Function at 0x40c620
Capabilities:
Delete file
Get common file path
Get startup folder
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f05e
mov eax, dword fs:[0]
push eax
sub esp, 0xb58
mov eax, dword [0x450958]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x62
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.0040f5c0
add esp, 0xc
xor ecx, ecx
jmp 0x40c670
movzx eax, word [ecx + str.npscreenleap]
mov word [ebp + ecx - 0x74], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x40c670
mov edx, dword [0x4506ac]
mov esi, edx
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40c690
lea edi, [ebp - 0x74]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40c6a3
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x74]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40c6c3
mov eax, dword [str..dll]
mov dword [ecx], eax
mov eax, dword [0x441d68]
mov dword [ecx + 4], eax
mov ax, word [0x441d6c]
mov word [ecx + 8], ax
call fcn.0040c550
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x4e0], ax
lea eax, [ebp - 0x4de]
push eax
call fcn.0040f5c0
push 0x104
lea eax, [ebp - 0x4e0]
push eax
push 0x441d70
call fcn.0040c280
mov edx, esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [ebp - 0x4e0], ax
jne 0x40c740
xor ecx, ecx
jmp 0x40c75f
lea ecx, [ebp - 0x4e0]
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c750
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [ebp - 0x4e0]
push eax
mov ecx, edx
call fcn.00402620
call fcn.004085e0
push 1
call fcn.004094b0
lea eax, [ebp - 0xb60]
push 0x452e48
push eax
call fcn.0040a930
add esp, 0x24
mov esi, eax
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 0
call fcn.00406d90
push esi
push str.Installing_into
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00408370
push eax
call fcn.00403f70
add esp, 8
push eax
call fcn.00403c80
add esp, 8
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0
call fcn.004070e0
cmp dword [ebp - 0xb4c], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x40c7f2
push dword [ebp - 0xb60]
call fcn.0040e01f
add esp, 4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x8f0], ax
lea eax, [ebp - 0x8ee]
push eax
call fcn.0040f5c0
lea eax, [ebp - 0x8f0]
push eax
push 0x441dac
push 0xc9
call fcn.0040c0f0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xaf8], ax
lea eax, [ebp - 0xaf6]
push eax
call fcn.0040f5c0
lea eax, [ebp - 0xaf8]
push eax
push 0x441dd4
push 0xcb
call fcn.0040c0f0
lea eax, [ebp - 0x8f0]
push eax
push dword [0x4506a8]
call fcn.0040a060
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x6e8], ax
lea eax, [ebp - 0x6e6]
push eax
call fcn.0040f5c0
add esp, 0x44
lea eax, [ebp - 0x6e8]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40c90f
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0xb60]
push eax
call fcn.0040a930
add esp, 8
mov esi, eax
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 2
call fcn.00406d90
push esi
push 0x441df4
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00408370
push eax
call fcn.00403f70
add esp, 8
push eax
call fcn.00403c80
add esp, 8
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 2
call fcn.004070e0
cmp dword [ebp - 0xb4c], 0x10
jb 0x40c90f
push dword [ebp - 0xb60]
call fcn.0040e01f
add esp, 4
xor eax, eax
mov dword [ebp - 0xb14], 7
mov dword [ebp - 0xb18], 0
mov word [ebp - 0xb28], ax
mov dword [ebp - 4], 4
cmp word [0x452e48], ax
jne 0x40c940
xor ecx, ecx
jmp 0x40c95f
mov ecx, 0x452e48
lea edx, [ecx + 2]
jmp 0x40c950
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c950
sub ecx, edx
sar ecx, 1
push ecx
push 0x452e48
lea ecx, [ebp - 0xb28]
call fcn.00409f30
xor eax, eax
push 0xffffffffffffffff
push eax
mov word [ebp - 0xb40], ax
lea eax, [ebp - 0xb28]
push eax
lea ecx, [ebp - 0xb40]
mov dword [ebp - 0xb2c], 7
mov dword [ebp - 0xb30], 0
call fcn.00402500
push 1
push 0x441c14
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], 5
call fcn.00409f30
push 0xe
push 0x441dd4
lea ecx, [ebp - 0xb28]
call fcn.00409f30
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0xb48]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40caa7
lea eax, [ebp - 0xb60]
push 0x452e48
push eax
call fcn.0040a930
add esp, 8
mov esi, eax
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 6
call fcn.00406d90
push esi
push str.Registering_auto_start_at
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00408370
push eax
call fcn.00403f70
add esp, 8
push eax
call fcn.00403c80
add esp, 8
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 6
call fcn.004070e0
cmp dword [ebp - 0xb4c], 0x10
mov byte [ebp - 4], 5
jb 0x40ca6f
push dword [ebp - 0xb60]
call fcn.0040e01f
add esp, 4
mov eax, dword [ebp - 0xb18]
cmp dword [ebp - 0xb14], 8
lea eax, [eax*2 + 2]
push eax
lea ecx, [ebp - 0xb28]
cmovae ecx, dword [ebp - 0xb28]
push ecx
push 1
push 0
push 0x441e80
push dword [ebp - 0xb48]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2d8], ax
lea eax, [ebp - 0x2d6]
push eax
call fcn.0040f5c0
add esp, 0xc
lea eax, [ebp - 0x2d8]
push eax
push 0
push 0
push 0x8010
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0xafc], 7
mov dword [ebp - 0xb00], 0
mov word [ebp - 0xb10], ax
cmp word [ebp - 0x2d8], ax
jne 0x40cb07
xor ecx, ecx
jmp 0x40cb1f
lea ecx, [ebp - 0x2d8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cb10
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0xb10]
call fcn.00402620
push 1
push 0x441c14
lea ecx, [ebp - 0xb10]
mov byte [ebp - 4], 8
call fcn.00409f30
push 0xa
push 0x441e80
lea ecx, [ebp - 0xb10]
call fcn.00409f30
push 4
push str..lnk
lea ecx, [ebp - 0xb10]
call fcn.00409f30
cmp dword [ebp - 0xafc], 8
lea eax, [ebp - 0xb10]
cmovae eax, dword [ebp - 0xb10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xb2c], 8
push 0xffffffffffffff9b
lea eax, [ebp - 0xb40]
cmovae eax, dword [ebp - 0xb40]
cmp dword [ebp - 0xb14], 8
lea esi, [ebp - 0x6e8]
push esi
push 1
lea edx, [ebp - 0xb28]
cmovae edx, dword [ebp - 0xb28]
cmp dword [ebp - 0xafc], 8
push 0
push 0x441ca0
lea ecx, [ebp - 0xb10]
cmovae ecx, dword [ebp - 0xb10]
push eax
call fcn.0040b160
lea ecx, [ebp - 0xd0]
call fcn.00406d90
push str.Done_installing
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.00408370
push eax
call fcn.00403f70
add esp, 8
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 8
call fcn.004070e0
cmp dword [ebp - 0xafc], 8
jb 0x40cc25
push dword [ebp - 0xb10]
call fcn.0040e01f
add esp, 4
xor eax, eax
cmp dword [ebp - 0xb2c], 8
mov dword [ebp - 0xafc], 7
mov dword [ebp - 0xb00], 0
mov word [ebp - 0xb10], ax
jb 0x40cc59
push dword [ebp - 0xb40]
call fcn.0040e01f
add esp, 4
xor eax, eax
cmp dword [ebp - 0xb14], 8
mov dword [ebp - 0xb2c], 7
mov dword [ebp - 0xb30], 0
mov word [ebp - 0xb40], ax
jb 0x40cc8d
push dword [ebp - 0xb28]
call fcn.0040e01f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e7a9
mov esp, ebp
pop ebp
ret