Function at 0x40b4d0
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
lea ebx, [edi + 2]
push 0x20006
push ebx
call fcn.0040b210
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b4f5
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
ret
lea eax, [edi + 0x18416]
push eax
push 0x41e1cc
push esi
call fcn.0040ace0
add esp, 0xc
test eax, eax
je 0x40b52e
push str.SYSTEMCurrentControlSetServices_sParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 2
pop ebx
ret
lea ecx, [edi + 0x28414]
push ecx
push str.AppParameters
push esi
call fcn.0040ace0
add esp, 0xc
test eax, eax
je 0x40b567
push str.SYSTEMCurrentControlSetServices_sParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 3
pop ebx
ret
lea edx, [edi + 0x30412]
push edx
push str.AppDirectory
push esi
call fcn.0040ace0
add esp, 0xc
test eax, eax
je 0x40b5a0
push str.SYSTEMCurrentControlSetServices_sParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 4
pop ebx
ret
mov eax, dword [edi + 0x4041c]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 0x20
je 0x40b5c3
push eax
push str.AppPriority
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40b5d2
cmp byte [esp + 0x18], 0
je 0x40b5d2
push str.AppPriority
push esi
call ebp
mov eax, dword [edi + 0x40400]
mov ecx, dword [edi + 0x40404]
mov edx, eax
or edx, ecx
je 0x40b691
lea edx, [esp + 0x14]
push edx
push ecx
push eax
call fcn.0040c3e0
add esp, 0xc
test eax, eax
jne 0x40b677
mov edx, dword [esp + 0x14]
mov eax, edx
lea ebp, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b604
sub eax, ebp
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push str.AppAffinity
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40b671
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00404fa0
add esp, 4
push eax
push str.AppAffinity
push 0xc00003fb
push 1
call fcn.004050e0
mov ecx, dword [esp + 0x28]
add esp, 0x14
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
pop edi
pop esi
mov eax, 5
pop ebx
ret
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40b6a0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40b6a0
cmp byte [esp + 0x18], 0
je 0x40b6a0
push str.AppAffinity
push esi
call ebp
mov eax, dword [edi + 0x70484]
not eax
test eax, eax
je 0x40b6bd
push eax
push str.AppStopMethodSkip
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40b6cc
cmp byte [esp + 0x18], 0
je 0x40b6cc
push str.AppStopMethodSkip
push esi
call ebp
mov eax, dword [edi + 0x70478]
cmp eax, 4
jae 0x40b6ed
mov edx, dword [esp + 0x18]
mov eax, dword [eax*4 + 0x422004]
push edx
push eax
push ebx
call fcn.0040a790
add esp, 0xc
mov eax, dword [edi + 0x7047c]
test eax, eax
je 0x40b708
push eax
push str.AppRestartDelay
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40b717
cmp byte [esp + 0x18], 0
je 0x40b717
push str.AppRestartDelay
push esi
call ebp
mov eax, dword [edi + 0x70480]
cmp eax, 0x5dc
je 0x40b735
push eax
push str.AppThrottle
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40b744
cmp byte [esp + 0x18], 0
je 0x40b744
push str.AppThrottle
push esi
call ebp
mov eax, dword [edi + 0x70488]
cmp eax, 0x5dc
je 0x40b762
push eax
push str.AppStopMethodConsole
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40b771
cmp byte [esp + 0x18], 0
je 0x40b771
push str.AppStopMethodConsole
push esi
call ebp
mov eax, dword [edi + 0x7048c]
cmp eax, 0x5dc
je 0x40b78f
push eax
push str.AppStopMethodWindow
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40b79e
cmp byte [esp + 0x18], 0
je 0x40b79e
push str.AppStopMethodWindow
push esi
call ebp
mov eax, dword [edi + 0x70490]
cmp eax, 0x5dc
je 0x40b7bc
push eax
push str.AppStopMethodThreads
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40b7cb
cmp byte [esp + 0x18], 0
je 0x40b7cb
push str.AppStopMethodThreads
push esi
call ebp
movzx eax, word [edi + 0x40424]
lea ecx, [edi + 0x40424]
test ax, ax
jne 0x40b7ec
cmp byte [esp + 0x18], al
je 0x40b8bf
test ax, ax
je 0x40b7fd
push ecx
push str.AppStdin
push esi
call fcn.0040ace0
add esp, 0xc
jmp 0x40b80c
cmp byte [esp + 0x18], 0
je 0x40b80c
push str.AppStdin
push esi
call ebp
mov eax, dword [edi + 0x50424]
cmp eax, 2
je 0x40b82d
push eax
push str.ShareMode
push str.AppStdin
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40b847
cmp byte [esp + 0x18], 0
je 0x40b847
push str.ShareMode
push str.AppStdin
push esi
call fcn.004084f0
add esp, 0xc
mov eax, dword [edi + 0x50428]
cmp eax, 3
je 0x40b868
push eax
push str.CreationDisposition
push str.AppStdin
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40b882
cmp byte [esp + 0x18], 0
je 0x40b882
push str.CreationDisposition
push str.AppStdin
push esi
call fcn.004084f0
add esp, 0xc
mov eax, dword [edi + 0x5042c]
cmp eax, 0x80
je 0x40b8a5
push eax
push str.FlagsAndAttributes
push str.AppStdin
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40b8bf
cmp byte [esp + 0x18], 0
