Function at 0x401c30
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 5
push dword [0x404394]
call sub.user32.dll_ShowWindow
push 0
push dword [0x404398]
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x184
push dword [0x404394]
call sub.user32.dll_SendMessageA
push 0x404299
call fcn.00401118
push 0x404235
call fcn.00401118
push 1
push 3
call fcn.00401410
test eax, eax
je 0x401e23
mov dword [ebp - 4], eax
jmp 0x401ca5
inc ecx
push ecx
push 3
call fcn.00401410
or eax, eax
je 0x401ca0
cmp eax, dword [ebp - 4]
jne 0x401ca5
jmp 0x401e23
mov dword [ebp - 8], 0
mov ecx, dword [0x4047f5]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push 0x4042aa
call fcn.00401118
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.0040120c
test eax, eax
je 0x401dd9
mov eax, dword [esi + 2]
or eax, eax
je 0x401d04
cmp dword [0x4047e0], eax
je 0x401cf8
push 0x4040db
call fcn.00401118
jmp 0x401dd9
push 0x4040fe
call fcn.00401118
jmp 0x401d0e
push 0x40410b
call fcn.00401118
cmp dword [esi + 0xa], 0
je 0x401d47
push dword [0x4047e4]
push dword [0x4047e0]
call section..text
cmp dword [esi + 0xa], eax
je 0x401d3b
push str.CRC32_
call fcn.00401118
jmp 0x401dd9
push 0x4040b7
call fcn.00401118
jmp 0x401d51
push str.CRC32
call fcn.00401118
cmp byte [esi + 1], 1
jne 0x401da0
mov eax, 0x226
add eax, dword [0x4047f1]
push esi
push eax
push 3
push dword [0x4047e4]
call fcn.004020f4
or eax, eax
jne 0x401d8d
push 0x40414b
call fcn.00401118
push dword [0x4047e0]
pop dword [0x4047ec]
jmp 0x401d9e
push 0x404160
call fcn.00401118
mov dword [ebp - 8], 1
jmp 0x401dd9
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
mov edi, dword [0x4047e4]
cmp dword [esi], 0
jne 0x401db8
cmp word [esi + 4], 0
je 0x401dd9
lodsd eax, dword [esi]
xchg ecx, eax
lodsb al, byte [esi]
cmp byte [ecx + edi], al
je 0x401dcc
push 0x404123
call fcn.00401118
jmp 0x401dd9
lodsb al, byte [esi]
mov byte [ecx + edi], al
mov dword [ebp - 8], 1
jmp 0x401dac
cmp dword [ebp - 8], 0
jne 0x401df7
push dword [0x4047e0]
pop dword [0x4047ec]
push 0x4041c1
call fcn.00401118
jmp 0x401e01
push 0x4041d2
call fcn.00401118
push dword [ebp - 8]
call fcn.004013b0
push 0x40422c
call fcn.00401118
push 0x404235
call fcn.00401118
pop ecx
jmp 0x401c8e
push 1
push 4
call fcn.00401410
test eax, eax
je 0x401f6f
mov dword [ebp - 4], eax
jmp 0x401e50
inc ecx
push ecx
push 4
call fcn.00401410
or eax, eax
je 0x401e4b
cmp eax, dword [ebp - 4]
jne 0x401e50
jmp 0x401f6f
mov dword [ebp - 8], 0
mov ecx, dword [0x4047f5]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push 0x4042b9
call fcn.00401118
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.0040120c
test eax, eax
je 0x401f31
cmp byte [esi + 1], 1
jne 0x401ed2
mov eax, 0x226
add eax, dword [0x4047f1]
push esi
push eax
push 4
push dword [0x4047e4]
call fcn.004020f4
or eax, eax
jne 0x401ebf
push 0x40414b
call fcn.00401118
push dword [0x4047e0]
pop dword [0x4047ec]
jmp 0x401ed0
push 0x404160
call fcn.00401118
mov dword [ebp - 8], 1
jmp 0x401f31
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
push ebx
push dword [0x4047e0]
push ecx
lea eax, [esi + ecx*2 + 8]
add eax, ecx
push eax
lea eax, [esi + ecx*2 + 8]
push eax
lea eax, [ecx + esi + 8]
push eax
lea eax, [esi + 8]
push eax
push dword [0x4047e4]
call fcn.00402234
pushal
test eax, eax
jne 0x401f20
cmp dword [esi + ecx*4 + 8], 0
je 0x401f1d
push 0x404171
call fcn.00401118
jmp 0x401f27
popal
jmp 0x401f31
mov dword [ebp - 8], 1
popal
lea esi, [esi + ecx*4 + 8]
cmp dword [esi], 0
jne 0x401ed8
cmp dword [ebp - 8], 0
jne 0x401f43
push 0x4041c1
call fcn.00401118
jmp 0x401f4d
push 0x4041d2
call fcn.00401118
push dword [ebp - 8]
call fcn.004013b0
push 0x40422c
call fcn.00401118
push 0x404235
call fcn.00401118
pop ecx
jmp 0x401e39
push 1
push 5
call fcn.00401410
test eax, eax
je 0x40202b
mov dword [ebp - 4], eax
xor esi, esi
jmp 0x401f9e
inc ecx
push ecx
push 5
call fcn.00401410
or eax, eax
je 0x401f99
cmp eax, dword [ebp - 4]
jne 0x401f9e
jmp 0x40202b
mov ecx, dword [0x4047f5]
push ecx
mov esi, eax
lea eax, [esi + 9]
push 0x4042d2
call fcn.00401118
push dword [esi + 1]
push eax
push str.c:_regpatch.reg
call fcn.004025d4
test eax, eax
je 0x401ff1
mov edi, 0x4043d8
mov byte [edi], 0
push str.regedit.exe__s
push edi
call sub.kernel32.dll_lstrcatA
push str.c:_regpatch.reg
push edi
call sub.kernel32.dll_lstrcatA
push 0
push edi
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
ja 0x401ffd
push 0x404197
call fcn.00401118
jmp 0x402007
push 0x4041ae
call fcn.00401118
push str.c:_regpatch.reg
call sub.kernel32.dll_DeleteFileA
push 0x40422c
call fcn.00401118
push 0x404235
call fcn.00401118
pop ecx
jmp 0x401f87
push 1
push 7
call fcn.00401410
test eax, eax
je 0x4020e8
mov dword [ebp - 4], eax
jmp 0x402058
inc ecx
push ecx
push 7
call fcn.00401410
or eax, eax
je 0x402053
cmp eax, dword [ebp - 4]
jne 0x402058
jmp 0x4020e8
mov ecx, dword [0x4047f5]
push ecx
mov esi, eax
lea edi, [esi + 0xd]
mov ebx, dword [esi + 5]
lea ebx, [ebx + esi]
push 0x4043d8
push edi
call fcn.00402700
mov edi, eax
push 0x4042e3
call fcn.00401118
push edi
call fcn.00401118
push edi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4020aa
push 0x24
push edi
push 0x4042f1
push dword [0x40437c]
call sub.user32.dll_MessageBoxA
cmp eax, 7
je 0x4020ce
push dword [esi + 1]
push ebx
push edi
call fcn.004025d4
or eax, eax
jne 0x4020c4
push 0x404205
call fcn.00401118
jmp 0x4020ce
push 0x40421c
call fcn.00401118
push 0x40422c
call fcn.00401118
push 0x404235
call fcn.00401118
pop ecx
jmp 0x402041
push 0x404310
call fcn.00401118
leave
ret