Function at 0x4027fe
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Hide graphical window
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp byte [0x405615], 0
jne 0x402827
push 5
push dword [0x4055d1]
call sub.user32.dll_ShowWindow
push 0
push dword [0x4055d5]
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x184
push dword [0x4055d1]
call sub.user32.dll_SendMessageA
push 0x405493
call fcn.004017cb
push 0x4052a0
call fcn.004017cb
call fcn.004011a7
push 1
push 3
call fcn.00401057
test eax, eax
je 0x402a1b
mov dword [ebp - 4], eax
jmp 0x402887
inc ecx
push ecx
push 3
call fcn.00401057
or eax, eax
je 0x402882
cmp eax, dword [ebp - 4]
jne 0x402887
jmp 0x402a1b
mov dword [ebp - 8], 0
mov ecx, dword [0x405594]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push 0x4054a4
call fcn.004017cb
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.004018da
test eax, eax
je 0x4029d1
mov eax, dword [esi + 2]
or eax, eax
je 0x4028e6
cmp dword [0x405e22], eax
je 0x4028da
push 0x405146
call fcn.004017cb
jmp 0x4029d1
push 0x405169
call fcn.004017cb
jmp 0x4028f0
push 0x405176
call fcn.004017cb
cmp dword [esi + 0xa], 0
je 0x402929
push dword [0x405e26]
push dword [0x405e22]
call section..text
cmp dword [esi + 0xa], eax
je 0x40291d
push 0x40510e
call fcn.004017cb
jmp 0x4029d1
push str.CRC32_
call fcn.004017cb
jmp 0x402933
push 0x405132
call fcn.004017cb
cmp byte [esi + 1], 1
jne 0x402982
mov eax, 0x23a
add eax, dword [0x405590]
push esi
push eax
push 3
push dword [0x405e26]
call fcn.00402e21
or eax, eax
jne 0x40296f
push 0x4051b6
call fcn.004017cb
push dword [0x405e22]
pop dword [0x405e2e]
jmp 0x402980
push 0x4051cb
call fcn.004017cb
mov dword [ebp - 8], 1
jmp 0x4029d1
mov bl, byte [esi + 0x1a]
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
mov edi, dword [0x405e26]
lea esp, [esp]
lea esp, [esp]
nop
cmp dword [esi], 0
jne 0x4029ac
cmp word [esi + 4], 0
je 0x4029d1
lodsd eax, dword [esi]
xchg ecx, eax
lodsb al, byte [esi]
or bl, bl
jne 0x4029c4
cmp byte [ecx + edi], al
je 0x4029c4
push 0x40518e
call fcn.004017cb
jmp 0x4029d1
lodsb al, byte [esi]
mov byte [ecx + edi], al
mov dword [ebp - 8], 1
jmp 0x4029a0
cmp dword [ebp - 8], 0
jne 0x4029ef
push dword [0x405e22]
pop dword [0x405e2e]
push 0x40522c
call fcn.004017cb
jmp 0x4029f9
push 0x40523d
call fcn.004017cb
push dword [ebp - 8]
call fcn.00401afc
push 0x405297
call fcn.004017cb
push 0x4052a0
call fcn.004017cb
pop ecx
jmp 0x402870
push 1
push 4
call fcn.00401057
test eax, eax
je 0x402b77
mov dword [ebp - 4], eax
jmp 0x402a57
inc ecx
push ecx
push 4
call fcn.00401057
or eax, eax
je 0x402a52
cmp eax, dword [ebp - 4]
jne 0x402a57
jmp 0x402b77
mov dword [ebp - 8], 0
mov ecx, dword [0x405594]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push 0x4054b3
call fcn.004017cb
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.004018da
test eax, eax
je 0x402b39
cmp byte [esi + 1], 1
jne 0x402ad9
mov eax, 0x23a
add eax, dword [0x405590]
push esi
push eax
push 4
push dword [0x405e26]
call fcn.00402e21
or eax, eax
jne 0x402ac6
push 0x4051b6
call fcn.004017cb
push dword [0x405e22]
pop dword [0x405e2e]
jmp 0x402ad7
push 0x4051cb
call fcn.004017cb
mov dword [ebp - 8], 1
jmp 0x402b39
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
nop
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
push ebx
push dword [0x405e22]
push ecx
lea eax, [esi + ecx*2 + 8]
add eax, ecx
push eax
lea eax, [esi + ecx*2 + 8]
push eax
lea eax, [ecx + esi + 8]
push eax
lea eax, [esi + 8]
push eax
push dword [0x405e26]
call fcn.00402f70
pushal
test eax, eax
jne 0x402b28
cmp dword [esi + ecx*4 + 8], 0
je 0x402b25
push 0x4051dc
call fcn.004017cb
jmp 0x402b2f
popal
jmp 0x402b39
mov dword [ebp - 8], 1
popal
lea esi, [esi + ecx*4 + 8]
cmp dword [esi], 0
jne 0x402ae0
cmp dword [ebp - 8], 0
jne 0x402b4b
push 0x40522c
call fcn.004017cb
jmp 0x402b55
push 0x40523d
call fcn.004017cb
push dword [ebp - 8]
call fcn.00401afc
push 0x405297
call fcn.004017cb
push 0x4052a0
call fcn.004017cb
pop ecx
jmp 0x402a40
push 1
push 5
call fcn.00401057
test eax, eax
je 0x402c34
mov dword [ebp - 4], eax
xor esi, esi
jmp 0x402ba7
inc ecx
push ecx
push 5
call fcn.00401057
or eax, eax
je 0x402ba2
cmp eax, dword [ebp - 4]
jne 0x402ba7
jmp 0x402c34
push 0x4054cc
call fcn.004017cb
mov ecx, dword [0x405594]
push ecx
mov esi, eax
lea eax, [esi + 9]
push dword [esi + 1]
push eax
push str.c:_regpatch.reg
call fcn.00403398
test eax, eax
je 0x402bfa
mov edi, 0x40561a
mov byte [edi], 0
push str.regedit.exe__s
push edi
call sub.kernel32.dll_lstrcatA
push str.c:_regpatch.reg
push edi
call sub.kernel32.dll_lstrcatA
push 0
push edi
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
ja 0x402c06
push 0x405202
call fcn.004017cb
jmp 0x402c10
push 0x405219
call fcn.004017cb
push str.c:_regpatch.reg
call sub.kernel32.dll_DeleteFileA
push 0x405297
call fcn.004017cb
push 0x4052a0
call fcn.004017cb
pop ecx
jmp 0x402b90
push 1
push 0x11
call fcn.00401057
test eax, eax
je 0x402e04
mov dword [ebp - 4], eax
jmp 0x402c67
inc ecx
push ecx
push 0x11
call fcn.00401057
or eax, eax
je 0x402c62
cmp eax, dword [ebp - 4]
jne 0x402c67
jmp 0x402e04
mov ecx, dword [0x405594]
push ecx
mov esi, eax
lea edi, [esi + 0x421]
push 0x400
push 0x40561a
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, 0x40561a
push 0x4054dd
call fcn.004017cb
push edi
call fcn.004017cb
push edi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x402cfb
cmp byte [0x405ed8], 0
jne 0x402ccd
test dword [esi + 0xd], 2
je 0x402ccb
push 0x24
push edi
push 0x4054eb
push dword [0x4055b5]
call sub.user32.dll_MessageBoxA
jmp 0x402ce2
cmp byte [0x405eda], 1
jne 0x402cdd
mov eax, 6
jmp 0x402ce2
mov eax, 7
cmp eax, 6
jne 0x402cf2
push 0x80
push edi
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 7
je 0x402dea
cmp byte [edi + 1], 0x3a
jne 0x402d26
cmp byte [edi + 2], 0x5c
jne 0x402d26
push edi
push 0x4062db
call sub.kernel32.dll_lstrcpyA
push 0x4062db
call fcn.0040177a
push 0x4062db
call fcn.004036b0
test dword [esi + 0xd], 1
je 0x402d69
push edi
push 0x4062db
call sub.kernel32.dll_lstrcpyA
push 0x4062db
call fcn.0040177a
push edi
call fcn.00403480
push eax
push dword [0x4055b5]
push 0x4062db
push 0x40550a
push edi
call fcn.00403630
test al, al
je 0x402dea
mov eax, dword [esi + 5]
lea eax, [eax + esi]
push dword [esi + 1]
push eax
push edi
call fcn.00403398
or eax, eax
jne 0x402d94
push edi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x402dea
push 0x405270
call fcn.004017cb
jmp 0x402dea
mov eax, dword [esi + 9]
or eax, eax
je 0x402db1
push eax
push edi
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
jne 0x402db1
push 0x405519
call fcn.004017cb
test dword [esi + 0xd], 2
je 0x402de0
push 0x40552d
call fcn.004017cb
lea eax, [esi + 0x21]
cmp byte [eax], 0
jne 0x402dce
xor eax, eax
push 0xa
push 0
push eax
push edi
push str.open
push 0
call sub.shell32.dll_ShellExecuteA
push 0x405287
call fcn.004017cb
push 0x405297
call fcn.004017cb
push 0x4052a0
call fcn.004017cb
pop ecx
jmp 0x402c50
push 0x405541
call fcn.004017cb
push 1
push 0
push 0
push dword [0x4055b5]
call sub.user32.dll_RedrawWindow
leave
ret