Function at 0x4186d0
Capabilities:
Delete file
Delete registry value
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x40c], 0
jne 0x418993
cmp dword [esi + 0x474], 0
mov dword [esi + 0x40c], 1
je 0x41871a
push 0
push 0
push 0
push dword [0x514990]
call fcn.00449000
add esp, 0x10
mov ecx, esi
call fcn.00418b70
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
push 0x20006
push 0
push 0x47b570
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esi + 0xd2d0]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x4a7278
call fcn.00415380
mov ecx, 0x4a7278
call fcn.004153d0
push dword [0x514990]
call fcn.00448f80
add esp, 4
test eax, eax
je 0x4187a2
mov ecx, 0x4a7278
call fcn.004153d0
mov ecx, 0x4a7278
call fcn.00415330
cmp dword [esi + 0x400], 0
je 0x4187ca
push 4
lea eax, [esi + 0xd1f4]
mov dword [eax], 0
push eax
push 0x2a
push 0
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [esi + 0x4cc], eax
cmp dword [esi + 0x35c80], 0
push edi
jne 0x418842
cmp dword [0x52b07c], 0
jne 0x418842
cmp dword [0x52b00c], 0
jne 0x418842
cmp dword [0x53b13c], 0
je 0x418842
lea edi, [esi + 0xd208]
mov ecx, 0x478b6c
mov eax, edi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x418826
test dx, dx
je 0x418822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x418826
add eax, 4
add ecx, 4
test dx, dx
jne 0x418800
xor eax, eax
jmp 0x41882b
sbb eax, eax
or eax, 1
test eax, eax
je 0x418842
push 0
push 0
push 2
push 2
push edi
mov ecx, 0x52abf8
call fcn.0041c080
push dword [0x53b6b0]
lea eax, [ebp - 0xc]
push 0x47b1f0
push 5
push eax
call fcn.0040e9e0
add esp, 0x10
cmp dword [0x53b3a0], 0
je 0x4188b8
push 0x53b3a4
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
push 0x53b3a4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x4188aa
push 0
lea eax, [ebp - 0x218]
push eax
push 0x64
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
push 0x53b3a4
jmp 0x418958
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x418966
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00453332
push str.ITSExitCode.log
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0045338c
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 2
push 4
push 0
push 2
push 0xc0000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x41894d
push 0
lea eax, [ebp - 0x218]
push eax
push 0x64
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [0x514990]
call fcn.00449480
add esp, 0xc
cmp dword [0x55f074], 0
pop edi
je 0x418981
push 1
push 0x55ec74
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
push 0
push 0x10
push dword [esi + 0xd200]
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret