Function at 0x401520
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x61c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x618], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 1
mov dword [0x42f8b8], eax
call fcn.0040ba74
add esp, 4
mov dword [0x42f8c4], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0xff
mov dword [esp + 0x10], 8
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x2c0
call fcn.0040ba74
add esp, 4
test eax, eax
je 0x40158c
mov ecx, eax
call fcn.004023f0
jmp 0x40158e
xor eax, eax
push 0x208
mov dword [0x42f8bc], eax
call fcn.0040ba74
mov esi, dword [0x42f8bc]
add esp, 4
mov dword [0x42f8c8], eax
test esi, esi
je 0x4016c0
test eax, eax
je 0x4016a1
push str.riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
call fcn.004012e0
mov ecx, edi
call fcn.00401370
xor eax, eax
push 0x206
push eax
mov word [esp + 0x218], ax
lea eax, [esp + 0x21a]
push eax
call fcn.004164b0
add esp, 0xc
lea eax, [esp + 0x210]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x210]
push str.4997GameBox_Data_
push eax
call edi
mov ecx, dword [0x42f8c8]
lea eax, [esp + 0x210]
push 0
push 0
push eax
call fcn.00402b80
push 0
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401667
lea ecx, [esp + 0x210]
call fcn.004037d0
push str.softinfo.ini
lea eax, [esp + 0x214]
push eax
call edi
push str.4997GAME_BOX_MAIN_WINDOW
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4016f0
test esi, esi
je 0x401697
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [0x42f8bc]
test esi, esi
je 0x4016bb
mov ecx, esi
call fcn.00402610
push esi
call fcn.0040baea
add esp, 4
mov dword [0x42f8bc], 0
mov eax, dword [0x42f8c8]
test eax, eax
je 0x4016d7
push eax
call fcn.0040baea
mov dword [0x42f8c8], 0
add esp, 4
mov ecx, dword [esp + 0x624]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b999
mov esp, ebp
pop ebp
ret 0x10
push 0x208
call fcn.0040ba74
mov esi, eax
add esp, 4
test esi, esi
je 0x401715
push 0x104
push 0
push esi
call fcn.004164b0
add esp, 0xc
jmp 0x401717
xor esi, esi
mov ecx, esi
call fcn.00402370
xor eax, eax
push 0x206
push eax
mov word [esp + 0x420], ax
lea eax, [esp + 0x422]
push eax
call fcn.004164b0
add esp, 0xc
call fcn.00402880
push eax
lea eax, [esp + 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x210]
push eax
call fcn.004029d0
push eax
lea eax, [esp + 0x41c]
push eax
call edi
push 0x425878
lea eax, [esp + 0x41c]
push eax
call edi
push 0x42587c
lea eax, [esp + 0x41c]
push eax
call edi
xor eax, eax
push 0x62
push eax
mov word [esp + 0x1b0], ax
lea eax, [esp + 0x1b2]
push eax
call fcn.004164b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040bb10
add esp, 4
call fcn.0040baef
cdq
mov esi, 0x1a
idiv esi
add edx, 0x61
push edx
call fcn.0040baef
cdq
idiv esi
add edx, 0x61
push edx
call fcn.0040baef
cdq
idiv esi
add edx, 0x61
push edx
call fcn.0040baef
cdq
idiv esi
add edx, 0x61
push edx
call fcn.0040baef
cdq
idiv esi
add edx, 0x61
push edx
call fcn.0040baef
cdq
idiv esi
lea eax, [esp + 0x1bc]
add edx, 0x61
push edx
push str._c_c_c_c_c_c
push eax
call fcn.004019c0
mov dword [esp + 0x100], 0x4f0053
lea ebx, [esi + 0x27]
mov dword [esp + 0x104], 0x540046
mov dword [esp + 0x108], 0x410057
push 0xa8
lea eax, [esp + 0x124]
mov dword [esp + 0x110], 0x450052
push 0
push eax
mov dword [esp + 0x11c], 0x5c005c
mov dword [esp + 0x120], 0x53004b
mov dword [esp + 0x124], 0x660061
mov dword [esp + 0x128], 0x65
call fcn.004164b0
add esp, 0x2c
mov dword [esp + 0x18], 0x4f0053
lea eax, [esp + 0x54]
mov dword [esp + 0x1c], 0x540046
lea ecx, [esi + 0x54]
mov dword [esp + 0x20], 0x410057
mov dword [esp + 0x24], 0x450052
push 0x8c
push 0
push eax
mov dword [esp + 0x34], 0x5c005c
mov dword [esp + 0x38], 0x69006b
mov dword [esp + 0x3c], 0x67006e
mov dword [esp + 0x40], 0x6f0073
mov dword [esp + 0x44], 0x740066
mov dword [esp + 0x48], 0x5c005c
mov dword [esp + 0x4c], 0x6e0061
mov dword [esp + 0x50], 0x690074
mov dword [esp + 0x54], 0x690076
mov dword [esp + 0x58], 0x750072
mov dword [esp + 0x5c], 0x73
call fcn.004164b0
add esp, 0xc
lea eax, [esp + 0xc]
xor bl, bl
push eax
push 0x20019
push 0
lea eax, [esp + 0xec]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401947
push dword [esp + 0xc]
mov bl, 1
call esi
lea eax, [esp + 0xc]
movzx edi, bl
push eax
push 0x20019
push 0
lea eax, [esp + 0x24]
xor bl, bl
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401974
push dword [esp + 0xc]
mov bl, 1
call esi
test edi, edi
jne 0x40199b
test bl, bl
jne 0x40199b
lea eax, [esp + 0x418]
push eax
lea eax, [esp + 0x1ac]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00402a90
sub esp, 8
lea eax, [esp + 0x420]
push eax
push ecx
call fcn.00402b00
jmp 0x4016d7