
cmp eax, dword [ebp - 4]
jne 0x4024a7
jmp 0x4025c7
mov dword [ebp - 8], 0
mov ecx, dword [0x4054a4]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push 0x4053e5
call fcn.00401360
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.00401490
test eax, eax
je 0x402589
cmp byte [esi + 1], 1
jne 0x402529
mov eax, 0x23b
add eax, dword [0x4054a0]
push esi
push eax
push 4
push dword [0x405931]
call fcn.004027f0
or eax, eax
jne 0x402516
push 0x4051af
call fcn.00401360
push dword [0x40592d]
pop dword [0x405939]
jmp 0x402527
push 0x4051c4
call fcn.00401360
mov dword [ebp - 8], 1
jmp 0x402589
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
nop
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
push ebx
push dword [0x40592d]
push ecx
lea eax, [esi + ecx*2 + 8]
add eax, ecx
push eax
lea eax, [esi + ecx*2 + 8]
push eax
lea eax, [ecx + esi + 8]
push eax
lea eax, [esi + 8]
push eax
push dword [0x405931]
call fcn.00402940
pushal
test eax, eax
jne 0x402578
cmp dword [esi + ecx*4 + 8], 0
je 0x402575
push 0x4051d5
call fcn.00401360
jmp 0x40257f
popal
jmp 0x402589
mov dword [ebp - 8], 1
popal
lea esi, [esi + ecx*4 + 8]
cmp dword [esi], 0
jne 0x402530
cmp dword [ebp - 8], 0
jne 0x40259b
push 0x405225
call fcn.00401360
jmp 0x4025a5
push 0x405236
call fcn.00401360
push dword [ebp - 8]
call fcn.004016c0
push 0x405290
call fcn.00401360
push 0x405299
call fcn.00401360
pop ecx
jmp 0x402490
push 1
push 5
call fcn.00401050
test eax, eax
je 0x402684
mov dword [ebp - 4], eax
xor esi, esi
jmp 0x4025f7
inc ecx
push ecx
push 5
call fcn.00401050
or eax, eax
je 0x4025f2
cmp eax, dword [ebp - 4]
jne 0x4025f7
jmp 0x402684
mov ecx, dword [0x4054a4]
push ecx
mov esi, eax
lea eax, [esi + 9]
push 0x4053fe
call fcn.00401360
push dword [esi + 1]
push eax
push str.c:_regpatch.reg
call fcn.00402d24
test eax, eax
je 0x40264a
mov edi, 0x405525
mov byte [edi], 0
push str.regedit.exe__s
push edi
call sub.kernel32.dll_lstrcatA
push str.c:_regpatch.reg
push edi
call sub.kernel32.dll_lstrcatA
push 0
push edi
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
ja 0x402656
push 0x4051fb
call fcn.00401360
jmp 0x402660
push 0x405212
call fcn.00401360
push str.c:_regpatch.reg
call sub.kernel32.dll_DeleteFileA
push 0x405290
call fcn.00401360
push 0x405299
call fcn.00401360
pop ecx
jmp 0x4025e0
push 1
push 7
call fcn.00401050
test eax, eax
je 0x4027c7
mov dword [ebp - 4], eax
jmp 0x4026b7
inc ecx
push ecx
push 7
call fcn.00401050
or eax, eax
je 0x4026b2
cmp eax, dword [ebp - 4]
jne 0x4026b7
jmp 0x4027c7
mov ecx, dword [0x4054a4]
push ecx
mov esi, eax
lea edi, [esi + 0xd]
mov ebx, dword [esi + 5]
lea ebx, [ebx + esi]
push 0x200
push 0x405525
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, 0x405525
push 0x40540f
call fcn.00401360
push edi
call fcn.00401360
push edi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x402741
cmp byte [0x4059e3], 0
jne 0x402717
push 0x24
push edi
push 0x40541d
push dword [0x4054c4]
call sub.user32.dll_MessageBoxA
jmp 0x40272c
cmp byte [0x4059e5], 1
jne 0x402727
mov eax, 6
jmp 0x40272c
mov eax, 7
cmp eax, 6
jne 0x40273c
push 0x80
push edi
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 7
je 0x4027ad
cmp byte [edi + 1], 0x3a
jne 0x40276c
cmp byte [edi + 2], 0x5c
jne 0x40276c
push edi
push 0x405be6
call sub.kernel32.dll_lstrcpyA
push 0x405be6
call fcn.00401300
push 0x405be6
call fcn.00402fb0
push dword [esi + 1]
push ebx
push edi
call fcn.00402d24
or eax, eax
jne 0x402786
push 0x405269
call fcn.00401360
jmp 0x4027ad
mov eax, dword [esi + 9]
or eax, eax
je 0x4027a3
push eax
push edi
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
jne 0x4027a3
push 0x40543c
call fcn.00401360
push 0x405280
call fcn.00401360
push 0x405290
call fcn.00401360
push 0x405299
call fcn.00401360
pop ecx
jmp 0x4026a0
push 0x405450
call fcn.00401360
push 1
push 0
push 0
push dword [0x4054c4]
call sub.user32.dll_RedrawWindow
leave
ret