Function at 0x401000
Capabilities:
Check os version
Delete registry key
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
push str.Device_removal_and_cleanup_utility_n
xor ebp, ebp
call fcn.00403645
mov eax, dword [esp + 0x88]
add esp, 4
test eax, eax
je 0x401038
push 0x40ac24
push eax
call fcn.004035be
add esp, 8
test eax, eax
jne 0x401038
mov ebp, 1
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x104
push 0x40
call esi
mov edi, eax
push 0x104
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x94
push 0x40
call esi
mov ebx, eax
push ebx
mov dword [esp + 0x18], ebx
mov dword [ebx], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebx + 0x10]
cmp eax, 2
jne 0x4010a6
cmp dword [ebx + 4], 5
jne 0x4010a6
push str.Windows2000_n
call fcn.00403645
push 8
call fcn.004035b0
add esp, 8
test eax, eax
je 0x4010e4
mov dword [eax], 0x40914c
mov dword [eax + 4], ebp
jmp 0x4010e6
cmp eax, 1
jne 0x401389
mov eax, dword [ebx + 8]
test eax, eax
jbe 0x401389
push str.Windows_98__or_Me_n
call fcn.00403645
push 0xc
call fcn.004035b0
add esp, 8
test eax, eax
je 0x4010e4
mov dword [eax + 4], ebp
mov dword [eax], 0x409140
mov dword [eax + 8], str.ENUMPCI
jmp 0x4010e6
xor eax, eax
mov esi, eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
mov edx, dword [esi]
mov ecx, esi
call dword [edx]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x84]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x30], str.SystemCurrentControlSetControlMedia_Categories992C6360_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x34], str.SystemCurrentControlSetControlMedia_Categories992C6361_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x38], str.SystemCurrentControlSetControlMedia_Categories992C6362_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x3c], str.SystemCurrentControlSetControlMedia_Categories992C6366_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x40], str.SystemCurrentControlSetControlMedia_Categories992C6372_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x44], str.SystemCurrentControlSetControlMedia_Categories992C6374_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x48], str.SystemCurrentControlSetControlMedia_Categories992C6376_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x4c], str.SystemCurrentControlSetControlMedia_Categories992C637A_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x50], str.SystemCurrentControlSetControlMedia_Categories992C6380_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x54], str.SystemCurrentControlSetControlMedia_Categories992C6387_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x58], str.SystemCurrentControlSetControlMedia_Categories992C638D_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x5c], str.SystemCurrentControlSetControlMedia_Categories992C6392_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x60], str.SystemCurrentControlSetControlMedia_Categories992C6396_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x64], str.SystemCurrentControlSetControlMedia_Categories992C6397_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x68], str.SystemCurrentControlSetControlMedia_Categories992C636A_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x6c], str.SystemCurrentControlSetControlMedia_Categories992C6365_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x70], str.SystemCurrentControlSetControlMedia_Categories992C6364_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x74], str.SystemCurrentControlSetControlMedia_Categories992C6363_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x78], str.SystemCurrentControlSetControlMedia_Categories992C6370_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x7c], str.SystemCurrentControlSetControlMedia_Categories992C6381_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x80], str.SystemCurrentControlSetControlMedia_Categories992C6382_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x84], str.SystemCurrentControlSetControlMedia_Categories992C6383_643D_11D2_9BDC_00A0C9696B7D
mov dword [esp + 0x88], str.SystemCurrentControlSetControlMedia_Categories992C636C_643D_11D2_9BDC_00A0C9696B7D
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x401304
mov ecx, dword [esp + 0x84]
push str.Smapp
push ecx
call ebp
push str.SysTray.exe
mov edx, dword [esp + 0x88]
push edx
call ebp
mov eax, dword [esp + 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov ecx, esi
call fcn.00401740
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallF0A37341_D692_11D4_A984_009027EC0A9C
push 0x80000002
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallE7E518B2_B174_11D3_9D4E_0060B0A4823E
push 0x80000002
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall945E2519_C2B9_11D3_9D56_0060B0A4823E
push 0x80000002
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCD47EFC1_D692_11D4_A984_009027EC0A9C
push 0x80000002
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall854A5F01_D692_11D4_A984_009027EC0A9C
push 0x80000002
call edi
push 0x40a15c
push str.SOFTWARE
mov ecx, esi
call fcn.004015a0
push str.Staccato
push str.SOFTWARE
mov ecx, esi
call fcn.004015a0
push str.Sensaura
push str.SOFTWARE
mov ecx, esi
call fcn.004015a0
push 0x40a15c
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov ecx, esi
call fcn.004015a0
push str.Staccato
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov ecx, esi
call fcn.004015a0
push str.Sensaura
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov ecx, esi
call fcn.004015a0
push 0x40d9ac
push str.SOFTWAREInstalledOptionsAnalogDevicesAudio
mov ecx, esi
call fcn.004015a0
lea ebx, [esp + 0x1c]
mov dword [esp + 0x10], 0x18
mov ecx, dword [ebx]
push ecx
push 0x80000002
call edi
add ebx, 4
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x4012e2
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x84]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsNTCurrentVersionDrivers32
push 0x80000002
call edi
test eax, eax
jne 0x40137c
mov eax, dword [esp + 0x84]
push str.MIDI
push eax
call ebp
mov ecx, dword [esp + 0x84]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x84]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsNTCurrentVersionuserinstallable.drivers
push 0x80000002
call edi
test eax, eax
jne 0x40137c
mov eax, dword [esp + 0x84]
push str.MIDI
push eax
call ebp
mov ecx, dword [esp + 0x84]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00401950
mov edi, dword [esp + 0x18]
jmp 0x401396
push str.No_support_for_this_OS_n
call fcn.00403645
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x68
ret 0x10