Function at 0x403cf0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x310
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x30c], eax
push 0x200
lea eax, [esp + 0x10]
push eax
push 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.__start
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp]
push edx
push 3
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403d89
lea eax, [esp]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x403d89
xor eax, eax
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040fac6
add esp, 0x310
ret
push esi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x294]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.FTSafeNetRockey4SMTService
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov esi, dword [esp + 0x318]
jne 0x403ee8
lea edx, [esp + 0x10]
lea ecx, [esp + 0x290]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x403df8
test al, al
je 0x403df4
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x403df8
add ecx, 2
add edx, 2
test al, al
jne 0x403dd8
xor eax, eax
jmp 0x403dfd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403e56
test esi, esi
jne 0x403e27
mov edx, dword [esp + 4]
push str.FTSafeNetRockey4SMTService
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x403eec
mov ecx, dword [esp + 4]
push ecx
jmp 0x403f50
cmp esi, 1
jne 0x403ee8
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040fac6
add esp, 0x310
ret
test esi, esi
jne 0x403e98
mov eax, dword [esp + 4]
push str.FTSafeNetRockey4SMTService
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403f4b
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040fac6
add esp, 0x310
ret
cmp esi, 1
jne 0x403ee8
mov eax, dword [esp + 4]
push str.FTSafeNetRockey4SMTService
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403e1d
push 0x80
lea edx, [esp + 0x14]
push edx
push esi
push eax
mov eax, dword [esp + 0x14]
push str.FTSafeNetRockey4SMTService
push eax
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403e30
mov ecx, dword [esp + 4]
push ecx
jmp 0x403f50
test esi, esi
jne 0x403f12
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.0040fac6
add esp, 0x310
ret
cmp esi, 1
jne 0x403f4b
mov edx, dword [esp + 4]
push 0x80
lea ecx, [esp + 0x14]
push ecx
push esi
push 0
push str.FTSafeNetRockey4SMTService
push edx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403e72
mov eax, dword [esp + 4]
push eax
jmp 0x403f50
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x310]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040fac6
add esp, 0x310
ret