Function at 0x401180
Capabilities:
Check os version
Create process on windows
Extract resource via kernel32 functions
Get common file path
Query or enumerate registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x16c8
call fcn.0040b780
mov eax, dword [0x413014]
xor eax, esp
mov dword [esp + 0x16c4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2a8]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push pe_nt_image_headers32
lea eax, [esp + 0xb0]
mov dword [esp + 0x9c], 0x11c
push 0
push eax
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
call fcn.00402580
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [esp + 0x1ae], ax
mov dword [esp + 0x1b0], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0xa4]
mov dword [esp + 0xa8], 6
xor ecx, ecx
mov dword [esp + 0xac], 1
push eax
mov word [esp + 0x1bc], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x40128f
push 0x10
push str.Invalid_operating_system
push str.You_need_a_64_bit_version_of_Windows_7__or_later_.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x16c4]
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x94]
mov dword [esp + 0x94], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4016eb
cmp dword [esp + 0x94], 0
je 0x4016eb
lea eax, [esp + 0x88]
mov dword [esp + 0x8c], 0
push eax
lea eax, [esp + 0x90]
mov dword [esp + 0x8c], 4
push eax
push 0
push 0x10
push 0x410c3c
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x401325
cmp dword [esp + 0x8c], 0x6040e
jae 0x401480
push 0x34
push str..NET_framework_missing
push str.The_.NET_framework_must_be_downloaded_and_installed._This_might_take_a_while._Install_
push 0
call esi
cmp eax, 6
je 0x401355
mov eax, 3
pop edi
pop esi
mov ecx, dword [esp + 0x16c4]
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10
push str.NetFx48installer.exe
lea eax, [esp + 0x2ac]
push eax
lea eax, [esp + 0xa0]
push eax
call edi
lea ecx, [esp + 0x98]
call section..text
test eax, eax
jne 0x4013a6
push 0x10
push str.Download_error
push str.Unable_to_download_the_.NET_Framework_installer.
push eax
call esi
mov eax, 4
pop edi
pop esi
mov ecx, dword [esp + 0x16c4]
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x98]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
xorps xmm0, xmm0
lea eax, [esp + 0x2a8]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
push eax
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x20], str.runas
mov dword [esp + 0x30], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x401442
push 0x10
push str.NetFX_installer_error
push str.Unable_to_start_the_.NET_Framework_installer.
push eax
call esi
mov eax, 5
pop edi
pop esi
mov ecx, dword [esp + 0x16c4]
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10
push 0xffffffffffffffff
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x88]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4016b6
cmp dword [esp + 0x88], 0
jne 0x4016b6
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.RimoteBootstrapper.exe
lea eax, [esp + 0x2ac]
push eax
lea eax, [esp + 0x4c0]
push eax
call edi
push 0x410d48
push 2
push dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40168b
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40168b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0
mov dword [esp + 0x94], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x4cc]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40168b
push 0
lea eax, [esp + 0x94]
mov dword [esp + 0x94], 0
push eax
push dword [esp + 0x90]
push dword [esp + 0x98]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.__launcher__
lea eax, [esp + 0x6cc]
push 0x800
push eax
call fcn.004031b0
lea ecx, [esp + 0x6d4]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401564
sub ecx, edx
mov eax, 0x800
sar ecx, 1
sub eax, ecx
push eax
lea eax, [esp + 0x6cc]
lea eax, [eax + ecx*2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x41119c
lea eax, [esp + 0x6cc]
push 0x800
push eax
call fcn.00403214
push 0x4111a0
lea eax, [esp + 0x6d8]
push 0x800
push eax
call fcn.00403214
push dword [esp + 0x24]
lea eax, [esp + 0x6e4]
push 0x800
push eax
call fcn.00403214
lea eax, [esp + 0x4dc]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], eax
add esp, 0x24
lea eax, [esp + 0x6c8]
mov dword [esp + 0x84], 0
mov dword [esp + 0x60], eax
xorps xmm0, xmm0
lea eax, [esp + 0x2a8]
movlpd qword [esp + 0x50], xmm0
mov dword [esp + 0x64], eax
lea eax, [esp + 0x4c]
push eax
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x80], xmm0
mov dword [esp + 0x50], 0x3c
mov dword [esp + 0x6c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x401673
push 0x10
push str.Bootstrapper_error
push str.Unable_to_start_the_bootstrapper.
push eax
call esi
mov eax, 7
pop edi
pop esi
mov ecx, dword [esp + 0x16c4]
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x16c4]
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Bootstrapper_error
push str.Unable_to_extract_the_bootstrapper.
push 0
call esi
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0x16c4]
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push str.NetFX_installer_error
push str.Unable_to_install_the_.NET_Framework.
push 0
call esi
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0x16c4]
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Invalid_operating_system
push str.You_need_a_64_bit_version_of_your_operating_system.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x16cc]
mov eax, 2
pop edi
pop esi
xor ecx, esp
call fcn.00401965
mov esp, ebp
pop ebp
ret 0x10