je 0x40b8bf
push str.FlagsAndAttributes
push str.AppStdin
push esi
call fcn.004084f0
add esp, 0xc
movzx eax, word [edi + 0x50430]
lea ecx, [edi + 0x50430]
test ax, ax
jne 0x40b8e0
cmp byte [esp + 0x18], al
je 0x40b9b3
test ax, ax
je 0x40b8f1
push ecx
push str.AppStdout
push esi
call fcn.0040ace0
add esp, 0xc
jmp 0x40b900
cmp byte [esp + 0x18], 0
je 0x40b900
push str.AppStdout
push esi
call ebp
mov eax, dword [edi + 0x60430]
cmp eax, 3
je 0x40b921
push eax
push str.ShareMode
push str.AppStdout
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40b93b
cmp byte [esp + 0x18], 0
je 0x40b93b
push str.ShareMode
push str.AppStdout
push esi
call fcn.004084f0
add esp, 0xc
mov eax, dword [edi + 0x60434]
cmp eax, 4
je 0x40b95c
push eax
push str.CreationDisposition
push str.AppStdout
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40b976
cmp byte [esp + 0x18], 0
je 0x40b976
push str.CreationDisposition
push str.AppStdout
push esi
call fcn.004084f0
add esp, 0xc
mov eax, dword [edi + 0x60438]
cmp eax, 0x80
je 0x40b999
push eax
push str.FlagsAndAttributes
push str.AppStdout
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40b9b3
cmp byte [esp + 0x18], 0
je 0x40b9b3
push str.FlagsAndAttributes
push str.AppStdout
push esi
call fcn.004084f0
add esp, 0xc
movzx eax, word [edi + 0x60448]
lea ecx, [edi + 0x60448]
test ax, ax
jne 0x40b9d4
cmp byte [esp + 0x18], al
je 0x40baa7
test ax, ax
je 0x40b9e5
push ecx
push str.AppStderr
push esi
call fcn.0040ace0
add esp, 0xc
jmp 0x40b9f4
cmp byte [esp + 0x18], 0
je 0x40b9f4
push str.AppStderr
push esi
call ebp
mov eax, dword [edi + 0x70448]
cmp eax, 3
je 0x40ba15
push eax
push str.ShareMode
push str.AppStderr
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40ba2f
cmp byte [esp + 0x18], 0
je 0x40ba2f
push str.ShareMode
push str.AppStderr
push esi
call fcn.004084f0
add esp, 0xc
mov eax, dword [edi + 0x7044c]
cmp eax, 4
je 0x40ba50
push eax
push str.CreationDisposition
push str.AppStderr
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40ba6a
cmp byte [esp + 0x18], 0
je 0x40ba6a
push str.CreationDisposition
push str.AppStderr
push esi
call fcn.004084f0
add esp, 0xc
mov eax, dword [edi + 0x70450]
cmp eax, 0x80
je 0x40ba8d
push eax
push str.FlagsAndAttributes
push str.AppStderr
push esi
call fcn.00408460
add esp, 0x10
jmp 0x40baa7
cmp byte [esp + 0x18], 0
je 0x40baa7
push str.FlagsAndAttributes
push str.AppStderr
push esi
call fcn.004084f0
add esp, 0xc
cmp byte [edi + 0x70460], 0
je 0x40bac2
push 1
push str.AppRotateFiles
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40bad1
cmp byte [esp + 0x18], 0
je 0x40bad1
push str.AppRotateFiles
push esi
call ebp
cmp dword [edi + 0x70464], 0
je 0x40baec
push 1
push str.AppRotateOnline
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40bafb
cmp byte [esp + 0x18], 0
je 0x40bafb
push str.AppRotateOnline
push esi
call ebp
mov eax, dword [edi + 0x7046c]
test eax, eax
je 0x40bb16
push eax
push str.AppRotateSeconds
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40bb25
cmp byte [esp + 0x18], 0
je 0x40bb25
push str.AppRotateSeconds
push esi
call ebp
mov eax, dword [edi + 0x70470]
test eax, eax
je 0x40bb40
push eax
push str.AppRotateBytes
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40bb4f
cmp byte [esp + 0x18], 0
je 0x40bb4f
push str.AppRotateBytes
push esi
call ebp
mov eax, dword [edi + 0x70474]
test eax, eax
je 0x40bb6a
push eax
push str.AppRotateBytesHigh
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40bb79
cmp byte [esp + 0x18], 0
je 0x40bb79
push str.AppRotateBytesHigh
push esi
call ebp
cmp dword [edi + 0x40420], 0
je 0x40bb94
push 1
push str.AppNoConsole
push esi
call fcn.0040ad00
add esp, 0xc
jmp 0x40bba3
cmp byte [esp + 0x18], 0
je 0x40bba3
push str.AppNoConsole
push esi
call ebp
mov eax, dword [edi + 0x403f8]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40bbf5
mov ecx, dword [edi + 0x40410]
add ecx, ecx
push ecx
push eax
push 7
push 0
push str.AppEnvironment
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40bc08
push 0
call ebp
push eax
call fcn.00404fa0
add esp, 4
push eax
push str.AppEnvironment
push 0xc00003fb
push 1
call fcn.004050e0
add esp, 0x14
jmp 0x40bc08
cmp byte [esp + 0x18], 0
je 0x40bc08
push str.AppEnvironment
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [edi + 0x40414]
test eax, eax
je 0x40bc60
mov edx, dword [edi + 0x40418]
add edx, edx
push edx
push eax
push 7
push 0
push str.AppEnvironmentExtra
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40bc73
push 0
call ebp
push eax
call fcn.00404fa0
add esp, 4
push eax
push str.AppEnvironmentExtra
push 0xc00003fb
push 1
call fcn.004050e0
add esp, 0x14
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp byte [esp + 0x18], 0
je 0x40bc73
push str.AppEnvironmentExtra
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret